JP3308669B2 - System control unit - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system controller, and more particularly to a system controller suitable for controlling various systems for vehicles.

[0002]

2. Description of the Related Art In recent years, it has become very common to use a microprocessor for controlling the system of an automobile. Such an in-vehicle system control device usually includes two
It consists of one processing unit. That is, it is common to mount at least two units of a host-side processing unit for performing main system control and a sub-side processing unit for performing subordinate system control as a peripheral processing device. Also, apart from these processing units,
In general, a standby system processing circuit for performing temporary system control as an emergency measure when an abnormality occurs in these processing units is further provided. This standby processing circuit is normally in a standby state, and has a function of performing minimum necessary system control only when an abnormality occurs in the processing unit. Also, various functions are known for the function of self-detecting an abnormality. For example, Japanese Unexamined Patent Publication No. Hei.
A logic circuit for detecting a disconnection in an SI is disclosed.

[0003]

The host-side processing unit, the sub-side processing unit,
Normally, the standby processing circuits are integrated on one chip. Therefore, the on-board system controller needs to mount these three-chip units on a substrate, and therefore has a problem that the mounting area is relatively large, and it is difficult to reduce the size of the entire device. Theoretically, it is possible to integrate all three units in one chip, but such a single chip is not preferable because it reduces the reliability of the entire device. In other words, when all are integrated into one chip, if an abnormality occurs in the power supply system of the chip or an abnormality occurs in the clock system, the abnormality spreads to all parts in the chip, and the standby processing circuit becomes the original processing circuit. There is a risk of failing to function as a fail-safe.

It is an object of the present invention to provide a system control device having a reliable fail-safe function and capable of reducing the size of the entire device.

[0005]

[Means for Solving the Problems]

(1) The first invention of the present application is a system control device,
A host-side processing unit in which a host processing device for performing main system control is integrated on one chip;
A sub-side in which a sub-processing device for performing secondary system control and a standby processing device that is normally in a standby state and perform temporary system control as an emergency measure when an abnormality occurs are integrated on one chip. A processing unit, the host processing device is operated by a first power supply system, the sub-processing device and the standby processing device are operated by a second power supply system, and the host processing device and the sub-processing device are controlled by a first clock. And the standby processing device is operated by a second clock system.

(2) The second invention of the present application is the system control device according to the first invention, wherein the host processing device,
Each of the sub-processing device and the standby processing device is provided with a failure self-determination execution circuit for determining its own failure, and when a failure occurs in itself, a function of notifying another device of the failure is added, In addition, each failure self-determination execution circuit is configured to perform failure determination using a clock system that is opposite to the clock system used for its own operation.

(3) The third invention of the present application is the system control device according to the second invention, wherein the failure self-determination execution circuit of the standby processing device divides the frequency of the clock signal CLK1 of the first clock system. And a clock signal CLK of a second clock system slower than the first clock system.
A second frequency divider that divides the frequency by 2; a double edge detector that generates a pulse signal synchronized with a rising edge and a falling edge of a frequency-divided signal generated by the second frequency divider;
It has a function of counting the clock signal divided by the first frequency divider. When a pulse is supplied from the double edge detection unit, the count value is returned to an initial value, and a pulse is supplied from the double edge detection unit. A watchdog timer unit that outputs a predetermined detection signal when the count value reaches a predetermined value before the count value reaches a predetermined value, and outputs the detection signal as a failure detection signal of the second clock system. It is.

(4) The fourth invention of the present application is the system control device according to the first invention, wherein a control execution value table storing control execution values used in a plurality of systems is provided. Reading means for reading a control execution value for a selected one of the systems in the control execution value table based on an external setting for selecting any one of the above, and holding the control execution value read by this reading means And a match detection unit that compares a control execution value given from the host processing device with a control execution value held in the register, and outputs a failure detection signal when the two do not match, and a standby processing device. It is provided inside.

(5) The fifth invention of the present application is directed to a normal processing device which operates on the first clock system and performs system control during normal operation, and a second clock system which is slower than the first clock system. And a standby system processing device that is normally in a standby state and performs temporary system control as an emergency measure when an abnormality occurs, and a first processing device in the standby system processing device. Clock signal CL of clock system
A first frequency divider for dividing K1, a second frequency divider for dividing the clock signal CLK2 of the second clock system, and a rising edge and a rising edge of the frequency-divided signal by the second frequency divider A double edge detector for generating a pulse signal synchronized with the falling edge, and a function for counting the clock signal divided by the first frequency divider, and when a pulse is given from the double edge detector, A failure self-determination execution circuit having a watchdog timer unit that returns a count value to an initial value and outputs a predetermined detection signal when the count value reaches a predetermined value before a pulse is supplied from a double edge detection unit. And outputs a detection signal from the watchdog timer unit as a failure detection signal of the second clock system.

