JP2545783B2 - Abnormality monitoring device for control computer - Google Patents

Description

The present invention relates to a device for monitoring an abnormality in a computer for controlling various devices.

[Prior Art] Computers are used for controlling various mechanical devices and are effective in saving labor and energy.

However, because the computer has advanced processing,
On the other hand, if the computer has an abnormality in reading the command signal due to noise or the like, the controlled side may drive the wrong drive. Such a state cannot usually be automatically repaired by the computer itself. Therefore, once an abnormality occurs, the arithmetic unit in the computer continues to run out of control.

As a technique to prevent this problem, a step of outputting a monitor signal at a fixed time interval is provided in advance in a program on the computer side, and a device for inputting and monitoring the monitor signal is also provided. There was something to observe the time until. In other words, if a next signal is not input after a predetermined time has passed from the signal input, it is determined that the computer is malfunctioning and is out of control.
As a measure against runaway, a reset signal was output to the computer.

[Problems to be Solved by the Invention] However, such a runaway monitoring device only monitors one side of the abnormality of the computer, and only resets the measures, which may damage the computer program itself or , It was impossible to deal with the hardware abnormality caused by the destruction of the computer circuit.

 Hereinafter, the reason for this will be described in detail.

First, a computer of this type usually executes a preset program to control the controlled device. However, by inverting the output level of a specific output terminal at a predetermined step of the program, the monitor is controlled. A pulse signal as a signal is output. Therefore, when the computer is executing the program accurately, a pulse signal having a waveform shape corresponding to the execution timing of the step of inverting the output level is repeatedly output from its output terminal, and on the contrary, the computer causes noise. If the runaway occurs due to, for example, the step of inverting the output level is not executed and the pulse signal is not output.

Therefore, in the above-mentioned conventional runaway monitoring device, when the time during which the pulse signal is not output reaches the predetermined time or longer, the computer is reset to restore the runaway state to the normal state.

However, for example, when an oscillator that generates a basic clock for operating a computer has an abnormality and its oscillation frequency deviates from a specified value, even if the computer accurately executes the program, all An abnormality occurs that the control timing of is shifted. In this case, the frequency of the pulse signal output from the computer changes in accordance with the oscillation frequency of the oscillator, but the pulse signal itself is still output. It cannot be detected.

If the oscillator (such as ROM) that stores the program is not affected by electromagnetic waves and some of the program is not executed, it is natural that the controlled An abnormality will occur in the control of the device. Even in this case, the ON time (High level time) or OFF time (Low level time) of the pulse signal output from the computer is shortened according to the program that is no longer executed, but the pulse signal itself is output. Therefore, the above-mentioned conventional runaway monitoring device cannot detect an abnormality.

That is, in the above-mentioned conventional runaway monitoring device, the abnormality is detected when the time when the pulse signal is not output exceeds the predetermined time, so the abnormality is detected unless the pulse signal from the computer is stopped. Therefore, as described above, the abnormality of the hardware such as the oscillator and the ROM that constitutes the computer cannot be detected and appropriate measures cannot be taken.

[Means for Solving Problems] As a means for solving the above problems, the present invention employs the following configurations.

That is, the gist of the first invention is, as illustrated in FIG. 1, a controlled device M11 according to a preset program.
An abnormality monitoring device for controlling the computer M12 that outputs a pulse signal having a predetermined waveform repeatedly during normal operation, which is output when the pulse signal is output from the control computer M12. The determination means M13 for determining whether the waveform shape of the pulse signal matches the predetermined waveform shape, and when the determination means M13 determines that the waveform shape does not match the predetermined waveform shape, Control computer
An abnormality monitoring device for a control computer, comprising: a control prohibiting means M14 for prohibiting control of the controlled device M11 by M12.

