JPH11167505A - Electronic controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To confirm that a CPU operation monitor circuit (WDT: watching timer) for detecting a hang-up of a CPU is operating normally. SOLUTION: A monitoring operation test means is provided in a CPU part 21 and supplies an operation confirmation signal (WDT reset signal) 21a having cycles different from regular cycles to a CPU operation monitor circuit (WDT) 22. The CPU operation monitor circuit (WDT) 22 once detecting the operation of the CPU part 21 being abnormal outputs an L-level operation abnormality detection signal 22a. An abnormal-time output stop circuit 23 once supplied with the L-level operation abnormality detection signal 22a stops various control signals outputted from the CPU part 21 from being supplied to a controlled part. The CPU part 21 judges that the abnormal time output stop circuit 23 does not operate normally when the control state of the controlled part does not change and stores abnormality information in an abnormality storage part 28 consisting of a nonvolatile memory.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control device provided with a CPU operation monitoring circuit (hereinafter sometimes referred to as a watchdog timer) for detecting runaway of a microcomputer system (hereinafter referred to as a CPU). More specifically, the present invention relates to an electronic control device capable of confirming the operation of a watchdog timer.

[0002]

2. Description of the Related Art A pulse signal of a predetermined period is generated from a CPU, and the period of the pulse signal is monitored by a watchdog timer. If the pulse signal is not generated even if the predetermined period is exceeded, it is determined that the operation of the CPU is abnormal. Techniques for judging are disclosed in JP-A-57-50004 and JP-A-61-23202.
JP, JP-A-62-70948, JP-A-2-4
No. 0735, for example.

[0003] When an abnormal operation (runaway) of the CPU is detected by the watchdog timer, the CPU is generally reset. Further, a technique for stopping the operation of the CPU by holding the CPU in a reset state when the abnormal operation of the CPU continuously occurs is described in the above-mentioned JP-A-61-23202.

[0004]

However, the conventional electronic control devices and the like do not have means for checking whether the watchdog timer is operating normally. For this reason, when the watchdog timer has failed, the CPU
There is a problem that cannot be detected when a runaway occurs.

[0005] The present invention has been made to solve such a problem, and an electronic control device capable of confirming the operation of a watchdog timer and an operation of a CPU when the watchdog timer cannot operate normally. It is an object of the present invention to provide an electronic control device capable of restricting the above.

[0006]

In order to solve the above-mentioned problems, an electronic control unit according to the present invention comprises: a CPU for outputting an operation confirmation signal at a predetermined cycle when in a normal operation state; A CPU operation monitoring circuit that generates an operation abnormality detection signal when the operation is out of a predetermined allowable cycle range, wherein a control signal output from the CPU unit based on the operation abnormality detection signal Abnormal output stop circuit for preventing supply to CPU and CPU
A monitoring operation test means for supplying a test signal outside the permissible cycle range to the operation monitoring circuit; and an operation state detection circuit for detecting an output state of the abnormal output stop circuit or an operation state of the controlled unit, Is characterized in that the operation of the CPU operation monitoring circuit is checked based on a change in the operation state of the controlled unit accompanying the supply of the test signal.

The electronic control unit according to the present invention has a CPU unit for outputting an operation confirmation signal at a predetermined cycle when the electronic control unit is in a normal operation state, and when the cycle of the operation confirmation signal is out of a preset allowable period range. An electronic control device comprising a CPU operation monitoring circuit that generates an operation abnormality detection signal
The CPU operation monitoring circuit is provided with a self-check circuit for checking that the CPU operation monitoring function is operating normally. After the self-check confirms that the CPU operation monitoring function is operating normally, the CPU unit is brought into an operable state. Or the control signal output from the CPU unit is allowed to be supplied to the controlled unit.

[0008] Further, the electronic control device according to the present invention includes:
A CPU unit that outputs an operation confirmation signal at a predetermined cycle when in a normal operation state, and a CPU operation monitoring circuit that generates an operation abnormality detection signal when the period of the operation confirmation signal is out of a preset allowable period range. An electronic control unit provided with an abnormal output stop circuit for preventing a control signal output from the CPU unit from being supplied to the controlled unit based on the operation abnormality detection signal; Monitoring operation test means for supplying a test signal of
The CPU operation monitoring circuit outputs an operation abnormality detection signal in an initial state, and stops outputting the operation abnormality detection signal based on detecting that the CPU operation monitoring function is in a normal operation state based on the test signal, Thereafter, when the CPU section detects an abnormal operation state, it outputs an operation abnormality detection signal.

In the electronic control unit according to the present invention, when the CPU operation monitoring circuit detects an operation abnormality of the CPU unit, an operation abnormality detection signal is supplied to the abnormal output stop circuit, and the control signal output from the CPU unit is output. From being supplied to the controlled part. Therefore, by supplying a test signal to the CPU operation monitoring circuit and monitoring the state of the output side of the abnormal output stop circuit or the operation state of the controlled unit, it is possible to determine whether the CPU operation monitoring circuit is operating normally. You can check.

Further, the electronic control device according to the present invention has a C
The PU operation monitoring circuit is provided with a self-check function. After the self-check confirms that the CPU operation monitoring function operates normally, the CPU unit is controlled to an operable state, or a control signal output from the CPU unit. Is allowed to be supplied to the controlled part, so that the control operation can be performed only when the CPU operation monitoring circuit is operating normally.

Further, the electronic control device according to the present invention includes:
When a test signal is supplied to the CPU operation monitoring circuit and it is confirmed that the CPU operation monitoring circuit operates normally,
Since the control signal output from the PU unit is allowed to be supplied to the controlled unit, the control operation can be performed only when the CPU operation monitoring circuit is operating normally.

[0012]

Embodiments of the present invention will be described below with reference to the accompanying drawings. In this embodiment, an electric power steering device will be described as a specific example of the electronic control device. FIG. 1 is a schematic structural diagram showing an example of the electric power steering device. The electric power steering device 1 includes an electric motor 10 in a steering system, and controls the power supplied from the electric motor 10 by using the control device 20 to reduce the steering force of the driver.