[0010]

[Operation]

(1) In the system control device according to the first aspect of the present invention, since the standby processing device is integrated in the sub-side processing unit, the number of chips to be mounted on the board is limited to the host-side processing unit and the sub-side processing unit. Since only two chips are required for the unit, the size of the apparatus can be reduced. In addition, since a separate power supply system is used for each chip and a separate clock system is used only for the standby processing device, a reliable fail-safe function can be secured.

(2) In the system control device according to the second invention of the present application, a failure self-determination execution circuit is provided in each processing device. Moreover, since these failure self-determination execution circuits are configured to perform failure determination using a clock system that is opposite to the clock system used for their own operation, they can also perform self-determination for clock system failures. become able to.

(3) The third invention of the present application discloses a specific configuration of the above-described fault self-determination execution circuit. That is, the watchdog timer unit performs the counting of the opposite clock system, but returns the count value to the initial value every time a pulse is given from the double edge detection unit. The double edge detection unit generates a pulse at a predetermined cycle based on its own clock system. Therefore, if its own clock system is normal, the watchdog timer section periodically executes a process of returning the count value to the initial value. However,
If an abnormality occurs in its own clock system, the count value of the watchdog timer unit reaches a predetermined value set in advance, and a failure detection signal is output.

(4) In the system control device according to the fourth aspect of the present invention, in each of the above-described system control devices, it is possible to generalize the standby processing device. That is,
The control execution value table stores control execution values used in a plurality of systems in advance, and reads and uses the control execution values for any one of the systems based on external settings. For this reason, the same standby processing device can be shared for controlling the plurality of systems. A dedicated host processing device is prepared for each system. However, if the control execution value for the specific system is stored in the host processing device, the stored value can be reduced. Can be used to test whether the control execution value in the standby processing device is correct.

(5) According to the fifth aspect of the present invention, the system control device according to the third aspect can be applied to a wider and more general system control device.

[0015]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the illustrated embodiments.

§1 Basic Configuration of System Control Device According to the Present Invention FIG. 1 is a block diagram showing a basic configuration of a system control device according to the present invention. This device is composed of two LSI chips. The first LSI chip is the host-side processing unit 100, and the second LSI chip is the sub-side processing unit 200.
In the drawing, hatching patterns bordering these blocks indicate the classification of the power supply system and the clock system used by each unit, as described later.

The host-side processing unit 100
Is a device in which a host processing device for performing main system control is integrated on one chip. For example, in an in-vehicle system control device for controlling an automobile, main control such as fuel injection control and ignition timing control during normal running is executed by the host-side processing unit 100. On the other hand, the sub-side processing unit 200 is provided with a sub-processing device 210 for performing secondary system control and a standby-system processing device 220 which is normally in a standby state and performs temporary system control as an emergency measure when an abnormality occurs. And are integrated on one chip.
The sub-processing device 210 can perform processing operations in parallel with the host processing device, and functions as a peripheral processing device for assisting the processing of the host processing device. The standby processing device 220 is a device that performs a fail-safe function, and is in a standby state while the host processing device and the sub-processing device 210 are operating normally. This device has a function to perform minimum control. For example, in the in-vehicle system control device, the standby processing device 220 only needs to have a function of performing a minimum control necessary for driving the automobile to the maintenance shop, and without using a microprocessor, In general, it is constituted by a combination circuit of logic elements.

One of the features of the present invention is that the host processing device is provided on the first chip and both the sub-processing device and the standby processing device are incorporated in the second chip. . Conventionally, each of these processing apparatuses has been divided into three chips, so that a large mounting area on a substrate is required, and it has been difficult to reduce the size of the entire apparatus. In the present invention, since only two chips need to be mounted on the substrate,
The size can be reduced as compared with the conventional device.

