GB2191613A

GB2191613A - Data protection apparatus

Info

Publication number: GB2191613A
Application number: GB08710165A
Authority: GB
Inventors: Shoji Sasaki; Kenji Tabuchi; Yasunori Mouri
Original assignee: Hitachi Ltd
Current assignee: Hitachi Ltd
Priority date: 1986-05-01
Filing date: 1987-04-29
Publication date: 1987-12-16
Also published as: JPS62258154A; GB8710165D0; DE3714325A1; KR870011521A

Description

GB 2 191 613 A 1 SPECIFICATION Further, in the conventional system, the

write of data intothe RAM is permitted by releasing the re Data protective apparatus setting of the computer concurrently with the re covery of the power su pply voltage. Butthere is a

Background of the invention 70 possibility that the program runaway in the micro

This invention relates to a data protective appar- computer also takes place just after the voltage re atus for an engine control system using a computer covery and with the conventional system failing to and more particu larly to a protective apparatus guard against the possibility, data are liable to be which can prevent program ru naway and data deserroneously written into the RAM just afterthe re truction in the event that the power su pply voltage 75 covery of the power supply voltage.

forthe computervaries. The prior art engine control system as described

In automobiles,to meetthe request for saving en- above is disclosed in, for example, P-A-54-112 filed ergy consumption and reducing amounts of detri- on June 3,1977 in Japan by Hitachi, Ltd.

mental substances contained in the exhaust gas, many parameters such as fuel flow rate, ignition tim- 80 Summary of the invention ing and airflow rate forthe engine haveto be con- An object of this invention is to provide a data prot trolled accurately at a time. In recent years, the use of ective apparatus which can permit smooth engine a microcomputer has been highlighted as a way of control by resetting a microcomputer while retaining achieving the intended engine controlling. data in the microcomputer, in the eventthatthe Variations in the power supplyvoltage are more 85 power supply voltage for the microprocessor dec remarkable in a car on-board microcomputerthan in reases and which can prevent data from being erron a computer used in, for example, an office or a plant eousiy written into a RAM immediately after re and fed from the commercial power source. The covery of voltage.

power supply voltage is considerably decreased es- To accomplish the above object, the data protect- peciallywhen the engine is started, the engine is 90 ive apparatus according to the invention saves data greatly loaded or an electrical accessory requiring in the microcomputer into another storage im high power consumption is operated. In the event mediately before resetting the microcomputer in the thatthe power supply voltageforthe microcomputer eventthatthe power supply voltage forthe micro falls below a predetermined level, an errortakes computer decreases and thereafter resetsthe micro place in the count value of a program counterto 95 computerto prevent it from coming into program which thetiming for controlling a control processing runaway, and releases the resetting at expiration of a unit (CPU) of the microcomputer is referenced, with predetermined time delayfollowing the recovery of the resuitthatthe program is read at an erroneous the power supplyvoltage.

countvalue and hence data delivered from the mic rocomputer is disordered, resulting in a phen- 100 Brief description of the drawings omenon called program runaway. Figure 1 is a block diagram showing a data protective Accordingly, in a conventional engine control apparatus according to an embodiment of the inven system using the caron-board microcomputer, tion; when a variation in the power supply voltage is det- Figure2 is a time chart illustrating control signals ected,the microcomputer is temporarily reset until 105 at various points in the Figure 1 apparatus; the voltage recoversto a normal level, so asto pre- Figure3 is a flow chart illustrative of a processing ventthe occurence of program runaway. operation for a non-maskable interrupt request; In the event of the occurrence of such a variation in Figure4 is a flow chart illustrative of a processing the power supplyvoltage, the conventional system operation for a reset interrupt request; and also inhibits write of data into a random access 110 Figure 5is a circuit diagram of a voltage detection memory (RAM) of the microcomputer, so that erron- circuit and a delay circuit according to an embodi eous data may be prevented from being written into ment of the invention.

the RAM.

