JP3367379B2 - CPU output control circuit - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to prevention of erroneous output in output control of an electronic circuit using a microcomputer.

[0002]

2. Description of the Related Art An output control circuit of a device using a microcomputer is disclosed in, for example, Japanese Utility Model Publication No. 5-8649. FIG. 9 shows an output control circuit of a CPU similar to that of this publication. In the figure, reference numeral 1 denotes a CPU, which has many input / output terminals, but here, only a port output, a reset (RESET) terminal, and an output port for outputting a control output are shown. 2 is a watchdog timer (WDT) connected to the port output of the CPU 1 to monitor the operation of the CPU 1; 3 is output means connected to the output port of the CPU 1; and 4 is another controlled device controlled by this device. Is. When CPU1 is normal, WD is output through port output
The clear pulse 21 is output at a constant cycle at T2, and WDT
2 indicates that the CPU 1 is normal while receiving the clear pulse 21 one after another within a predetermined time interval.

When the CPU 1 becomes abnormal, the CPU 1 does not output the clear pulse 21, the WDT 2 times up, and the reset signal 22 is generated, which resets the CPU 1. There are various methods for the subsequent processing, such as the CPU 1 being restarted or the CPU 1 being stopped. However, since they are not directly related to the present invention, detailed description thereof will be omitted.

FIG. 10 shows a general program flow when the system of FIG. 9 is operating. In addition, FIG.
Shows the time chart. In the figure, the control output is performed in the main process (S2), but the main process (S2) and the check by WDT2 (S3) are alternately performed every time the program flow is cycled, so the clear pulse 21 to the WDT2 If a CPU abnormality occurs immediately after the output of (that is, immediately after the CPU 1 determines that it is normal), the CPU abnormality is not known until the next WDT 2 detects the CPU abnormality and the reset is not applied. There was a possibility of output operation. It should be noted that the types of CPU abnormalities referred to here are of course limited to those of the type in which the CPU 1 can only perform an output operation. It is also a kind of erroneous output that the output signal 30 is not output when it should be output. And, as a result, it means that WDT2 is not useful for monitoring.

[0005]

In the conventional CPU having the watchdog timer for monitoring the operation of the CPU, since the output control circuit is configured as described above,
There has been a problem that an erroneous output signal may be output from the CPU after the CPU becomes abnormal until the watchdog timer outputs the abnormality detection signal. This invention is immediately after the clear pulse is output (that is, CP
Immediately after the U operation is monitored and it is determined that the CPU is normal, the CPU
It is intended to obtain an output control circuit of a CPU in which an erroneous output signal is not transmitted even when an abnormality occurs.

[0006]

A CPU according to the first invention
The output control circuit includes a CPU, a watchdog timer that outputs an output signal when an abnormality is found by monitoring the operation of the CPU based on a clear signal, and an output unit that outputs the output signal of the CPU to the outside. An output control circuit of a CPU, wherein the CPU is configured to send an output command signal during an output period of the output signal, and the CP
The U consists of separate hardware, is inserted between the finger command signal determination circuit for determining whether the output command signal matches the signal specifications predetermined said CPU and said output means, when the directive signal determination circuit determines the previous SL output command signal as a legitimate, the output signal is continued
And the output signal if the output out to said output means
Output, shut off the output if the output signal is not output
And a fail-safe means having a gate or a storage circuit .

The output control circuit of the CPU according to the second invention monitors the CPU and the operation of the CPU based on a clear signal.
A watchdog that emits a signal when you detect an abnormality by looking at it
Timer and output that outputs the output signal of this CPU to the outside
An output control circuit of a CPU having means
The PU outputs a pulse of a specific length following the output of the output signal.
Or multiple pulse signals output within a predetermined time length
When configured to send an output command signal consisting of
At the same time, the hardware is different from the CPU,
The output command signal matches the predetermined signal specifications.
A command signal determination circuit for determining whether or not the CPU and the front
Is inserted between the output means and the command signal determination circuit
The output command signal sent from the CPU is normally
Only when it is determined that the output signal
Fail-safe having a gate or a memory circuit for outputting to
It has a means .

An output control circuit of a CPU according to a third aspect of the present invention outputs the CPU, a watchdog timer which outputs a signal when an abnormality is found by monitoring the operation of the CPU based on a clear signal, and an output signal of the CPU. An output control circuit of a CPU having an output means for outputting to the outside, comprising:
Together with the PU, configured to sent the <br/> force command signal subsequently exits the store command signal in the output of the output signal, the C
The PU consists of separate hardware, the storage command signal
No. and a directive signal determination circuit for determining whether the output command signal matches the signal specifications predetermined said C
Inserted between the PU and the output means, the command signal judgment
When the constant circuit determines that the memory command signal is normal
Only stores the output signal, the storage of said output signal
Then the output command signal is sent out, and, only when the directive signal determination circuit determines the previous SL output command signal as a legitimate, storage for outputting an output signal that is the stored in the output means Fail-safe means with circuit
I have .