Further, the gist of the second invention is, as illustrated in FIG. 2, a controlled device M21 according to a preset program.
An abnormality monitoring device of the control computer M22 that controls the output of the pulse signal having a predetermined waveform shape during normal operation, and outputs the pulse signal when the pulse signal is output from the control computer M22. And a first determining means M23 for determining whether or not the waveform shape of the pulse signal matches the predetermined waveform shape, and the first determining means M23 determines that the pulse shape does not match the predetermined waveform shape. When
An abnormality processing unit M25 having a control prohibiting means M24 for prohibiting the control of the controlled device M21 by the control computer M22, and a time when a pulse signal is not output from the control computer M22, and the measured time thereof. Second judging means M26 for judging whether or not the time has exceeded a predetermined time
And an abnormality recovery section M28 having a reset means M27 for resetting the control computer M22 when the second determination means M26 determines that the timed time is longer than or equal to a predetermined time. An abnormality monitoring device for a control computer is characterized in that

[Operation] In the first invention configured as described above, a control computer (hereinafter, also simply referred to as a computer) M12
The controlled device M1 according to a preset program.
In addition to controlling 1, the pulse signal having a predetermined waveform is repeatedly output during normal operation.

Then, the determining means M13 determines whether or not the waveform shape of the pulse signal output from the computer M12 matches the predetermined waveform shape during normal operation, and this determining means M1
When it is determined by 3 that the waveform shape of the pulse signal does not match the predetermined waveform shape, the control prohibiting means M14 prohibits the computer M12 from controlling the controlled device M11.

That is, in the abnormality monitoring device for a control computer according to the first aspect of the present invention, unlike the above-described conventional device, the waveform shape itself of the pulse signal itself does not simply monitor the time when the pulse signal is not output. It is determined whether or not the waveform shape matches, and if it is determined that the waveform shape does not match, it is determined that an abnormality has occurred, and the control of the controlled device M11 is prohibited.

Therefore, according to the abnormality monitoring device for the control computer of the first invention, as described above, the abnormality such as the oscillator or ROM of the computer M12 causes the waveform shape of the pulse signal (frequency or ON / OFF ratio). Is affected,
This can be immediately detected to prevent abnormal operation of the controlled device M11.

Here, the determining unit M13 can be configured to determine the waveform shape of the pulse signal by determining whether the frequency and the duty ratio of the pulse signal are within a predetermined range.

Further, the determining means M13 may determine that the waveform shapes of the pulse signals do not match the waveform shapes of the pulse signals when the waveform shapes of the pulse signals do not match the predetermined waveform shapes for a predetermined time. In this case, it is possible to prevent the influence of noise or the like on the determination.

On the other hand, the determination means M13 is configured to output a determination signal indicating its own determination state to the computer M12, and the control prohibition means M14 indicates whether or not the control of the controlled device M11 is prohibited. The status signal may be output to the computer M12. And in this case, before the computer M12 starts controlling the controlled device M11,
By intentionally outputting a pulse signal different from the waveform shape at the time of normal operation, the determination means M13 or the control prohibition means M
It becomes possible to confirm on the computer M12 side whether or not 14 operates normally.

As a method for the control prohibiting means M14 to prohibit the control of the controlled device M11 by the computer M12, the computer M
12 to disconnect the control signal line between the controlled device M11,
It is conceivable to cut off the power supply to the controlled device M11. In the latter case, the control of the controlled device M11 can be prohibited more easily and reliably.

Next, in the abnormality monitoring device for a control computer according to the second aspect of the invention, the first determining means M23 and the control inhibiting means M24 of the abnormality processing unit M25 are the determining means M13 and the control inhibiting means M14 in the first aspect of the invention, respectively. Has the same effect. That is, when the first determining means M23 determines that the pulse signal output from the computer M22 does not match the predetermined waveform shape, the control prohibiting means M24 causes the computer M22 to control the controlled device M21. Prohibit

On the other hand, in the abnormality recovery section M28, the second judging means M26 measures the time during which the pulse signal is not output from the computer M22, and judges whether or not the measured time is equal to or longer than the predetermined time. When the determination means M26 determines that the timed time is equal to or longer than the predetermined time, the reset means M27
Resets the computer M22.

That is, in the abnormality detecting device for a control computer according to the first aspect of the present invention, by determining whether the waveform shape of the pulse signal output from the computer M12 matches the waveform shape during normal operation, the hardware The computer M1 is designed to detect abnormalities caused by it.
In the event of an abnormality caused by software that can be normally restored by resetting, such as when 2 runs away and no pulse signal is output at all, the control prohibiting means M14 prohibits the control of the controlled device M11. It will be. Therefore, in the abnormality monitoring device for a control computer according to the second aspect of the present invention, when the pulse signal is not output, there is no abnormality in the hardware, and the computer
Since there is a high possibility that the M22 is simply going out of control, the abnormal recovery unit M28 resets the computer M22 and attempts to recover the computer M22 to normal.

Therefore, according to the abnormality detecting device for a control computer of the second invention, in the case of an abnormality caused by software, the abnormality recovering unit M28 restores the computer M22 to the normal state, and as described above, the normal state caused by the hardware is restored. When an impossible abnormality is detected, the abnormality processing unit M25 detects it and prohibits the control of the controlled device M21. Thus, appropriate measures can be taken for each abnormality mode.

Next, examples of the present invention will be described. The first and second inventions are not limited to this, and include various aspects without departing from the gist.

[Embodiment] FIG. 3 is a principal block diagram showing an embodiment of the first and second inventions.

Here, 1 represents a one-chip microcomputer, which includes a central processing unit (hereinafter referred to as CPU) 1a, a random access memory (hereinafter referred to as RAM) 1b, a read-only memory (hereinafter referred to as ROM) 1c, and an input / output circuit (hereinafter referred to as I / O). 1d is included. The CPU 1a uses the data set in the ROM 1c or the RAM 1b according to a program stored in the ROM 1c in advance, performs various calculations, and outputs control signals to various systems 2.

The system 2 is, for example, a system such as an automobile slip control device. The system power supply 3 is supplied with power from the power supply 4 via the relay 5, converts it into a voltage required for the system 2, and supplies the voltage to the system 2. System 2
The control by the microcomputer 1 is based on energy from the system power supply 3.

The CPU1 performs a process of turning on or off the monitor signal set in the program in the ROM1c at almost constant time intervals and outputs it to the CPU abnormality processing circuit 6 and the CPU recovery circuit 7 via the I / O 1d. . The CPU abnormality processing circuit 6 determines whether the frequency and duty ratio components in the monitor signal are within a predetermined range, and the CPU restoration circuit 7 determines whether the pulse interval component of the pulse signal in the monitor signal is within a predetermined range. are doing.

Another signal S1 output at the initial stage is output from the microcomputer 1, and a signal as a determination signal from the CPU abnormality processing circuit 6 indicating an abnormality of the microcomputer 1
It is input to the AND circuit 8 together with S2. The signal S2 is also input to the microcomputer 1. The AND circuit 8 outputs a signal S3 that is turned on when both signals S1 and S2 are turned on at the same time. The signal S3 is input to the buffer 9 to excite the electromagnetic coil 5a of the relay 5 and turn on its a contact. A signal S4 as a status signal for detecting the on / off state of the relay 5 is input to the computer 1 between the relay 5 and the system power supply 3.

An example of the main part of the CPU abnormality processing circuit 6 is shown in FIG. A monitor signal (for example, duty ratio: 50%, ON time: 8 msec) input from the microcomputer 1 side via the terminal PA is supplied with an ON time measuring circuit 21 and an OFF time measuring circuit 2.
2 and on / off time difference measuring circuit 23. The on-time measurement circuit 21 measures the duration of the monitor signal in the on state, the off-time measurement circuit 22 measures the duration of the monitor signal in the off state, and the on / off time difference measurement circuit 23 measures the monitor signal The absolute value of the difference between the on-state time and the subsequent off-state time is measured. The on-time measuring circuit 21, the off-time measuring circuit 22 and the on / off-time difference measuring circuit 23 can each be configured by a pulse width discriminating circuit in a digital circuit, for example.

The on-time measured by the on-time measuring circuit 21 is input to the first determination circuit 24 as a digital signal, and it is checked whether it is within a predetermined range. For example, it is checked whether it is within 4 msec to 12 msec. If yes, the first determination circuit 24 outputs a signal "1", and if no, a signal "0". The off-time measured by the off-time measuring circuit 22 is input to the second judging circuit 25 as a digital signal to check whether it is within a predetermined range. For example, 4m
It is checked whether it is within sec ~ 12msec.
If yes, the second determination circuit 25 outputs a signal "1", and if not, a signal "0". The absolute value of the difference between the on-state duration and the subsequent off-state duration measured by the on / off time difference measuring circuit 23 is input to the third determination circuit 26 as a digital signal to determine whether it is within a predetermined range. Is checked. For example, it is checked whether it is 4 msec or less. This will check the duty ratio. If it is within the range, the third judgment circuit 26 outputs a signal "1", and if it is out of the range, it outputs a signal "0".

Next, the signals from the first determination circuit 24, the second determination circuit 25, and the third determination circuit 26 are input to the AND circuit 27. As a result, the output signal Sa from the AND circuit 27 is all the determination circuits 24, 25,
If all the signals from 26 are "1", it will be "1", and if any of the judgment circuits 24, 25, 26 is "0", it will be "0".
Becomes

The output signal Sa of the AND circuit 27 is D of the flip-flop 28.
The signal is input to the terminal, is output as the signal Sb from the Q terminal, and is output as the signal S2 from the terminal PC.

Further, the signal Sa from the AND circuit 27 is applied to the clock selection circuit 29.
To enter. Here, it is determined whether the signal Sa has switched from "1" to "0" or from "0" to "1", and the unit time counted by the timer 30 is set. For example, when the signal Sa is "1" → "0", 1 count / 1msec,
If "0" → "1", set 1 count / 2msec. The timer 30 outputs a pulse Sc to the CI terminal of the flip-flop 28 when the count reaches a predetermined count, for example 128. However, normally, the signal Sb and the signal Sa from the Q terminal of the flip-flop 28 are
The output signal of the exclusive NOR circuit 31 if and match
By Se, "1" is output to the reset terminal R of the timer 30,
Always reset. When the signal Sb and the signal Sa do not match, that is, immediately after the signal Sa switches from “1” → “0” or “0” → “1”, the signal Se becomes “0” and the timer 30 continues counting. Let Therefore, the timer 30 counts a predetermined time after switching the signal Sa, and after the predetermined time elapses, a pulse is generated.
The Sc is output to the CI terminal of the flip-flop 28. As a result, the signal Sb is switched for the first time after the signal Sa is switched, and the signal S2 output to the outside is also switched.

When the count number in timer 30 is "128", pulse S
If c is output, when the signal Sa is switched from "1" to "0" by the clock selection circuit 29, that is, when it is determined that the monitor signal has changed to the abnormal side, 128 msec.
Signal Sa is "0" for the first time after Sa = "0" continues.
When the signal Sa switches from "0" to "1", that is, when it is determined that the monitor signal has changed to the normal side, 256m
The signal Sb becomes "1" for the first time after Sa = "1" continues for sec.
Becomes Thus, the reason why the signal Sa is continuously checked for a predetermined time is to prevent misjudgment due to noise or the like, and it is abnormal that the predetermined time is changed in the switching direction of Sa. This is to deal with it early.

The above is a discrete circuit CPU error processing circuit 6
However, the same function can be realized by a program in various microcomputers. That is, as shown in FIG. 5, it is composed of CPU6a, RAM6b, ROM6c, I / O6d, and by executing the program in ROM6c, the contents of the monitor signal are judged and the signal S2 indicating the presence or absence of abnormality is output. You can also

The CPU recovery circuit 7 can use, for example, a watchdog timer using a retriggerable monostable multivibrator, and a reset signal if the interval of rising or falling of the monitor signal exceeds a predetermined time (for example, 200 to 300 msec). Is output. Of course, it can be configured by various microcomputers.

The CPU abnormality processing circuit 6 and the CPU restoration circuit 7 can be combined into one microcomputer, and the programs can be unified or can be made into a subroutine.

As described above, in the CPU recovery circuit 7, for example 500 msec
If there is no rise or fall of the monitor signal above,
As shown in FIG. 3, the reset signal R is output to the microcomputer 1 side, and the microcomputer 1 returns to the initial state. In this way, the microcomputer 1 is restored from a runaway caused by noise or the like. Further, the CPU abnormality processing circuit 6 checks the frequency (wavelength) and duty ratio of the monitor signal from the microcomputer 1. For example, if the wavelength, that is, the on or off state is out of the range of 4 to 12 msec, or if the time difference between the on time and the off time is 4 msec or more, the signal S2 changes from "1" to " If the wavelength and the time difference are both within the above range and 256 msec is continued, the signal S2 is changed from "0" to "1".

The abnormality detected by the CPU abnormality processing circuit 6 is mainly a hardware abnormality. In particular, this abnormality cannot be relieved by the CPU restoration circuit 7, so it is effective in such a case.

