JPH0646384B2 - Preventing malfunction of automobile computer - Google Patents

Description

Detailed Description of the Invention [Industrial applications]

The present invention relates to a malfunction prevention method for an automobile computer, which prevents malfunction in computer control.

2. Description of the Related Art An electronic circuit including a control microcomputer mounted on an automobile is placed in a bad environment such as temperature, humidity, vibration, and electrical noise, so that a high degree of electronic technology is required.
With respect to the destruction of electronic equipment, the corresponding technology has advanced remarkably due to technological progress, so at this stage, using these, it is almost in a satisfactory state, but the problem of malfunction in program control is It has not been fully resolved. In particular, a microcomputer that executes long steps in sequence may run out of control when only one noise enters, causing a serious situation such as engine stop during running due to a malfunction of the computer for engine control. become. Therefore, in order to avoid such a worst situation, a lot of filters are used in the electronic control section to prevent noise from entering, or a watchdog circuit is externally attached to identify the noise periodically in the process of computer software processing. The "H" state and "L" state pulses are alternately output to the output port of as a program run signal, monitored by the watchdog circuit, and when it stops, it is judged as "CPU runaway", and the CPU It has been proposed to restore the normal state by resetting the other parts. Recently, there are dedicated ICs for the above "watch dock circuit", etc., and a microcomputer of an on-chip watch dock circuit has been announced.

[Problems to be Solved by the Invention]

However, since the watchdog circuit is added, the cost increases, and a problem of malfunction of the circuit itself arises. In particular, a decisive drawback of this method is that the malfunction cannot be restored to the normal state until the malfunction of the CPU affects the outside (until the watchdog circuit works). In the case of multi-task processing that can perform interrupt processing, if the interrupt disable flag is set due to a malfunction, necessary interrupt control cannot be performed, resulting in serious problems such as operation control being disabled. Will end up. Malfunction of the control computer of a car is an extremely rare phenomenon, and occurs at a rate of, for example, 1 in tens of thousands, and
Although it occurs only about once every tens of thousands of kilometers running, various tests have shown that the information obtained indicates that the internal registers of the CPU may be affected by ignition noise or power surge immediately before the computer malfunctions. It was found that this was due to changes in the content held in. Ie CPU
In spite of the fact that a normal program is being executed, a malfunction is caused due to a change in register contents. This phenomenon is often observed in the multi-task processing that performs interrupt processing in addition to the main routine. The present invention has been made in view of the above circumstances, and an illegal signal due to ignition noise, a power surge, or the like may be input in a program execution process to affect a register, and an interrupt prohibition flag may be set. It is also an object of the present invention to provide a method for preventing malfunction of an automobile computer that can cancel this, enable necessary interrupt processing, and prevent malfunction.

[Means for Solving the Problems]

In order to achieve the above object, the method for preventing malfunction of an automobile computer according to the present invention is a computer having a processing routine capable of interrupt processing. It judges whether or not it is in the interrupt disabled state, and if it is in the disabled state, it branches to a predetermined malfunction countermeasure routine, and after execution of the malfunction countermeasure routine, it returns to the normal processing routine,
It is characterized by executing interrupt prohibition.

[Action]

According to the present invention, during execution of a normal processing routine, it is determined whether the interrupt is in the interrupt disabled state before the scheduled interrupt is disabled, and in the case of the interrupt disabled state, the normal operation routine is returned after the malfunction countermeasure routine is executed, Since the scheduled interrupt prohibition is executed, even if the contents of the register change due to an illegal signal and the interrupt prohibition flag is set, this is canceled to secure the interrupt enable state before the next interrupt prohibition process starts. . This prevents the CPU from running out of control by ignoring the interrupt request, and prevents malfunction.

【Example】

An embodiment of the present invention will be described below with reference to FIGS. 1 and 2. FIG. 1 shows an example of a vehicle-mounted computer embodying the present invention, which is used for engine control such as fuel injection and ignition control, or vehicle speed control. In FIG. 1, reference numeral 1 is various sensors that supply necessary control parameters to the CPU 6, and these sensors 1 are
It is connected to the input / output unit 5 via the input interface 3. Reference numeral 2 denotes various control actuators, which are driven by drive signals output from the input / output unit 5 via the output interface 4. The input / output unit 5 is connected to the CPU 6 via the bus line 9, and the output of the sensor 1 is processed by the CPU 6,
The commands for driving the various actuators 2 are output. An interrupt line 10 is connected from the input / output unit 5 to the CPU 6, and an interrupt processing request to the CPU 6 can be made from the input / output unit 5 for an input / output signal. Reference numeral 8 is a ROM that incorporates the processing procedure of the CPU 6, and reference numeral 7 is a RAM used for temporary saving of data.
, And each of them is connected to the CPU 6 via the bus line 9. The input / output unit 5 is usually composed of a general-purpose LSI and employs a programmable option for selecting a plurality of functions by software. In this programmable option, a constant is written from a CPU 6 to a predetermined register. , The function is uniquely determined. Next, the malfunction prevention method according to the present invention will be specifically described with reference to FIG. First, in step S1, it is determined whether or not the interrupt prohibition flag is set in the routine that has flown through the normal processing. If the flag is not set, the interrupt is not prohibited, so that the processing routine is assumed to be operating normally and the original interrupt prohibition step S2 is performed, and then the processing in the interrupt prohibition state is performed at step S3. ,
In step S4, interruption prohibition is released. Such temporary interruption prohibition processing is necessary when handling, for example, 2-word length data. And step S1
If it is determined that the interrupt is prohibited in step S3, that is, if an illegal signal is input to the register due to ignition noise, power surge, etc., and an interrupt prohibited flag is set, the process branches to step S5. Here, a predetermined malfunction countermeasure routine is executed, the interrupt prohibition flag is reset to "0", and the state in which interruption is possible is restored. And step S2
, So at least before the scheduled interrupt disable,
Since the interruptable state is held, the runaway of the CPU 6 can be completely avoided.

【The invention's effect】

The present invention has been described in detail above. In the processing routine, the interrupt disable flag is checked before the scheduled interrupt disable, the contents of the register are changed by an invalid signal, and the interrupt disable flag is set. In such a case, this is canceled and the interrupt-enabled state is secured before the next interrupt disable processing is executed. Therefore, the interrupt request is ignored and the CPU runs out of control, causing a serious problem in operation. It is possible to prevent malfunctions that may cause troubles. Moreover, there is no need for an external circuit as in the prior art, so that the cost does not increase.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of a computer for carrying out the method of the present invention, and FIG. 2 is a flow chart showing a control procedure. 1 ... Sensor, 2 ... Actuator, 3 ... Input interface, 4 ... Output interface, 5 ... Input / output unit, 6 ... CPU, 7 ... RAM, 8 ... ROM, 9 ... Bus line, 10 ... Interrupt line.

Claims (1)

[Claims] 1. A computer having a processing routine capable of interrupt processing, during execution of a normal processing routine,
Before interrupts are disabled, it is judged whether the above processing routine is in the interrupt disabled state, and if it is in the disabled state, it branches to a predetermined malfunction countermeasure routine, and after execution of the malfunction countermeasure routine, it returns to the normal processing routine. And a method for preventing malfunction of a computer for an automobile, characterized by executing interrupt prohibition.