JP3714141B2 - Runaway monitoring device for electronic control system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a runaway monitoring device for an electronic control system that includes at least two arithmetic processors operating in parallel and monitors the runaway of the arithmetic processor by a watchdog clear signal (WDC signal) based on a periodic output from the arithmetic processor. It is about.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, there has been proposed an apparatus for monitoring the runaway of a microcomputer based on the periodicity of pulses output as a watchdog clear (WDC) signal. Also, in recent years, due to the increasing complexity, speed, and miniaturization of microcomputer processing, two normal microcomputers or dual-core (dual CPU) microcomputers with two CPUs in one package are used. As a result, processing is distributed to two microcomputers (CPUs).
[0003]
In the case of a control system using two microcomputers, two methods shown in FIG. That is, in FIG. 7A, a monitoring unit is provided for each of the two microcomputers A and B, and a WDC signal output from each of the microcomputers A and B is input to a separate monitoring unit. In FIG. 7B, the operation of the microcomputer B is monitored by the microcomputer A, and when the microcomputer B is normal and the microcomputer A itself is also normal, a WDC signal is output from the microcomputer A to the monitoring unit. It becomes the composition which is done.
[0004]
However, in the method shown in FIG. 7A, a monitoring unit is required for each microcomputer, and two communication lines to the monitoring unit are required, resulting in an increase in cost. In the method of FIG. 7B, the monitoring unit can be integrated into one, but the WDC signal of the microcomputer B must be monitored by the microcomputer A. Therefore, the processing on the microcomputer A side becomes complicated and the processing load is increased. Increase.
[0005]
On the other hand, for control that requires safety, such as anti-skid control, a so-called dual microcomputer system has been proposed in which two microcomputers perform the same or the same arithmetic processing (processing that calculates the same processing time in the same cycle). Japanese Patent No. 2556156 discloses a microcomputer runaway monitoring device useful for the system. In the apparatus of this publication, two microcomputers output WDC signals at different timings at predetermined intervals, and the output of the flip-flop is inverted by the WDC signal of each microcomputer. If the output period of the flip-flop is not within a predetermined range, it is determined that there is an abnormality.
[0006]
However, in the case of an electronic control system in which the processing load is distributed to multiple microcomputers and each microcomputer performs different processes, different processes such as engine control and transmission control are assigned to each microcomputer. The output timing of the WDC signal is shifted due to the difference in timing and processing time. Therefore, even if an attempt is made to output a WDC signal for each microcomputer at a predetermined cycle as in the above publication, the output cycle of the WDC signal is shifted, resulting in an erroneous monitoring operation. For example, in a control system having an engine control microcomputer and a transmission control microcomputer, the former microcomputer performs a lot of processing (angle synchronization processing) at a timing corresponding to the engine rotation, whereas the latter microcomputer performs a certain period of time. Since there are many processes (time synchronization processes) performed every time, the timing cycle cannot be adjusted by the two microcomputers.
[0007]
Also, when two microcomputers perform the same or the same arithmetic processing such as anti-skid control, the two microcomputers have different operating cycles (one is operating at 20 MHz and the other is 16 MHz). Use). Even in such a case, in the apparatus of the above publication, the timing cycle does not match for each microcomputer, and the monitoring operation cannot be performed correctly.
[0008]
[Problems to be solved by the invention]
The present invention has been made paying attention to the above-mentioned problem, and an object thereof is to provide a runaway monitoring device for an electronic control system capable of correctly monitoring a runaway of an arithmetic processor while simplifying the configuration. Is to provide.
[0009]
[Means for Solving the Problems]
In the invention of claim 1, the monitoring unit may determine the watchdog clear (WDC) effect of occurrence of abnormality in the arithmetic processor periodicity of the signal is broken based on the periodic output inputted from each of the processors To do. In particular in the present invention, the timer unit notifies the timing at a predetermined period for each of the processors, the one arithmetic processors said I follow the rising timing notified from the common timer monitoring unit And outputting the watchdog clear signal with a constant cycle to the monitoring unit by performing output to the monitoring unit according to the falling timing notified from the common timer unit. I do.