[0013] Steering wheel (steering handle) 2
Is connected to a pinion 6 of a rack and pinion mechanism 5 via a connecting shaft 4 having universal joints 4a and 4b. The rack shaft 7 includes rack teeth 7a that mesh with the pinion 6. The rack and pinion mechanism 5 converts the rotation of the pinion 6 into a reciprocating motion of the rack shaft 7 in the axial direction. Left and right front wheels 9 as rolling wheels are connected to both ends of the rack shaft 7 via tie rods 8.
When the steering wheel 2 is steered, the front wheels (steering wheels) 9 are swung via the rack and pinion mechanism 5 and the tie rods 8. Thereby, the direction of the vehicle can be changed.

In order to reduce the steering force, a motor 10 for supplying a steering assist torque (assist torque) is connected to a rack shaft 7.
The rotation output of the electric motor 10 is converted into a thrust through a ball screw mechanism 11 provided substantially parallel to the rack shaft 7 so as to act on the rack shaft 7. Electric motor 1
The drive side helical gear 10a is provided integrally with the rotor 0. The helical gear 11b and the drive-side helical gear 10a provided integrally with the shaft end of the screw shaft 11a of the ball screw mechanism 11 are meshed. The nut 11c of the ball screw mechanism 11 is connected to the rack shaft 7.

A manual steering torque acting on the pinion 6 is detected by a steering torque detector (steering torque sensor) 12 provided in a steering box (not shown),
A steering torque signal 12a corresponding to the detected steering torque is supplied to the control device 20. The control device 20 controls the output power (steering assist torque) of the electric motor 10 by operating the electric motor 10 using the steering torque signal 12a as a main signal.

FIG. 2 is a block diagram of the control device.
The control device 20 includes a CPU 21, a CPU operation monitoring circuit (WDT: watchdog timer) 22, an abnormal output stop circuit 23, a gate drive circuit 24, an H-type bridge circuit 25, and a current detector 26. , A / D converter 27,
An abnormality storage unit 28, a constant voltage circuit (REG) 29, a power-on reset circuit (POR) 30, a power supply relay 31, a motor cutoff relay 32, relay drive circuits 33 and 34, and each operation. State detection circuits 35, 36, 37
And power supply diodes 38 and 39. Reference numeral 40 denotes a battery power supply, reference numeral 41 denotes a fuse, and reference numeral 42.
Is an ignition switch, 43 is a vehicle speed detector, and 12 is a steering torque detector.

The CPU section 21 includes a CPU, ROM, RA
A microcomputer system including an M, an input / output port, a system controller, and the like is configured using a one-chip microcomputer integrated on one chip. CP
The U unit 21 repeatedly executes various processes for operating the electric motor 10 based on the control program stored in the ROM, and an operation confirmation signal (pulse signal) indicating that the CPU unit 21 is operating normally. 21a is output from the output port O7 at predetermined intervals. For example, the CPU unit 2
1 is to repeat a series of processing such as input processing, arithmetic processing, and output processing and then to perform processing for outputting an operation confirmation signal, so that when the CPU unit 21 is operating normally, a predetermined cycle is performed. To output the operation confirmation signal 21a. In the present embodiment, when the CPU unit 21 is operating normally, the operation confirmation signal 21a is output, for example, at a cycle of 1.5 milliseconds.

The CPU operation monitoring circuit (WDT) 22
The period of the operation confirmation signal 21a supplied from the output port O7 of the PU unit 21 is monitored. If the period of the operation confirmation signal 21a is out of the preset allowable period range, the CPU
It determines that the operation of the unit 21 is abnormal and outputs an operation abnormality detection signal 22a. In the present embodiment, the CPU operation monitoring circuit (WDT) 22 determines that the cycle of the operation confirmation signal 21a is
For example, when the time exceeds 2 milliseconds, and when the period of the operation confirmation signal 21a becomes less than 1 millisecond, for example,
It determines that the operation of the CPU unit 21 is abnormal, and outputs an L-level operation abnormality detection signal 22a. In the following description, even when the detection signal 22a is at the H level, it may be expressed as an operation abnormality detection signal for convenience, but more precisely, when the detection signal 22a is at the L level, the operation abnormality detection signal.

When an abnormal operation of the CPU section 21 is detected by the CPU operation monitoring circuit (WDT) 22, the abnormal state output stop circuit 23 detects the abnormal operation of the CPU section 21 based on the abnormal operation detection signal 22a. From being supplied to each control object.
An abnormal (undesired) control signal may be output when the CPU goes out of control, but by providing the abnormal output stop circuit 23, an abnormal control signal can be prevented from being supplied to each control target. In the present embodiment, the CP
A two-input AND circuit (logical product circuit) A1 corresponding to each control signal output from each output port O1 to O6 of the U unit 21
To A6, respectively, and each of the two-input AND circuits A1 to A6
When the CPU unit 21 is in a normal operation state, the control signal is supplied to one input terminal of each of the above and the operation abnormality detection signal 22a is supplied to the other input terminal of each of the two-input AND circuits A1 to A6. The control signals output from the output ports O1 to O6 of the CPU unit 21 are supplied to the subsequent circuit units, and when an operation abnormality of the CPU unit 21 is detected, the outputs of the AND circuits A1 to A6 are output. The control signal is set to the L level so that each control signal is not supplied to each circuit unit at the subsequent stage. It should be noted that the output stop circuit 23 at the time of abnormality
The configuration may be such that a three-state buffer circuit is used to set the output side of the three-state buffer circuit to a high impedance state when an abnormal operation of the CPU unit 21 is detected.

The gate drive circuit 24 is output from each of the output ports O3 to O6 of the CPU section 21,
Based on the PWM signal supplied through .about.A6, the gate power is supplied to the respective gates of the power field effect transistors (FETs) Q1 to Q4 constituting the H-type bridge circuit 25.