When the signal S2 from the CPU abnormality processing circuit 6 becomes "0", the signal S1 for initial processing from the microcomputer 1 is usually "1", but the signal output from the AND circuit 8
S3 becomes "0", the current flowing from the buffer 9 to the coil 5a of the relay 5 is cut off, the a contact 5b is turned off, the power supply from the power supply 4 to the system power supply 3 is cut off, and the system 2 is not operated. Stop. For example, if the system 2 is an anti-skid brake pressure adjustment operating circuit and the microcomputer 1 is its control device, when the CPU abnormality processing circuit 6 detects an abnormality in the anti-skid control device, the brake pressure adjustment operating circuit is activated. Stopping and adjusting the brake pressure will follow the driver's depression.

Next, the monitor signal output processing on the microcomputer 1 side will be described. 6 to 10 are flowcharts showing the contents.

Fig. 6 shows the main routine. Step 1 is performed every 4 msec.
Executed 00 and set flag Fmc to "1".

FIG. 7 shows an interrupt routine executed every 3 msec. At step 150, the flag Fcp is set to "1".

FIG. 8 shows an interrupt routine executed every 1.66 msec, and the counter Ccp is incremented in step 200.

FIG. 9 shows a monitor signal output routine, which is an interrupt routine executed every 4 msec.

When this routine is started, first, at step 310, it is judged if "NO" was previously judged at this step 310. If "NO" the last time, the process proceeds to step 320, and if "YES" the last time, the process proceeds to step 410. That is, 8m
It will be judged as "YES" every sec.

In step 320, the flag Fmc is checked. That is, normally, in the main routine 4 msec process, Fmc should be set to "1" every 4 msec. Therefore, it is determined to be "YES" in step 320, and "0" is set to Fmc in step 330. Is set. Next, at step 340, the flag Fcp is checked. Again, normally, with 3msec interrupt processing, 3
Since "1" should be set in Fcp every msec,
In step 340, it is determined to be "YES", and in step 350 the flag Fcp is set to "0". Next, in step 360, the counter Ccp is checked. Again, usually 1.66m
Since Ccp should have been incremented every 1.66 msec in the interrupt processing of sec, Ccp should be 3 or more and 8 or less during 8 msec. Therefore, in step 360, it is determined to be "YES", and the process proceeds to step 370.
In step 370, if the monitor signal currently output is on, it is turned off, and if it is off, it is turned on. That is, the main routine 4msec processing is correctly processed and Fmc is set to "1", the 3msec interrupt routine is correctly processed and Fcp is set to "1", and the 1.66msec interrupt routine is processed correctly and the value of Ccp is set. When is set between 3 and 8, the monitor signal is inverted for the first time.

The processing of the main routine is abnormal and F
If "1" is not set in mc, "N" is set in step 320.
It is determined to be "O" and Fmc is set to "0" in step 380, but the monitor signal is not inverted. If the 3msec interrupt routine is abnormal and Fcp is not set to "1" within 8msec, it is determined to be "NO" in step 340.
In step 390, Fcp is set to "0", but the monitor signal is not inverted.

Furthermore, the 1.66msec interrupt routine is abnormal,
If the value of 3 to 8 is not set in Ccp within 8 msec, it is determined as "NO" in step 360 and the monitor signal is not determined.

If NO at step 360, or step 3
After 70,380,390, in step 400, Ccp is cleared.

Next, in step 410, Fcp is set to "0", and the process is terminated.

As described above, the abnormal operation of the CPU 1a in the microcomputer 1 becomes an abnormal time during which the monitor signal is on or off and is output. Upon receiving this monitor signal, the CPU abnormality processing circuit 6 and the CPU restoration circuit 7 perform the processing as described above.

Next, the abnormality confirmation processing of the peripheral device performed by the microcomputer 1 side at the initial stage of operation will be described. FIG. 10 shows the flowchart.

First, when the power supply of the microcomputer 1 and its peripheral devices is turned on, in the processing of step 500,
When the power is turned on, the contents of the register PS, which is "0", are checked. If the power is on, PS = "0", so "YE
It is determined to be “S”, and then PS is set to “1” in step 510. Next, in step 520, the process waits for 500 msec. During this time, the main routine 4 msec process described above is not performed, so Fmc = "0", the process of step 370 of the 4 msec interrupt monitor signal output routine is not performed, and the monitor signal remains in the on or off state, and the CPU returns. The circuit 7 is activated and the microcomputer 1 is reset.