[0010]
According to this configuration, the same number of monitoring units is not required for a plurality of arithmetic processors, and the configuration can be simplified. Further, there is no need for a specific arithmetic processor to monitor the other arithmetic processors, and there is no inconvenience that the specific arithmetic processor is complicated and the processing load increases. Furthermore, according to the timing notified from the common timer unit, each arithmetic processor outputs a watchdog clear signal with a constant cycle to the monitoring unit by performing periodic output. Even when processing different from each other is undertaken, the output cycle of the watchdog clear signal does not shift. Therefore, the runaway of the arithmetic processor can be reliably monitored.
[0011]
In this case, for an electronic control system (Claim 3) having at least two arithmetic processors performing different processes, or an electronic control system (Claim 4) having at least two arithmetic processors having different operation cycles. A useful configuration can be provided.
[0012]
In addition, as described in claim 2, when each abnormality is continued for a predetermined time, each arithmetic processor is reset, so that the arithmetic processor can be returned to normal after the abnormality occurs.
[0013]
In practice, as described in claim 5, it is preferable that an interrupt request is generated in each arithmetic processor by the timing notification from the timer unit, and the watchdog clear process is performed.
[0014]
Further, the present invention can be suitably embodied when each arithmetic processor is provided in the same package (claim 6). In such a case, in the invention according to claim 7, the first and second arithmetic processors output the output of the output unit to H / L (high level / low level) at the timing of each arithmetic processor notified by the timer unit. Reverse with. Then, the monitoring unit determines that an abnormality has occurred when the output of the output unit does not reverse at a predetermined cycle. In this configuration, when one of the arithmetic processors goes out of control, the periodicity of the H / L output of the output unit is lost, so that the occurrence of an abnormality can be easily and reliably determined.
[0015]
Further, as described above, in the configuration in which the output of the output unit is inverted H / L at a constant cycle as described above, in the first and second arithmetic processors, in accordance with the timing notification from the timer unit, the output unit It is good to comprise so that the output of each may be periodically operated to H or L, respectively.
[0016]
Furthermore, in the invention described in claim 9, the flip-flop circuit is set by a periodic output from the first arithmetic processor and is reset by a periodic output from the second arithmetic processor. The monitoring unit determines that an abnormality has occurred when the output of the flip-flop circuit does not invert in a predetermined cycle. In this configuration, when one of the arithmetic processors goes out of control, the periodicity of the H / L output of the flip-flop circuit is lost, so that the occurrence of an abnormality can be easily and reliably determined.
[0017]
Further, as described above, in the configuration in which the output of the flip-flop circuit is inverted at a constant cycle as described above, in the first and second arithmetic processors, according to the timing notification from the timer unit, A one-shot pulse may be periodically output to the set terminal and the reset terminal.
[0018]
In the invention according to claim 11, when an abnormality occurs, an abnormal operation processor is specified according to whether the output to the monitoring unit is fixed in H or L, and the abnormal operation processor is determined. Reset. According to this configuration, only the runaway arithmetic processor can be selectively reset.
[0019]
In the twelfth aspect of the invention, the timer unit is a free-run timer composed of a predetermined number of bits, and the timing is notified to the arithmetic processor when a specific bit of the free-run timer is inverted. To do. In this case, each bit of the free-run timer is inverted at a predetermined time period, and according to the timing of this inversion, timing notification can be performed at a desired constant period.