The current detector 26 includes an H-type bridge circuit 25.
, And outputs a voltage signal (motor current signal) 26a corresponding to the detected current. The current detector 26 includes a current detection resistor and a DC amplifier that amplifies a voltage generated between both ends of the current detection resistor. Voltage signal 2 according to the detected current
6a is supplied to the A / D converter 27. Note that the current detector 26 may be configured using a current sensor having a Hall element.

The A / D converter 27 uses a multiplex input type. Each input terminal of the A / D converter 27 has a voltage signal (vehicle speed signal) 43a corresponding to the vehicle speed output from the vehicle speed detector 43, a steering torque output from the steering torque detector 12, and a steering signal corresponding to the steering direction. A voltage signal (steering torque signal) 12a and a voltage signal (motor current signal) corresponding to the motor current output from the current detector 26 are supplied. The CPU section 21 has an A / D
Supplying information specifying an A / D conversion target input to the converter 27 via a bus (address bus, data bus, control bus) BUS connected to a bus input / output terminal group BIO of the CPU unit 21 A / D conversion of the designated input to be converted is performed, and the A / D conversion result is taken in via the bus BUS.

The abnormality storage section 28 is constituted by a nonvolatile memory such as an EEPROM or a flash memory.
When an abnormality or the like occurs in the control device 20, the CPU unit 21 stores information indicating the content of the abnormality or the like in the abnormality storage unit 28 via the bus BUS. Further, the CPU unit 21 reads out the abnormality information and the like stored in the abnormality storage unit 28 via the bus BUS, changes the control content based on the read abnormality information and the like, and reads the read abnormality information and the like. The data can be transmitted to another device via a serial communication port (not shown).

A constant voltage circuit (REG) 29 supplies a stabilized circuit power supply VCC (for example, 5 volts) based on a DC power supply supplied from a battery power supply 40 via power supply diodes 38 and 39. Output. Circuit power supply V
CC indicates a CPU section 21, a CPU operation monitoring circuit 22, an abnormal output stop circuit 23, a current detector 26, an A / D converter 2
7, the abnormality storage unit 28, the power-on reset circuit 30, and the like.

Power-on reset circuit (POR) 30
Outputs a power-on reset signal 30a for a predetermined time from the time when the circuit power supply VCC is supplied.
The power-on reset signal 30a is supplied to a reset input terminal RS of the CPU 21. The CPU section 21 is reset (initialized) by the power-on reset signal 30a.

When the ignition switch 42 is turned on, the battery power supply 40 is supplied from the battery power supply 40 to the constant voltage circuit (REG) 29 via the fuse 41, the ignition switch 42, and one power supply diode 38. The circuit power supply VCC is output from the constant voltage circuit (REG) 29. Power-on reset signal 3
After the reset of the CPU unit 21 by 0a,
The control operation of the CPU section 21 is started. CPU unit 21
Performs an initial state setting process and an initial abnormality detection process described below first.

When the ignition switch 42 is turned on, the battery power supply 40 is supplied to the input terminal of the ignition switch operation state detection circuit 35. The ignition switch operation state detection circuit 35 outputs an L level signal to an output terminal when a voltage equal to or higher than a predetermined voltage is supplied to the input terminal, and outputs an L level signal when no voltage equal to or higher than the predetermined voltage is supplied to the input terminal. H level (VCC)
The signal of is output. The output of the ignition switch operation state detection circuit 35 is supplied to the input port I3 of the CPU 21. As a result, the port input I of the CPU
Reference numeral 3 indicates a low level when the ignition switch 42 is on and a high level when the ignition switch 42 is off. The CPU unit 21 detects the operation state (ON or OFF) of the ignition switch 42 by checking the logical level of the port input I3.

When the CPU section 21 detects that the ignition switch 42 is on, the output port O
It outputs a power supply relay drive signal 21b of 1 to H level. The power supply relay drive signal 21b is supplied to the power supply relay drive circuit 33 via the two-input AND circuit A1. When the input terminal of the power supply relay drive circuit 33 becomes H level, the power supply relay drive circuit 3
The output transistor 3 is turned on. Therefore, the exciting current is supplied to the exciting winding 31a of the power supply relay 31 based on the power supply relay drive signal 21b, and the contact 31b of the power supply relay 31 is turned on.

When the contact 31b of the power supply relay 31 is turned on, the battery power supply 40
4, and is supplied to the constant voltage circuit 29 via the other power supply diode 39. By providing the battery power supply 40 to the constant voltage circuit 29 via the other power supply diode 39, the contact 31b of the power supply relay 31 is turned on even if the ignition switch 42 is turned off. During this time, the circuit power supply VCC is supplied to each circuit unit via the constant voltage circuit 29 so that each circuit unit can operate.

The battery power supply 40 is supplied to the input terminal of the power supply relay operating state detection circuit 36 via the contact 31b of the power supply relay 31. The power supply relay operating state detection circuit 36 outputs an L level signal to the output terminal when a voltage equal to or higher than a predetermined voltage is supplied to the input terminal, and outputs a signal when the voltage equal to or higher than the predetermined voltage is not supplied to the input terminal. An H level (VCC) signal is output to the output terminal. The output of the power supply relay operating state detection circuit 36 is
It is supplied to the input port I2 of the CPU section 21. As a result, the port input I2 of the CPU unit 21 goes low when the power supply relay 31 is in the operating state, and goes high when the power supply relay 31 is in the inactive state. The CPU section 21 checks the logic level of the port input I2 to determine the operation / reaction of the power supply relay 31.
Detect inactive state. The CPU unit 21 has an output port O
If it is not detected that the power supply relay 31 is in the operating state despite the output of the power supply relay drive signal 21b from 1 to the H level, the drive of the power supply relay 31 is abnormal. Abnormality information indicating the presence is stored in the abnormality storage unit 28.

When the CPU section 21 detects that the power supply relay 31 is in the operating state, it sets the output port O3 to the H level for a predetermined time. This H-level output is supplied to the gate drive circuit 24 via the two-input AND circuit A3, and gate power is supplied from the gate drive circuit 24 to the gate of one field effect transistor Q1 constituting the upper arm. The CPU unit 21 outputs H to the output port O3.
While the level signal is being output, the A / D converter 27
, The detected current value of the current detector 26 is read. CP
If the read current value is not zero (or exceeds a predetermined value), the U unit 21 determines that one of the field effect transistors Q3 constituting the lower arm has a short circuit failure or the like, Information indicating that the field effect transistor Q3 is faulty is written to the abnormality storage unit 28.