The conventional control system is however dis- Description of thepreferred embodiments advantageous in that because of resetting the com- 115 Referring nowto Figure 1, there is illustrated a data puter, data stored in the RAM of the computerare protective apparatus embodying the invention erased and information indicative of an engine state which comprises a CPU 1 of an engine control micro priorto the resetting is lost. Therefore, if the con- computer, a RAM 2, a constantvoltage circuit 3, a ventional system is used as a system in which when voltage detection circuit 4, a delay circuit 5, a reset the engine control signal is changed in response to a 120 circuit 6 and a RAM power source backup circuit7.

change of engine state, engine states before and The CPU 1 incorporates some registers (not shown) afterthe change of engine state are detected and for storage of data, a read only memory (ROM), not compared with each other to produce an updated shown, for storage of a control program, and a pro control signal, the RAM storing the engine state prior gram counter (not shown) for controlling read of the to the engine state change is also reset by a decrease 125 program.

in the power supply voltage, raising a problem that The CPU 1 and the RAM 2 constitute the micro the engine control can not be effected smoothly becomputerfor engine control whih fetches engine fore and afterthe resetting and especially, in thefuel running states through various sensors, prepares flow rate control, an unnecessarily enriched mixture control signals on the basis of the running states and gas tends to be supplied to the engine. 130 supplies the control signals to various actuators so 2 GB 2 191 613 A asto perform properengine control.The micro- alsofalisfrom high to lowattimet2 as shown at (d) in computer used herein may be of a known type. Figure 2. The reset circuit may be realized with a cir The constantvoltage circuit 3 is supplied with a cuit construction substantially similarto the delay predetermined voltageVB from a battery (not shown) circuit 5.

serving as a power source of an automobile and it 70 On the other hand, since the detection signal 4a of stabilizes the voltage VB to deliver a stabilized vol- the voltage detection circuit 4 is also supplied to an tage Vec. The voltage Vcc is used as a powersupply NMI input of the CPU 1, a non-maskable interrupt re forfeeding the CPU 1, RAM 2 and other circuits and is quest (NMI) is applied to the CPU 1 attime t, atwhich of, for example, 5 volts. the detection signal 4a falls in response to a decrease The voltage detection circuit4 is supplied with the 75 in the power supply voltage Vcc, so that a data pro outputvoltage 3a (Vcc) of the constantvoltage circuit cessing as shown in Figure 3 is enabled to start in 3 and it generates a detection signal 4a which be- preference to the program which has proceeded till comes a low level when the voltage 3a decreases to a then. In the Figure 3 processing, particular data predetermined level, for example, 4.6 volts and re- selected in advance, because of their importance, turns to a high level when the voltage 3a retu ms to a 80 from data stored in the register of the CPU 1, for ex second predetermined level different from the first ample, information indicative of the engine speed oneJor example, 4.7 volts. and intake airflow rate and the count value of the Generally, the program runaway takes place when program counter, are saved into the RAM 2. Specific the power supply voltage level falls below about 4 ally, all of the given important data are saved into the volts. Therefore, it is desirable that the threshold 85 RAM 2 and safely stored therein during an interval of levels---for determining the rise and fall of the detec- time ranging from time t, to time t2 at which thefirst tion sigal 4a be setto voltage levels which are predetermined time delay T1 defined by the delay cir slightlytolerantto the voltage level of about 4volts. cuit 5 expires. The time delayr, (200 [Ls) is so deter The delay circuit 5 is supplied with the detection mined as to correspond to the time required forthe signal 4a and it generates a delay signal 5a which 90 data to be saved from CPU 1 to RAM 2. During the fails to the low level at expiration of a first predinterval of time, the power supply voltage is decreas etermined time delay T1 beginning with a time point ing butthis time interval is sufficiently short ahead of atwhich the detection signal 4a fallsto the low level arrival of the decreasing power supplyvoltage atthe and thereafter rises concurrently with the rise of the voltage level of about4volts at which the CPU comes detection signal 4a. 95 intothe program runaway mode.