In the invention according to claim 13, the first arithmetic processor, the second arithmetic processor that performs processing different from the first arithmetic processor, and the periodic operations from the first and second arithmetic processors are provided. An output unit whose own output is inverted to H / L by a simple output is provided in the same package, and further, it is composed of a predetermined number of bits and each bit repeats inversion at the same time interval. A run timer and a monitoring unit that determines that an abnormality has occurred in the arithmetic processor when the periodicity of the watchdog clear signal output from the output unit is lost. In particular, in the present invention, the output of the output unit is operated to H by the first arithmetic processor according to the inversion timing of the specific bit notified by the free-run timer, while a certain time interval is set from the inversion timing. By causing the second arithmetic processor to operate the output of the output unit to L according to the inversion timing notified after the elapse, a watchdog clear signal that repeats inversion at a constant cycle is output from the output unit.
According to this configuration, the same number of monitoring units is not required for a plurality of arithmetic processors, and the configuration can be simplified. Further, there is no need for a specific arithmetic processor to monitor the other arithmetic processors, and there is no inconvenience that the specific arithmetic processor is complicated and the processing load increases. Further, since the timing is notified to each arithmetic processor in accordance with the inversion of the specific bit of the free-run timer, the timing notification can be performed at a desired constant cycle. In order to change the cycle of the watchdog clear process, the bit for notifying the timing to each arithmetic processor may be changed.
In this case, it is possible to provide a configuration useful for an electronic control system (claim 15) having at least two arithmetic processors having different operation cycles.
Further, as described in claim 14, when the abnormality continues for a predetermined time, each arithmetic processor is reset, so that the arithmetic processor can be returned to normal after the abnormality occurs.
In practice, as described in claim 16, it is preferable that an interrupt request is generated in each arithmetic processor by the timing notification from the free-run timer, and the watchdog clear process is performed.
In the invention according to claim 17, when an abnormality occurs, an abnormal operation processor is specified according to whether the output to the monitoring unit is fixed in H or L, and the abnormal operation processor is determined. Reset. According to this configuration, only the runaway arithmetic processor can be selectively reset.
[0020]
DETAILED DESCRIPTION OF THE INVENTION
(First embodiment)
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. The electronic control system of this embodiment uses a so-called dual-core microcomputer in which two CPUs (cores) are accommodated in the same package in order to improve the processing speed, and each CPU has ROM, RAM, I / O, timer, etc. are used in common.
[0021]
FIG. 1 is a configuration diagram illustrating an in-vehicle control device according to the present embodiment. In FIG. 1, the microcomputer 10 includes a first CPU 11 that performs engine control and a second CPU 12 that performs transmission control, a RAM 13, a ROM 14, a free-run timer 15, and an I / O unit 16. In this case, the first CPU 11 mainly performs rotation-synchronized engine control, and the second CPU 12 mainly performs time-synchronized transmission control. An oscillator 17 is connected to the first and second CPUs 11 and 12 and the free-run timer 15. Here, the free-run timer 15 is composed of a 2-byte (16-bit) timer counter that is counted up at regular intervals (for example, every 1 μs). That is, the free-run timer 15 functions as a timer that changes the count value between “0000H” and “FFFFH”.
[0022]
In addition, a WDC monitoring unit 18 constituted by a microcomputer or the like is connected to the WDC I / O port of the I / O unit 16. The WDC monitoring unit 18 monitors the WDC signal output from the I / O unit 16, and when the periodicity of the WDC signal is lost, the WDC monitoring unit 18 determines that an abnormality has occurred in each of the CPUs 11 and 12, and outputs a reset signal (/ RST). Output. In the present embodiment, the first and second CPUs 11 and 12 correspond to an “arithmetic processor”, the free-run timer 15 corresponds to a “timer unit”, and the I / O unit 16 corresponds to an “output unit”.
[0023]
Next, the runaway monitoring operation of the first and second CPUs 11 and 12 will be described using the time chart of FIG. FIG. 2 shows the operation of the free-run timer 15, the WDC processing timing of each of the CPUs 11 and 12, the output of the WDC I / O port (WDC signal), and the reset signal.
