JP3415381B2 - Microcomputer and electronic control unit - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a microcomputer configured to detect program runaway by itself, and an electronic control device equipped with the microcomputer.

[0002]

2. Description of the Related Art Conventionally, as a microcomputer configured to detect a program runaway,
It is known that a watchdog timer (hereinafter, also referred to as WDT) is built in.

That is, the WDT built in the microcomputer mainly has a counter that performs a counting operation at a constant cycle by an internal clock of the microcomputer, and its count value is an overflow value (upper limit if the counting operation is up-counting. When the down count is reached, which is the lower limit value), it is determined that a program runaway has occurred, and the CPU in the microcomputer is reset.

Therefore, in the microcomputer having the WDT as described above, the CPU executes the program to access the WDT within a predetermined time, and
The DT count value is a predetermined value (for example, if the WDT count operation is up-counting, it is the lower limit value of the counter
On the contrary, if it is a down-count, it is set to the upper limit value of the counter). As a result, when the CPU is executing the program normally, the WDT is not reset to the CPU, and the program runaway occurs. And CPU
If WDT is no longer accessed from
The CPU is reset by WDT.

In addition to the WDT built-in type, a microcomputer disclosed in, for example, Japanese Patent Laid-Open No. 61-121140 has been proposed. That is, the microcomputer disclosed in the above publication is provided with a timer counter that performs a counting operation at regular intervals by an internal clock, and an instruction to reset the timer counter before an instruction to call a subroutine in the main routine of the program (details) Is an instruction for the CPU to access the timer counter to clear the count value) and an instruction for detecting the overflow of the timer counter before the return instruction to the main routine in the subroutine. If the overflow of the program is detected, it is determined that a program runaway has occurred, and the process proceeds to the execution of a runaway countermeasure routine prepared in advance.

According to the microcomputer disclosed in the above publication, a program runaway in which the subroutine cannot be returned to the main routine can be detected by itself, and the program runaway can be canceled. By the way, according to this kind of microcomputer, the program runaway can be detected and avoided by itself. Therefore, when the microcomputer is installed in the electronic control unit, the program runaway should be prevented without providing a circuit for runaway detection. You can

However, generally, in an electronic control device, when a peripheral circuit such as an external memory or a register is connected to a microcomputer and a program runaway occurs in the microcomputer, such a peripheral circuit is also initialized. It is necessary to change (reset) it.

Therefore, in order to be able to initialize the peripheral circuits of the microcomputer at the time of program runaway, it is necessary to be able to detect whether the program runaway has occurred even on the outside of the microcomputer. In order to achieve this, it is conceivable that in the above-mentioned microcomputer, every time the CPU accesses the WDT or the timer counter, a signal is output from the output port of the microcomputer to the outside.

That is, in the case of a microcomputer having a built-in WDT, if the CPU is executing the program normally, a signal is output from the output port every predetermined time, and if a program runaway occurs, the output is output. Since the signal is not output from the port, the signal output from the output port is monitored outside the microcomputer, and if the signal is not output within the preset time, the program runaway occurs. It is only necessary to provide a runaway detection circuit for determination.

Further, even in the case of a microcomputer not provided with the WDT disclosed in the above publication, the main routine is usually executed regularly, so that each time the CPU executes the main routine to access the timer counter, By outputting a signal from the output port, it becomes possible to detect the occurrence of program runaway in the microcomputer by the runaway detection circuit provided outside.

[0011]

However, in the conventional microcomputer, in order to output a signal from the output port as described above, the CPU has to use the WD
In addition to the T and timer counter access instructions, an operation instruction for outputting a signal from the output port must be added and executed, which increases the load on the software (the amount of the program and its execution time). The problem arises that

Moreover, before the CPU accesses the internal WDT or the timer counter and the signal is actually output from the output port, there is a delay by the time required for the CPU to execute the operation command of the output port. As a result, the detection accuracy at the time of detecting the program runaway outside the microcomputer decreases.

Specifically, a criterion for determining whether or not a program runaway has occurred in the runaway detecting circuit (that is, from the time when a signal is no longer output from the output port of the microcomputer until the program runaway is determined to occur) (Set time) must be set in consideration of the above delay, and that setting becomes difficult. As a result, in the electronic control device equipped with the conventional microcomputer described above,
When a program runaway occurs, there is a possibility that the normal recovery operation such as resetting the peripheral circuits of the microcomputer may deviate from the optimum timing.

