JPH06103468B2 - Preventing malfunction of automobile computer - Google Patents

Description

Detailed Description of the Invention [Industrial applications]

The present invention relates to a malfunction prevention method for an automobile computer, which prevents malfunction in computer control.

[Prior art]

An electronic circuit including a control microcomputer mounted on an automobile is placed in a bad environment such as temperature, humidity, vibration, and electrical noise, and thus requires high-level electronic technology.
With respect to the destruction of electronic equipment, the corresponding technology has advanced remarkably due to technological progress, so at this stage, using these, it is almost in a satisfactory state, but the problem of malfunction in program control is It has not been fully resolved. In particular, a microcomputer that executes long steps in sequence may run out of control when only one noise enters, causing a serious situation such as engine stop during running due to a malfunction of the computer for engine control. become. Therefore, in order to avoid such a worst case, a filter that prevents noise from being mixed is often used in the electronic control section, or a watchdog circuit is externally attached to identify it periodically in the process of computer software processing. Alternately outputs "H" and "L" state pulses to the output port of as a program run signal, monitors them with the above watchdog circuit, detects that it has stopped, and determines "OPU runaway" And reset other parts,
Proposals have been made to restore normal conditions. Recently, there are dedicated ICs for the "watchdog circuit" mentioned above, and a microcomputer with an on-chip watchdog circuit has been announced. However, since the watchdog circuit is added, the cost increases, and a problem of malfunction of the circuit itself occurs. In particular, the decisive flaw of this method is that the malfunction of the CPU must affect the outside (until the watchdog circuit works) before the return to the normal state can be obtained. In the case of multi-task processing that can perform interrupt processing, if the interrupt disable flag is set due to a malfunction, necessary interrupt control cannot be performed, resulting in serious problems such as operation control being disabled. Will end up. Malfunction of the control computer of a car is an extremely rare phenomenon, and occurs at a rate of, for example, 1 in tens of thousands, and
Although it occurs only about once every tens of thousands of kilometers running, various tests have shown that the information obtained indicates that the internal registers of the CPU may be affected by ignition noise or power surge immediately before the computer malfunctions. It was found that this was due to changes in the content held in. That is, the CPU
Despite the execution of a normal program, malfunctions are caused by changes in the register contents. This phenomenon is often observed in the multi-task processing that performs interrupt processing in addition to the main routine. It should be noted that, in Japanese Patent Laid-Open No. 50-142134, if the interrupt disable time exceeds the upper limit value determined by the usage conditions of the computer, the interrupt response deteriorates and it becomes impossible to follow the interrupt factor that occurs periodically, so it is constant. In a computer that performs timer control by initializing the count value of the counter to the initial value each time an interrupt occurs while generating an interrupt each time the counter that gradually increases or decreases in a cycle, and extracts the count value of the counter, A technique is disclosed in which the maximum value of the count value is stored and the maximum stored value is compared with the upper limit value to detect the appearance of an abnormally long interrupt prohibition time that exceeds the upper limit value.

[Problems to be Solved by the Invention]

However, in the above prior art example, merely detecting an abnormally long interrupt disable time, ignoring the interrupt request.
It cannot prevent the CPU from running out of control, and cannot prevent malfunctions in computer control of the automobile computer.
In addition, since it only detects an abnormally long interrupt time, when an illegal signal is input due to ignition noise or power surge and the interrupt disable flag is set, the interrupt disable flag remains set and normal normal state processing is performed. Cannot be returned to. The present invention has been made in view of the above circumstances, and an ignition noise, an illegal signal due to a power surge, or the like may be input in a process of executing a program to affect a register, and an interrupt prohibition flag may be set. It is another object of the present invention to provide a method for preventing malfunction of an automobile computer that can prevent malfunction by allowing necessary interrupt processing to be maintained in a processing routine.

[Means for Solving the Problems]

In order to achieve the above object, a method for preventing malfunction of an automobile computer according to the present invention executes a normal processing routine, and divides the normal processing routine in an automobile computer that executes interrupt processing when an interrupt request occurs. Then, after executing the processing routine, it is judged whether or not it is in the interrupt disabled state. If it is in the interrupt disabled state, the process of releasing the interrupt disabled state is executed and the process proceeds to the next processing routine. It is characterized in that the process is shifted to the processing routine of.