[0009]

[0010]

DETAILED DESCRIPTION OF THE INVENTION

Embodiment 1. FIG. 1 shows a block diagram of the present invention. Figure 1
1 is a CPU, which has many input terminals, but here, at least a port output for outputting the WDT clear signal 21, an output port for outputting the control output signal 30, an input terminal for the reset signal 22, and a clock output signal 23. It has a clock output terminal for outputting (hereinafter referred to as clock output), and normally outputs the WDT clear pulse 21 to the port output every one cycle of the program.
In the following description, the clock output 23 may be referred to as the clock input 23 when viewed from the signal receiving side, but it is the same. 2 receives the WDT clear pulse 21,
It is a watchdog timer circuit (hereinafter referred to as WDT) that monitors the abnormality of the CPU 1. Since the function of the watchdog timer circuit and the clear signal 21 are well known, detailed description thereof will be omitted. 3 is an output means, and CPU 1
The control output signal 30 is converted into a high current contact signal, which is convenient for control, and the state is maintained until the signal is updated. Reference numeral 4 denotes a control target, such as a heater or a pump motor.

Reference numeral 5 denotes a fail-safe means composed of hardware other than the CPU 1, such as sequential logic, and as shown in detail in FIG. 2, an input / output terminal of an output signal 30 and a clock output 23 (output command signal 23). 1) which cuts off the input terminal, the output command signal determination circuit 11 and the output signal 30 or connects to the output means 3
It has 2 and 2.

The output command signal determination circuit 11 confirms that the input clock output 23 is not an error signal due to noise or malfunction of the CPU 1 (whether it is a signal that matches a predetermined specification). For example, as shown in FIG. 2, it is constituted by a counter 13 having a built-in clock and the like, and it is possible to confirm whether the pulse time length of the clock output 23 or the number of pulses is predetermined.

Next, the operation will be described. FIG. 3 shows a program flow of the apparatus of FIG. 1, and FIG. 4 shows its time chart. When the CPU 1 is normal, the CPU 1 resets the WDT 2 at a constant cycle and loops the program forever. S30 of FIG. 3 shows a flow in the fail-safe means 5. Output signal 3 of CPU1
Even if 0 is input to the fail safe means 5, the gate 12
It is blocked by and is not immediately sent to the output means 3. At this time, the output signal 30 of the CPU 1 is held as it is until the next update. The CPU 1 is preprogrammed to send the output signal 30 (S21), and subsequently (S22) to send the clock output 23. When the output command signal determination circuit 11 confirms that the predetermined specific clock output 23 (corresponding to the output command signal) has entered the clock input terminal (S31), the gate 12 passes the output signal 30 ( S32).

Here, the output command signal determination circuit 11 does not necessarily have to have an intelligent configuration, and may be one that can open the gate 12 if the clock output 23 is normal, for example, one that is configured by a sequence logic. good. When controlling the output from the CPU 1, in order to open the gate 12 of the fail-safe means 5, the output signal 3
It does not open unless there is a sequential operation of outputting 0 (S21) and then outputting the clock output 23 (S22). Specifically, after outputting the output signal 30 to the fail-safe means 5, a predetermined clock output 23
To the fail safe means 5 and the output command signal judgment circuit 11 does not judge the clock output 23 to be normal (normal), the fail safe means 5 does not output.

Next, a case in which a CPU abnormality occurs will be described with reference to the abnormality timing chart of FIG.
When a CPU abnormality occurs, the behavior of the CPU1 becomes unstable until the WDT2 detects the CPU abnormality, and thus an erroneous output is output from the output port. However, as described above, since the output port is not directly connected to the output means 3 and is output only through the gate 12 in the fail-safe means 5, the signal from the output port of the CPU 1 is transmitted to the output means 3. Sequential control from the CPU 1 (that is, the clock output 23 is output after the control output)
However, it is also necessary for the output command signal determination circuit 11 to determine that the clock output 23 is normal (normal).

Further, the clock output 23 is configured to have a very characteristic signal specification, for example, one pulse having a specific length or including a predetermined number of plural pulses at a predetermined time interval. ing. Therefore, even though CPU1 is running out of control,
Has a very low probability of sequentially outputting a normal erroneous output. Also, since this period is only one cycle period until WDT2 detects an abnormality at the longest, the probability that an erroneous output will eventually occur is It will be extremely low.