Next, the CPU section 21 outputs an H level signal from the output port O4 to supply gate power to the gate of the other field effect transistor Q2 constituting the upper arm, and in that state, detects the current. By reading the detected current value of the detector 26, it is checked whether or not a short circuit fault has occurred in the other field effect transistor Q4 constituting the lower arm. Further, the CPU unit 21 includes an output port O
5 to output an H-level signal to supply gate power to the gate of one of the field effect transistors Q3 constituting the lower arm. In this state, the detection current value of the current detector 26 is read, and It is checked whether or not a short circuit fault has occurred in one of the field effect transistors Q1 constituting the arm. Further, the CPU unit 21 outputs an H level signal from the output port O6 to supply gate power to the gate of the other field effect transistor Q4 constituting the lower arm, and in this state, the current detector 26
By reading the detected current value, it is checked whether or not a short circuit fault has occurred in the other field effect transistor Q2 constituting the upper arm.

By outputting an H-level signal from the output port O3 of the CPU section 21 to supply gate power to the gate of one of the field effect transistors Q1 forming the upper arm, the field effect transistor Q1 is turned off. Controlled to ON state. In this state, the power supply relay 3
Battery power supply 4 supplied via one contact 31b
0 is supplied to the input terminal of the motor cut-off relay operating state detecting circuit 37 via the field effect transistor Q1 and the normally closed side of the contact 32b of the motor cut-off relay 32.
When the motor shutoff relay 32 is activated, the contact 32
Is in an open state (OFF state), the voltage from the battery power supply 40 is not supplied to the input terminal of the motor cutoff relay operating state detection circuit 37.

Motor operating relay operating state detecting circuit 37
Outputs an L level signal to an output terminal when a voltage higher than a predetermined voltage is supplied to an input terminal, and outputs an H level (VCC) signal to an output terminal when a voltage higher than a predetermined voltage is not supplied to the input terminal. Output a signal. The output of the motor operation relay operating state detection circuit 37 is supplied to the input port I1 of the CPU section 21. As a result, the port input I1 of the CPU section 21 is at the L level when the motor shutoff relay 32 is in the non-operation state, and is at the H level when the motor shutoff relay 32 is in the operation state. CPU unit 21
Detects the non-operation / operation state of the motor cutoff relay 32 by checking the logic level of the port input I1.

When the CPU section 21 completes the abnormality check of each of the field-effect transistors Q1 to Q4 constituting the H-type bridge circuit 25, it outputs an H level signal from the output port O2 of the CPU section 21 and outputs the signal of the port input I1. After confirming that the motor cut-off relay 32 is in the non-operation state (L level) based on the logic level, the output port O2 is set to H level.
It outputs a motor drive relay drive signal 21c for shutting down the motor. Note that when the CPU unit 21 detects that the motor shutoff relay 32 is operating in a state where the motor shutoff relay drive signal 21c is not output, the operation of the motor shutoff relay 32 is abnormal. Is written to the abnormality storage unit 28.

The motor drive relay drive signal 21c is 2
It is supplied to the motor drive relay drive circuit 34 via the input AND circuit A2. Motor drive relay drive circuit 34
Is configured such that when its input terminal goes to the H level, the output transistor in the motor drive relay drive circuit 34 is turned on. Therefore, an exciting current is supplied to the exciting winding 32a of the motor cut-off relay 32 based on the motor cut-off relay drive signal 21c, and the contact 32b is switched between the normally closed side and the normally open side. As a result, a state where current can be supplied to the electric motor 10 via the H-type bridge circuit 25 is established.

When the CPU section 21 detects that the motor shutoff relay 32 has been activated by outputting the motor shutoff relay drive signal 21c from the output port O2, the steering force assist process described below is started. I do. If the CPU unit 21 detects that the motor shutoff relay 32 is in the inactive state despite outputting the motor shutoff relay drive signal 21c, the operation of the motor shutoff relay 32 is abnormal. Is written to the abnormality storage unit 28.

When the above-described initial state setting processing and initial abnormality detection processing are completed, the CPU section 21 starts the steering force assist processing. The CPU section 21 takes in the steering torque data corresponding to the steering torque signal 12a via the A / D converter 27 and also takes in the vehicle speed data corresponding to the vehicle speed signal 43a via the A / D converter 27. C
The PU unit 21 obtains a target motor current corresponding to the steering torque with reference to a steering torque-motor current conversion table provided in the CPU unit 21, and corrects the target motor current according to the vehicle speed to obtain a corrected motor current. Calculate. CPU
The section 21 receives the motor current signal 2 via the A / D converter 27.
6a, the motor current data corresponding to the deviation is obtained, the deviation between the corrected motor current and the motor current actually supplied to the motor 10 is obtained, the duty of the PWM signal is set based on the obtained deviation, and the duty corresponding to the deviation is obtained. PWM
A signal is generated, and the generated PWM signal is output to each output port O
Output from 3-O6.

P output from each of the output ports O3 to O6
The WM signal is supplied to the gate drive circuit 24 via each of the two-input AND circuits A3 to A6, and gate power is supplied from the gate drive circuit 24 to the gates of the field effect transistors Q1 to Q4. Thus, the current supplied to the motor 10 via the inverter circuit including the H-type bridge circuit 25 is switching-controlled, and the PWM operation of the motor 10 is performed.

The CPU section 21 determines whether the ignition switch 4 has been switched to the H level or not.
When it is detected that the motor 2 has been turned off, the motor 1
A fade-out process for gradually reducing the current supplied to 0 is performed. If the steering assist torque is suddenly changed to zero while the steering assist torque is being supplied from the electric motor 10, the steering feeling suddenly changes or the steering wheel 2 is turned by the reaction force from the road surface. May be. Therefore, a state where the steering assist torque is supplied from the electric motor 10 (a state where electric current is supplied to the electric motor 10).
Thus, when the ignition switch 42 is turned off, the current supplied to the electric motor 10 is gradually reduced to eliminate a sudden change in the steering feeling.