The present invention has been made in view of these problems, and it is possible to output a signal for externally monitoring the presence or absence of program runaway without increasing the load of software and without causing a delay. And a microcomputer that can
It is an object of the present invention to provide an electronic control device capable of performing a normal return operation at an optimum timing when a program runaway occurs.

[0015]

[Means for Solving the Problems and Effects of the Invention] Claim 1 or Claim 3 made to achieve the above object.
The microcomputer of the present invention includes a CPU according to,
The microcomputer is provided with a counter that performs a count operation at regular intervals and is capable of write access and read access from the CPU via an address bus and a data bus. In this microcomputer, the counter is executed by the CPU executing a program. Write access is made to the counter every predetermined time and a predetermined value as an initial value is written in the counter. Then, the microcomputer determines whether or not the program runaway has occurred based on the value of the counter, and when detecting the occurrence of the program runaway, performs the operation for exiting the program runaway.

The function of determining the presence or absence of program runaway based on the value of the counter and performing the operation for exiting the program runaway when the program runaway is detected may be realized by a built-in WDT. Further, like the microcomputer described in the above-mentioned publication,
The configuration may be realized by the CPU executing the program.

Here, in particular, the microcomputer of the present invention according to claim 1 detects that a write access is made from the CPU to the counter, and every time a write access to the counter is detected. A signal output circuit for outputting a signal to the outside of the microcomputer is provided.

That is, in this microcomputer,
Each time the CPU makes a write access to the counter, the signal output circuit outputs a signal to the outside independently of the operation of the CPU. Then, the presence or absence of program runaway can be detected by monitoring whether or not the signal is output from the microcomputer every predetermined time.

Therefore, according to the microcomputer of the first aspect of the present invention, a signal for externally monitoring the presence or absence of program runaway is output without increasing the load of software and without causing a delay. be able to. Incidentally, as described in claim 2, the signal output circuit, and with the signal, it may be configured to output a pulse signal having a predetermined pulse width. Also, in claim 3.
According to the present invention described above, the signal output circuit is the CPU.
The write access to the counter from the
And write access to the counter is detected.
The signal whose level inverts each time
It can be configured to output to the outside of the data. Further, if the toggle output circuit according to the fourth aspect is used as the signal output circuit according to the third aspect , the above-described effect can be obtained with a small-scale circuit configuration.

On the other hand, when an electronic control unit is constructed using such a microcomputer of the present invention, the signal output from the signal output circuit of the microcomputer is monitored as described in claim 5. , If the signal is not output within a preset time, or
According to claim 6, the level of the signal is predetermined.
If the program runaway detecting means for determining that the program runaway has occurred in the microcomputer when it is not reversed within the set time set, it is possible to detect whether the program runaway has occurred even on the outside of the microcomputer. .

[0021] In such an electronic control device, when the peripheral circuits such as an external memory or a register in the microcomputer is connected, as described in claim 7, the loop detection means, by the microcomputer The peripheral circuit may be initialized when it is determined that a program runaway has occurred. With this configuration, when a program runaway occurs, the microcomputer itself escapes from the program runaway (returns to the normal state), and the peripheral circuit of the microcomputer is initialized by the runaway detecting means, so that the electronic control device concerned. The entire function of can be restored to normal.

Moreover, as described above, the microcomputer of the present invention outputs a signal for externally monitoring the presence or absence of program runaway without delay from the CPU accessing the counter. It is possible to easily set the optimum value of the set time in the runaway detection means for determining whether or not the program runaway has occurred.

Therefore, according to the electronic control unit of the seventh aspect , when the program runaway occurs, the normal recovery operation of initializing (resetting) the peripheral circuits of the microcomputer can be performed at an optimum timing. become. Further, in this electronic control unit, if the runaway detecting means is configured to initialize the microcomputer together with the peripheral circuit as described in claim 8 , in the unlikely event that the microcomputer cannot recover normally by itself. In addition, since the microcomputer is initialized by the runaway detecting means, it becomes possible to more reliably restore the normal operation of the entire electronic control device.