In FIGS. 4 and 5, the clock output 23
Is expressed by two pulses output within a predetermined time. However, this may be a signal having a characteristic that a difference from a signal that may be erroneously output due to noise or a malfunction of the CPU 1 is easy to identify. Any kind of pulse may be used, for example, it is preferable that the pulse has a predetermined accurate time length, or that a plurality of predetermined pulses within a predetermined time are output.

Further, in FIG. 5, the clock output 23 is described as being output immediately after the clear pulse 21, but it will be explained that there is no problem even if a failure occurs immediately after the clear pulse 21. This is because the clear pulse 21 and the clock output 23 require a specific time relationship. In this way, even when the CPU 1 becomes abnormal, the WDT 2 CPU abnormality detection dead period (see FIG. 5).
It is possible to realize a highly reliable device (system) that does not output the erroneous output output by the CPU 1 to the outside during the period from the abnormality occurrence to the failure detection.

Embodiment 2. In FIG. 2 of the first embodiment, the gate 12 is used as means for cutting off the output signal of the CPU 1 and allowing the output signal 30 to pass when conditions are satisfied, but a memory (memory circuit) may be used, for example. That is, the output signal 30 of the CPU 1 is temporarily stored in the storage circuit, and when the subsequently output clock output 23 is determined to be normal, the stored output signal 30 is output means 3
You can send it to. If you are using gate 12,
It is necessary that the output of the CPU 1 is normal at the time when the output signal 30 is passed. However, if the method of once storing in the memory circuit is used, once it is stored, then the CPU 1
There is an advantage that an abnormal output will not be output even if the output 30 of is abnormal.

Embodiment 3. Since there are various ways of occurrence of abnormality in the CPU 1, even though the CPU 1 is abnormal,
It does not mean that the clock output 23 happens to be output as if it were normal.
In such a case, an erroneous output will be output in the case of the first and second embodiments. Therefore, a method for further reducing the chance of such an accidental erroneous output is shown in the block diagram of FIG. 6, the partial detailed block diagram of FIG. 7, and the timing chart of FIG.

In FIG. 6, 7 is a second fail-safe means according to the third embodiment. 25 is a clock A signal output from the CPU 1 following the output signal 30.
Is a clock B signal output following the clock A signal 25. These signals have a specific signal pattern (signal specification) that can be easily distinguished from noise or the like, and form an output command signal.

The second fail-safe means 7 is configured as another hardware different from the CPU 1, and storing and reading (that is, output) of the memory are performed by a clock A signal 25 (corresponding to a storage command signal), Clock B signal 2
It has a memory circuit 8 controlled by 6 (corresponding to an output command signal). 11 is an output command signal determination circuit, which is CP
When the clock A signal 25 and the clock B signal 26 are input from U1, it is determined whether or not these signals match the above-mentioned specific specifications. That is, it is determined whether or not these signals are legitimate.
Of course, the clock A signal 25 and the clock B signal 26 are signals of different shapes, and there is no difference.

Then, even if the output signal 30 is output from the CPU 1, it is not immediately stored in the storage circuit 8, and C
The clock A signal 25 is input from PU1, and
It is not stored unless it is determined to be regular. Furthermore, in order for the stored signal to be output to the output means 3, the clock B signal 26 must be input and it must be determined that it is normal. in this way,
Since the fail-safe means 7 has a double condition for outputting the output signal 30, the probability of erroneous output is further lower than that in the first embodiment. Since the clock B signal 26 is a command for reading the stored data from the storage circuit 8, it is also called a storage read command.

[0024]

The output control circuit of the CPU according to the first aspect of the present invention is such that the CPU outputs an output signal during the output period of the output signal.
Command signal, and separate from the CPU
It is composed of hardware of
Command signal judgment to determine whether the specified signal specifications are met
The command signal is inserted between the constant circuit, the CPU and the output means.
When the signal judgment circuit judges that the output command signal is normal
If the output signal is continuously output,
Output to the output means, and output if the output signal is not output
With a gate or a memory circuit for shutting off
Since it is provided with a switching means, the probability that an erroneous output will be output is reduced.

The output control circuit of the CPU that by the second aspect of the present invention
Is, CPU is the specific length Following the output of the output signal pulse
Or multiple pulse signals output within a specified time length.
Signal output command signal
Both are configured with hardware separate from the CPU, and output
Whether the command signal matches the predetermined signal specifications
Command signal determination circuit for determining the CPU, the CPU and the output means
And the command signal judgment circuit is sent from the CPU.
When the output command signal is judged to be normal,
Only, a gate or memory circuit for outputting an output signal to the output means
Since to have a fail-safe means having bets, possibility the CPU malfunctions would be output becomes extremely low.