[0024]
The free-run timer 15 continues the count-up operation at a constant speed, and at this time, each bit constituting the free-run timer 15 repeats inversion at the same time interval. As an example, as shown in FIG. 3, the twelfth bit (bit 12) of the free-run timer 15 repeats inversion approximately every 4 ms. In this case, the inversion timing of the bit 12 is notified to the first and second CPUs 11 and 12, and at that time, an interrupt request is generated in each of the CPUs 11 and 12, and the WDC process is performed. That is, the first CPU 11 interrupts engine control at the timing when the bit 12 of the free-run timer 15 reverses from 0 to 1, and operates the WDC I / O port to H by WDC processing. Further, the second CPU 12 interrupts the transmission control at the timing when the bit 12 of the free-run timer 15 reverses from 1 to 0, and operates the WDC I / O port to L by WDC processing. As a result, a WDC signal having a fixed period is output from the WDC I / O port to the WDC monitoring unit 18. At this time, the I / O unit 16 is commonly used by each CPU, but the CPUs 11 and 12 alternately output to the I / O unit 16 every time a certain time interval elapses. Therefore, there is no inconvenience that outputs are simultaneously performed on the I / O unit 16.
[0025]
For example, during the period (A) in FIG. 2, the output of the WDC I / O port repeats inversion at a constant period in accordance with the inversion of bit 12 of the free-run timer 15 as described above. Therefore, it can be determined that both the CPUs 11 and 12 are operating normally.
[0026]
On the other hand, for example, if the second CPU 12 runs away, the WDC process cannot be performed by the second CPU 12. At this time, as shown in the period (B) of FIG. 2, the WDC I / O port is not lowered to L, and the WDC I / O port output is fixed to H. This is checked by the WDC monitoring unit 18, and when the state continues for a certain period of time, the CPUs 11 and 12 are reset. By this reset, normal recovery is possible as in the period (C) of FIG. 2, and thereafter, the WDC signal is inverted again at a constant period.
[0027]
According to the embodiment described in detail above, the following effects can be obtained.
The timing of WDC processing (interrupt request generation) of the first and second CPUs 11 and 12 was alternately notified from the free-run timer 15, and the runaway of the CPUs 11 and 12 was monitored by the periodicity of the WDC signal generated at that time. In such a configuration, the same number of WDC monitoring units is not required for each of the CPUs 11 and 12, and the configuration can be simplified. In addition, there is no need for a specific CPU to monitor other CPUs, and there is no inconvenience that the processing of the specific CPU becomes complicated and the processing load increases. Furthermore, even if the CPUs 11 and 12 perform different processes, the output cycle of the WDC signal does not shift. Therefore, the runaway of the CPUs 11 and 12 can be reliably monitored.
[0028]
Since the timing is notified to each of the CPUs 11 and 12 in accordance with the inversion of a specific bit of the free-run timer 15, the timing notification can be performed at a desired fixed period. In order to change the cycle of the WDC process, the bit for notifying the CPUs 11 and 12 of the timing may be changed.
[0029]
In this case, the WDC signal output from the microcomputer 10 is the same as the conventional one that periodically performs the H / L inversion operation, and the function as the WDC monitoring unit 18 is not changed at all. Therefore, even if the form of the microcomputer to be monitored changes, the compatibility as the WDC monitoring unit 18 (monitoring function) is maintained. That is, the same WDC monitoring unit 18 (monitoring function) can be applied even if the monitoring target microcomputer is a dual core microcomputer provided in the same package as shown in FIG. 1 or a microcomputer provided in a separate package.
[0030]
Incidentally, in the configuration of FIG. 1, when any one of the first and second CPUs 11 and 12 runs away, the CPUs 11 and 12 are reset at the same time. However, the runaway CPU is identified and only the runaway CPU is reset. Anyway. For example, the CPU on the abnormality occurrence side is specified depending on whether the WDC port output is fixed to H or L, and the specified CPU is reset.
[0031]
(Second Embodiment)
Next, a second embodiment of the present invention will be described focusing on differences from the first embodiment. In this embodiment, two microcomputers packaged separately are used, and each microcomputer performs a different process.
