JPH0646385B2 - Preventing malfunction of automobile computer - Google Patents

Description

Detailed Description of the Invention [Industrial applications]

The present invention relates to a malfunction prevention method for an automobile computer, which prevents malfunction in computer control.

[Prior art]

An electronic circuit including a control microcomputer mounted on an automobile is placed in a bad environment such as temperature, humidity, vibration, and electrical noise, and thus requires high-level electronic technology.
With respect to destruction of electronic equipment, the corresponding technology has advanced remarkably due to technological progress, so at this stage, using these, it is almost satisfactory recovery, but the problem of malfunction in program control is It has not been fully resolved. In particular, a microcomputer that executes long steps in sequence may run out of control when only one noise enters, causing a serious situation such as engine stop during running due to a malfunction of the computer for engine control. become. Therefore, in order to avoid such a worst situation, a filter that prevents noise from entering the electronic control section is often used, or a watchdog circuit is externally attached to identify it periodically during the software processing of the computer. The "H" state and "L" state pulses are alternately output to the output port of as a program run signal, monitored by the watchdog circuit, and when it stops, it is judged as "CPU runaway", and the CPU It has been proposed to restore the normal state by resetting the other parts. Recently, there are dedicated ICs for the above "watch dock circuit", etc., and a microcomputer of an on-chip watch dock circuit has been announced.

[Problems to be Solved by the Invention]

However, since the watchdog circuit is added, the cost increases, and a problem of malfunction of the circuit itself arises. In particular, a decisive drawback of this method is that the malfunction cannot be restored to the normal state until the malfunction of the CPU affects the outside (until the watchdog circuit works). In the case of multi-task processing that can perform interrupt processing, an abnormal interrupt occurs when the interrupt flag of the corresponding register is raised by a signal from a source where interrupts were originally prohibited due to a malfunction. , Cause a runaway of the processing program. As a result, there is a serious problem that operation control becomes impossible. Malfunction of the control computer of a car is an extremely rare phenomenon, and occurs at a rate of, for example, 1 in tens of thousands, and
Although it occurs only about once every tens of thousands of kilometers running, various tests have shown that the information obtained indicates that the internal registers of the CPU may be affected by ignition noise or power surge immediately before the computer malfunctions. It was found that this was due to changes in the content held in. Ie CPU
In spite of the fact that a normal program is being executed, a malfunction is caused due to a change in register contents. In particular, this phenomenon is often observed in the multi-task processing that performs interrupt processing in addition to the main routine. The present invention has been made in view of the above circumstances. In the program execution process, an illegal signal due to ignition noise, power surge, or the like is input to affect the register, and an interrupt from a source that is originally prohibited is interrupted. It is an object of the present invention to provide a method for preventing a malfunction of a computer for an automobile, which makes it possible to prevent the processing routine from running out of control.

[Means for Solving the Problems]

In order to achieve the above object, the method for preventing malfunction of an automobile computer according to the present invention is a computer having a processing routine capable of interrupt processing, and if an interrupt occurs during execution of a normal processing routine, interrupt processing is performed. Branch, check the source of the interrupt here,
In the case of an interrupt at a predetermined source, the interrupt disabled state is set.

[Action]

According to the present invention, when an interrupt request is issued during execution of a normal processing routine, the source that generated the interrupt is checked, and if the interrupt is originally prohibited, the interrupt disabled state is set to prevent runaway of the CPU. Malfunctions are prevented in advance.

【Example】

An embodiment of the present invention will be described below with reference to FIGS. 1 and 2. FIG. 1 shows an example of a vehicle-mounted computer embodying the present invention, which is used for engine control such as fuel injection and ignition control, or vehicle speed control. In FIG. 1, reference numeral 1 is various sensors that supply necessary control parameters to the CPU 6, and these sensors 1 are
It is connected to the input / output unit 5 via the input interface 3. Reference numeral 2 denotes various control actuators, which are driven by drive signals output from the input / output unit 5 via the output interface 4. The input / output unit 5 is connected to the CPU 6 via the bus line 9, and the output of the sensor 1 is processed by the CPU 6,
The commands for driving the various actuators 2 are output. An interrupt line 10 is connected from the input / output unit 5 to the CPU 6, and an interrupt processing request to the CPU 6 can be made from the input / output unit 5 for an input / output signal. Reference numeral 8 is a ROM that incorporates the processing procedure of the CPU 6, and reference numeral 7 is a RAM used for temporary saving of data.
, And each of them is connected to the CPU 6 via the bus line 9. The input / output unit 5 is usually composed of a general-purpose LSI and employs a programmable option for selecting a plurality of functions by software. In this programmable option, a constant is written from a CPU 6 to a predetermined register. , The function is uniquely determined. Next, the malfunction prevention method according to the present invention will be specifically described with reference to FIG. First, in the main routine, when it becomes necessary to process an interrupt by an input / output signal to the CPU 6, the CP is sent via the interrupt line 10
When an interrupt request is issued to U6, the process branches to the interrupt processing routine. Here, in step S1, the interrupt request flag is searched to see which source caused the interrupt. Next, in step S2, it is determined from the previous search contents whether the interrupt request is from a normal interrupt request or an interrupt request. In the case of a normal interrupt, the interrupt request flag is cleared in step S3, then normal processing (interrupt processing) is performed in step S4, and the process returns to the main program in step S5. On the other hand, when it is determined as an abnormal interrupt in step S2 (in the corresponding register of the source which is originally in the interrupt-disabled state, an illegal signal due to ignition noise or power surge is input, the interrupt-disabled flag is cleared, and the interrupt is enabled. (This happens in some cases), the process proceeds to step S11, the interrupt request flag is cleared, and the interrupt disable flag is reset for the register in step S12. If necessary, the occurrence of the abnormal interrupt is recorded in the RAM 7 or the like in step S13, and the process returns to the main program. In this way, it is possible to confirm that the abnormal interruption has occurred when the malfunction countermeasure program is started or the abnormality is checked at a later time by the above recording (fault diagnosis). Note that the inhibition flag can be reset during the main program, but it is better to perform it in the interrupt processing routine in that it is reset periodically even when no abnormality occurs.

【The invention's effect】

The present invention has been described in detail above. When an interrupt request is issued in the processing routine, the source of the request originator is searched, and if the interrupt is originally prohibited, the interrupt prohibition is reset. By setting it, it is possible to prevent an interrupt from occurring, prevent the CPU from running out of control, and prevent a serious trouble in operation. Moreover, there is no need for an external circuit as in the conventional case, so that the cost does not increase.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of a computer for carrying out the method of the present invention, and FIG. 2 is a flow chart showing a control procedure. 1 ... Sensor, 2 ... Actuator, 3 ... Input interface, 4 ... Output interface, 5 ... Input / output unit, 6 ... CPU, 7 ... RAM, 8 ... ROM, 9 ... Bus line, 10 ... Interrupt line.

Claims (1)

[Claims] 1. In a computer having a processing routine capable of interrupt processing, if an interrupt occurs during execution of a normal processing routine, the process branches to interrupt processing and the source of the interrupt is checked here. A method for preventing malfunction of an automobile computer, which comprises setting an interrupt disabled state in the case of an interrupt at a predetermined source.