JP2019087177A - Monitoring system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To identify a cause of an abnormality when any of the control devices is abnormally terminated in a device provided with a plurality of control devices capable of mutually monitoring an abnormality. Each CPU of the first and second microcomputers 11 and 12 writes a value 00 when it is started and a value 11 when it ends normally as a value to be written to the first and second EEPROMs 21 and 22, respectively. Writing, the value 01 is written when the abnormality of the other microcomputer is determined, and the value 10 is written when the abnormality of the own microcomputer is determined by the self-diagnosis. That is, different values are written in the EEPROMs 21 and 22 according to the states of the first and second microcomputers 11 and 12. This makes it possible to identify the cause of the abnormality when any of the first and second microcomputers 11 and 12 terminates abnormally by confirming the values written in the EEPROMs 21 and 22. [Selection diagram] FIG. 4

Description

  The present invention relates to a monitoring system.

  Conventionally, a value AA indicating normal operation has been set in a non-volatile memory provided in a microcomputer inside the ECU, and a power cut-off detection device has been proposed that resets the value to a value of 00 after normal termination. (See, for example, Patent Document 1). In this device, if a momentary interruption occurs during operation and ends abnormally, the value is not reset and remains at the value AA, so it can be determined that forced termination has occurred during operation.

JP-A-8-178976

  By the way, in a system including a plurality of control devices capable of mutually monitoring an abnormality, when one control device determines that an abnormality has occurred in the other control device, a reset signal is output to the other control device to force the other control device. There is something to end. When applying the technology described in Patent Document 1 described above to such a system, the same value AA as that for the momentary interruption remains set even if forced termination other than the momentary interruption occurs, and the cause of the forced termination of the control device is specified It is difficult to do.

  A monitoring system according to the present invention is provided with a plurality of control devices capable of mutually monitoring an abnormality, and provides a monitoring system capable of identifying a cause of the abnormality when any control device abnormally ends. The main purpose is

  The monitoring system of the present invention adopts the following means in order to achieve the above-mentioned main object.

The monitoring system of the present invention is
First and second control devices capable of mutually monitoring an abnormality and outputting a reset signal and capable of self-diagnosis, a first non-volatile memory accessible by a CPU of the first control device, and (2) A monitoring system comprising: a second non-volatile memory accessible by a CPU of a control unit;
The respective CPUs of the first and second control devices respectively judge as a value to be written to the first and second non-volatile memories when activated, when normally terminated, when judging an abnormality of the other party, and when judging as an abnormality of the other. Write different values for each case,
Make it a gist.

  The monitoring system of the present invention comprises first and second control devices and first and second non-volatile memories. The CPUs of the first and second control devices respectively have values to be written to the first and second non-volatile memories, one being activated, one being normally terminated, one having determined the other's abnormality, and one having determined its own abnormality. And write different values. As a result, by confirming the value written in the non-volatile memory, it becomes possible to specify the cause of the abnormality when any of the plurality of control devices abnormally ends.

  In the monitoring system of the present invention, the first and second control devices are configured to transmit periodic run pulse signals to each other's control device and to receive run pulse signals from the other control device. When activated, the first value is written to the corresponding non-volatile memory, and when completed normally, the second value is written to the corresponding non-volatile memory, and the run pulse signal from the partner control device is normal If the third value is written to the corresponding non-volatile memory and a reset signal is sent to the counterpart control device, and if the self-diagnosis determines an abnormality of the control device itself The transmission of the run pulse signal to the control device of the other party may be stopped while the fourth value is written to the corresponding nonvolatile memory. In this case, the priority of the values to be written to the non-volatile memory may be determined in the order of the fourth value, the third value, and the second value from the highest value.