Then, the process of step 500 is performed again. Step 5
Since PS = "1" in 10, it is judged as "NO",
Move on to the next process. However, the CPU recovery circuit 7 is abnormal, the terminal for resetting and the signal line are abnormal,
If the reset gas is not applied, 500 msec has elapsed in step 520, and the process of step 530 is executed. In step 530, the third set to "1" when the power is turned on.
By setting the signal S1 shown in the figure to "0", the signal S3 of the AND circuit 8 also becomes "0", the output of the buffer 9 also disappears, the a contact of the relay 5 is opened, and the power supply 4 is disconnected. The operation of the system 2 is stopped. After that, the state of the signal S1 being “0” continues.

If it is determined to be “NO” in step 500, that is, C
If the PU recovery circuit 7 is normal, then in step 540,
A normal monitor signal is output. That is, a monitor signal with a duty ratio of 50%, which is switched on and off every 8 msec, is output. Next, in step 550, the signal directly output from the microcomputer 1 to the AND circuit 8
"1" is output as S1. If the CPU abnormality processing circuit 6 itself is not abnormal, the CPU abnormality processing circuit 6 outputs a "1" as the signal S2 to the AND circuit 8 because the monitor signal is normal. If the signals S1 and S2 are both "1", the AND circuit 8
"1" is output as the signal S3. Furthermore, the a contact 5b of the relay 5 is also turned on by this, and the signal S4 is also "1" (on).
Becomes In step 560, it is determined whether this signal S4 is "1". If the CPU abnormality processing circuit 6 is normal and the signal path and the relay 5 are also normal, the microcomputer 1
Since the signal S4 input to is supposed to be "1",
At 560, it is determined to be "YES".

If “NO” is determined in this step 560, it is determined in step 570 that there is an abnormality in the CPU abnormality processing circuit 6, the signal path or the relay 5, for example, the signal S1 is set to “0” or not shown. The abnormality lamp of the display device is turned on.

If "YES" is determined in step 560, then in step 580, the microcomputer 1 outputs an abnormal signal as a monitor signal. For example, a monitor signal of a signal (duty ratio 18.9%) of 3.1 msec on and 13.3 msec off is output. In the next step 590, the time T1 from when the abnormality monitor signal is output in step 580 is 800 msec.
It is determined whether or not Since the initial value has not been exceeded, it is then determined in step 600 whether the output signal S2 of the CPU abnormality processing circuit 6 is "0". If the signal S2 is still "1", it is determined to be "NO" and the process is started again from step 580.

In the above example of the CPU abnormality processing circuit 6, the signal S2 changes to "0" 128 msec after the output of the abnormality monitor signal is started. If "YES" is determined in step 600, it is determined in step 610 whether or not it is within 50 msec after the abnormality monitor signal output in step 580 is started.

The determination of “YES” in step 600 above means that 128 msec or more has elapsed, so normally, determination of “NO” is made in step 610.

It is determined to be “YES” in the above steps 590 and 610, which means that the signal S2 does not switch from “1” to “0” even if the set delay time (128 msec) has sufficiently elapsed, or , It means a situation in which the time has changed from "1" to "0" even though there is enough time to pass the delay time. Therefore, step 620
Then, the signal S1 is set to "0", the abnormal lamp is turned on, and the like.

Next, when S2 changes from "1" to "0" during 50 msec to 800 msec, step 630 is executed and it is determined whether the signal S4 is "0" (off). If it is not "0" here, the abnormality monitor signal output is further continued in step 640, and it is determined in step 650 whether 100 msec has elapsed after the first output processing in step 640. 100
If it is within msec, the processes of steps 630 and 640 are repeated. 1
If the signal S4 is "0" even after the passage of 00 msec, it means that it is abnormal.
The processing of step 620 is performed.

On the other hand, if the signal S4 normally changes to "0", step 63
The process moves from 0 to step 660, and a normal signal is output this time as a monitor signal. That is, ON / OFF is switched every 8 msec, and a pulse signal with a duty ratio of 50% is output. Next, at step 670, it is judged if the signal S4 has switched from "0" to "1".

