JPH0395636A - Diagnostic system for fail-safe circuit - Google Patents

Abstract

PURPOSE:To detect the abnormality of a fail-safe circuit itself in a simple constitution without deteriorating the functions of the fail-safe circuit and a control circuit by providing a diagnostic period signal generating circuit to produce a diagnostic period signal having the prescribed time width. CONSTITUTION:A CPU 1, a watchdog timer 2, and a mode timer 4 are reset by a power-on reset signal, the inverse of POC. The timer 4 outputs the diagnostic period signal STBY of the prescribed time width to the CPU 1 and the timer 2 respectively. Thus the timer 2 and the CPU 1 are set in a diagnostic mode, and the timer 2 stops the fail-safe diagnostic action to the CPU 1. Then the CPU 1 outputs a test pattern signal DIAGN and inputs it to the timer 2 via an AND gate 5 while the signal STBY is kept at a high level. Then the presence or absence of the abnormality of the timer 2 is detected by a diagnostic result signal (answer signal) DIAGI outputted from the time-out output Q2 of the timer 2. As a result, the abnormality of a fail-safe circuit is detected without deteriorating the functions of the fail-safe circuit itself and the CPU 1.

Description

[Detailed Description of the Invention] A. INDUSTRIAL APPLICATION FIELD The present invention relates to a diagnostic method for diagnosing the presence or absence of an abnormality in a fail-safe circuit itself, typified by a watchdog timer.

B. BACKGROUND OF THE INVENTION In order to prevent control circuits from running out of control, various control devices are equipped with fail-safe circuits that detect abnormalities in the control circuits during their operation.

FIG. 4 is a circuit diagram showing a typical configuration of a conventional fail-safe circuit. In the CPU 1 as a control circuit, a fail-safe circuit called a watchdog timer 2 detects the presence or absence of an abnormality. That is, as shown in the time chart of FIG. 5, when the power is turned on and a power-on reset signal K having a predetermined time width as shown in FIG. Reset by signal POC.

Further, the CPUI is reset by inputting the power-on reset signal R to the reset input via the AND gate 3. After the CPUI is reset, it starts the required control operation according to a preset program. During the control operation, a monitoring signal MS as shown in FIG. 5(b) is sent from the output port (PORTI) at regular intervals. Output. This monitoring signal MS is the watchdog timer 2
The signal is input to the watchdog timer 2 as a signal for setting the timer value. After the watchdog timer 2 sets a predetermined timer value in accordance with the monitoring signal MS, it starts a timing operation.

Specifically, the set timer value is subtracted at a predetermined period,
The timer value is It O while the next monitoring signal MS is input.
When it becomes I1, it outputs a watchdog reset signal WR to forcibly control CPtJ1 to the safe side. This reset signal WR is passed through AND gate 3 to C
Input to the reset input of the PUI. Due to this. C.P.
The UI is forcibly controlled to a safe reset state. CPU
If I is normal, the timer value will not become "'0" during the successive monitoring signals MS, so the watchdog reset signal WR will not be output.

In such a fail-safe circuit, the watchdog timer 2 may perform a timekeeping operation in an abnormal state for some reason, making it impossible to detect an abnormality in the CPUI. Therefore, conventionally, the watchdog timer 2 has either a built-in self-diagnosis circuit that detects its own abnormality, or
An external diagnosis method is adopted in which the CPU detects an abnormality in the watchdog timer 2.

C. Problems to be Solved by the Invention However, in a structure in which a self-diagnosis circuit is incorporated to detect an abnormality in the watchdog timer 2, the circuit scale of the watchdog timer 2 itself becomes large, and the self-diagnosis result also becomes abnormal at the same time. The problem is that the diagnostic operation becomes complicated and causes confusion. Further, in the case of the external diagnosis method, there is a problem in that the CPU itself may output a diagnostic signal while the failsafe circuit is operating, causing the failsafe function to stop.

A technical object of the present invention is to detect an abnormality in the fail-safe circuit itself with a simple structure without interfering with the functions of the fail-safe circuit or the control circuit.

D. Means and Effects for Solving the Problems A diagnostic period signal generating circuit is provided which is activated by a predetermined trigger signal and generates a diagnostic period signal having a predetermined time width. The diagnostic operation of the fail-safe circuit is stopped during the period in which the diagnostic period signal is being generated.

Further, while the diagnostic period signal is being generated, the control circuit sends a diagnostic signal to the fail-safe circuit. Diagnose whether or not there is an abnormality in the circuit.

E. Embodiment FIG. 1 is a circuit diagram showing an embodiment of the present invention. In contrast to the conventional circuit, there is a mode timer 4 that outputs the diagnostic period signal STBY, and a mode timer 4 that outputs the diagnostic period signal STBY only when the diagnostic period signal STBY is generated. Watchdog timer 2 uses the test pattern signal (diagnostic signal) DIAGN from the CPU as a control circuit.
and a NAND gate 6 which inputs a negative AND signal of the test pattern signal DIAGN and the watchdog reset signal WR of the watchdog timer 2 to the AND gate 3. .

The mode timer 4 is reset by the power-on reset signal δ and generates a diagnostic period signal STBY having a predetermined time width. In addition, after being reset by the power-on reset signal being enabled, the CPU generates a test pattern signal DIAGN and supplies it to the watchdog timer 2 during the generation period of the diagnostic period borrow code STBY, and the timeout output Q2 of the watchdog timer 2. The presence or absence of an abnormality in the watchdog timer 2 is detected by the diagnosis result signal (response signal) DIAGI output from the watchdog timer 2.

Next, the operation will be explained.

