JPH0552945U - Runaway monitoring device - Google Patents

Abstract

(57) [Summary] [Purpose] The main CPU and slave CPU monitor each other to enhance the runaway monitoring function. [Structure] The main CPU 12 designates a diagnostic mode for the changeover switch 17 incorporated in the sub CPU 13, and determines whether or not the counting operation of the counter 16 is successful and whether or not the carry-out signal indicating the counting limit is output. After diagnosis, if there is an abnormality, an abnormality detection signal is output, and after canceling the designation of the diagnostic mode, the counting operation is cleared before the carry-out signal of the counter 16 is output. On the other hand, the sub CPU 13 sends the carry-out signal of the counter 16 to the main C when the diagnosis mode is designated by the main CPU 12.
While being supplied to the PU 12, the carry-out signal of the counter 16 is output as an abnormality detection signal when the diagnostic mode is released. The stop circuit 14 forcibly stops the operations of the main CPU 12 and the sub CPU 13 by any of the abnormality detection signals.

Description

[Detailed description of the device]

[0001]

[Industrial application]

 The present invention relates to a runaway monitoring device in which a runaway monitoring function is enhanced by mutually monitoring a first CPU and a second CPU.

[0002]

[Prior Art]

 The runaway monitoring device 1 shown in FIG. 3 is a device for monitoring the runaway of the CPU 2 mounted in the airbag device that protects the occupant of the vehicle in the event of a collision accident. The CPU2 has a mission to comprehensively judge changes in vehicle speed and acceleration, and immediately deploy the airbag when a vehicle collision is judged, and execute a program for collision judgment. .. However, the operation of the CPU2 must always be closely monitored so that the CPU2 does not run away and output the airbag deployment signal when the vehicle is not in collision. The watchdog circuit 3 for monitoring is configured to repeat the diagnosis of the CPU 2 at a constant cycle.

The watchdog circuit 3 shown in this example has a counter 4 built therein. First, when the vehicle-mounted power source is turned on, the watchdog circuit 3 starts counting operation of the built-in counter 4 from zero. Then, when the count value of the counter 4 reaches a constant value, a carry-out signal indicating carry is output. The carry-out output terminal of the watchdog circuit 3 is connected to the forced interrupt input terminal (NMI bar) of the monitored CPU 2, so the CPU 2 receiving the carry-out signal interrupts the processing operation of the main routine. Then, the response operation is started. Here, the CPU 4 in the watchdog circuit 3 responds by clearing the counter 4, and the count value of the counter 4 can be cleared only by the clear pulse from the CPU 2. Therefore, when the CPU 2 is operating normally, the counter 4 is cleared by the clear pulse output by the CPU 2 before the counter 4 overflows. However, when an abnormality occurs in the operation of the CPU2, that is, when a runaway occurs, the CPU2 does not output a clear pulse, so the counter 4 overflows and the watchdog circuit 3 sends the CPU2 to the CPU2 at the same time as the overflow. An operation stop command is output.

[0004]

[Problems to be solved by the device]

 Since the above-mentioned conventional runaway monitoring device 1 has a configuration in which the watchdog circuit 3 monitors the CPU 2 with the counting cycle of the counter 4, when the counter 4 in the watchdog circuit 3 is operating normally, the CPU 2 The abnormal condition can be detected when the output of the clear pulse is interrupted. However, if some abnormality occurs on the side of the watchdog circuit 3 that is in the position of diagnosing and monitoring the CPU 2, and the counting operation of the counter 4 is stopped, the carry-out signal is not supplied to the CPU 2, so the CPU 2 The counter 4 does not overflow even if it does not output a clear pulse, so that the watchdog circuit 3 falls into a state in which the monitoring function for the CPU 2 is abandoned. Therefore, in such a situation, if the CPU 2 runs out of control, the runaway of the CPU 2 will be overlooked without noticing the abnormality of the watchdog circuit 3, and the airbag will not deploy at an emergency, which is expensive. There was a problem that such a system may not be useful for protecting human life. Further, not only in the airbag device, but also in other systems that require high reliability such as being related to human life, the CPU 2 and the watchdog circuit 3 that monitors the operation thereof have the same problem.