Another feature of the present invention resides in that a power supply system and a clock system supplied to each processing device are divided into two systems. First, the power supply system will be described. The first power supply VCC1 is supplied to the host-side processing unit 100, and the sub-side processing unit 2
00 is supplied with the second power supply VCC2. In other words, the power supply system used for each chip is separated.
Thus, even if an abnormality occurs in the power supply of one chip, the other chip is not affected. Next, the clock system will be described. The host processing device in the host-side processing unit 100 and the sub-processing device 21 in the sub-side processing unit 200
0, the first clock CLK1 is supplied, and the standby processor 220 in the sub-side processing unit 200 is supplied with the second clock CLK2. In other words, the clock system is separated between the processing device that operates in the normal state and the processing device that operates in the abnormal state. In this embodiment, the reset system is separated in the same manner as the clock system.

The reason why the two systems are separated from each other for the power supply system and the clock system is as follows. That is, from the viewpoint of fail-safe, it is ideal to divide the power supply system and the clock system for each of the three processing devices. However, it is not reasonable to prepare three power supply systems and three clock systems in consideration of cost performance. In order to maintain the cost performance while ensuring the fail-safe function, it is reasonable to prepare two systems each. Therefore, consider the allocation of power and clocks for two systems. Originally, it is preferable to separate the power supply system and the clock system between the processing device that operates in the normal state and the processing device that operates in the abnormal state, in order to ensure the fail-safe function.
However, supplying two systems of power to the same chip is not rational in terms of circuit mounting efficiency. In a normal LSI design, it is common to use only one power supply in the same chip, and using a plurality of power supplies in the same chip is disadvantageous in terms of cost performance. Therefore, in the present invention, the power supply system is separated for each chip as described above. By separating the power supply system in this way, at least the abnormality of the power supply system does not affect another chip.

On the other hand, regarding the clock system, it is relatively easy to separate the processing device that operates in the normal state from the processing device that operates in the abnormal state. As shown in FIG. 1, in the sub-side processing unit 200, the first clock CLK1 is supplied to the sub-processing device 210.
And the second clock CLK2 is supplied to the standby processing device 220. As described above, two clocks are supplied to the same chip. In general, the second clock CLK2 required by the standby processing device 220 is necessary for operating a normal microprocessor. A thing that is much slower than the clock is sufficient. This is because, as described above, the standby processing device 220 does not include a microprocessor and is configured by a circuit composed of a combination of logic elements. More specifically, in this embodiment, as the first clock CLK1 that needs to operate the microprocessor,
A high-speed clock signal of about 10 to 20 MHz is used, and the second clock used only in the standby processing device 220 is used.
As the clock CLK2, a low-speed clock signal of about 50 to 250 kHz is used. As described above, the second clock CLK2 is a signal that is relatively slow as a clock signal, and there is no particular problem without using a dedicated wiring for the clock signal inside the LSI chip. Therefore, in the same LSI chip, the first clock CLK1 that is a high-speed clock is supplied using a wiring dedicated to a clock signal, and the second clock CLK2 that is a low-speed clock is supplied using a general signal line. It becomes possible to do. Therefore, supplying two clocks to the same chip can be relatively easily realized.

§2 Failure self-judgment function As described above, the system control device shown in FIG. 1 includes a host processing device (host-side processing unit 100),
The three processing units, the sub-processing unit 210 and the standby processing unit 220, are provided. Each of these processing units has a built-in failure self-determination execution circuit 101, 211, and 221. In the case where the processing has been performed, a function is provided for notifying the other processing apparatuses of the fact. That is, in the block diagram of FIG.
The failure self-determination execution circuit 101 in the processor 00 determines whether or not the host processing device is operating normally. If the failure has been determined, the failure self-determination execution circuit 101 outputs a host-side processing unit failure detection signal. The information is transmitted to the side processing unit 200. Further, the failure self-determination execution circuits 211 and 221 in the sub-side processing unit 200
Diagnoses whether the sub-processing unit 210 and the standby processing unit 220 are operating normally, and outputs a failure detection signal to the OR circuit 215 when it is determined that a failure has occurred. In this way, if either of them fails, OR
The circuit 215 outputs a sub-side processing unit failure detection signal, which is transmitted to the host-side processing unit 100.