First, the CPU 1, watchdog timer 2, and mode timer 4 are reset by the power-on reset signal shown in FIG. 2(a). This reset causes the mode timer 4 to change the mode timer 4 from its MODE output to the second
A diagnosis period borrowing code STBY having a predetermined time width shown in FIG. 2(e) is output. This signal diagnosis period signal STBY is applied to the SE terminal of the watchdog timer 2 and the input port of the control circuit 1 (
PORTI). As a result, the watchdog timer 2 and the CPUI enter the diagnostic mode, and the watchdog timer 2 stops the fail-safe diagnostic operation for the CPUI. Further, the CPUI outputs a test pattern signal DIAGN at time intervals as shown in FIG. 2(c). The time interval of the test pattern signal DIAGN is set to be longer than that of the monitoring signal MS (see FIG. 2(b)) which is output from the output port (PORT3) of the CPU during normal operation. This test pattern signal DI
AGN is input to the timer setting manual Sn of the watchdog timer 2 via the AND gate 5 only during the period when the diagnostic period signal STBY is at a high level. When this test pattern signal DIAGN is input to the watchdog timer 2, the time interval of the diagnostic period signal STBY is longer than the normal monitoring signal MS and longer than the allowable limit value, so the watchdog timer 2 outputs the output terminal A diagnostic result signal DIAGI as shown in FIG. 2(d) is output from Q2. If an abnormality occurs in watchdog timer 2, a diagnostic result signal DI A as shown in Fig. 2(d) is generated.
G1 is not output. Therefore, the CPU 1 determines via the input port (PORT2) whether or not the diagnosis result signal DIAGI has become high level, and if it has not become high level, it is assumed that an abnormality has occurred in the watchdog timer 2 itself. It is determined and the state is transitioned to the safe side by processing the abnormality on the CPU itself. When the diagnostic period signal STBY returns to low level, the CPU
And watchdog timer 2 becomes normal mode. In the normal mode, the watchdog timer 2 judges the time interval of the monitoring signal MS input from the CPU to the timer setting input S2 in the same manner as before, and if the time interval exceeds the allowable limit, the watchdog timer 2 issues a watchdog reset from the output terminal Q1. Outputs signal WR. This signal WR is input to the reset terminal of CPUI via NAND gate 6 and AND gate 1. Thereby, the CPUI is controlled on the safe side.

FIG. 3 is a flowchart showing an overview of the processing executed by the CPUI to diagnose such a fail-safe circuit.

The test pattern output process in step S100 and the diagnosis result signal DIAGI in step SIOI are 'H'?
The process consists of a process of determining whether the diagnostic period signal STBY has returned to “L” in step S102, and an abnormality process of causing the control circuit 1 itself to transition to the safe side in step S103. In normal operation, step S101 is affirmed, so normal operation is performed in step S104.When diagnosing the watchdog timer as described above, data is sent from the CPU to the watchdog timer during normal operation and during diagnosis. The signal may be shared,
Also, C from the watchdog timer during normal operation and diagnosis.
A common signal may be sent to the PUI.

Furthermore, in addition to the above, the following diagnosis method may also be considered. A part of the watchdog timer circuit that performs a fail-safe diagnostic operation for the CPU is configured as a circuit that operates only with the test pattern signal DIAGN and outputs a signal, and outputs the output to the input port 2 of the CPUI. You may also do so. In addition, a signal identical to the test pattern input by the watchdog timer is prepared in advance, and a circuit is installed to compare the two signals. C
A part of the watchdog timer circuit that performs a fail-safe diagnostic operation for the PUI may be used as the comparison circuit, and the output of the comparison circuit may be output to the input port 2 of the CPUI.

In the above description, the monitoring target is the CPU and the fail-safe circuit is the watchdog timer, but other combinations may be used.

F. Effects of the Invention As explained above, in the present invention, the control circuit detects whether or not there is an abnormality in the fail-safe circuit provided to prevent the control circuit from running out of control during a specific period such as when the power is turned on. Therefore, there is no need to provide the fail-safe circuit with a self-diagnosis function, and the presence or absence of an abnormality in the fail-safe circuit can be detected with a simple structure. Furthermore, since the fail-safe circuit can be diagnosed only within a specific and limited period of time, the abnormality diagnosis of the control circuit can be performed without any problem.

[Brief explanation of drawings]

Fig. 1 is a circuit diagram showing one embodiment of the present invention, and Fig. 2 is a circuit diagram showing an embodiment of the present invention.
FIG. 3 is a flowchart showing the contents of the diagnostic operation executed by the control circuit; FIG. 4 is a circuit diagram showing a typical configuration of a conventional fail-safe circuit; FIG. 5 is a time chart for explaining the operation of the conventional circuit. 1: Control circuit 2: Watchdog timer 3: AND gate 4: Mode timer 5: AND gate 6: NAND gate

Claims (1)

[Scope of Claims] Monitors the time interval of monitoring signals output from a control circuit to be monitored at predetermined time intervals, and when the time interval exceeds a permissible time, the control circuit is forcibly controlled to the safe side. In a fail-safe circuit diagnostic method, a diagnostic period signal generating circuit is provided which is activated by a predetermined trigger signal to generate a diagnostic period signal of a predetermined time width, and the fail-safe circuit is activated during the period in which the diagnostic period signal is generated. stopping the diagnostic operation of the control circuit, causing the control circuit to send a diagnostic signal to the fail-safe circuit, and receiving a response signal from the fail-safe circuit in response to the diagnostic signal in the control circuit to diagnose whether or not there is an abnormality in the fail-safe circuit. A fail-safe circuit diagnostic method characterized by: