JP2017187860A - Controller control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a controller control device which allows a controller to continue working if a timer went wrong.SOLUTION: A first controller 2 outputs a timing signal St working with its own timer 4 to a second controller 3 via a direct line 9. A second controller 3 monitors the timer 4 for detecting a failure based on the timing signal St, and outputs a waveform signal Sr to the first controller 2 via a direct line 18 if a failure has been confirmed, the waveform signal Sr having a waveform of which main cycle can be generated by the first controller 2. With the configuration, it is possible to generate the main cycle based on the waveform signal Sr input from the second controller 3 if the timer 4 has been broken in the first controller 2 and to ensure a continuous operation of the first controller 2.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a controller control device that controls the operation of a controller.

  Conventionally, it is well known that a controller executes an operation at a regular processing cycle by measuring time with a timer and periodically generating an interrupt (see Patent Document 1 and the like).

JP 2009-230425 A

  By the way, if the timer fails, the controller becomes incapable of processing, so a method of restoring the timer by, for example, resetting the system can be used. However, when the timer is not restored by the system reset, there is a problem that the process cannot be resumed and the process cannot be continued.

  An object of the present invention is to provide a controller control device that can continue the processing of a controller even if a timer fails.

  A controller control device that solves the above problem is configured to ensure continuous operation of the first controller along the main cycle repeatedly generated based on the measurement time of the timer by the operation of the other second controller, A fault monitoring unit that is provided in the two controllers and inputs a timing signal according to the operation of the timer of the first controller through a wiring connected to the second controller, and monitors whether or not the timer has failed; Provided in the second controller, when the failure monitoring unit determines that the timer of the first controller has failed, the main period can be generated through a Zika line connecting the first controller and the second controller A signal output unit for outputting a simple waveform signal to the first controller, and a signal output unit provided in the first controller. By operating the first controller in the main cycle on the basis of the waveform signal, and a hydraulic control unit to ensure the continuous operation of the first controller.

  According to this configuration, when the timer fails, the timing signal in the wiring takes a waveform according to the timer failure, and the failure monitoring unit determines that there is a failure based on this waveform change. At this time, the second controller outputs a waveform signal that can generate the main period in the first controller from the signal output unit to the first controller through the Zika line. As a result, when the timer fails, the operation controller of the first controller can generate the main period based on the waveform signal input from the second controller. Therefore, even when the timer of the first controller fails, it is possible to ensure continuous operation of the first controller.

  In the controller control device, the wiring is preferably a Zika wire that directly connects both controllers. According to this configuration, it is possible to connect the first controller and the second controller with a simple configuration that connects the Zika lines.

  The controller control device preferably includes a signal notification unit provided in the first controller and outputting the timing signal to the second controller through the Zika line. According to this configuration, the timing signal can be directly linked to the timer, which is advantageous for accurately determining whether or not the timer has failed.

  In the controller control device, the timing signal is preferably a pulse signal that switches Hi-Lo every time the timer is counted up. According to this configuration, since the timing signal may be a simple pulse signal, it is possible to determine whether the timer has failed or not with a simple configuration of monitoring the waveform of the pulse signal.

  In the controller control device, the operation control unit generates a main cycle based on a main cycle generation timer interrupt flag used when generating a main cycle based on the output of the timer and an external input signal. It is preferable to generate the main period using either the external edge interrupt flag used in the above. According to this configuration, when changing the software of the first controller, only the change of adding the external edge interrupt flag is sufficient.

  In the controller control device, it is preferable that the first controller and the second controller have the same power supply system. According to this configuration, there is no situation where the power of the second controller is turned off even though the first controller is powered on. Therefore, it is advantageous to ensure the reliability of the device operation.

  According to the present invention, the processing of the controller can be continued even if the timer fails.

The block diagram of the controller control apparatus of one Embodiment. Timing chart of timer measurement period and main period. The schematic diagram which shows the memory structure of a 1st controller. Operation diagram when the timer is normal. Operation diagram at the time of timer failure.

