JP2006323494A - Failure recovery method and microcomputer - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To continue processing by executing fail-safe even if processing suffering from abnormality is called. <P>SOLUTION: An identifier acquiring means 2 acquires identifiers attached to processings 7a and 7b to 7n to be executed. When the identifiers of the processings to be executed are not stored in a volatile storage device 5 of which power source Vdd is backed up and a rewritable nonvolatile storage device 6, the processing executing means 3 executes the processings after storing the identifiers thereof in the volatile storage device 5. When the identifiers of the processings to be executed are stored in one or both of the volatile storage device 5 and the nonvolatile storage device 6, the processing executing means 3 executes the fail-safe of the processings. When the microcomputer 1 is reset by a watchdog monitoring device 8, a storage means 4 stores the identifiers stored in the volatile storage device 5 into the nonvolatile storage device 6 before starting execution of the processings 7a and 7b to 7n. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a failure recovery method and a microcomputer, and more particularly to a failure recovery method and microcomputer for a microcomputer that recovers from a failure occurrence.

  Conventionally, there is a microcomputer that uses a watchdog signal to detect abnormality. For example, a watchdog signal output from a microcomputer is monitored by a watchdog monitoring IC (Integrated Circuit). The watchdog monitoring IC resets the microcomputer when the watchdog signal is not output from the microcomputer for a certain period of time.

In addition, when an abnormality occurs, there is an automatic failure recovery method that records a process (process) that has been executed, and that allows the process to be removed and restarted (see, for example, Patent Document 1). . In addition, there is a computer with a runaway detection function that minimizes damage to the computer when a CPU (Central Processing Unit) runs away, and does not put a load on the CPU (see, for example, Patent Document 2).
JP-A-6-35737 JP 11-161548 A

However, even if the process of the abnormal part is removed, the process may be called again. In this case, the process may be interrupted because the process does not exist.
The present invention has been made in view of the above points, and stores a history of processing when an abnormality occurs, and executes failsafe of the processing when the processing is called after restarting by resetting. It is an object of the present invention to provide a failure recovery method and a microcomputer that can continue processing.

  In the present invention, in order to solve the above problem, in a failure recovery method for a microcomputer that recovers from a failure occurrence, an identifier assigned to a process to be executed is obtained, and a volatile storage device that is backed up and rewritten. If the identifier is not stored in a possible non-volatile storage device, the process identifier is stored in the volatile storage device to execute the processing, and one of the volatile storage device and the non-volatile storage device or When the identifier is stored in both, when fail-safe of the process is executed and reset by a watchdog monitoring device that monitors a watchdog signal output from the microcomputer, the execution of the process is started. The identifier stored in the volatile storage device is stored in the nonvolatile storage device. That, error recovery method, characterized in that there is provided.

  According to such a failure recovery method, when an attempt is made to execute a process, the identifier assigned to the process is acquired and executed after the power source is stored in a volatile storage device backed up. When there is a reset by the watchdog monitoring device, the identifier stored in the volatile storage device is stored in the nonvolatile storage device. And when it is going to perform the process of the identifier memorize | stored in the volatile memory | storage device or the non-volatile memory | storage device, the fail safe of the process is performed.

  In the failure recovery method of the present invention, when an attempt is made to execute a process, an identifier assigned to the process is acquired and stored after the power source is stored in a backed up volatile storage device. When there is a reset by the watchdog monitoring device, the identifier stored in the volatile storage device is stored in the nonvolatile storage device. And when it is going to perform the process of the identifier memorize | stored in the volatile memory | storage device or the non-volatile memory | storage device, the fail safe of the process was performed. As a result, even if the process when an abnormality occurs is called, the process can be continued by executing the fail safe.

Hereinafter, the principle of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a diagram for explaining an outline of a microcomputer fault recovery method. As shown in the figure, the microcomputer 1 includes an identifier acquisition unit 2, a process execution unit 3, a storage unit 4, a volatile storage device 5, and a nonvolatile storage device 6. The microcomputer 1 is connected to the watchdog monitoring device 8 and outputs a watchdog signal to the watchdog monitoring device 8. The watchdog monitoring device 8 resets the microcomputer 1 when no watchdog signal is output from the microcomputer 1 for a certain period of time. The microcomputer 1 executes processes 7a, 7b, ..., 7n. The processing 7a, 7b,..., 7n is given an identifier for distinguishing each.

The identifier acquisition means 2 acquires the identifiers of the processes 7a, 7b, ..., 7n to be executed.
When the acquired identifier is not stored in the volatile storage device 5 and the rewritable nonvolatile storage device 6 backed up by the power supply Vdd, the process execution unit 3 stores the identifier of the process in the volatile storage device 5. Then, execute the process. Moreover, the process execution means 3 performs the fail safe of the process, when the acquired identifier is memorize | stored in one or both of the volatile memory | storage device 5 and the non-volatile memory device 6. FIG.

  When the microcomputer 1 is reset by the watchdog monitoring device 8, the storage unit 4 stores the identifier stored in the volatile storage device 5 in a non-volatile manner before starting the execution of the processes 7 a, 7 b,. Store in the storage device 6.