BRIEF DESCRIPTION OF THE DRAWINGS It is a block diagram which shows the outline of a structure of the monitoring system 10 containing the monitoring system as one Example of this invention. 5 is a flowchart showing an example of a main control routine executed by the first and second microcomputers 11 and 12, respectively. 5 is a flowchart showing an example of a monitoring process routine executed by the first and second microcomputers 11 and 12, respectively. FIG. 6 is an explanatory view showing an example of a combination of the values of the first and second EEPROMs 21 and 22 and the states of the first and second microcomputers 11 and 12;

  Next, modes for carrying out the present invention will be described using examples.

  FIG. 1 is a block diagram showing an outline of the configuration of a monitoring system 10 as an embodiment of the present invention. The monitoring system 10 according to the embodiment includes a first microcomputer (hereinafter referred to as a first microcomputer) 11, a second microcomputer (hereinafter referred to as a second microcomputer) 12, a first EEPROM 21, a second EEPROM 22, and a monitoring IC 31. And. The monitoring system 10 of the embodiment is mounted on, for example, an electric vehicle or a hybrid vehicle provided with two motors which are driven and controlled by the first and second microcomputers 11 and 12, respectively.

  The first and second microcomputers 11 and 12 are microcomputers centering on a CPU (not shown), and include ROM, RAM, input / output port and communication port in addition to the CPU. In the present embodiment, the second microcomputer 12 is configured as a main microcomputer capable of communicating with a host microcomputer (hereinafter referred to as a host microcomputer). Further, the first microcomputer 11 is configured to be able to communicate with the second microcomputer 12 and is configured as a sub-microcomputer capable of receiving a command from the upper microcomputer via the second microcomputer 12.

  The first and second microcomputers 11 and 12 are configured to be able to monitor each other by a watchdog timer. The first microcomputer 11 transmits to the second microcomputer 12 a watchdog pulse signal WD1 (run pulse signal) in which two signal states of the Hi level and the Lo level are switched at a predetermined cycle, and a similar watch transmitted from the second microcomputer 12 When the dog pulse signal WD2 is received and the watchdog pulse signal WD2 is not normally received from the second microcomputer 12, a reset signal RST1 for resetting the second microcomputer 12 is transmitted to the second microcomputer 12. The second microcomputer 12 transmits the watchdog pulse signal WD2 to the first microcomputer 11, and receives the watchdog pulse WD1 transmitted from the first microcomputer 11, and the watchdog pulse signal WD1 is normally received from the first microcomputer 11 If not, the reset signal RST2 for resetting the first microcomputer 11 is sent to the first microcomputer 11.

  The first and second microcomputers 11 and 12 execute self-diagnosis processing such as checking an error in the ROM or RAM, for example, at the time of start-up, in order to detect a failure of the own microcomputer in advance.

  The first EEPROM 21 is a non-volatile memory that holds data even after the power is turned off, and is configured to be readable and writable by the first microcomputer 11. Similar to the first EEPROM 21, the second EEPROM 22 is a non-volatile memory that stores data even when the power is turned off, and can be read and written by the second microcomputer 12. Each of the first and second EEPROMs 21 and 22 is provided with a 2-bit state storage area for storing the states of the first and second microcomputers 11 and 12, respectively.

  The monitoring IC 31 is an IC for monitoring the power supply voltage and resetting the first and second microcomputers 11 and 12 via the second microcomputer 12. When the monitoring IC 31 detects a drop in the power supply voltage, the monitoring IC 31 transmits a reset signal RST3 to the second microcomputer 12. The second microcomputer 12 receiving the reset signal RST3 transmits the reset signal RST2 to the first microcomputer 11 and resets itself.

  Next, the operation of the monitoring system 10 of the embodiment thus configured will be described. FIG. 2 is a flowchart showing an example of the main control routine executed by the first and second microcomputers 11 and 12, and FIG. 3 is a monitoring processing routine executed by the first and second microcomputers 11 and 12, respectively. It is a flowchart which shows an example. These routines are executed when the system is started. First, the main control routine will be described, and then the monitoring process routine will be described. Since both the first and second microcomputers 11 and 12 execute the same processing, the contents of the processing of both will be described below by taking the processing of the first microcomputer 11 as an example.