[0032]
FIG. 4 is a configuration diagram showing the vehicle control device in the present embodiment. In FIG. 4, the present control device includes a first microcomputer 21 that controls the engine control and a second microcomputer 22 that controls the transmission control, and both the microcomputers 21 and 22 are connected so as to be able to communicate with each other by serial communication. . In addition, a timer 23 is connected to the microcomputers 21 and 22, and the timer 23 outputs a pulse signal having a constant period to each of the microcomputers 21 and 22 according to the operation of the oscillator 24. Each of the microcomputers 21 and 22 outputs a one-shot pulse at the rising or falling timing of the timer output.
[0033]
The WDC I / O port of the first microcomputer 21 is connected to the set (S) terminal of the SR flip-flop 25, and the WDC I / O port of the second microcomputer 22 is connected to the reset (R) terminal. ing. The output (Q) terminal of the flip-flop 25 is connected to a WDC monitoring unit 26 constituted by a microcomputer or the like. In this case, the flip-flop 25 is set by the one-shot pulse of the first microcomputer 21, is reset by the one-shot pulse of the second microcomputer 22, and the WDC signal as the output is input to the WDC monitoring unit 26.
[0034]
The WDC monitoring unit 26 is connected to the reset (/ RST) terminal of the first microcomputer 21 and is connected to the reset (/ RST) terminal of the second microcomputer 22. Then, the WDC monitoring unit 26 considers that an abnormality has occurred when the output Q of the flip-flop 25 does not invert in a predetermined cycle, and outputs a reset signal to the / RST terminals of the microcomputers 21 and 22. In this case, the WDC monitoring unit 26 may reset each of the microcomputers 21 and 22 separately or at the same time. In the present embodiment, the first and second microcomputers 21 and 22 correspond to an “arithmetic processor”, and the timer 23 corresponds to a “timer unit”.
[0035]
Next, the runaway monitoring operation of the microcomputers 21 and 22 will be described with reference to the time chart of FIG. In FIG. 5, a to e <b> 2 indicate signal waveforms of the respective parts having the same reference numerals in FIG. 1.
[0036]
In FIG. 5, the timer 23 performs an inverted output at regular intervals (for example, every 4 ms) (a signal in the figure). An interrupt request is generated in the microcomputers 21 and 22 at the rising or falling timing of the timer output, and WDC processing is performed. That is, the first microcomputer 21 interrupts the engine control at the rising timing of the timer output a, and outputs a one-shot pulse to the flip-flop 25 (b signal in the figure). The second microcomputer 22 interrupts transmission control at the timing of the fall of the timer output a, and outputs a one-shot pulse to the flip-flop 25 (c signal in the figure).
[0037]
At this time, the flip-flop 25 is set by the one-shot pulse b from the first microcomputer 21 and the output Q is operated to H as shown in FIG. Further, the flip-flop 25 is reset by the one-shot pulse c from the second microcomputer 22 and the output Q is operated to L. As a result, the flip-flop 25 repeats inversion at the same constant cycle as the timer output (a signal).
[0038]
For example, in the period (A) of FIG. 5, as described above, the one-shot pulses b and c are periodically output from the microcomputers 21 and 22 in response to the rising and falling edges of the timer output a, and the flip-flop 25 is accordingly turned on. Repeat inversion output at regular intervals. Therefore, it can be determined that both the microcomputers 21 and 22 are operating normally.
[0039]
On the other hand, if the second microcomputer 22 runs away, for example, as shown in the period (B) of FIG. 5, the WDC process cannot be performed by the second microcomputer 22 even at the falling timing of the timer output. At this time, since the one-shot pulse is not output from the second microcomputer 22, the flip-flop 25 is not reset, and the output Q of the flip-flop 25 is fixed to H. This is checked by the WDC monitoring unit 26, and when the state continues for a certain time, the second microcomputer 22 is reset (e2). By this reset, normal recovery is possible as in the period (C) of FIG. 5, and thereafter, the WDC signal is inverted again at a constant cycle.