[0005]

[Means for Solving the Problems]

 This invention solves the above-mentioned problems, and a first CPU that generates a clear pulse at a predetermined timing with the execution of a predetermined program and a counting operation that is reset by the clear pulse and then starts counting. If the clear pulse is not input again until the numerical value reaches the predetermined upper limit value, it is determined that the first CPU is abnormal, a second CPU that generates a carry-out signal, and the above-mentioned case after the clear pulse is generated. When the abnormal detection signal output when the first CPU detects the abnormality of the second CPU or the carry-out signal is supplied, the first CPU and the second CPU are forced. And a stop circuit for stopping the electric field.

[0006]

[Action]

 According to this invention, the first CPU generates a clear pulse at a predetermined timing when a predetermined program is executed, while the second CPU starts the counting operation after being reset by the clear pulse and the count value is If the clear pulse is not input again by the time the predetermined upper limit is reached, a carry out signal is generated indicating that the first CPU is abnormal, and after the clear pulse is generated, the first CPU switches to the second CPU. When the abnormality detection signal output when an abnormality is detected or the carry-out signal is supplied to the stop circuit, the first CPU and the second CPU are forcibly stopped, thereby The CPU and the second CPU mutually monitor runaway.

[0007]

【Example】

 An embodiment of the present invention will be described below with reference to FIGS. FIG. 1 is a circuit configuration diagram showing an embodiment of the runaway monitoring apparatus of the present invention, and FIG. 2 is a flow chart for explaining the operation of the main CPU and the sub CPU shown in FIG.

The runaway monitoring device 11 shown in FIG. 1 is provided with a slave CPU 13 as a second CPU in place of a conventional watchdog circuit in order to monitor the operation of a main CPU 12 as a first CPU. In addition to the mutual monitoring of the pair of CPUs 12 and 13 in FIG. 1, a stop circuit 14 for inputting a stop signal to both CPUs 12 and 13 is provided. The main CPU 12 executes a main routine including a program for operating, for example, an in-vehicle airbag device, while the sub CPU 13 is in a position to complement the operation of the main CPU 12 and performs work outside the jurisdiction of the main CPU 12. A predetermined main routine is executed for.

The main CPU 12 shown in the embodiment monitors the count output supplied from the slave CPU 13, and outputs an abnormality detection signal if the count operation is abnormal. In addition, a diagnosis mode is designated for the slave CPU 13, the success or failure of the reset of the counting operation and the output of the carry-out signal indicating the counting limit are diagnosed in addition to the counting operation, and if there is an abnormality, an abnormality detection signal is output. At the same time, after canceling the designation of the diagnostic mode, a clear pulse is generated and the counting operation is reset before the carry-out signal is output from the slave CPU 13.

The sub CPU 13 has a built-in counting means 15 for supplying a count output and a carry-out signal to the main CPU 12. The counting means 15 comprises an 8-bit counter 16 and a changeover switch 17 for switching the output destination of the carry-out signal of the counter 16. The counter 16 has its count value reset to zero by a clear pulse sent from the main CPU 12, and sends an 8-bit count output to the main CPU 12 via the data bus. The changeover switch 17 is switched by a diagnostic mode pulse sent from the main CPU 12, switches to a contact point on the main CPU 12 side in the diagnostic mode, and sends a carry-out signal output from the counter 16 to the main CPU 12. On the contrary, when the diagnostic mode is released, the switching switch 17 switches to the contact on the stop circuit 14 side and supplies the carry-out signal to the stop circuit 14 as an abnormality detection signal.

The stop circuit 14 receives the abnormality detection signal output by the main CPU 12 and the abnormality detection signal output by the slave CPU 13, and when at least one of these abnormality detection signals is received, the stop circuit 14 of the main CPU 12 and the slave CPU 13 receives the abnormality detection signal. A stop signal is sent to each forced interrupt input terminal (NMI bar) to forcibly stop the operations of the main CPU 12 and the slave CPU 13.

Here, when the power is turned on in step (100) of FIG. 2, the main CPU 12 and the sub CPU 13 execute the diagnostic operation according to the flow shown in steps (101) and below and (201) and below, respectively. First, in order to diagnose the slave CPU 13 from the main CPU 12, the active output of the diagnostic mode pulse is sent out in step (101). On the other hand, on the slave CPU side, as shown in step (201), the counter 16 is set upon receiving the power supply, the counting operation by the counter 16 is started, and as shown in the following step (202), Wait for the diagnostic mode pulse to be supplied from the CPU 12.