Of course, in the case of an electronic control device in which the peripheral circuit requiring initialization is not connected to the microcomputer, it is said that the runaway detection means causes a program runaway in the microcomputer as described in claim 9. If it is determined, the microcomputer may be initialized. In other words, even if the microcomputer cannot return to normal by itself, the microcomputer will be initialized by the runaway detecting means, so that normal return will be more reliable.

[0025]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. It is needless to say that the embodiment of the present invention is not limited to the following and can take various forms within the technical scope of the present invention.

First, FIG. 1 is a schematic configuration diagram showing the configuration of the electronic control unit of the present embodiment. This electronic control unit
As shown in FIG. 1, a single-chip microcomputer (hereinafter, referred to as a microcomputer) that controls an engine mounted on a vehicle and performs processing for engine control.
2 and the voltage (usually about 12V) VB from the battery mounted on the vehicle, the power supply voltage VCC (main) is supplied to the microcomputer 2 and peripheral circuits (not shown) such as external memory and input / output circuits connected to the microcomputer 2. In the embodiment, 5V ± 0.25
V) for supplying the power supply circuit 4 and the power supply voltage Vcc from the power supply circuit 4 until the power supply voltage VCC rises to a specified voltage (for example, 4.75 V) to be supplied to the microcomputer 2 and its peripheral circuits, or from the power supply circuit 4. When the power supply voltage V.sub.CC of the power supply voltage V.sub.CC is lower than the specified voltage, the power supply IC6 for outputting the system reset signal RES to the microcomputer 2 and its peripheral circuits to initialize them is provided.

Then, the power supply IC 6 monitors the output signal OUT outputted from the microcomputer 2 as described later, and when the output signal OUT does not rise within the preset time T1, the microcomputer 2 and its It also has a watchdog timer function as a runaway detecting means for outputting the system reset signal RES to the peripheral circuits.

Next, the microcomputer 2 executes a program stored in advance in a ROM (not shown) and a CPU 10,
An address bus 12 and a data bus 14 connected to the PU 10, and a down counter 1 that performs a down count operation at regular intervals by an internal clock CKW of the microcomputer 2.
6 and the internal state (status information) of the down counter 16, and when the count value of the down counter 16 becomes "0", it is determined that the program runaway has occurred in the CPU 10, and the internal reset signal is sent to the CPU 10. The status register 18 for outputting RT is provided.

The down counter 16 is CP
U10 executes the program for a predetermined time TS
The write access is performed every time, and the write access from the CPU 10 sets a predetermined value N as an initial value of the down count operation.

The predetermined time Ts is set shorter than the time (N.times.TCKW) obtained by multiplying the predetermined value N set in the down counter 16 by the period TCKW of the internal clock CKW. Further, the above-mentioned set time T1 on the power IC 6 side
Is set to be equal to or longer than the time (N.times.TCKW) and equal to or longer than the time (2.times.TS) obtained by doubling the predetermined time TS.

That is, in the microcomputer 2, the down counter 16 and the status register 18 are used to control the CPU.
A watchdog timer that monitors the operation of the counter 10 is configured. In the following description, the down counter 16
Is called DCT16 and status register 18 is WSR
It is called 18.

Here, the write access from the CPU 10 to the DCT (down counter) 16 will be specifically described. First, inside the microcomputer 2, as shown in FIG. 2, two internal clocks CK whose phases are shifted from each other by a half cycle.
1, CK2 are generated, and the CPU 10 is configured to change the address A output to the address bus 12 every two cycles of the internal clock CK2. Further, the CPU 10 is configured to output the write signal W and the data Da to the data bus 14 in the second cycle of the internal clock CK2 after the address A is changed.

Then, based on the above timing relationship, the CPU 10 sends the address corresponding to the DCT 16 to the address bus 12 ([0412h] in this embodiment).
In addition to outputting the write signal W, a write signal is output from the AND circuit 20 shown in FIG. 1 to the DCT 16 to put the DCT 16 in the writable state, and in this state, the CPU 10 sends the DCT 16 to the data bus 14.
When the predetermined value N to be set to is output as the data Da, the output predetermined value N is written in the DCT 16.