[0040]
As described above, according to the second embodiment, as in the first embodiment, the runaway of the first and second microcomputers 21 and 22 can be correctly monitored while simplifying the configuration.
[0041]
In addition to the above, the present invention can be embodied in the following forms.
In the second embodiment, the timer 23 is provided separately from the first and second microcomputers 21 and 22, and the timer 23 notifies the microcomputers 21 and 22 of the timing of WDC processing. Change to 6 In FIG. 6, the timer 28 in the first microcomputer 21 is used, and the timing of the WDC process is generated in the first microcomputer 21 by this timer output, and the timing of the WDC process is notified to the second microcomputer 22. For example, the timer 28 is realized by a free-run timer built in the first microcomputer 21.
[0042]
Further, the present invention is effective even when the operation cycles of the respective arithmetic processors are different even when the respective arithmetic processors perform different processes. That is, when two or more arithmetic processors perform the same or the same equivalent arithmetic processing such as anti-skid control, even if the operation cycles of the arithmetic processors are different, the WDC processing cycle does not deviate from each arithmetic processor. The operation can be performed correctly.
[0043]
In each of the above-described embodiments, the operation processor is configured to be reset when the runaway occurs, but this is changed. For example, the WDC monitoring unit may perform fail-safe processing to supplement the function of the arithmetic processor that has runaway. In addition, if the resetting of the arithmetic processor cannot be reset even after a plurality of attempts, the WDC monitoring unit may similarly perform the fail-safe process.
[0044]
In each of the above-described embodiments, the configuration having two CPUs (or microcomputers) is exemplified as the electronic control system. However, the electronic control system may be embodied by a configuration having three or more CPUs (or microcomputers).
[Brief description of the drawings]
FIG. 1 is a configuration diagram showing an outline of an in-vehicle control device according to an embodiment of the invention.
FIG. 2 is a time chart showing a runaway monitoring operation of each CPU.
FIG. 3 is a diagram showing an operation of a free-run timer.
FIG. 4 is a configuration diagram showing an outline of an in-vehicle control device in a second embodiment.
FIG. 5 is a time chart showing a runaway monitoring operation of each microcomputer.
FIG. 6 is a configuration diagram showing an in-vehicle control device according to another embodiment.
FIG. 7 is a configuration diagram for explaining a conventional technique.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 ... Microcomputer, 11 ... 1st CPU, 12 ... 2nd CPU, 15 ... Free run timer, 16 ... I / O part, 18 ... WDC monitoring part, 21 ... 1st microcomputer, 22 ... 2nd microcomputer, 23 ... Timer, 25 ... Flip-flop, 26 ... WDC monitoring unit.