A general method for detecting a failure and a general method for processing when a failure detection signal is output from a partner side are already known technologies, and thus description thereof is omitted here. However, the feature of the fault detection according to the present invention is that each fault self-determination execution circuit has a function of performing a fault determination by using an opposite clock system in addition to a clock system used for its own operation. . Specifically, the fault self-determination execution circuit 10 that operates on the first clock CLK1
1 and 211 perform a failure determination using the second clock CLK2, and the failure self-determination execution circuit 221 that operates on the second clock CLK2 performs a failure determination using the first clock CLK1 (see FIG. 2). 1, an input line for using the reverse clock system is not shown). As described above, by using the reverse clock system together with the own clock system, it is possible to detect an abnormality of the own clock system, and to perform a more reliable failure detection operation. This is because if the failure diagnosis is performed using only the own clock system, for example, the speed of the own clock system becomes 1
If the processing speed is reduced to / 2, the operating speed of the entire processing apparatus is reduced to 1/2, so that a diagnosis result as if the normal operation is obtained is obtained, and a failure cannot be detected. It is. Diagnosis using a reverse clock system can detect a failure in such a case.

Here, a specific circuit configuration for performing the self-diagnosis processing using such an inverted clock system will be disclosed. FIG. 2 is a circuit diagram showing a failure diagnosis circuit used in the failure self-determination execution circuit 221 in the standby processing device 220. As described above, the standby processing device 22
0 operates with the second clock CLK2. In this circuit, the self-diagnosis is performed by using the first clock CLK1 which is the reverse clock system, so that the second clock CL2
K2 abnormality diagnosis can be performed. First clock C
LK1 is frequency-divided by the frequency divider 1 to a predetermined frequency, and the second clock CLK2 is frequency-divided by the frequency divider 2 to a predetermined frequency. Note that each division ratio may be set to an appropriate value so as to be convenient in executing the operation described below. In this embodiment, a 16-bit prescaler circuit is used as the frequency divider 1 and a general frequency division counter is used as the frequency divider 2, but any other frequency divider may be used. It doesn't matter.

The clock CLK2 divided by the frequency divider 2
Is given to the double edge detection unit 3. The double edge detection unit 3 has a function of generating a pulse signal synchronized with the rising edge and the falling edge of a given signal. This function is clearly shown in FIG.
In FIG. 3, a signal described as “input signal” is a frequency-divided signal output from the frequency divider 2, and a signal described as “output signal” is an output signal of the double edge detection unit 3. It is. This output signal is given to the reset terminal Rs of the watchdog timer 4. The clock signal Ck of the watchdog timer 4 is supplied with a frequency-divided signal of the frequency divider 1. This watchdog timer 4 is a timer that performs the following operation. That is, each time the logic value of the clock signal applied to the clock terminal Ck changes, the count is incremented by one, and the reset terminal Rs
When a pulse is given to the, the operation of returning the previous count value to the initial value 0 is performed. Then, if the count value reaches a predetermined value, a failure detection signal is output from the carry-out terminal Co.

The failure detection operation by such a circuit is as follows. As described above, the first clock CLK
Compared to 1, the second clock CLK2 is a clock that is considerably slower. Therefore, the pulse output cycle from the double edge detector 3 is considerably longer than the cycle of the frequency-divided signal from the frequency divider 1. Therefore, when the watchdog timer 4 performs a count-up operation for the frequency-divided signal from the frequency divider 1 a predetermined number of times, a pulse from the double edge detector 3 arrives at the reset terminal Rs, and the count value returns to 0. Is repeated. Here, for example, assuming that the operation in which a pulse is applied to the reset terminal Rs is normal when the count value reaches 90, the watchdog timer 4 has a predetermined value slightly larger than the count value 90. A value, for example, a value 100 is set. If the clock CLK2 is normal, the watchdog timer 4
When the count value reaches 90, the pulse from the double edge detector 3 arrives and the count value is returned to 0, so that the count value does not reach the predetermined value 100. However, when the clock CLK2 is delayed, the timing at which the pulse is applied to the reset terminal Rs is delayed, and the count value exceeds the predetermined value 100. In such a case, a failure detection signal is output from the carry-out terminal Co, and an abnormality of the clock CLK2 is detected.

§3 Generalization of Sub-Side Processing Unit As shown in FIG. 1, the system control device according to the present invention comprises:
It is composed of two LSI chips. Here, in order to further improve cost performance, a method for generalizing the sub-side processing unit 200 will be disclosed. For example, consider the case of designing a system control device for controlling an automobile. Here, for convenience of explanation, a case will be described as an example where a system control device mounted on four different types of vehicles A to D is designed. Normally, different types of vehicles have different control contents. Therefore, it is necessary to prepare a separate host-side processing unit 100 for each vehicle type. In contrast, for the sub-side processing unit 200,
It can be shared by four types of vehicles. Therefore, for example, the system control device mounted on the vehicle C is a host-side processing unit 1 dedicated to the vehicle C.
00 and sub-side processing unit 2 common to all four models
00 and However, the standby processing device 220 needs to perform different control for each vehicle type.
In the embodiment described below, this standby processing device 220
By making the device common to the vehicle types, the sub-side processing unit 200 can be shared.