After performing the above-described fade-out processing, the CPU section 21 executes a CPU operation monitoring circuit (WDT) 22.
Performs an operation test process of the CPU operation monitoring circuit to confirm that the CPU operates normally. The CPU section 21 (in this case, the monitoring operation test means) stops outputting the operation confirmation signal 21a output from the output port O7 every predetermined period (for example, 1.5 milliseconds). Alternatively, the CPU unit 21
Makes the cycle of the operation confirmation signal 21a output from the output port O7 longer than the upper limit (for example, 2 milliseconds) of the allowable cycle range. For example, by outputting the operation check signal 21a output every time each time a series of processing is repeated, the operation check signal 21a is output at twice the predetermined period (for example, 3 milliseconds). You may.

The CPU operation monitoring circuit (WDT) 22 does not supply the next operation confirmation signal 21a even if it exceeds the upper limit value (for example, 2 milliseconds) of the allowable cycle range from the time when the operation confirmation signal 21a is supplied first. In this case, an L-level operation abnormality detection signal 22a is output. By this L-level operation abnormality detection signal 22a, the abnormality-time output stop circuit 23
Each relay drive signal 21a, supplied from the U section 21,
21b is prevented from being supplied to each of the relay drive circuits 33 and 34, so that each of the relays 31 and 32 becomes inactive. When the power supply relay 31 returns to the non-operating state, the power supply to the control device 20 is cut off.

Even if the CPU operation monitoring circuit (WDT) 22 does not operate normally and the operation confirmation signal 21a is not supplied for a predetermined time or more, the operation abnormality detection signal 22a
Is not output, the power supply to the control device 20 is continued. Therefore, the CPU unit 21 sets the operation check signal 2
Even if a preset time (for example, several tens of milliseconds to several hundreds of milliseconds) elapses from the time when the output of the first signal generator 1a is stopped or the time when the abnormal operation confirmation signal (test signal) is output, the power supply relay 31 Is detected to be in the operating state, the abnormality information indicating that the operation of the CPU operation monitoring circuit (WDT) 22 is abnormal is written to the abnormality storage unit 28, and then the output of the motor supply relay drive signal 21b is output. To stop. As a result, the motor supply relay 31 is restored, and the power supply to the control device 20 is stopped. A preset time (for example, several tens of milliseconds to several hundreds of seconds) from when the output of the operation confirmation signal 21a is stopped or when the abnormal operation confirmation signal (test signal) is output.
(Milliseconds) When the CPU unit 21 is operating,
It is also possible to determine that the operation of the PU operation monitoring circuit (WDT) 22 is abnormal. In this case, the CPU unit 21 corresponds to an operation state detection circuit.

The CPU operation monitoring circuit (WDT) 22 determines whether the period of the operation confirmation signal 21a exceeds the preset allowable period range (1-2 milliseconds) (exceeds 2 milliseconds), If it is shorter than the range (less than 1 millisecond), it outputs an operation abnormality detection signal 22a. Therefore, under each condition, the CPU operation monitoring circuit (WDT) 2
It is necessary to perform operation test 2 above.

Therefore, the CPU unit 21 writes the test conditions in the abnormality storage unit 28 when performing the operation test of the CPU operation monitoring circuit, and stores the test conditions in the abnormality storage unit 28 before the next operation test. The previous test condition is read, and a test condition different from the previous test condition is set. That is, the check of the abnormality detection function when the cycle of the operation check signal 21a becomes longer than the allowable cycle range and the check of the abnormality detection function when the cycle of the operation check signal 21a becomes shorter than the allowable cycle range. , Each time the electric power steering device 1 is used.

When checking the abnormality detection function when the cycle of the operation confirmation signal 21a is shorter than the allowable cycle range, the CPU 21 checks the operation confirmation signal for test (test signal) at a cycle shorter than 1 millisecond. ) Is output continuously. The CPU unit 21 outputs a preset operation time (a CP signal by the CPU operation monitoring circuit 22) from the time when the operation confirmation signal (test signal) having a cycle shorter than 1 millisecond is output.
Even if a time set in consideration of a time until an abnormal operation of the U is detected and a delay time until the relay is restored, for example, several tens to several hundreds of milliseconds, the power supply relay If it is detected that the operation of the CPU 31 is in an operating state, the abnormality information indicating that the operation of the CPU operation monitoring circuit (WDT) 22 is abnormal is written to the abnormality storage unit 28,
The output of the motor supply relay drive signal 21b is stopped. As a result, the motor supply relay 31 is restored, and the power supply to the control device 20 is stopped.

In the present embodiment, an example has been described in which the monitoring operation test means for supplying a test signal outside the allowable cycle range to the CPU operation monitoring circuit 22 is constituted by the CPU section 21. A test signal generating circuit for generating a test signal is provided therein, and when the ignition switch 42 is turned off from an on state, the test signal generating circuit is activated to generate a test signal,
The test signal may be supplied to the CPU operation monitoring circuit 22. In this case, the operation confirmation signal 21a output from the CPU unit 21 is output from the CPU operation monitoring circuit 22.
A circuit configuration for preventing supply to the power supply is employed.

The CPU section 21 reads out the abnormality information stored in the abnormality storage section 28 when the operation state is changed to the next operation state. And so on. CPU unit 2
1 can stop all the functions of the electric power steering device 1 depending on the content of the abnormality.

As described above, the control device 2 shown in FIG.
0 indicates that the operation of the CPU operation monitoring circuit (WDT) 22 and the abnormal time output stop circuit 23 can be checked every time the use of the electric power steering device 1 is completed. Therefore, when an operation abnormality of the CPU operation monitoring circuit (WDT) 22 and the abnormality output stop circuit 23 is detected, it is notified to the driver or the like via a display device or an alarm device (not shown) that the operation abnormality is occurring. The display can be performed, or the operation of the electric power steering device 1 can be stopped.