Claims (17)

At least two arithmetic processors operating in parallel;
An electronic control system comprising: a monitoring unit that inputs a watchdog clear signal based on a periodic output from each arithmetic processor and determines whether an abnormality occurs in the arithmetic processor when the periodicity of the watchdog clear signal is lost A runaway monitoring device,
Notifies the timing at a predetermined period of a common timer for each arithmetic processor, in conjunction with one of the processors performs an output to said I follow the rising timing notified from the common timer monitoring unit, The other arithmetic processor outputs a watchdog clear signal with a constant cycle to the monitoring unit by performing output to the monitoring unit according to the falling timing notified from the common timer unit. Runaway monitoring device for electronic control system. The runaway monitoring device for an electronic control system according to claim 1, wherein the monitoring unit outputs a signal for resetting each arithmetic processor when the abnormality continues for a predetermined time. The runaway monitoring device for an electronic control system according to claim 1, further comprising at least two arithmetic processors that perform different processes. The runaway monitoring device for an electronic control system according to claim 1, further comprising at least two arithmetic processors having different operation cycles. The runaway monitoring device for an electronic control system according to any one of claims 1 to 4, wherein an interrupt request is generated in each arithmetic processor in response to timing notification from the timer unit, and a watchdog clear process is performed. The runaway monitoring device for an electronic control system according to any one of claims 1 to 5, wherein each of the arithmetic processors is provided in the same package. In the electronic control system runaway monitoring device according to claim 6,
The first and second arithmetic processors and an output unit whose own output is manipulated by periodic outputs from these arithmetic processors are provided, and the first and second arithmetic processors are notified by the timer unit. Electronic control that inverts the output of the output unit at H / L at the timing of each arithmetic processor, and the monitoring unit determines that an abnormality has occurred when the output of the output unit is not inverted at a predetermined cycle System runaway monitoring device. In the electronic control system runaway monitoring device according to claim 7,
The first arithmetic processor operates the output of the output unit to H according to the timing notification from the timer unit, while the second arithmetic processor sets the output of the output unit to L according to the timing notification from the timer unit. Runaway monitoring device for electronic control system to operate. A first and a second arithmetic processor; and a flip-flop circuit that is set by a periodic output from the first arithmetic processor and reset by a periodic output from the second arithmetic processor, 6. The runaway monitoring device for an electronic control system according to claim 1, wherein the monitoring unit determines that an abnormality has occurred when the output of the flip-flop circuit does not invert at a predetermined cycle. In the electronic control system runaway monitoring device according to claim 9,
The first arithmetic processor outputs a one-shot pulse to the set terminal of the flip-flop circuit according to the timing notification from the timer unit, while the second arithmetic processor outputs a flip-flop circuit according to the timing notification from the timer unit Electronic control system runaway monitoring device that outputs a one-shot pulse to the reset terminal. In the runaway monitoring device for an electronic control system according to any one of claims 7 to 10,
In the event of an abnormality, a runaway monitoring device for an electronic control system that identifies an arithmetic processor in which an abnormality has occurred according to whether the output to the monitoring unit is fixed in H or L, and resets the arithmetic processor in which the abnormality has occurred . The said timer part is a free run timer comprised by a predetermined number of bits, The timing is notified to the said arithmetic processor with the inversion of the specific bit of this free run timer. Runaway monitoring device for electronic control system. The first arithmetic processor, the second arithmetic processor that performs processing different from the first arithmetic processor, and the periodic output from the first and second arithmetic processors causes the output to be H / L. A runaway monitoring device for an electronic control system having an output unit to be reversed in the same package,
  A free-run timer composed of a predetermined number of bits, each of which is inverted at the same time interval, and an abnormality in the arithmetic processor when the periodicity of the watchdog clear signal output from the output unit is lost A monitoring unit for determining
  According to the inversion timing of the specific bit notified by the free-run timer, the first arithmetic processor operates the output of the output unit to H, while inversion notified after a certain time interval has elapsed from the inversion timing. Runaway monitoring of an electronic control system characterized in that the second arithmetic processor causes the second arithmetic processor to operate the output of the output unit to L, thereby outputting a watchdog clear signal that repeats inversion at a constant period from the output unit. apparatus. The runaway monitoring device for an electronic control system according to claim 13, wherein the monitoring unit outputs a signal for resetting each arithmetic processor when an abnormality continues for a predetermined time. The runaway monitoring device for an electronic control system according to claim 13 or 14, wherein the first and second arithmetic processors have different operation cycles. The runaway monitoring device for an electronic control system according to any one of claims 13 to 15, wherein an interrupt request is generated in each arithmetic processor by a timing notification from the free-run timer, and a watchdog clear process is performed. In the runaway monitoring device for an electronic control system according to any one of claims 13 to 16,
  In the event of an abnormality, a runaway monitoring device for an electronic control system that identifies an arithmetic processor in which an abnormality has occurred depending on whether the output to the monitoring unit is fixed in H or L, and resets the arithmetic processor in which the abnormality has occurred .

Images