  In the main control routine, the CPU of the first microcomputer 11 first reads a value from the state storage area of the first EEPROM 21 (S100), and determines whether the read value is the value 11 indicating that the system was terminated normally at the previous time. (S110). If it is determined that the read-out value is 11, the value 00 indicating that the system is normally activated and operating is written in the first EEPROM 21 (S120). On the other hand, when it is determined that the read value is not the value 11, it is determined that the system did not end normally last time, and the process at the previous abnormal end is executed, for example, a safe mode to limit some functions (S130) ). Note that even if the processing at the time of the previous abnormal termination is performed, if the same abnormality as the previous occurrence occurs, the system may be immediately stopped, and thereafter the system may not be started. Next, self-diagnosis processing such as error check of ROM and RAM is executed (S140), and if it is judged that the result of self-diagnosis is normal ("YES" in S150), the end command (for example, ignition off) It is determined whether a signal is received (S160). If it is determined that the end command has not been received, the process returns to S160, and if it is determined that the end command has been received, the value 11 described above is written in the state storage area of the first EEPROM 21 (S170), and the system end processing for ending the system is performed. Execution is made (S180), and the main control routine is ended. On the other hand, when it is determined that the result of the self-diagnosis is abnormal ("NO" in S150), the transmission of the watchdog pulse signal WD1 to the second microcomputer 12 is stopped (S190) and the value is stored in the state storage area of the first EEPROM 21. Write 10 (S200). Then, after receiving the reset signal RST2 from the second microcomputer 12, the reset is performed (S210), and the main control routine is ended.

  In the monitoring processing routine, the CPU of the first microcomputer 11 first performs watchdog pulse reception processing for receiving the watchdog pulse signal WD2 (run pulse signal) from the second microcomputer 21 which is the other microcomputer (S300), and executes the watchdog pulse. It is determined whether the signal WD2 has been received normally (S310). If it is determined that the watchdog pulse signal WD2 has been received normally, it is determined whether the end command described above has been received (S320). If it is determined that the end command has not been received, the process returns to S300, and if it is determined that the end command has been received, the monitoring processing routine is ended. On the other hand, when it is determined in S310 that the watchdog pulse signal WD2 is not received normally, the value 01 is written to the first EEPROM 21 (S330), and the reset signal RST1 is transmitted to the second microcomputer 12 as the other microcomputer (S340). ), Go to S320.

  Here, for example, while it is determined in S150 of the main control routine that the self-diagnosis is abnormal in the own microcomputer, it is determined in S310 of the monitoring processing routine that the watchdog pulse signal from the other microcomputer is not properly received. If the events of (4) overlap, the value to be written to the first EEPROM 21 is determined according to a predetermined priority. In this embodiment, when the result of the self-diagnosis of its own microcomputer is abnormal (value 10) in order from the event with the highest priority, the watchdog pulse signal from the other microcomputer is not received normally (value 01) ), When normal termination (value 11).

