JPH06103466B2 - Preventing malfunction of automobile computer - Google Patents

Description

Detailed Description of the Invention [Industrial applications]

The present invention relates to a malfunction prevention method for an automobile computer, which prevents malfunction in computer control.

2. Description of the Related Art An electronic circuit including a control microcomputer mounted on an automobile is placed in a bad environment such as temperature, humidity, vibration, and electrical noise, so that a high degree of electronic technology is required.
With respect to the destruction of electronic equipment, the corresponding technology has advanced remarkably due to technological progress, so at this stage, using these, it is almost in a satisfactory state, but the problem of malfunction in program control is It has not been fully resolved. In particular, a microcomputer that executes long steps in sequence may run out of control when only one noise enters, causing a serious situation such as engine stop during running due to a malfunction of the computer for engine control. become. Therefore, in order to avoid such a worst case, a filter that prevents noise from being mixed in is frequently used in the electronic control section, or a watchdog circuit is externally attached to the electronic control section periodically during the software processing process of the computer. Alternately outputs "H" and "L" state pulses to a specific output port as a program run signal,
It has been proposed that the watchdog circuit monitors the signal, detects that it has stopped, determines "OPU runaway", resets the CPU and other parts, and restores the normal state. Recently, there are dedicated ICs for the "watchdog circuit" mentioned above, and a microcomputer with an on-chip watchdog circuit has been announced. However, since the watchdog circuit is added, the cost increases, and a problem of malfunction of the circuit itself arises. In particular, the decisive flaw of this method is that the malfunction cannot be returned to the normal state until the malfunction of the CPU affects the outside (until the watchdog circuit works). In the case of multi-task processing that can perform interrupt processing, if the interrupt disable flag is set due to a malfunction, necessary interrupt control cannot be performed, resulting in serious problems such as operation control being disabled. Will end up. Malfunction of the control computer of a car is an extremely rare phenomenon, and occurs at a rate of, for example, 1 in tens of thousands, and
Although it occurs only about once every tens of thousands of kilometers running, various tests have shown that the information obtained indicates that the internal registers of the CPU may be affected by ignition noise or power surge immediately before the computer malfunctions. It was found that this was due to changes in the content held in. That is, the CPU
Despite the execution of a normal program, malfunctions are caused by changes in the register contents. This phenomenon is often observed in the multi-task processing that performs interrupt processing in addition to the main routine. It should be noted that, in Japanese Patent Laid-Open No. 50-142134, if the interrupt disable time exceeds the upper limit value determined by the usage conditions of the computer, the interrupt response deteriorates and it becomes impossible to follow the interrupt factor that occurs periodically, so it is fixed. In a computer that performs timer control by initializing the count value of the counter to the initial value each time an interrupt occurs and generating an interrupt each time a counter that gradually increases or decreases in a cycle and retrieves the count value of the counter, A technique is disclosed in which the maximum value of the count value is stored and the maximum stored value is compared with an upper limit value to detect the appearance of an abnormally long interrupt prohibition time that exceeds the upper limit value.

[Problems to be Solved by the Invention]

However, in the above prior art example, merely detecting an abnormally long interrupt disable time, ignoring the interrupt request.
It cannot prevent the CPU from running out of control, and cannot prevent malfunctions in computer control of the automobile computer.
In addition, since it only detects an abnormally long interrupt time, when an illegal signal is input due to ignition noise or power surge and the interrupt disable flag is set, the interrupt disable flag remains set and normal normal state processing is performed. Cannot be returned to. The present invention has been made in view of the above circumstances, and an illegal signal due to ignition noise, a power surge, or the like may be input in a program execution process to affect a register, and an interrupt prohibition flag may be set. Another object of the present invention is to provide a method for preventing malfunction of an automobile computer, which can eliminate this problem early so as to hold necessary interrupt processing and prevent malfunction in advance.

[Means for Solving the Problems]

In order to achieve the above object, a method for preventing malfunction of an automobile computer according to the present invention executes a normal processing routine and, in an automobile computer that executes interrupt processing when an interrupt request occurs, sets the normal processing routine to a predetermined value. It is characterized in that it is divided for each time, and after the divided processing routines are executed, the interruption prohibition cancellation processing is executed.