The signal S4 switches from "0" to "1" because when the signal S1 is "1", the signal S2 switches from "0" to "1". It should switch later. Therefore, even if "NO" is determined in step 670, step 660 and step 670 are executed and the signal S4 switches to "1" until 1.2 seconds have elapsed. If at step 670 the signal S4
If it is determined to be “1”, if only 50 msec has elapsed since the processing of step 660 was first performed in step 690, it is determined to be “NO” and the CPU abnormality processing circuit 6 etc. is determined in step 700. Is abnormal, the same abnormality processing as in steps 570 and 620 is performed.

When it is determined to be “YES” in step 690 or step 680, in step 710, initial data such as various flags and variables for various control processes for the future system is set.

After that, the main routine for performing various control processes including the above-described main routine 4 msec process and each interrupt process described above are executed. In the contents above, step 60
I checked the signal S2 directly at 0, but unlike in Fig. 3, the signal S2 was checked.
2 and the signal S1 =
By checking the content of signal S4 in the state of "1",
The state of the CPU abnormality processing circuit 6 may be grasped.

As described above in detail, in the present embodiment, the CPU abnormality processing circuit 6 determines whether the frequency and the duty ratio of the monitor signal are within the predetermined range. The contact 5a is turned off to shut off the power supply to the system 2.

Therefore, as described in the section “Problems to be solved by the invention”, an abnormality occurs in the oscillator (not shown) of the microcomputer 1 or the hardware such as the ROM 1c, and the frequency or duty ratio of the monitor signal is changed. When a change appears, it can be detected and the control of the system 2 by the microcomputer 1 can be prohibited. That is, it is possible to protect the system 2 from abnormal control of the microcomputer 1 by detecting an abnormality caused by hardware that cannot be returned to normal even if the microcomputer 1 is reset, and proceed to the processing by switching to manual operation or the like. be able to.

Further, in the present embodiment, the CPU recovery circuit 7 resets the microcomputer 1 if the rise or fall of the monitor signal is not longer than a predetermined time.

Therefore, according to the present embodiment, the microcomputer 1
In the event of an abnormality caused by software that can be restored to normal by resetting, such as when the monitor signal does not output due to a runaway, the microcomputer 1 is restored to normal by resetting, and even if it is reset, the hardware cannot return to normal. In case of abnormality caused by wear, system 2
It is possible to take appropriate measures for each abnormal mode, such as prohibiting the control of.

In this embodiment, the signal S2 indicating the abnormality of the microcomputer 1 from the CPU abnormality processing circuit 6 and the signal S4 indicating the ON / OFF state of the relay 5 are input to the microcomputer 1. There is. Therefore, the microcomputer 1 performs the above-described peripheral device abnormality confirmation processing in its operation processing, and the relay 5, the CPU abnormality processing circuit 6, and the CPU restoration circuit 7 are abnormal. Abnormality detection error can be prevented.

Further, as a measure against a hardware error, the power supply to the system 2 is stopped, so that the operation of the system 2 can be surely stopped. Therefore, extremely reliable runaway monitoring can be performed.

In the above configuration, the relay 5 is the control prohibiting means M1.
4, M24, the CPU abnormality processing circuit 6 is the determination means M13, the first
CPU recovery circuit 7 corresponds to the determination means M23 of
8 (second determination means M26 and reset means M27).

[Effects of the Invention] As described above, in the abnormality monitoring device for a control computer according to the first aspect of the present invention, the determination means does not simply monitor the time during which the pulse signal is not output from the computer; It is determined whether or not the waveform itself matches the waveform shape during normal operation, and if it is determined that the waveform does not match the waveform shape, it is determined that an abnormality has occurred, and the control prohibiting means prohibits control of the controlled device. I am trying.

Therefore, according to the abnormality monitoring device for the control computer of the first invention, when an abnormality occurs in the hardware such as the oscillator or the ROM of the microcomputer and the waveform shape of the pulse signal is affected, this is immediately detected. It is possible to prevent abnormal operation of the controlled device.