The reset circuit 6 is supplied with the delay signal Asthe time has elapsed to reach the time pointt2, Sa and it generates a reset signal 6a which falls tothe the reset signal 6a falls and with the low level of the low level concurrently with the delay signal and rises reset signal 6a applied to a reset input RE of the CPU at expiration of a second predetermined time delayT2 1 and to an enable input EN of the RAM 2, the CPU 1 beginning with a time point atwhich the delay signal 100 is reset and the RAM 2 is disabled (write/read inhibi 5a rises. tion state) and as a result, the runaway in the CPU 1 The RAM power source backup circuit 7 having an which would otherwise be caused by a decrease in inner capacitor and directly connected to the battery the power supply voltage Vcc can be prevented and power source is constructed so as notto lose its write of erroneous data into the RAM 2 can be pre outputvoitage when the power supply voltage is lost 105 vented during that interval of time.

for a short period of time, whereby voltage charged Subsequently, afterthe lapse of time, the power in the capacitor is supplied to the RAM 2 to retain supply voltage Vcc starts to recover. When the vol data in the RAM 2 even in the eventthatthe power tage Vcc rises up to a predetermined level V2 equal supply voltage varies. ling 4.7 volts attime t3, the detection signal 4a rises The operation of this embodimentwill now be des110 from lowto high and concurrently therewith the cribed with referenceto a timechartshown in Figure delaysignal 5a also rises. As a result, the reset circuit 2. 6 istriggered atthattimeh. Then, the reset circuit6 It is assumed that during the normal operation of operates to cause the reset signal 6a, which has been the microcomputer comprised of the CPU 1 and RAM atthe low level till then, to rise up to the high level at 2 underthe application of the voltage Vec from the 115 time t4, that is, atthe expiration of the second pred constantvoltage circuit3, this voltage Vcc: is dec- etermined time delay T2 beginning with time t3. Con reased, as shown at (a) in Figure 2, to V, equalling 4.6 sequently, the CPU 1 is released from resetting and volts attimet, owing to some cause, for example, an atthe same time the RAM 2 is enabled with its write/ abrupt change in the engine speed or a variation in read inhibition state released.

electrical accessory load as in the case of turning-on 120 Atthe time that the power supplyvoltage recovers of the headlights. Then, atthattime, the detection the normal level after its temporaryfall, the inner cir signal 4a from the voltage detection circuit Calls cuits (the counter and the like) of the CPU have to be from high level to low level as shown at (b) in Figure reset (power-on reset) because if the resetting of the 2 and as a result, the delay circuit 5 is triggered to CPU and the writelread inhibition state of the RAM produce the delaysignal 5a which falls at time t2,that 125 are both released before the power-on resetting of all is, atthe expiration of thefirst predetermined time the inner circuits has been completed, there is a pos delayrj, for example, 200 Ks beginning with the siblitythatthe runaway and the erroneous data write triggering as shown at (c) in Figure 2. will occur. Therefore, the time delay'r2 is so deter The reset circuit 6 istriggered bythe fall of the mined as to correspond to the time required forthe delay signal 5a to produce the reset signal 6a which 130 power-on resetting to complete.

3 GB 2 191613 A 3 After time tO the control iscarried outsimilarlyto duce a voltage decrease signal when said power that performed before time tl, with the only excep- supplyvoltage fails below a first predetermined level tion that beforethe control is started, the data saved and producing a voltage recovery signal when said in the RAM 2 must be read therefrom and returned to power supplyvoltage exceeds a second pred the register of the CPU 1. To this end, a program of a 70 etermined level afterfalling below said first pred reset interrupt request processing, as illustrated in etermined level; Figure 4, is executed when the CPU 1 receivesthe interrupt request processing means for receiving rise of the reset signal 6a. More particularly, afterthe said voltage decrease signal, arranged to applyto data are read out of the RAM 2, it is decided asto said CPU a nonmaskable interrupt request signal whetherthe read data coincide with the saved data. 75 which causes said CPU to transfer data stored in said Considering restart of the engine after stoppage, the first storage means to said second storage means; previous data are unnecessary and in such a case, and the saved data are all rendered zero and need not be signal delay meansfor receiving said voltage dec returned to the CPU 1. If the data read out of the RAM rease signal and said voltage recovery signal, arran 2 are decided to be coincidentwith the saved data, 80 ged to applyto said CPU and said second storage the read data are stored in the register of the CPU 1. means a reset signal during an interval of time which The engine control is then restarted on the basis of ranges from expiration of a first predetermined time the read and returned data. delay beginning with the occurrence of said voltage As described above, according to this embodi- decrease signal to expiration of a second pred ment,the data in the RAM 2 can always be protected 85 etermined time delay beginning with the occurrence steadilyto attain the satisfactory backup effect even of said voltage recovery signal, said reset signal ser when the power supply voltage is decreased. ving to reset said CPU and inhibit a write operation of Sincethe data stored in the RAM 2 are oneswhich data into said second storage means.