Hereinafter, an embodiment of a controller control device will be described with reference to FIGS.
As shown in FIG. 1, the vehicle 1 includes a first controller 2 that is required to operate continuously, and a second controller 3 that is different from the first controller 2. The first controller 2 is preferably a controller that controls lighting of, for example, a vehicle-mounted light. The second controller 3 is preferably a controller having, for example, two or more empty ports and having the same power supply system as that of the first controller 2. Thus, the first controller 2 and the second controller 3 are controllers having different functions.

  As shown in FIG. 2, the first controller 2 measures the passage of time (elapsed time) with a timer 4 provided in the first controller 2, and follows a main cycle that is repeatedly generated based on the measurement time of the timer 4. Operate continuously. That is, the first controller 2 generates a periodic interrupt based on the time measurement by the timer 4 and executes the process at the periodic timing. In the case of this example, the first controller 2 measures 1 ms with the timer 4, performs processing at the timing of 3 ms, and periodically repeats this operation.

  Returning to FIG. 1, the vehicle 1 includes a controller control device 7 that ensures the continuous operation of the first controller 2 by the operation of the second controller 3. The controller control device 7 of this example uses the second controller 3 to continue the continuous operation of the first controller 2 even if the timer 4 of the first controller 2 fails.

  In the case of this example, the first controller 2 and the second controller 3 are connected through the wiring 8 so that a signal can be output from the first controller 2 to the second controller 3. The wiring 8 is preferably a Zika wire 9 that directly connects both controllers (the first controller 2 and the second controller 3). The Zika wire 9 has one end connected to the output port 10 of the first controller 2 and the other end connected to the input port 11 of the second controller 3.

  The controller control device 7 includes a signal notification unit 14 that outputs a timing signal St in conjunction with the count operation of the timer 4. The signal notification unit 14 of this example is provided in the first controller 2. The signal notification unit 14 outputs the timing signal St from the first controller 2 to the second controller 3 via the wiring 8 (Zika line 9). The timing signal St is a pulse signal that switches Hi-Lo every time the timer 4 is counted up.

  The controller control device 7 includes a failure monitoring unit 15 that monitors whether or not the timer 4 of the first controller 2 has failed. The failure monitoring unit 15 of this example is provided in the second controller 3. The failure monitoring unit 15 acquires the timing signal St output from the first controller 2 through the wiring 8 (Zika line 9), and determines whether or not the timer 4 has failed based on the timing signal St.

  The first controller 2 and the second controller 3 are connected through a Zika line 18 so that a signal can be output from the second controller 3 to the first controller 2. The Zika wire 18 has one end connected to the output port 19 of the second controller 3 and the other end connected to the input port 20 of the first controller 2. The input port 11 and the output port 19 in the second controller 3 are preferably empty ports.

  When the failure monitoring unit 15 determines that the timer 4 has failed, the controller control device 7 outputs a waveform signal Sr capable of generating a main cycle to the first controller 2 through the Zika line 18. Is provided. The signal output unit 23 is provided in the second controller 3. The waveform signal Sr in this example is preferably a rectangular wave (pulse signal) having a period of 1 ms, for example.

  The controller control device 7 includes an operation control unit 24 that ensures continuous operation of the first controller 2 based on the waveform signal Sr output from the second controller 3. The operation control unit 24 is provided in the first controller 2. The operation control unit 24 ensures the continuous operation of the first controller 2 by operating the first controller 2 in the main cycle based on the waveform signal Sr input from the second controller 3 when the timer 4 fails.

  As shown in FIG. 3, the software stored in the memory 27 of the first controller 2 includes a main cycle generation timer interrupt flag 28 used when generating a main cycle based on the output of the timer 4, and an external There is an external edge interrupt flag 29 used when generating a main period based on an input signal (in this example, a waveform signal Sr). The main cycle generation timer interrupt flag 28 is a flag that increments the counter along with the timing of the timer 4. The external edge interrupt flag 29 is a flag for incrementing the counter by using an edge (pulse edge) of an input signal from the outside as a trigger. The main cycle generation timer interrupt flag 28 is a flag that has been previously provided, and an external edge interrupt flag 29 is newly added in this example.