The control device 20 shown in FIG.
When the operation monitoring circuit (WDT) 22 detects that the CPU unit 21 has gone out of control, the abnormality detection signal 22a
Is supplied to the abnormal time output stop circuit 23 to prevent the various control signals output from the CPU unit 21 from being supplied to each circuit unit.
0 can be stopped immediately.

Further, a CPU operation monitoring circuit (WDT) 2
2 is configured to detect an abnormal operation of the CPU unit 21 not only when the period of the operation check signal 21a becomes longer than the allowable range but also when the period becomes shorter than the allowable range. In addition to the abnormality that the operation of the operation 21 enters an infinite loop or the like and the operation confirmation signal 21a is not supplied,
It is also possible to detect an abnormality in which a series of processing cycles is shortened because the CPU unit 21 does not perform a specific processing.

FIG. 3 is a block diagram showing a specific example of the CPU operation monitoring circuit. The CPU operation monitoring circuit 22
A clock pulse generating circuit 51 for generating a clock pulse for timing, a first counter circuit 52, a second counter circuit 53, a first OR circuit (OR circuit) 54,
Set-reset type flip-flop circuit 55, second
And an inverter circuit 57 that inverts the power-on reset signal 30a whose L level indicates the reset state and generates a signal whose H level indicates the reset state. When a power-on reset signal whose H level indicates a reset state is supplied, the inverter circuit 5
7 is unnecessary.

The clock pulse generation circuit 51 includes a master clock generator such as a crystal oscillation circuit, a frequency divider for dividing the master clock generated by the master clock generator, and the like. A clock 51a and a clock 51b having a period of, for example, 10 milliseconds are output.

After the power-on reset signal 30a is supplied to the reset terminal R via the inverter circuit 57 and the second OR circuit 56 to reset the counter value, the first counter circuit 52 outputs the signal to the clock input terminal CK. The operation confirmation signal 21a (CP shown in FIG. 2) which is advanced by the supplied clock 51a having a cycle of 0.01 millisecond and supplied to the reset terminal R via the second OR circuit 56.
(Supplied from the U section 21). The first counter circuit 52 outputs an H-level overflow signal 52a from the carry-out output terminal CO when the counter value exceeds 200. Therefore, when the period of the operation confirmation signal 21a exceeds 2 milliseconds, the counter value exceeds 200 and the H-level overflow signal 52a is output.

The second counter circuit 53 is reset at the rising or falling edge of the clock 51b having a period of 10 milliseconds supplied to the reset input terminal R, and is reset by the operation confirmation signal 21a supplied to the clock input terminal CK. Is advanced. The second counter circuit 53 outputs a signal from the carry-out output terminal CO to H when the counter value exceeds 10.
A level overflow signal 53a is output. Therefore, when the cycle of the operation confirmation signal 21a is shorter than 1 millisecond, the counter value exceeds 10 and the H-level overflow signal 53a is output within the 10 millisecond cycle in which the second counter circuit 53 is reset. Is done.

Each of the overflow signals 52 a and 53 a is supplied to the set input terminal S of the flip-flop circuit 55 via the first OR circuit 54. In the flip-flop circuit 55, the inverted output terminal NQ is initially set to the H level by the power-on reset signal 30a supplied to the reset input terminal R via the inverter circuit 57. When the overflow signal 52a, 53a is supplied from one of the counter circuits 52, 53 to the set input terminal S of the flip-flop circuit 55 via the OR circuit 54, the inverted output terminal NQ is set to L level. The output of the inverted output terminal NQ is the L-level operation abnormality detection signal 2
2a is supplied to the abnormal output stop circuit 23 shown in FIG.

In this embodiment, the operation test of the CPU operation monitoring circuit 22 is performed when the ignition switch 42 is turned off from the on state. However, the ignition switch 42 is turned on from the off state. In such a case, that is, the operation test of the CPU operation monitoring circuit may be performed when the power of the control device 20 is turned on.

FIG. 4 is a block diagram showing a specific example of a CPU operation monitoring circuit (WDT) which performs an operation check based on a test signal supplied from the CPU unit in an initial state after power is turned on. . The CPU operation monitoring circuit (WDT) 60 shown in FIG.
0a is supplied via the inverter circuit 57 to the second flip-flop circuit 61 and the third flip-flop circuit 62.
, The flip-flop circuits 61 and 62 are reset, and the output Q of each flip-flop circuit 61 and 62 becomes L level.
The output Q of each flip-flop circuit 61, 62 is supplied to a three-input AND circuit 63. Therefore, in the initial state, the operation abnormality detection signal 22a output from the three-input AND circuit 63 is at the L level.

The CPU section 21 (in this case, the monitoring operation test means), for example, 0.5
11 milliseconds of incorrect operation confirmation signal (test signal)
By causing the second counter circuit 53 shown in FIG. 4 to overflow continuously by generating a pulse or more, the output of the operation confirmation signal is stopped for, for example, 3 milliseconds.
Overflows the first counter circuit 52 shown in FIG. Overflow signal 53 of second counter circuit 53
The third flip-flop circuit 62 is set by a, and the output Q thereof goes to H level. The second flip-flop circuit 61 is set by the overflow signal 52a of the first counter circuit 52, and its output Q goes to H level.

The operation check circuit 64 (self-check circuit) monitors the elapsed time from the time when the power-on reset signal 30a is released based on the clock signal 51b having a period of, for example, 10 milliseconds, and sets a predetermined time (for example,
If both the outputs Q of the second and third flip-flop circuits 61 and 62 become H level within 0.5 second), each counter circuit 52 and 53 (CPU operation monitoring function)
Is determined to be operating normally, and an internal reset pulse signal 64a is generated. The internal reset pulse signal 64a is supplied to a reset input terminal R of the first flip-flop circuit 55 via a two-input OR circuit 65. As a result, the first flip-flop circuit 55 is reset by the internal reset signal 64a, and the inverted output NQ of the first flip-flop circuit 55 goes high. Since the outputs Q of the second and third flip-flop circuits 61 and 62 are both at H level, the operation abnormality detection signal 22a output via the three-input AND circuit 63 is at H level. The internal reset pulse signal 64a is 3
The signal is supplied to the reset input terminal R of the first counter circuit 52 via the input OR circuit 66. As a result, the first counter circuit 52 is reset.