In the judgment step (203), if the diagnostic mode pulse does not become active forever and the counter 16 overflows, the slave CPU 13 stops the abnormality detection signal together with the overflow in the judgment step (204). Send to circuit 14. As a result, in step (300), the stop circuit 14 outputs stop signals to the main CPU 12 and the slave CPU 13, respectively, and the system stops operating. On the other hand, when the diagnostic mode pulse from the main CPU 12 becomes active, in the step (205) following the judgment step (203), the switching switch 17 switches to the contact on the main CPU 12 side, which causes the counter 16 to operate. The carry-out signal is supplied to the main CPU 12 via the changeover switch 17.

The main CPU 12, which has actively output the diagnostic mode pulse and designated the diagnostic mode to the slave CPU 13, first diagnoses the reset function of the counter 16 in step (102). That is, when the clear pulse is supplied from the main CPU 12 to the counter 16, it is checked whether the count output of the counter 16 is switched to zero. Further, in the subsequent step (103), the counting function of the counter 16 is diagnosed. That is, it is checked whether or not the count value of the counter 16 which has been reset to zero increases step by step. Further, in the subsequent step (104), the carry function of the counter 16 is diagnosed. That is, it is checked whether the counter 16 outputs the carry-out signal at the counting limit. Then, as a result of these three types of diagnosis, if there is no problem in the reset function, the counting function and the carry function of the counter 16, in the step (106) following the judgment step (105), the diagnostic mode pulse is set to non-active. And the designation of the diagnostic mode for the slave CPU 13 is canceled. However, if an abnormality is detected in any one of the above three types of functions, an abnormality detection signal is supplied from the main CPU 12 to the stop circuit 14, and the system operates in step (300). Stop.

On the other hand, on the side of the slave CPU 13, after the switching switch 17 is switched to the contact on the side of the main CPU 12 in step (205), it waits for the diagnostic mode pulse to switch to non-active in step (206). .. Then, the diagnostic mode pulse is switched to non-active and the diagnostic mode is released, so that the carry-out signal of the counter 16 is returned to the state of being supplied to the stop circuit 14 in the step (208) following the judgment step (207). To do. Therefore, after the diagnosis of the slave CPU 13 by the main CPU 12 is completed, the main CPU 12 that monitors the counting output of the counter 16 outputs a clear pulse before the counter 16 exceeds the counting limit. The supply of the carry-out signal to the stop circuit 14 is blocked. However, when an abnormality occurs in the main CPU 12, the carry-out signal of the counter 16 is supplied to the stop circuit 14 via the changeover switch 17, and both the main CPU 12 and the sub CPU 13 stop operating.

As described above, according to the runaway monitoring apparatus 11, the main CPU 12 designates the diagnostic mode for the changeover switch 17 included in the sub CPU 13, and resets the counting operation in addition to the counting operation of the counter 16. The carry-out signal of the counter 16 is output after diagnosing the output of the carry-out signal indicating success or failure and the counting limit, outputting the error detection signal if there is an error, and canceling the designation of the diagnostic mode. Generate a clear pulse before resetting the counting operation. On the other hand, the slave CPU 13 having the built-in counter 16 supplies the carry-out signal of the counter 16 to the main CPU 12 when the diagnosis mode is designated by the main CPU 12, and the counter 16 of the counter 16 when the diagnosis mode is released. The carry-out signal is output as an abnormality detection signal. Then, the stop circuit 14 forcibly stops the operations of the main CPU 12 and the slave CPU 13 by any abnormality detection signal. Therefore, the main CPU 12 diagnoses the counting function, the reset function and the carry function of the counter 16 by monitoring the count output and the carry out signal supplied from the counter 16 incorporated in the CPU 13 when the diagnosis mode is designated. On the other hand, the slave CPU 13 also diagnoses the operation of the main CPU 12 by monitoring the diagnostic mode pulse that specifies the diagnostic mode output by the main CPU 12 and the clear pulse that resets the counting operation of the counter 16. be able to. Therefore, the operation monitoring of the main CPU 12 by the sub CPU 13 such as resetting from the main CPU 12 side before the counter 16 of the sub CPU 13 overflows, and the operation monitoring of the sub CPU 13 by designating the diagnostic mode from the main CPU 12 side are both performed. It is possible, and the main CPU 12 and the sub CPU 13 mutually diagnose the operation of the other party and monitor each other. Therefore, even if either the main CPU 12 or the sub CPU 13 runs out of control, the operation of both CPUs 12 and 13 must be stopped. This makes it possible to secure the safety of the entire system.