Claims

occur immediately before the CPU 1 is reset attime
2. A data protective

apparatus according to Claim tl, continuity of the engine control can be sustained 90 1 wherein said signal delay means comprises a first perfectly and the control can proceed in smooth con- delay circuit in operation responsive to said voltage tinuation. decrease signal to produce a first delay output signal As an embodiment, the voltage detection circuit4 having a leading edge atthe expiration of said first and delay circuit 5 have a specified construction as predetermined time delay and a trailing edge atthe shown in Figure 5. 95 occurrence of said voltage recovery signal, and a The voltage detection circuit 4 comprises a corn- second delay circuitwhich, in operation, produces a parator40, a Zener diode 41, diodes 42 and 43, and second delay output signal having a leading edge at resistors 44 to 49. The Zener diode 41 cooperates the occurence of said leadi ng edge of said f irst delay with the resistors 44 and 45 to provide a fixed voltage output signal f rom said first delay circuit and a trailto which the comparator 40 is referenced to monitor 100 ing edge atthe expiration of said second pred the power supplyvoltage Vccto thereby produce the etermined time delay beginning with said trailing detection signal 4a. The diode 43 and resistor49 pro- edge of said first delay output signal from said first vide the comparator40 with a hysteresis char- delaycircuit.

acteristic bywhich the difference between the detec-
3. A data protective apparatus according to Claim tion voltage (threshold) V, forthe decreasing power 105 2 wherein said CPU has a reset signal terminal for supply voltage and the detection voltage (threshold) resetting said CPU and a non-maskable interrupt re V2forthe increasing power supplyvoltage can be quest signal terminal for processing a non-maskable obtained. interrupt request, and said second storage means is The delay circuit 5 comprises a comparator 50, a a random access memory having an enable signal capacitor 51, and resistors 52 to 56. The comparator 110 terminal for enabling or disabling a write operation compares a discharge voltage from an integration of data to said random access memory, whereby circuit comprised of the capacitor 51 and resistor 52 said voltage decrease signal is applied to said non with the voltage Vccto provide the predetermined maskable interrupt request signal terminal of said time delayrl. CPU and said second delay output signal is applied The remaining circuits, the constantvoltage circuit 115 to said reset signal terminal of said CPU and to said 3, reset circuit 6 and RAM power source backup cir- enable signal terminal of said random access cuit 7, may be of any circuits of known construction memory.

and will not be detailed herein.
4. A data protective apparatus according to Claim 3 wherein said random access memory comprises a CLAIMS 120 power source backup unit for sustaining voltage supplied to said random access memory at a pred 1. A data protective apparatus for an engine con- etermi ned level when said power supply voltage for trol system based on computer control, said appar- said computer is decreased.

atuscomprising:
5. A data protective apparatus according to Claim a computer including a CPU, first storage means 125 1 wherein said first storage means comprises a writ and writable second storage means, forfetching able memory for storing the data representative of data representative of states of an engine and prod- states of said engine and signals used to control said ucing signals which control said engine; engine, said data and signals including at least one voltage detection means for detecting a power of data indicative of the engine speed, data indicative supply voltage for said computer, arranged to pro- 130 of the engine intake airflow rate and counter data of 4 GB 2 191 613 A 4 a program counterof said computer.
6. A data protective apparatus substantially as herein described with reference to and as shown in the accompanying drawings.

Printed for Her Majesty's Stationery Office by Croypon Printing Company (UK) Ltd, 10187, D8991685. Published byThe Patent Office, 25 Southampton Buildings, London,WC2A lAY, from which copies maybe obtained.