FIG. 4 is a block diagram showing the basic configuration of a standby processing unit 220 which is designed to be shared by four types of vehicles. These components are actually integrated in the sub-side processing unit 200. In this embodiment, the control execution value table 225 stores R
The control execution values for four types of vehicles are stored as a table. That is, address A
In a 4-byte area following dd1, there are four control execution values a1 to a4 (all of which are 1) used for emergency control of the vehicle A.
Byte value) is stored. Similarly, the address Ad
In the 4-byte area following d2, the control execution values b1 to b4 for the car B are stored, and in the 4-byte area following the address Add3, the control execution values c1 to c4 for the car C are set.
However, in the 4-byte area following the address Add4, control execution values d1 to d4 for the vehicle D are stored, respectively.

The address register R0 has an external setting device 2
30 sets the upper bit of any one of the addresses Add1 to Add4. The external setting device 230 is, for example, a setting device including a resistance element and a DIP switch. The 2-bit free-run counter 222 has lower addresses “00”, “01”, and “1” for accessing the control execution value table 225.
The counter is a counter that sequentially generates “0” and “11”. The control execution value table 225 is accessed by receiving the designation of the upper address from the address register R0 and receiving the designation of the lower address from the 2-bit free-run counter 222. become. The 2-bit free-run counter 2
The output of 22 is supplied to the decoder 226, and the register to which the data read from the control execution value table 225 is to be taken is selected. That is, the output of the 2-bit free-run counter 222 is "00", "01", "1".
At the time of "0" and "11", the read data is taken into the control execution value registers R1, R2, R3 and R4, respectively. The standby processing device 220
Although emergency control for this vehicle is performed based on the control execution values in the registers R1 to R4, a circuit for performing this control is omitted in FIG.

On the other hand, the control execution value stored in the control execution value map 105 in the host processor (host processing unit) 100 is transferred to the diagnostic register R5 one byte at a time. At this time, the lower 2 bits in the control execution value map 105 are transferred together with the 1-byte control execution value. The diagnostic register R5 has a length of 10 bits and stores a 2-bit lower address value together with a 1-byte control execution value. Of the data stored in the diagnostic register R5, the lower address value of 2 bits is provided to the selector 227, and the 1-byte control execution value is provided to the match detection circuit 228. The selector 227 outputs one of the control execution value registers R1 to R4 based on the applied lower address value.
One is selected, the data stored in the selected register is read, and given to the match detection circuit. That is, the lower address values are "00", "01", "10", "11".
, The control execution value registers R1, R2, R
3 and R4 are selected and data is read. Match detection circuit 2
Reference numeral 28 compares the 1-byte control execution value given from the diagnostic register R5 with the 1-byte control execution value given from the selector 227, and outputs a failure detection signal if they do not match. .

Subsequently, such a standby processing device 220
The procedure for sharing the sub-side processing unit 200 with the built-in is described. As described above, when designing a system control device to be mounted on four different types of vehicles A to D, it is necessary to prepare separate host-side processing units 100 for each type of vehicle. Side processing unit 2
For 00, the standby processing device 22 as shown in FIG.
It suffices to prepare one common type that incorporates 0. Here, the following description will be given taking a case where a system control device to be mounted on the automobile C is mounted as an example. In order to control the vehicle C, the host-side processing unit 100 dedicated to the vehicle C and the general-purpose sub-side processing unit 200 may be mounted on a board. At this time, the operator sets the external setting device 23
By 0, the upper address of the address Add3 is set in the address register R0. On the other hand, the 2-bit free-run counter stores lower addresses “00”, “01”, and “1”.
Since “0” and “11” are sequentially generated, the 4-byte data “c1”, “c2”, “c3”, and “c4” following the address Add3 are sequentially read from the control execution value table 225. , Are taken into the control execution value registers R1 to R4. Thus, the standby processing device 220
Can perform control using the control execution values c1 to c4 for the vehicle C.