[0017]

[Effect of the device]

 As described above, according to the present invention, the first CPU generates a clear pulse at a predetermined timing when a predetermined program is executed, while the second CPU starts the counting operation after being reset by the clear pulse. However, if the clear pulse is not input again before the count value reaches the predetermined upper limit value, the carry-out signal is generated because the first CPU is abnormal, and the first CPU is cleared after the clear pulse is generated. A configuration for forcibly stopping the first CPU and the second CPU when an abnormality detection signal output when an abnormality of the second CPU is detected or the carry-out signal is supplied to the stop circuit. Therefore, the first CPU can diagnose the counting function of the second CPU after issuing the clear pulse, while the second CPU can also detect the counting function of the first CPU. By monitoring the clear pulse output by the CPU, the operation of the first CPU can be diagnosed. As a result, the operation monitoring of the first CPU by the second CPU and the operation from the first CPU side can be performed. Since the operation monitoring of the second CPU is possible, and the first CPU and the second CPU mutually diagnose the operation of the other party and monitor each other, either the first CPU or the second CPU Even in the event of a runaway, the operation of both CPUs can be stopped without fail, and the safety of the entire system can be ensured. In particular, extremely high reliability is required so that a runaway CPU can directly lead to a disaster. It has excellent effects such as being suitable for the system to be used.

Further, according to the present invention, the first CPU designates a diagnostic mode for the second CPU and monitors the counting output supplied from the second CPU, whereby the counting operation of the second CPU is performed. After resetting the counting operation and diagnosing the output of the carry-out signal indicating the counting limit, and after canceling the designation of the diagnostic mode, a clear pulse is generated before the second CPU outputs the carry-out signal. Then, the counting operation is reset, and when the second CPU corresponding thereto supplies a carry-out signal to the first CPU when the diagnostic mode is designated by the first CPU, and when the diagnostic mode is released. Is configured to output a carry-out signal as an abnormality detection signal to the stop circuit, so that the first CPU and the carry-out signal are supplied from the second CPU. The counting function, the reset function and the carry function of the second CPU can be diagnosed by monitoring the output signal, while the second CPU also specifies the diagnostic mode output by the first CPU. By monitoring the pulse and the pulse that resets the counting operation, the operation of the first CPU can be diagnosed, which allows the first CPU to clear it before the counting output of the second CPU overflows. It is possible to both monitor the operation of the first CPU by the second CPU, for example, call it, and monitor the operation of the second CPU by designating the diagnostic mode from the side of the first CPU. By mutually diagnosing each other's operations and monitoring each other, the CPUs can always stop the operations of both CPUs even if either the first CPU or the second CPU runs out of control. The effect of such safety can be ensured for the entire Temu.

[Brief description of drawings]

FIG. 1 is a circuit configuration diagram showing an embodiment of a runaway monitoring device of the present invention.

FIG. 2 is a flowchart for explaining operations of a main CPU and a sub CPU shown in FIG.

FIG. 3 is a circuit configuration diagram showing an example of a conventional runaway monitoring device.

[Explanation of symbols]

 11 Runaway Monitoring Device 12 First CPU (Main CPU) 13 Second CPU (Slave CPU) 14 Stop Circuit 15 Counting Unit

Claims (2)

[Scope of utility model registration request] 1. A first CPU that generates a clear pulse at a predetermined timing when a predetermined program is executed, and a counting operation is started after being reset by the clear pulse and the count value reaches a predetermined upper limit value. If the clear pulse is not input again, the second CPU that issues a carry-out signal as the first CPU is abnormal, and the first CPU after the clear pulse is generated
Stop circuit for forcibly stopping the first CPU and the second CPU when an abnormality detection signal output when the second CPU detects an abnormality or the carry-out signal is supplied. And a runaway monitoring device. 2. The first CPU is the second CPU
To the second C by monitoring the count output supplied from the second CPU
The second CPU outputs the carry-out signal after diagnosing the counting operation of the PU, the resetting of the counting operation, and the presence or absence of the output of the carry-out signal indicating the counting limit, and canceling the designation of the diagnostic mode. A clear pulse was previously generated to reset the counting operation, and the second CPU
When the diagnostic mode is designated by the first CPU, the carry-out signal is sent to the first CPU.
The runaway monitoring device according to claim 1, wherein the carry-out signal is output to the stop circuit as an abnormality detection signal when the diagnostic mode is released.