  The first controller 2 uses either the main cycle generation timer interrupt flag 28 or the external edge interrupt flag 29 to generate a main cycle by interrupt processing. That is, when the timer 4 is normal, the operation control unit 24 generates a main cycle by an interrupt process using the main cycle generation timer interrupt flag 28 as a trigger. When the timer 4 fails, the operation control unit 24 uses an external edge interrupt flag 29 as a trigger. The main period can be generated by processing.

Next, the operation and effect of the controller control device 7 will be described with reference to FIGS. 4 and 5.
As shown in FIG. 4, the first controller 2 measures the elapsed time of repeated constant time (for example, 3 ms) by the timer 4 and follows a main period (in this example, 3 ms period) generated at each timing of the constant time. Execute the necessary processing. At this time, the signal notification unit 14 sends a timing signal St having a Hi or Lo waveform linked to the timer 4 that measures time when generating the main cycle from the output port 10 through the Zika line 9 to the second controller 3. Output to the input port 11. When the timing signal St is generated by the timer 4 having a main period of 1 ms, the timing signal St is a signal in which Hi-Lo is repeated every 1 ms.

  The failure monitoring unit 15 determines whether or not the timer 4 has failed based on the timing signal St input through the Zika line 9. The failure monitoring unit 15 determines that the timer 4 is normal when it is confirmed that the timing signal St repeats Hi / Lo according to a specified timing. On the other hand, when the failure monitoring unit 15 confirms that the timing signal St does not take the prescribed Hi / Lo switching change, for example, the Lo is fixed or the Hi is fixed, the timer 4 is in failure. judge.

  When the failure monitoring unit 15 determines that the timer 4 has not failed, the second controller 3 does not output the waveform signal Sr from the output port 19. At this time, the first controller 2 operates based on the main cycle generation timer interrupt flag 28 to generate the main cycle.

  On the other hand, as shown in FIG. 5, when the failure monitoring unit 15 determines that the timer 4 has failed, the signal output unit 23 transmits the waveform signal Sr, which is an alternative to the output of the timer 4, through the Zika line 18. Output to the first controller 2. In this example, since the count cycle of the timer 4 is 1 ms, a rectangular wave having a 1 ms cycle is output to the first controller 2 as the waveform signal Sr. That is, the waveform signal Sr is a rectangular wave (pulse signal) in which Hi-Lo switches at 1 ms intervals.

  The operation control unit 24 is operated by the external edge interrupt flag 29 based on the input waveform signal Sr to generate a main period. That is, the counter is incremented each time an interrupt is generated by pulse edge detection, and the main process is executed when the number of times corresponding to its own main period is counted up. Thereby, even if the timer 4 breaks down, the continuous operation of the first controller 2 can be ensured.

  Now, according to this example, when the timer 4 of the first controller 2 fails, the timing signal St is fixed to Lo on the Zika line 9 and takes a waveform in accordance with the timer failure. The monitoring unit 15 determines that there is a failure. At this time, the second controller 3 outputs the waveform signal Sr that can generate the main cycle in the first controller 2 from the signal output unit 23 to the first controller 2 through the Zika line 18. As a result, when the timer fails, the operation controller 24 of the first controller can generate the main period based on the waveform signal Sr input from the second controller 3. Therefore, even if the timer 4 of the first controller 2 fails, the continuous operation of the first controller 2 can be ensured.

  The wiring 8 that connects the output port 10 of the first controller 2 and the input port 11 of the second controller 3 is a Zika wire 9. Therefore, it is possible to connect the first controller 2 and the second controller 3 with a simple configuration that connects the Zika wires 9.

  In the controller control device 7 of this example, a signal notification unit 14 that outputs a timing signal St is provided in the first controller 2. Therefore, the timing signal St can be directly linked to the timer 4 of the first controller 2, which is advantageous for accurately determining whether or not the timer 4 has failed.