The "h" in [] indicates that the number before the "h" is a hexadecimal number. Further, the WSR (status register) 18 is also connected to the CPU 10
Allows write access. That is, the CPU 10
Outputs the address ([0418h] in this embodiment) corresponding to the WSR 18 to the address bus 12 and outputs the write signal W, the AND circuit 22 outputs W.
When the write signal is output to the SR 18, the WSR 18 becomes the writable state, and further, when the CPU 10 outputs the data value to be set in the WSR 18 to the data bus 14, the output data value is written in the WSR 18. Although not described in detail, the DCT 16 and the WSR 18 can also be read-accessed by the CPU 10.

In the microcomputer 2, if the CPU 10 normally executes the program, as shown in FIG. 3, the CPU 10 makes a write access to the DCT 16 within a predetermined time Ts, and the count value of the DCT 16 is a predetermined value. Updated to N. Therefore, in this normal state, WSR18
Does not output the internal reset signal RT to the CPU 10.

On the other hand, when the program runaway occurs in the CPU 10, the CPU 10 does not perform write access to the DCT 16, and eventually the count value of the DCT 16 becomes "0". Then WSR18 to C
The internal reset signal RT is output to the PU 10, whereby the CPU 10 is reset and the program runs out of control.

Here, in particular, in the electronic control unit of the present embodiment, in order to monitor whether or not the program runaway has occurred also on the external side of the microcomputer 2, the above-mentioned power supply IC 6 is provided, which corresponds to this. In the inside of the microcomputer 2, C
Each time the PU 10 makes a write access to the DCT 16, C
Output signal OU to power supply IC 6 independent of the operation of PU 10.
A signal output circuit 24 that outputs T is provided.

That is, as shown in FIG. 1, the signal output circuit 24 receives the above-mentioned internal clock CK1, the address A and the write signal W from the CPU 10, and outputs the signal to the CPU.
Address A from 10 corresponds to DCT 16 [041
2h] and when the write signal W is output from the CPU 10, the AND circuit 30 outputs the internal clock CK1 and outputs a low level otherwise.

Further, the signal output circuit 24 is an AND circuit 3.
D type in which the output C1 of 0 is input to the clock terminal C
A flip-flop (hereinafter referred to as DFF) 32 and a DFF in which a data terminal D is connected to an output terminal Q of the DFF 32 and an internal clock CK2 is input to a clock terminal C
34, an inverter 36 for inverting the signal output from the output terminal Q of the DFF 34 and inputting it to the data terminal D of the DFF 32, and a signal obtained by inverting the signal output from the output terminal Q of the DFF 34, the output signal OUT And an inverter 38 for outputting to the outside of the microcomputer 2 (that is, the power supply IC 6).

The system reset signal RES output from the power supply IC 6 to the microcomputer 2 is input to the reset terminals R of the two DFFs 32 and 34. Although the signal output circuit 24 of the present embodiment includes two inverters 36 and 38, for example, the inverter 36 is deleted and the output of the inverter 38 is changed to the DFF3.
The data may be input to the second data terminal D.

In the signal output circuit 24 thus constructed, the system reset signal RES is supplied from the power supply IC 6.
Is output, the DFFs 32 and 34 are reset.
Therefore, the initial level of the output signal OUT obtained by inverting the signal output from the output terminal Q of the DFF 34 by the inverter 38 is the high level.

After the reset by the system reset signal RES, as shown in FIG.
0 has write access to DCT16, and address bus 1
The address A on 2 becomes [0412h] and the write signal W is output (the write signal W becomes high level),
When the internal clock CK1 rises from the low level to the high level in this state, the output C1 of the AND circuit 30 also rises.

Then, at this time, since a high level signal is input from the inverter 36 to the data terminal D of the DFF 32, the output terminal Q of the DFF 32 to the DFF 34.
When the signal Q1 (hereinafter referred to as the output of the DFF 32) output to the data terminal D of the DFF 34 changes from the low level to the high level, and then the internal clock CK2 rises with a half cycle delay of the internal clock CK1, the output terminal Q of the DFF 34 The output signal OUT changes from low level to high level, and the output signal OUT is inverted from high level to low level.