After the completion of the initial check, if the cycle of the operation confirmation signal 21a supplied from the CPU section 21 is out of the predetermined range, the first or second counter circuit 5
2 and 53 output overflow signals 52a and 53a. Either overflow signal 52a, 53a
Is output, the first flip-flop circuit 55 is set via the two-input OR circuit 54, so that the inverted output NQ of the first flip-flop circuit 55 goes low. As a result, the L-level operation abnormality detection signal 22a is output via the three-input AND circuit 63.

The CPU operation monitoring circuit (WD) shown in FIG.
T) 60 sets the operation abnormality detection signal 22a to L level in the initial state, a test signal is supplied from the CPU 21 side, and the CPU operation monitoring circuit (WDT) is based on the test signal.
After it is confirmed that the normal operation of the operation 60 is detected, the operation abnormality detection signal 22a is restored to the H level. Therefore, the control signal output from the CPU unit 21 can be supplied to the controlled unit only when the CPU operation monitoring circuit (WDT) 60 is operating normally.

When the output Q of each of the flip-flop circuits 61 and 62 attains the H level within a predetermined time from the time when the power-on reset signal 30a is released, the operation check circuit 64 sets each of the counter circuits 52 and 53. Is determined to be operating normally, but without monitoring the time, the output Q of each flip-flop circuit 61, 62 is
Are both at the H level, each counter circuit 52,
53 may be determined to be operating normally.

After supplying the two kinds of test signals described above, the CPU section 21 outputs, for example, the power supply relay drive signal 2
If the power supply relay 31 does not become active even after outputting 1b, it can be determined that the CPU operation monitoring circuit 22 is abnormal.

FIG. 5 is a block diagram of another control device. The control device 70 shown in FIG. 5 includes a CPU operation monitoring circuit (WDT) 80 having a self-check function. CPU operation monitoring circuit with self-check function (WD
T) 80, when the power-on reset signal 30a is supplied, performs a self-check while holding the CPU reset signal 80a in a reset state, and confirms that the internal circuit has normally operated.
From the reset state to the non-reset state. CP
The U unit 21 starts operating when the self-check of the CPU operation monitoring circuit (WDT) 80 is completed. That is, the CPU unit 21 can operate only when the CPU operation monitoring circuit (WDT) 80 is operating normally.

The control device 70 shown in FIG. 5 controls the input signal of the gate drive circuit 24 (the output signal of the two-input AND circuit A3).
To the input port I5 of the CPU section 21 and
An output signal of the gate drive circuit 24 (gate signal of the field effect transistor Q1) is supplied to the input port I4 of the CPU section 21 via the gate drive state detection circuit 71. With such a configuration, the CPU unit 2
1 is a logic level of the output port O3 and each input port I4,
Based on the logic level of I5, output stop circuit 2 for abnormal condition
3 and whether the gate drive circuit 24 operates normally. In FIG. 5, 4
System PWM signal (output signal of output ports O3 to O6)
Although the configuration for detecting the operation state of each of the circuit units 23 and 24 for only one specific system has been described, the configuration for detecting the operation state of each of the circuit units 23 and 24 for all four systems may be employed. Further, a portion for detecting an operation state may be selectively switched using a multiplexer (input signal selection switching circuit) or the like. By using a multiplexer (input signal selection switching circuit) or the like, a plurality of operating states can be selectively detected by one input port. Further, the operation state detection circuit can be commonly used.

The CPU section 21 supplies an operation confirmation signal 21a having an abnormal cycle to the CPU operation monitoring circuit (WDT) 80 while outputting an H level signal from the output port O3. Operation monitoring circuit (WD
T) An L-level operation abnormality detection signal 22a is output from 80, and the L-level operation abnormality detection signal 22a changes the output of the 2-input AND circuit A3 in the abnormal output stop circuit 23 to L level. Thus, it can be confirmed that the CPU operation monitoring circuit (WDT) 80 is operating normally.

The control device 70 shown in FIG. 5 uses a power supply relay 72 having two sets of normally open contacts 72b and 72c, and uses one of the contacts 72b to supply the battery power 40
And the connection / disconnection of the electric motor 10 is switched by the other contact 72c. When the exciting current is supplied to the exciting winding 72a, all the contacts are closed, and one contact 72
b to the H-bridge circuit 25 and the like via the battery power supply 40
Is supplied, and a current can be supplied to the electric motor 10 through the other contact 72c.

When the electric power steering device 1 is not operated and the steering operation is performed and the electric motor 10 is rotated by the steering operation, the electric motor 1
0 acts as a generator, and an induced electromotive voltage is generated in the winding of the motor 10. The other contact 72c is provided to prevent the induced electromotive voltage from being supplied to the H-bridge circuit 25 side. If the induced electromotive voltage can be supplied to the H-bridge circuit 25, the contact 72c for disconnecting the electric motor 10 may not be provided.

FIG. 6 shows a CPU having a self-check function.
FIG. 2 is a block diagram illustrating a specific example of an operation monitoring circuit.
The CPU operation monitoring circuit 80 shown in FIG.
For the PU operation monitoring circuit 60, the self-check circuit 8
1, an input signal switching circuit 82, and a flip-flop circuit 83 for generating a CPU reset signal.

The flip-flop circuit 83 for generating the CPU reset signal is reset by the power-on reset signal 30a supplied via the inverter circuit 57. As a result, an L-level CPU reset signal 80a is output from the output terminal Q of the flip-flop circuit 83 for generating a CPU reset signal.