[Action]

According to the present invention, during the execution of the normal processing routine, the interruption prohibition cancellation processing is executed at predetermined time intervals to cancel the interruption prohibition. Therefore, even if an illegal signal is input and the interrupt prohibition flag is set, this is resolved early, the CPU can be surely prevented from running away by ignoring the interrupt request, and the malfunction by computer control can be prevented in advance.

【Example】

An embodiment of the present invention will be described below with reference to FIGS. 1 and 2. FIG. 1 shows an example of a vehicle-mounted computer embodying the present invention, which is used for engine control such as fuel injection and ignition control, or vehicle speed control. In FIG. 1, reference numeral 1 denotes various sensors that supply necessary control parameters to the CPU 6, and these sensors 1 are connected to an input / output unit 5 via an input interface 3. Reference numeral 2 denotes various control actuators, which are driven by drive signals output from the input / output unit 5 via the output interface 4. The input / output unit 5 is connected to the CPU 6 via the bus line 9, and the CPU 6 processes the output of the sensor 1 to output commands for driving various actuators 2.
An interrupt line 10 is connected to the CPU 6 from the input / output unit 5, and an interrupt processing request to the CPU 6 can be made from the input / output unit 5 for an input / output signal. In addition, reference numeral 8 is a ROM having a built-in processing procedure of the CPU 6,
Reference numeral 7 is a RAM used for temporary saving of data, etc., and each is connected to the CPU 6 via a bus line 9. The input / output unit 5 is usually composed of a general-purpose LSI and employs a programmable option that selects a plurality of functions by software. In this programmable option, a constant is written from a CPU 6 to a predetermined register. , The function is uniquely determined. Next, the malfunction prevention method according to the present invention will be specifically described with reference to FIG. First, in step S1, a first processing routine (1) given by dividing a normal processing routine at predetermined time intervals is executed. After this routine is executed, in step S2,
A routine for canceling the interrupt prohibition is executed. For example, here, the interrupt prohibition flag is cleared to cancel the prohibition. Therefore, even if the register value changes due to noise in the processing routine (1) and the interrupt prohibition flag is set, this can be canceled at the step S2, and the next processing routine (2) is entered. When this happens, interrupt processing can be performed freely. Similarly, the processing routine (2) is performed in step S3, and the routine for canceling the interrupt inhibition is executed again in step S4. The same applies to steps S5 and S6. In this way, by having a routine for canceling the interrupt prohibition several times during one cycle, it is possible to substantially maintain a state in which interrupt processing to the computer is possible, and an illegal signal is input and the interrupt disable flag is set. However, this can be solved during the program execution process, the CPU 6 does not ignore the interrupt request, and a serious malfunction can be prevented in advance.

【The invention's effect】

As described above, according to the present invention, during the execution of the normal processing routine, the interruption prohibition cancellation processing is executed at predetermined time intervals to cancel the interruption prohibition. Even if an illegal signal is entered and the interrupt prohibition flag is raised due to, etc., this is resolved early, and with a very simple method, it is possible to reliably prevent CPU runaway by ignoring interrupt requests, Malfunction due to computer control of the automobile computer can be prevented reliably and in advance. Further, during the execution of the normal processing routine, the interrupt prohibition is released at every predetermined time, so that the interrupt prohibition flag can be cleared and the normal normal state enabling the execution of the interrupt processing can be easily restored.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of a computer for carrying out the method of the present invention, and FIG. 2 is a flow chart showing a control procedure. 1 ... Sensor, 2 ... Actuator, 3 ... Input interface, 4 ... Output interface, 5 ... Input / output unit, 6 ... CPU, 7 ... RAM, 8 ... ROM, 9 ... Bus line 10 …… Interrupt line.

Claims (1)

[Claims] 1. A vehicle computer for executing a normal processing routine and executing interrupt processing upon generation of an interrupt request, wherein the normal processing routine is divided at predetermined time intervals, and the divided processing routines are executed. After that, a method for preventing malfunction of the automobile computer, which is characterized in that interrupt prohibition cancellation processing is executed.