Then, as shown in FIG. 2, when the CPU 10 next makes a write access to the DCT 16, the DF
Since the low-level signal is input from the inverter 36 to the data terminal D of F32, the output Q1 of the DFF 32 changes from the high level to the low level at the rising timing of the internal clock CK1, and then the internal clock CK1.
When the internal clock CK2 rises with a half cycle delay of
The signal output from the output terminal Q of the FF 34 changes from high level to low level, and the output signal OUT is inverted from low level to high level.

Thereafter, by repeating the above operation, the level of the output signal OUT is inverted every time the CPU 10 makes a write access to the DCT 16, as shown in FIG. That is, the signal output circuit 24 of the present embodiment uses the DCT
Output signal OUT every time write access to 16 is performed
It is a so-called toggle output circuit in which the level of is inverted.

The output signal OUT output from the microcomputer 2 is monitored by the power supply IC 6,
If the output signal OUT does not rise within the set time T1, the microcomputer 2 determines that a program runaway has occurred, and the power supply IC 6 outputs the system reset signal RES to the microcomputer 2 and its peripheral circuits.

As a result, when a program runaway occurs in the microcomputer 2, the peripheral circuit of the microcomputer 2 is also initialized. In addition, even if the microcomputer 2 cannot initialize itself by the built-in watchdog timer (DCT16 and WSR18) for some reason, the microcomputer 2 can still be powered by the power supply IC.
It will be initialized by 6.

As described above in detail, in the electronic control unit of the present embodiment, the microcomputer 2 itself has a DC built in itself.
By the action of T16 and WSR18, the presence or absence of program runaway is detected, and even outside the microcomputer 2, the power IC
6, the presence or absence of program runaway is detected by monitoring whether the output signal OUT from the microcomputer 2 rises within the set time T1.

In particular, in the microcomputer 2 of this embodiment, the CPU 10 does not output the output signal OUT for externally monitoring the presence or absence of program runaway by the CPU 10 executing the program. A signal output circuit 24, which is separately provided, is provided from the CPU 10 to the DCT
A write access to 16 is detected, and the output signal OUT is output to the outside of the microcomputer 2 each time it is detected.

Therefore, according to the microcomputer 2, the output signal OUT can be output without increasing the software load at all. Moreover, when the CPU 10 outputs the output signal OUT by executing the program, as shown in FIG.
0 causes a delay time t for program execution after the write access to the DCT 16 until the signal is actually output. According to the microcomputer 2 of the present embodiment, as shown in FIG. In addition, the output signal OUT can be output without causing a delay with respect to the write access to the DCT 16 of the CPU 10.

Therefore, the criterion for determining whether or not the program runaway has occurred in the power supply IC 6 (that is, the set time T1) can be set without considering the delay time t, and its optimum setting is extremely high. It will be easy. As a result, when a program runaway occurs, the microcomputer 2 and its peripheral circuits are reset by the system reset signal RES, so that the normal recovery operation of the entire apparatus can be performed at an optimum timing.

Further, the signal output circuit 24 provided in the microcomputer 2 of the present embodiment uses the AND circuit 30 to control the CPU.
Address A from 10 is [0412h], and
The CPU 10 detects the output of the write signal W to detect the write access from the CPU 10 to the DCT 16, so that the above-described effect can be obtained with a very small circuit configuration.

In this embodiment, since it is assumed that the microcomputer 2 is connected to a peripheral circuit such as an external memory, the power supply IC 6 outputs the system reset signal RES to the peripheral circuit. However, when there is no peripheral circuit that needs to be reset, only the microcomputer 2 can be reset by the power supply IC 6.

Further, the signal output circuit 24 of the present embodiment is
The signal output circuit 24 is a toggle output circuit in which the level of the output signal OUT is inverted each time a write access is performed from the CPU 10 to the DCT 16.
Even with a so-called short pulse output circuit that outputs a pulse signal having a predetermined pulse width as the output signal OUT each time a write access to the CT 16 is performed, the same effect can be obtained.

On the other hand, in the above embodiment, the microcomputer 2
Watchdog timer (DCT16 and WS)
R18), but the above-mentioned JP-A-61
As disclosed in Japanese Patent Laid-Open No. 121140
The program 10 may read the count value of the DCT 16 by executing the program, and determine whether or not the program has runaway based on the read count value.