  The timing signal St is composed of a pulse signal (rectangular wave) that switches Hi-Lo every time the timer 4 is counted. Therefore, since the timing signal St is merely a pulse signal, it is possible to determine whether or not the timer 4 has failed with a simple configuration of monitoring the waveform of the pulse signal.

  The operation control unit 24 uses either the main cycle generation timer interrupt flag 28 or the external edge interrupt flag 29 written in the memory 27 and generates a main cycle by interrupt processing. Therefore, in the present example, when the software of the first controller 2 is changed, only the change of adding the external edge interrupt flag 29 is sufficient. Even if the timer 4 fails during the counting of the timer 4, the timer measurement can be continued only by interrupting the processing by the external edge interrupt flag 29.

  The first controller 2 and the second controller 3 are the same power supply system. As a result, there is no situation where the power supply of the second controller 3 is turned off even though the first controller 2 is turned on. Therefore, it is advantageous to ensure the reliability of the device operation.

Note that the embodiment is not limited to the configuration described so far, and may be modified as follows.
The second controller 3 preferably outputs the waveform signal Sr to the first controller 2 before the watchdog timer is reset after the timer failure of the first controller 2.

For example, when the first controller 2 detects a timer failure by itself, it is preferable that the first controller 2 promptly transits to a safe operation state (for example, execution of a failure detection interrupt).
In changing the software of the first controller 2, the added software is not limited to the external edge interrupt flag 29, but may be any software that can generate a main period using an external signal as a trigger in the first controller 2.

  The wiring 8 is not limited to the Zika wire 9. For example, any wiring that can input a signal in accordance with the operation of the timer 4 such as LAN or CAN on the system may be used. In this case, the signal notification unit 14 may be omitted on the system.

The timing signal St is not limited to a signal that switches Hi-Lo in conjunction with the count-up of the timer 4, but may be any signal that is linked to the operation (count-up) of the timer 4.
The waveform signal Sr is not limited to a signal having a 1 ms period, and may be any signal that can generate a main period in the first controller 2.

The first controller 2 and the second controller 3 are not limited to the same power supply system, and the power supply systems may be separated.
-The controller control apparatus 7 of this example is not limited to being mounted on the vehicle 1, but can be applied to other systems and devices.

  DESCRIPTION OF SYMBOLS 2 ... 1st controller, 3 ... 2nd controller, 4 ... Timer, 7 ... Controller control apparatus, 8 ... Wiring, 9 ... Zika wire which is an example of wiring, 14 ... Signal notification part, 15 ... Failure monitoring part, 18 ... Zika line, 23... Signal output unit, 24... Operation control unit, 28... Main cycle generation timer interrupt flag, 29... External edge interrupt flag, St.

Claims (6)

A controller control device that ensures continuous operation of a first controller along a main cycle repeatedly generated based on a measurement time of a timer by operation of another second controller,
A failure monitoring unit that is provided in the second controller and inputs a timing signal according to the operation of the timer of the first controller through a wiring connected to the second controller, and monitors whether or not the timer has failed; ,
When the failure monitoring unit determines that the timer of the first controller has failed, the main cycle is generated through a Zika line connecting the first controller and the second controller. A signal output unit for outputting possible waveform signals to the first controller;
A controller provided in the first controller, and having an operation control unit that ensures continuous operation of the first controller by operating the first controller in a main cycle based on the waveform signal. Control device. The controller control device according to claim 1, wherein the wiring is a Zika wire that directly connects both controllers. 3. The controller control device according to claim 2, further comprising: a signal notification unit that is provided in the first controller and outputs the timing signal to the second controller through the Zika line. The controller control device according to claim 1, wherein the timing signal is a pulse signal that switches Hi-Lo every time the timer is counted up. The operation control unit includes a main cycle generation timer interrupt flag used when generating a main cycle based on the output of the timer and an external edge interrupt used when generating a main cycle based on an external input signal. The controller control device according to any one of claims 1 to 4, wherein the main cycle is generated by interrupt processing using either one of the flags. The controller control device according to claim 1, wherein the first controller and the second controller are in the same power supply system.

Images