Next, a procedure for diagnosing whether or not a correct control execution value is used in the standby processing unit 220 will be described. As described above, the host processing device (host-side processing unit) 100 is dedicated to the vehicle C, and the control execution value map 105 housed therein contains the control used by the standby processing device 220 for the vehicle C. Execution values "c1", "c2", "c
3 "and" c4 "are stored. These values are the control execution values “c1”, “c2”, “c3”, “c” stored in the control execution value table 225 in the standby processing device 220.
4 ". Therefore, these control execution values are sequentially transferred to the diagnostic register R5. Specifically, first, the control execution value “c1” together with the lower address value “00”
Is stored in the diagnostic register R5. Selector 227
Reads the data "c1" in the control execution value register R1 based on the lower address value "00", and supplies the same to the match detection circuit 228. On the other hand, the diagnostic register R
The data “c1” in 5 is also supplied to the coincidence detection circuit 228. The coincidence detection circuit compares the two data to confirm the coincidence. Hereinafter, similarly, data “c2”, “c3”,
A match is also confirmed for “c4”. External setting device 230
If the setting of and the operation of the standby processing device are normal, the two data should always match. If they do not match, it can be determined that some abnormality has occurred. Therefore, if a mismatch occurs, a match detection circuit 228 outputs a failure detection signal.

[0033]§4 Example of control by standby processing unit 220  As described above, the standby processing device 220
If an error occurs in the device or sub-processing device,
It is a device that performs emergency control instead. Here,
When controlling the engine of a moving vehicle,
An example of an emergency control method using the device 220 will be described.

FIG. 5 is a timing chart showing a method of controlling fuel injection. In this control method, a signal synchronized with the rotation of the engine is input, and a control signal indicating a predetermined fixed fuel injection time is output. As described above, the fixed fuel injection time is a value stored in the control execution value register as one control execution value. The control signals 1 to 3 are signals for instructing fuel injection at every 1 to 3 cycles of the engine rotation synchronization signal, and the control signals 1 to 3 Is selected and output.

FIG. 6 is a timing chart showing a method of controlling the ignition timing. Also in this control method, a signal synchronized with the rotation of the engine is input, and a control signal is output based on the synchronization signal. In this method, two types of control execution values, Max and Min, are defined in advance,
At the time of rising of the engine rotation synchronization signal (time t1), the clock is counted up at a predetermined inclination. The bold line shown as the count value in the figure is a graph showing the change in the count value in this count. Then, at the time when the engine rotation synchronization signal falls (time t2), the operation is switched to the countdown operation. Then, at the time when the count value matches Min (time t3), the control signal falls, and when the engine rotation synchronization signal rises again (time t4), the control signal rises. By repeating this operation, a control signal for ignition timing control is generated. If the count value reaches Max during the count-up operation (immediately before time t5), the count value is held there. The charging of the spark plug is started at the falling timing (time t3, t6) of the control signal thus obtained, and the ignition is performed at the rising timing (time t4, t7).

FIG. 7 is a diagram for explaining a mask process for the above-described ignition timing control signal. Such mask processing makes it possible to stop ignition when the engine speed is low. That is, when the engine speed is RP
When it becomes smaller than M1, masking is performed so that the above-described ignition timing control signal is not actually output to the ignition system. Then, once the mask is executed, the execution of the mask is continued until the engine speed exceeds RPM2, and the mask is released when the engine speed exceeds RPM2 (so-called hysteresis control). In addition,
Here, RPM1 and RPM2 are control execution values set in advance.

As described above, the present invention has been described based on the illustrated embodiments. However, the present invention is not limited to these embodiments, but can be implemented in various other modes. In particular, in the above-described embodiment, the present invention is applied to a system control device for an automobile. However, the present invention can be applied to control of various other systems.

[0038]

As described above, according to the system control device of the present invention, the standby processing device is integrated in the sub-side processing unit. Only two chips, the unit and the sub-side processing unit, are used, and the size of the device can be reduced. In addition, since a separate power supply system is used for each chip and a separate clock system is used only for the standby processing device, a reliable fail-safe function can be secured.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a basic configuration of a system control device according to the present invention.

FIG. 2 is a standby processing unit 220 in the apparatus shown in FIG.
FIG. 3 is a circuit diagram showing a failure diagnosis circuit used in a failure self-determination execution circuit 221 in FIG.

FIG. 3 is a waveform diagram showing input / output signals of a double edge detection unit 3 shown in FIG.