In the output control circuit of the CPU according to the third aspect of the present invention, the CPU issues a storage command following the output of the output signal.
It is configured to send out a signal and an output command signal.
In addition, it is configured with hardware different from the CPU
Signals and output command signals must meet the predetermined signal specifications.
Command signal determination circuit for determining whether or not to match, and CPU
It is inserted between the output means and the command signal judgment circuit
Output signal only when it is determined that the
The output command signal is sent after storing the output signal.
And the command signal determination circuit outputs the output command signal normally.
If it is determined that the stored output signal is
Fail safe hand with memory circuit for outputting to force means
Since to have a stage, the probability that erroneous output Between the monitoring cycle by the watchdog timer from being outputted is reduced.

[0027]

[Brief description of drawings]

FIG. 1 is a block diagram of an output control circuit of a CPU according to a first embodiment of the present invention.

FIG. 2 is a diagram showing a detailed configuration of a fail-safe means of the circuit of FIG.

FIG. 3 is a flow chart of a program for the circuit of FIG.

FIG. 4 is a timing chart when the flow of FIG. 3 is normal.

5 is a timing chart when the flow of FIG. 3 is abnormal.

FIG. 6 is a block diagram of a second fail-safe means according to the third embodiment.

7 is a diagram showing a detailed configuration of a second fail-safe means of the circuit of FIG.

FIG. 8 is a control timing chart of the second fail-safe means shown in FIG.

FIG. 9 is a block diagram of a conventional output control circuit of a CPU.

10 is a flowchart of a program for the circuit of FIG.

11 is an operation timing chart of the flow of FIG.

[Explanation of symbols]

1: CPU 2: Watchdog timer (WDT) 3: Output means 4: Control object 5: Fail safe means 6: Memory circuit 7: Second fail safe means 8: Memory circuit 11: Output command signal determination circuit 12: Gate 21: WDT clear signal 22: Reset signal 23: Clock output signal (output command signal) 25: Clock A signal (memory command signal) 26: Clock B signal (memory read command signal) 30: Output signal

─────────────────────────────────────────────────── ─── Continued Front Page (58) Fields surveyed (Int.Cl. ⁷ , DB name) G05B 9/00-9/05 G05B 23/00-23/02 G06F 11/00 G05B 15/02

Claims (3)

(57) [Claims] 1. A CPU having a CPU, a watchdog timer that outputs a signal when an abnormality is found by monitoring the operation of the CPU based on a clear signal, and an output unit that outputs the output signal of the CPU to the outside. Of the output control circuit, the CPU is configured to send an output command signal during the output period of the output signal, and is configured by hardware different from the CPU, and the output command signal is predetermined. a directive signal determination circuit for determining whether matching signal specifications, is inserted between the output means and the CPU, and the directive signal decision circuit is normal the previous SL output command signal determination The output signal
Signal is continuously output, the output signal is output to the output means, and if the output signal is not output, the output signal is output.
An output control circuit for a CPU, comprising a fail-safe means having a gate or a memory circuit for cutting off power . 2. A CPU and a clear signal of the operation of the CPU.
No. that sends a signal when an abnormality is found by monitoring based on the
Output the output signal of the CPU and the dog dog timer to the outside.
An output control circuit of a CPU having an output means for applying
The CPU outputs a signal of a specific length following the output of the output signal.
Pulses or multiple pulses output within a predetermined time length
Output command signal composed of
In addition, the output is configured by hardware different from the CPU.
Whether the command signal matches the predetermined signal specifications
Command signal determining circuit for determining the CPU, the CPU and the output
Means for inserting the command signal determination circuit into the C
The output command signal sent from the PU is judged to be normal.
Output the output signal to the output means only when
Fail-safe means having a gate or a memory circuit
An output control circuit of a CPU having: 3. A CPU having a CPU, a watchdog timer which outputs a signal when an abnormality is found by monitoring the operation of the CPU based on a clear signal, and an output means which outputs the output signal of the CPU to the outside. the output control circuit, the CPU is, signal storage command subsequent to an output of said output signal
No. and thereby adapted to deliver an output command signal, is constituted by separate hardware and the CPU, the memory
A directive signal determination circuit for determining whether the command signal and the output command signal matches the signal specifications predetermined
The command is inserted between the CPU and the output means.
The signal determination circuit determines that the memory command signal is normal.
Only when the output signal is stored ,
The output command signal is transmitted following storage, and
Only when the directive signal determination circuit determines the previous SL output command signal as a legitimate, that have a fail-safe means that having a storage circuit for outputting an output signal that is the stored in the output means the output control circuit of the CPU, wherein the this.