When the power-on reset signal 30a is supplied through the inverter circuit 57, the self-check circuit 81 outputs, for example, an H-level input signal switching signal and switches the input signal switching circuit 82 to the test input side (dotted line in the figure). Side). Then, the self-check circuit 81 outputs, for example, 11 pulses of the clock signal 51a having a period of 0.01 millisecond as the test signal 64b, and causes the second counter circuit 53 to overflow. Next, the self-check circuit 81 outputs a signal that holds the L level for at least 2 milliseconds as the test signal 64b, and causes the first counter circuit 52 to overflow. The self-check circuit 81 determines whether each of the counter circuits 52 and 53 (CPU operation monitoring function) based on the fact that the outputs Q of the second and third flip-flop circuits 61 and 62 are both at the H level.
Is determined to be operating normally, and an internal reset pulse signal 64a is generated. The self-check circuit 8
Reference numeral 1 outputs, for example, an L-level input signal switching signal and switches the input signal switching circuit 82 to a state where the operation confirmation signal 21a can be input (solid line side in the drawing).

With the internal reset pulse signal 64a,
Flip-flop circuit 83 for generating CPU reset signal
Is set. As a result, the output terminal Q of the flip-flop circuit 83 for generating a CPU reset signal goes high. As a result, the CPU reset signal 80a returns to the H level, and the reset state of the CPU unit 21 is released. It should be noted that the input signal of the input signal switching circuit 82 may be switched based on the output Q of the flip-flop circuit 83 for generating a CPU reset signal.

[0074]

As described above, in the electronic control device according to the present invention, when the CPU operation monitoring circuit detects the operation abnormality of the CPU section, the operation abnormality detection signal is supplied to the abnormality output stop circuit, Since the control signal output from the unit is prevented from being supplied to the controlled unit,
An abnormal control signal can be prevented from being supplied to the controlled unit when the operation of the CPU unit becomes abnormal. Furthermore, CP
The U section supplies a test signal to the CPU operation monitoring circuit and monitors the state of the output side of the abnormal-state output stop circuit or the operation state of the controlled section to determine whether the CPU operation monitoring circuit is operating normally. Can be checked.

Further, the electronic control unit according to the present invention has a C
The PU operation monitoring circuit is provided with a self-check function. After the self-check confirms that the CPU operation monitoring function operates normally, the CPU unit is controlled to an operable state, or a control signal output from the CPU unit. Is permitted to be supplied to the controlled unit, so that the control operation of the CPU unit can be performed only when the CPU operation monitoring circuit is operating normally.

Further, the electronic control device according to the present invention is
When a test signal is supplied to the CPU operation monitoring circuit and it is confirmed that the CPU operation monitoring circuit operates normally,
Since the control signal output from the PU unit is allowed to be supplied to the controlled unit, the control operation of the CPU unit can be performed only when the CPU operation monitoring circuit is operating normally.

[Brief description of the drawings]

FIG. 1 is a schematic structural view showing an example of an electric power steering device.

FIG. 2 is a block diagram of a control device of the electric power steering device.

FIG. 3 is a block diagram showing a specific example of a CPU operation monitoring circuit.

FIG. 4 is a block diagram showing a specific example of a CPU operation monitoring circuit that performs an operation check based on a test signal supplied from the CPU unit in an initial state after power is turned on.

FIG. 5 is a block diagram showing another configuration example of the control device of the electric power steering device.

FIG. 6 is a block diagram showing a specific example of a CPU operation monitoring circuit having a self-check function.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Electric power steering device, 20, 70 ... Control device, 21 ... CPU part, 22, 60, 80 ... CPU operation monitoring circuit (WDT), 23 ... Abnormal output stop circuit, 35 ...
Ignition switch operation state detection circuit, 36: Relay operation state detection circuit for power supply, 37: Relay operation state detection circuit for motor cutoff, 64: Operation check circuit, 81
... Self-check circuit.

Claims (3)

[Claims] A CPU that outputs an operation confirmation signal at a predetermined cycle when in a normal operation state; and a CPU that generates an operation abnormality detection signal when the cycle of the operation confirmation signal is out of a predetermined allowable cycle range. An electronic control unit comprising: an operation monitoring circuit; an abnormal output stop circuit for preventing a control signal output from the CPU unit from being supplied to a controlled unit based on an operation abnormality detection signal; A monitoring operation test unit that supplies a test signal outside a permissible cycle range to a monitoring circuit; and an operation state detection circuit that detects an output state of the abnormal output stop circuit or an operation state of the controlled unit, The CPU unit monitors the CPU operation based on whether the state of the output of the abnormal output stop circuit or the operation state of the controlled unit changes with the supply of the test signal. An electronic control unit, characterized in that to check the operation as well as operation of the abnormality output stop circuit. 2. A CPU unit for outputting an operation confirmation signal at a predetermined period when in a normal operation state, and a CPU for generating an operation abnormality detection signal when the period of the operation confirmation signal is out of a preset allowable period range. An electronic control unit comprising an operation monitoring circuit, wherein the CPU operation monitoring circuit is provided with a self-check circuit for checking that the CPU operation monitoring function operates normally, and the CPU unit operation monitoring function operates normally by the self-check. After confirming that the CP
An electronic control device, wherein the electronic control device is configured to control the U portion to an operable state, or to allow a control signal output from the CPU portion to be supplied to the controlled portion. 3. A CPU unit for outputting an operation check signal at a predetermined cycle when in a normal operation state, and a CPU for generating an operation abnormality detection signal when the cycle of the operation check signal is out of a preset allowable cycle range. An electronic control unit comprising: an operation monitoring circuit; an abnormal output stop circuit for preventing a control signal output from the CPU unit from being supplied to a controlled unit based on an operation abnormality detection signal; A monitoring operation test means for supplying a test signal outside a permissible cycle range to the monitoring circuit, wherein the CPU operation monitoring circuit outputs an operation abnormality detection signal in an initial state, and the CPU operation monitoring function is normal based on the test signal. The output of the operation abnormality detection signal is stopped based on the detection of the operation state, and if the CPU unit detects that the operation state is abnormal thereafter, the operation abnormality is detected. An electronic control unit configured to output a normal detection signal.