  FIG. 4 is an explanatory view showing an example of a combination of the values of the first and second EEPROMs 21 and 22 and the states of the first and second microcomputers 11 and 12. As shown, the first and second microcomputers 11 and 12 write the value 00 to the first and second EEPROMs 21 and 22 when normally activated (normally activated), respectively, and normally terminated (normally terminated). Writes the value 11 to the first and second EEPROMs 21 and 22, respectively. Here, when an instantaneous interruption occurs in which the power supply to the first and second microcomputers 11 and 12 is cut off, the first and second microcomputers 11 and 12 write the value 11 to the first and second EEPROMs 21 and 22, respectively. Force quit without Therefore, when the read values of the first and second EEPROMs 21 and 22 have the value 00 when the first and second microcomputers 11 and 12 are activated next, it can be determined that a momentary interruption has occurred. Also, when one of the first and second microcomputers 11, 12 runs away, etc., and the watchdog pulse signal transmitted from one microcomputer to the other microcomputer stops, the other microcomputer receives the value in the corresponding EEPROM. While writing 01, a reset signal is output to one of the microcomputers to forcibly reset the one of the microcomputers. Since one microcomputer did not normally end, the read value of the corresponding EEPROM at the time of restart of one microcomputer is the value 00, and the write value of the corresponding EEPROM of the other microcomputer is the value 01. By confirming that, it can be determined that an abnormality has occurred in the watchdog pulse signal of one of the microcomputers. Furthermore, the first and second microcomputers 11 and 12 execute self-diagnosis processing at startup, and when a self-diagnosis error occurs in one of the microcomputers, one of the microcomputers transmits a watchdog pulse signal to the other microcomputer. Stop and write the value 10 to the corresponding EEPROM. The other microcomputer determines that the watchdog pulse signal can not be received normally, writes the value 01 to the corresponding EEPROM, and transmits a reset signal to one of the microcomputers to forcibly reset the one of the microcomputers. . Since one microcomputer did not normally end, the read value of the corresponding EEPROM at the time of restart of one microcomputer is the value 10, and the write value of the EEPROM corresponding to the other microcomputer is the value 01, so these values It is possible to determine that a self-diagnosis error has occurred in one of the microcomputers by confirming. Thus, it becomes possible to identify the cause of the abnormality of the first and second microcomputers 11 and 12 by confirming the values written in the first and second EEPROMs 21 and 22.

  In the monitoring system 10 of the present embodiment described above, the CPUs of the first and second microcomputers 11 and 12 write the value 00 when activated as the values to be written to the first and second EEPROMs 21 and 22, respectively. When the process is ended, the value 11 is written, when the abnormality of the other microcomputer is determined, the value 01 is written, and when the abnormality of the own microcomputer is determined by self-diagnosis, the value 10 is written. That is, different values are written in the EEPROMs 21 and 22 in accordance with the states of the first and second microcomputers 11 and 12, respectively. As a result, by confirming the values written in the EEPROMs 21 and 22, when one of the first and second microcomputers 11 and 12 abnormally ends, it is possible to identify the cause of the abnormality.

  The correspondence between the main elements of the embodiment and the main elements of the invention described in the section of "Means for Solving the Problems" will be described. In the embodiment, the first microcomputer 11 corresponds to a "first control device", the second microcomputer 12 corresponds to a "second control device", and the first EEPROM 21 corresponds to a "first non-volatile memory". Corresponds to the “second non-volatile memory”.

  In addition, the correspondence of the main elements of the embodiment and the main elements of the invention described in the section of the means for solving the problem implements the invention described in the column of the means for solving the problem in the example. The present invention is not limited to the elements of the invention described in the section of “Means for Solving the Problems”, as it is an example for specifically explaining the mode for carrying out the invention. That is, the interpretation of the invention described in the section of the means for solving the problem should be made based on the description of the section, and the embodiment is an embodiment of the invention described in the section of the means for solving the problem. It is only a specific example.

  As mentioned above, although the form for implementing this invention was demonstrated using the Example, this invention is not limited at all by these Examples, In the range which does not deviate from the summary of this invention, it becomes various forms Of course it can be implemented.

  The present invention is applicable to the manufacturing industry of surveillance systems.

  DESCRIPTION OF SYMBOLS 10 monitoring system, 11 1st microcomputer (1st microcomputer), 12 2nd microcomputer (2nd microcomputer), 21 1st EEPROM, 22 2nd EEPROM, 31 IC for monitoring.

Claims (1)

First and second control devices capable of mutually monitoring an abnormality and outputting a reset signal and capable of self-diagnosis, a first non-volatile memory accessible by a CPU of the first control device, and (2) A monitoring system comprising: a second non-volatile memory accessible by a CPU of a control unit;
The respective CPUs of the first and second control devices respectively judge as a value to be written to the first and second non-volatile memories when activated, when normally terminated, when judging an abnormality of the other party, and when judging as an abnormality of the other. Write different values for each case,
Monitoring system.

Images