In the abnormality monitoring device for a control computer according to the second aspect of the invention, in addition to the abnormality processing section corresponding to the determining means and the control inhibiting means according to the first aspect of the invention, a time during which a pulse signal is not output from the computer is timed, Second determining means for determining whether or not the timed time has reached a predetermined time or longer, and reset means for resetting the computer when the timed time is determined to be the predetermined time or longer. And an abnormal recovery unit having a.

Therefore, according to the abnormality monitoring device for a control computer of the second aspect of the present invention, in the case of an abnormality caused by software, the computer is returned to the normal state by the reset by the abnormality restoration unit, and when the abnormality cannot be restored normally due to the hardware, It is possible to take measures suitable for each abnormality mode, such as detecting the abnormality by the abnormality processing unit and prohibiting control of the controlled device.

[Brief description of drawings]

FIG. 1 is an exemplary diagram of the basic configuration of the first invention, FIG. 2 is an exemplary diagram of the basic configuration of the second invention, and FIG. 3 is a block diagram of essential parts of an embodiment of the first invention and the second invention. FIG. 6 is a block diagram of a main part of a CPU abnormality processing circuit, FIG. 5 is a block diagram showing an example of using a microcomputer for the CPU abnormality processing circuit, and FIG. 6 is a flowchart of a main routine 4 msec process of a program executed in the microcomputer. , FIG. 7 is the same 3 msec interrupt processing flowchart, FIG. 8 is the same 1.66 msec interrupt processing flowchart, FIG. 9 is the same 4 msec interrupt monitor signal output routine flowchart, and FIG. 10 is the same peripheral device abnormality confirmation processing flowchart. Represents M11, M21 ...... Controlled device M12, M22 ...... Computer M13 ...... Judgment means M14, M24 ...... Control prohibition means M23 ...... First judgment means M25 ...... Abnormality processing section M26 ...... Second judgment means M27 …… Reset means M28 …… Abnormal recovery unit 1 …… Microcomputer 2 …… System 4 …… Power supply 5 …… Relay 6 …… CPU error processing circuit 7 …… CPU recovery circuit

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Noriyuki Nakajima, 1-1, Showa-cho, Kariya City, Nippon Electric Co., Ltd. (56) References JP-A-56-123014 (JP, A) JP-A-60- 118942 (JP, A)

Claims (7)

(57) [Claims] 1. An abnormality monitoring device for a control computer, which controls a controlled device according to a preset program and repeatedly outputs a pulse signal having a predetermined waveform during normal operation. A pulse signal is being output from the pulse signal, the determining unit determines whether the waveform shape of the output pulse signal matches the predetermined waveform shape; An abnormality monitoring device for a control computer, comprising: a control prohibiting means for prohibiting control of the controlled device by the control computer when it is determined that the abnormality has not occurred. 2. The determination means determines whether the frequency and duty ratio of the output pulse signal are within a predetermined range, so that the waveform shape of the pulse signal conforms to the predetermined waveform shape. The abnormality monitoring device for a control computer according to claim 1, wherein it is determined whether or not the abnormality has occurred. 3. The determining means determines that the waveform shapes do not match when the waveform shape of the output pulse signal does not match the predetermined waveform shape for a predetermined time. An abnormality monitoring device for a control computer according to claim 1, wherein: 4. The abnormality monitoring device for a control computer according to claim 1, wherein the determination means outputs a determination signal indicating its own determination state to the control computer. 5. The control prohibiting means prohibits control of the controlled device by the control computer by cutting off power supply to the controlled device. An abnormality monitoring device for a control computer according to item 1. 6. The control prohibiting means outputs a status signal indicating whether or not the control of the controlled device is prohibited to the control computer to claim 1. Monitoring device for computer control. 7. An abnormality monitoring device for a control computer, which controls a controlled device according to a preset program, and repeatedly outputs a pulse signal having a predetermined waveform during normal operation. When a pulse signal is being output from the device, the first determining means determines whether or not the waveform shape of the output pulse signal matches the predetermined waveform shape; When it is determined that the waveform does not match the predetermined waveform shape, an abnormality processing unit having a control prohibiting unit that prohibits control of the controlled device by the control computer, and a pulse signal from the control computer. Second determining means for determining whether or not the time that has not been output is counted and whether the counted time is equal to or longer than a predetermined time; An abnormality recovering unit having a resetting unit that resets the control computer when the determination unit determines that the measured time is longer than or equal to a predetermined time. Monitoring equipment.