[Brief description of drawings]

FIG. 1 is a schematic configuration diagram illustrating a configuration of an electronic control device according to an embodiment.

2 is a time chart explaining the operation of a signal output circuit provided in the microcomputer of FIG.

FIG. 3 is an explanatory diagram illustrating an effect of the embodiment.

FIG. 4 is an explanatory diagram illustrating a problem of a conventional technique.

[Explanation of symbols]

2 ... Microcomputer 4 ... Power supply circuit 6 ... Power supply IC 10 ... CPU 12 ... Address bus 14 ... Data bus 16 ... Down counter (DCT) 18 ... Status register (WSR) 20, 22,
30 ... AND circuit 24 ... Signal output circuit 32, 34 ... D type-flip-flop (DFF) 36, 38 ... Inverter

─────────────────────────────────────────────────── ─── Continuation of the front page (56) References JP-A-4-260942 (JP, A) JP-A-1-319834 (JP, A) (58) Fields investigated (Int.Cl. ⁷ , DB name) G06F 11/30

Claims (9)

(57) [Claims] 1. A CPU and a counter capable of performing a count operation at regular intervals and having write access and read access from the CPU via an address bus and a data bus, wherein the CPU executes a program. The write-access to the counter is performed at every predetermined time by writing a predetermined value as an initial value to the counter, and it is determined based on the value of the counter whether or not the program runaway occurs, and the program runaway occurs. Is detected, the microcomputer configured to perform an operation for exiting the program runaway, detects that the CPU has performed write access to the counter, and also performs write access to the counter. A signal that outputs a signal to the outside of the microcomputer each time Microcomputer, further comprising a power circuit, the said. 2. The microcomputer according to claim 1, wherein the signal output circuit is configured to output a pulse signal having a predetermined pulse width as the signal. . 3. A CPU and a counting operation at regular intervals
At the same time, the CPU sends the address bus and data bus
Write access and read access are possible via
A counter, and the CPU executes a program
This allows the counter to write to the counter every predetermined time.
Access and write a predetermined value as an initial value to the counter
See further program runaway occurs based on the value of the counter
Whether or not the program has run out is detected.
Then, perform the action to get out of the program runaway
And a write access from the CPU to the counter.
And detects that the, the My signals level every time detecting the write access to the counter is inverted
Equipped with a signal output circuit that outputs to the outside of the black computer
A microcomputer characterized by: 4. The microcomputer according to claim 3 , wherein the signal output circuit serves as means for detecting a write access from the CPU to the counter, and an address output from the CPU to the address bus; A write signal output from the CPU to instruct writing of data, and the CPU
Input an internal clock that rises once during the period in which the write signal is being output, the address from the CPU is the address corresponding to the counter, and the write signal is being output from the CPU. A microcomputer comprising: an AND circuit that outputs the internal clock, and a toggle output circuit that inverts the level of the output signal every time the internal clock is output from the AND circuit. 5. The microcomputer according to claim 1 or 2, and a signal output from the signal output circuit of the microcomputer is monitored, and the signal is not output within a predetermined set time. An electronic control device further comprising: a runaway detecting unit that determines that a program runaway has occurred in the microcomputer. 6. My according to claim 3 or claim 4.
Black computer, Output from the signal output circuit of the microcomputer
Signal is monitored and the level of the signal is set to a predetermined value.
If it does not reverse within a fixed time,
Runaway detection to determine that a program runaway has occurred on the computer
Means and An electronic control device comprising: 7. The electronic control device according to claim 5, wherein, when the runaway detecting means determines that a program runaway has occurred in the microcomputer, the microcomputer is run in the electronic control device. The electronic control unit is configured to initialize the peripheral circuit connected to the. 8. The electronic control device according to claim 7 , wherein the runaway detecting unit is configured to initialize the microcomputer together with the peripheral circuit,
An electronic control device characterized by: 9. The electronic control device according to claim 5, wherein the runaway detection unit initializes the microcomputer when the runaway detecting unit determines that a program runaway has occurred in the microcomputer. The electronic control unit is characterized by being.