[Action]

According to the present invention, during execution of a normal processing routine, it is determined whether or not the interrupt is prohibited.
The process of releasing the interrupt disabled state is executed to release the interrupt disabled state. Therefore, even if an illegal signal is input and the interrupt prohibition flag is set, this is resolved early, the CPU can be surely prevented from running away by ignoring the interrupt request, and the malfunction by computer control can be prevented in advance.

【Example】

An embodiment of the present invention will be described below with reference to FIGS. 1 and 2. FIG. 1 shows an example of a vehicle-mounted computer embodying the present invention, which is used for engine control such as fuel injection and ignition control, or vehicle speed control. In FIG. 1, reference numeral 1 denotes various sensors that supply necessary control parameters to the CPU 6, and these sensors 1 are connected to an input / output unit 5 via an input interface 3. Reference numeral 2 denotes various control actuators, which are driven by drive signals output from the input / output unit 5 via the output interface 4. The input / output unit 5 is connected to the CPU 6 via the bus line 9, and the CPU 6 processes the output of the sensor 1 to output commands for driving various actuators 2.
An interrupt line 10 is connected to the CPU 6 from the input / output unit 5, and an interrupt processing request to the CPU 6 can be made from the input / output unit 5 for an input / output signal. In addition, reference numeral 8 is a ROM having a built-in processing procedure of the CPU 6,
Reference numeral 7 is a RAM used for temporary saving of data, etc., and each is connected to the CPU 6 via a bus line 9. The input / output unit 5 is usually composed of a general-purpose LSI and employs a programmable option that selects a plurality of functions by software. In this programmable option, a constant is written from a CPU 6 to a predetermined register. , The function is uniquely determined. Next, the malfunction prevention method according to the present invention will be specifically described with reference to FIG. First, in step S1, the first processing routine (1) given by dividing a normal processing routine into a predetermined number is executed. After this routine is executed, in step S2, it is determined whether or not the interrupt is disabled (the interrupt disabled flag is set). If the interrupt is disabled, the process proceeds to step S3 to cancel the interrupt disabled state. After execution (returning the interrupt disable flag to "0"), the fact that the interrupt disable state has occurred is stored in the RAM 7 in step S4. Then, after step S4 or when it is determined in step S2 that the interrupt is not disabled, the subsequent processing routine (2) is entered in step S5. In this way, it is possible to virtually interrupt a computer by monitoring whether the interrupt disabled state has been reached during one cycle of the processing routine, and when the interrupt disabled state is being performed, the interrupt disabled state is released. Even if an illegal signal is input and an interrupt prohibition flag is set, this can be eliminated in the program execution process, the CPU 6 does not ignore the interrupt request, and a serious malfunction can be prevented in advance.

As described above, according to the present invention, during the execution of a normal processing routine, it is determined whether or not the interrupt is prohibited, and when the interrupt is prohibited, the process of canceling the interrupt prohibited state is executed. As a result, the interrupt disable state is released, so even if an illegal signal is entered due to ignition noise or power surge during the program progress, and the interrupt disable flag is set,
This can be solved at an early stage, and by a very simple method, it is possible to reliably prevent the CPU from running away by ignoring the interrupt request, and to prevent the malfunction of the automobile computer under the computer control from occurring. It also monitors the interrupt disabled state during the execution of normal processing routines, and when it is in the interrupt disabled state, it releases the interrupt disabled state. Therefore, the interrupt disabled flag is cleared and interrupt processing can be executed normally. You can easily return to the state.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of a computer for carrying out the method of the present invention, and FIG. 2 is a flow chart showing a control procedure. 1 ... Sensor, 2 ... Actuator, 3 ... Input interface, 4 ... Output interface, 5 ... Input / output unit, 6 ... CPU, 7 ... RAM, 8 ... ROM, 9 ... Bus line 10 …… Interrupt line.

Claims (1)

[Claims] 1. In an automobile computer that executes a normal processing routine and executes interrupt processing when an interrupt request occurs, the normal processing routine is divided, and after execution of the processing routine, whether or not the interrupt is disabled. When it is in the interrupt disabled state, the processing for canceling the interrupt disabled state is executed to shift to the next processing routine, and when it is not in the interrupt disabled state, the processing directly shifts to the next processing routine. Malfunction prevention method.