FIG. 4 is a block diagram showing a basic configuration of a standby processing device 220 in which a common device is devised for four types of vehicles.

FIG. 5 is a timing chart showing an example of fuel injection control by a standby processing device.

FIG. 6 is a timing chart showing an example of ignition timing control by a standby processing device.

FIG. 7 is a diagram illustrating a mask process for the ignition timing control signal shown in FIG. 6;

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Divider 2 ... Divider 3 ... Double edge detection part 4 ... Watchdog timer 100 ... Host side processing unit (host processing unit) 101 ... Failure self-determination execution circuit 105 ... Control execution value map 200 ... Sub side processing Unit 210: Sub-processing device 211: Failure self-determination execution circuit 215: OR circuit 220: Standby processing device 221: Failure self-determination execution circuit 222: 2-bit free-run counter 225: Control execution value table 226: Decoder 227: Selector 228 ... Match detection circuit 230 ... External setting device Add1-Add4 ... Address R0 ... Address register R1-R4 ... Control execution value register R5 ... Diagnosis register

────────────────────────────────────────────────── ─── Continuation of the front page (56) References JP-A-1-199171 (JP, A) JP-A-5-52174 (JP, A) JP-A-5-44570 (JP, A) JP-A-58-1984 29240 (JP, A) (58) Fields investigated (Int. Cl. ⁷ , DB name) G01M 17/007 B60R 16/02 Patent file (PATOLIS)

Claims (5)

(57) [Claims] 1. A host processing unit in which a host processing device for performing main system control is integrated on one chip, a sub-processing device for performing sub system control, and usually in a standby state, A standby-side processing unit for performing temporary system control as an emergency measure when an error occurs, and a sub-side processing unit in which the host processing unit is integrated with a single chip. The sub-processing device and the standby processing device
Wherein the host processing device and the sub-processing device are operated by a first clock system, and the standby processing device is operated by a second clock system. apparatus. 2. The system control device according to claim 1, wherein each of the host processing device, the sub-processing device, and the standby processing device has a fault self-determination execution circuit that determines its own fault, and the self-failure. When a failure occurs, a function to notify other devices of the occurrence is added, and each failure self-determination execution circuit determines failure using a clock system opposite to the clock system used for its own operation. A system control device characterized by performing: 3. The system control device according to claim 2, wherein the failure self-judgment execution circuit of the standby processing device includes: a first frequency divider that divides the frequency of the first clock clock signal CLK1; A second frequency divider for dividing a clock signal CLK2 of a second clock system, which is slower than the first clock system, and synchronized with rising edges and falling edges of the frequency-divided signal by the second frequency divider A double edge detection unit that generates a pulse signal; and a function of counting a clock signal divided by the first frequency divider, and counts a count value when a pulse is given from the double edge detection unit. A watchdog timer unit that outputs a predetermined detection signal when the count value reaches a predetermined value before the pulse is applied from the double edge detection unit to the initial value; Wherein the detection signal, the system controller being characterized in that so as to output as a failure detection signal of the second clock system. 4. The system control device according to claim 1, wherein a control execution value table storing control execution values used in the plurality of systems, respectively, and an external control unit for selecting any one of the plurality of systems. Reading means for reading a control execution value for one selected system in the control execution value table based on the setting; a register for holding the control execution value read by the reading means; And a match detection unit that compares a control execution value obtained in the register with the control execution value held in the register and outputs a failure detection signal when the two do not match, and provided in the standby processing device. System control device. 5. A normal processing unit that operates on a first clock system and performs system control during normal operation, and operates on a second clock system that is slower than the first clock system and usually waits. A standby processing device for performing temporary system control as an emergency measure when an abnormality occurs, wherein the standby processing device includes: a clock signal of the first clock system. A first frequency divider for dividing the frequency of the clock signal CLK1, a second frequency divider for dividing the frequency of the clock signal CLK2 of the second clock system, a rising edge of the frequency-divided signal by the second frequency divider, A double edge detector for generating a pulse signal synchronized with a falling edge; and a function for counting the clock signal divided by the first frequency divider. A watchdog timer unit that returns a count value to an initial value at the time when the pulse is given, and outputs a predetermined detection signal when the count value reaches a predetermined value before the pulse is applied from the double edge detection unit. A system control device, comprising: a failure self-determination execution circuit having the following configuration, and outputting the detection signal as a failure detection signal of a second clock system.