JPH0810439B2 - Fail-safe device for electronic control unit - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION <Industrial Field of Application> The present invention relates to a fail-safe device for an electronic control device having two microcomputers (hereinafter referred to as microcomputers).

<Prior Art> As an electronic control unit for an automobile, as shown in FIG.
Two microcomputers are used, one microcomputer (main side microcomputer) 1 is the central existence of control, and the other microcomputer (sub side microcomputer) 2 is an auxiliary existence, and both microcomputers 1 and 2 are communication means (serial or parallel). There is a connection using a bidirectional bus 3) (see Japanese Utility Model Laid-Open No. 1-87458).

For example, in the engine electronic control unit, the main-side microcomputer is responsible for controlling the fuel injection amount and ignition timing,
The sub-side microcomputer is responsible for calculating the ignition timing knock correction amount.

In this case, for fail-safe in case of program runaway or failure, each microcomputer 1 and 2 is monitored for the cycle of the program run signal (P-RUN) and reset signal (R
A runaway monitoring circuit 11, 12 (see Japanese Patent Laid-Open No. 63-36301) called a watchdog timer for outputting ES) is provided to reset each microcomputer when each program run signal is abnormal.

<Problems to be Solved by the Invention> However, in such a conventional fail-sale device, when one microcomputer goes out of control or fails,
There is a problem that the other microcomputer cannot judge the runaway or failure, and abnormal data is given to the other microcomputer through the communication means, which lowers the reliability of the system.

In particular, when the sub-side microcomputer runs out of control or fails, the main-side microcomputer gives abnormal data even though the main-side microcomputer can operate, but the main-side microcomputer also operates. There was a problem that it was not guaranteed.

The present invention has been made in view of such conventional problems, and an object of the present invention is to ensure the operation of the system by minimizing the influence on the main microcomputer by the abnormality of the sub microcomputer.

<Means for Solving the Problem> For this reason, the present invention has two microcomputers of main and sub connected by the communication means, and monitors the program run signal to each microcomputer to provide a reset signal when an abnormality occurs. In an electronic control device having a runaway monitoring circuit that outputs, while being connected so that the reset signal of the main side runaway monitoring circuit is logically ORed with the reset signal of the Cebu side runaway monitoring circuit and input to the reset terminal of the sub-side microcomputer, Connect the reset signal of the sub-side runaway monitoring circuit so as to be input to a predetermined port of the main-side microcomputer, and read the presence or absence of the reset signal input to the main-side microcomputer to the signal means when there is an input. A fail-safe device is configured by providing a means for prohibiting communication by the above.

<Operation> In the above configuration, when the main-side microcomputer is abnormal, the main-side runaway monitoring circuit resets not only the main-side microcomputer but also the sub-side microcomputer at the same time.

When the sub-side microcomputer is abnormal, the sub-side runaway monitoring circuit resets the sub-side microcomputer, while the main-side microcomputer reads the reset signal from the port and prohibits communication with the sub-side microcomputer. This prevents abnormal data from being read from the sub-side microcomputer and guarantees the operation of the main-side microcomputer.

<Example> An example of the present invention will be described below with reference to FIGS. 1 and 2.

In FIG. 1, the main-side microcomputer 1 and the sub-side microcomputer 2 are connected via a communication means 3 such as a serial or parallel bidirectional bus.

The main microcomputer 1 monitors the cycle of the program run signal (P-RUN) and resets the reset signal (R
A runaway monitoring circuit 11 on the main side that outputs ES) is provided.

The program run signal (P
-RUN) cycle is monitored and reset signal (RES) when an error occurs
A sub-sided runaway monitoring circuit 12 that outputs is provided.

Here, the reset signal of the main-side runaway monitoring circuit 11 is taken out from the branch line 13, the logical sum of the reset signal of the sub-side runaway monitoring circuit 12 and the OR circuit 14 is input, and the result is input to the reset terminal of the sub-side microcomputer 2. Connected to.

Further, the reset signal of the sub-side runaway monitoring circuit 12 is taken out from the branch line 15 and is connected so as to be input to a predetermined port A of the main-side microcomputer 1.

Then, the main-side microcomputer 1 periodically reads the presence / absence of the input of the reset signal to the port A, and when the input is present, the communication prohibiting means for prohibiting the communication by the communication means 3
16 is provided as software. FIG. 2 is a flow chart showing the function of the communication prohibiting means 16.

Therefore, when the main side microcomputer 1 is abnormal, the main side runaway monitoring circuit 11 not only resets the main side microcomputer 1, but also the sub side microcomputer 2 through the OR circuit 14.
Are also reset at the same time.

When the sub-side microcomputer 2 is abnormal, the sub-side runaway monitoring circuit 12
As a result, the sub-side microcomputer 2 is reset, while the main-side microcomputer 1 reads the reset signal from the port A and prohibits communication with the sub-side microcomputer 2. This prevents abnormal data from being given from the sub-side microcomputer 2 to the main-side microcomputer 1 and ensures the operation of the main-side microcomputer 1.

<Effects of the Invention> As described above, according to the present invention, it is possible to obtain the effect that the operation of the system can be ensured by minimizing the influence of the abnormality of the sub-side microcomputer on the main-side microcomputer.

[Brief description of drawings]

FIG. 1 is a block circuit diagram showing an embodiment of the present invention, and FIG.
FIG. 3 is a flow chart of the communication prohibiting means, and FIG. 3 is a block circuit diagram showing a conventional example. 1 ... Main side microcomputer, 2 ... Sub side microcomputer 3 ... Communication means, 11 ... Main side runaway monitoring circuit 12 ... Sub side runaway monitoring circuit, 14 ... OR circuit, 16 ... Communication prohibition means

Claims (1)

[Claims] 1. An electronic control device having two main and sub microcomputers connected by communication means, and each computer having a runaway monitoring circuit for monitoring a program run signal and outputting a reset signal when an abnormality occurs. In the device, the reset signal of the main-side runaway monitoring circuit is connected to the reset signal of the sub-side runaway monitoring circuit and input to the reset terminal of the sub-side microcomputer, while the reset signal of the sub-side runaway monitoring circuit is connected. Means for connecting to a predetermined port of the main-side microcomputer to read the presence or absence of the input of a reset signal to the main-side microcomputer, and prohibiting communication by the communication means when there is an input A fail-safe for an electronic control device, characterized in that Device.