  As described above, when the processes 7a, 7b,..., 7n are to be executed, the identifier assigned to the process is acquired, and the power source Vdd is stored in the backed up volatile storage device 5 and then executed. . When there is a reset by the watchdog monitoring device 8, the identifier stored in the volatile storage device 5 is stored in the nonvolatile storage device 6. And when it is going to perform the process of the identifier memorize | stored in the volatile memory | storage device 5 or the non-volatile memory | storage device 6, the fail safe of the process was performed. As a result, even if a process in which an abnormality has occurred is called, the process can be continued by executing the fail safe.

Next, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 2 is a diagram for explaining abnormality detection of the microcomputer. In the figure, a microcomputer 10 and a watchdog monitoring IC 20 are shown. The microcomputer 10 outputs a watchdog signal WD that is inverted, for example, 4 ms to the watchdog monitoring IC 20 according to a program. The microcomputer 10 shown in the figure is mounted on a vehicle and performs processing such as engine control and vehicle control.

  The watchdog monitoring IC 20 monitors the watchdog signal WD output from the microcomputer 10 and outputs a reset signal RST to the microcomputer 10 when the watchdog signal WD is not output after being inverted for a certain time (for example, 100 ms). . That is, the microcomputer 10 is reset by the watchdog monitoring IC 20 when the watchdog signal WD cannot be output due to a software or hardware abnormality.

  When the microcomputer 10 is reset by the watchdog monitoring IC 20, the microcomputer 10 rejects the process being executed when the reset is performed, and executes a fail-safe process corresponding to the process. Then, when the microcomputer 10 starts operation by turning on the IG (ignition switch), when the rejected process is called, the microcomputer 10 calls and executes the fail-safe process corresponding to the process.

  Note that a microcomputer may be used instead of the watchdog monitoring IC 20. For example, the watchdog signal WD of the microcomputer 10 may be monitored by the microcomputer and the microcomputer 10 may be reset.

  Next, the hardware configuration of the microcomputer 10 will be described. FIG. 3 is a diagram illustrating a hardware configuration example of the microcomputer. As shown in the figure, the microcomputer 10 includes a CPU 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, an EEPROM (Electrically Erasable Programmable Read-only Memory) 14, and an I / O register 15. Yes.

  The entire microcomputer 10 is controlled by a CPU 11. A ROM 12, a RAM 13, an EEPROM 14, and an I / O register 15 are connected to the CPU 11 via a bus.

  The RAM 13 temporarily stores at least part of an OS (Operating System) program and application programs to be executed by the CPU 11. Various data necessary for processing by the CPU 11 are stored in the RAM 13 and the EEPROM 14. The ROM 12 stores an OS and application programs.

  The microcomputer 10 is connected to other devices including the watchdog monitoring IC 20. The CPU 11 can exchange data with an external device via the I / O register 15. With the hardware configuration described above, it is possible to reject the process that was being executed when the reset occurred and to execute the fail-safe process.

  The RAM 13 includes an SRAM (Static RAM) that retains data even when the IG is turned off (even when the power is turned off), and an NRAM (Normal RAM) that erases data when the IG is turned off. ing. The SRAM holds data even when, for example, a backup voltage is supplied from a battery mounted on the vehicle and the IG is turned off.

  Next, information stored in the SRAM of the RAM 13 will be described. FIG. 4 is a diagram showing a storage area of the SRAM. As shown in the figure, the SRAM 13a of the RAM 13 stores an initialization occurrence confirmation variable area 13aa in which an initialization occurrence confirmation variable is stored, a process execution storage variable area 13ab in which a process execution storage variable is stored, and a battery detachment history variable. Battery desorption history variable area 13ac. In other areas, variables that need to be retained even when IG is turned off are stored.

  Next, information stored in the EEPROM 14 will be described. FIG. 5 is a diagram showing a storage area of the EPROM. As shown in the figure, the EEPROM 14 has a process execution history variable area 14a in which process execution storage variables are stored. A plurality of process execution history variable areas 14a are provided so that a plurality of process execution storage variables can be stored.

  Next, the operation of the microcomputer 10 will be described using a flowchart. FIG. 6 is a flowchart showing the operation of the microcomputer when the IG is turned off. When the IG is turned off, the CPU 11 of the microcomputer 10 executes the process of the flowchart shown in the figure, and ends the engine control and vehicle control processes.

  In step S1, the CPU 11 stores specific values in the initialization occurrence confirmation variable and the battery removal / removal history variable of the SRAM 13a. The specific values of the initialization occurrence confirmation variable and the battery attachment / detachment history variable are, for example, hexadecimal 5AA5. In step S2, the CPU 11 clears the process execution storage variable of the SRAM 13a to 0, for example.

  That is, when the process is terminated by turning off the IG without being reset by the watchdog monitoring IC 20, the CPU 11 stores 5AA5 of a specific value in the initialization occurrence confirmation variable and the battery removal / removal history variable of the SRAM 13a, and stores the process execution. The variable is cleared to 0 and the process is terminated. When reset by the watchdog monitoring IC 20, the processing of steps S1 and S2 performed by turning off the IG is not performed, so that 5AA5 is stored in the initialization occurrence confirmation variable and the battery removal / removal history variable of the SRAM 13a. In addition, the process execution storage variable is never cleared to zero.

  Next, the operation of the microcomputer 10 after the IG is turned on or reset will be described. FIG. 7 is a flowchart showing the operation of the microcomputer after the IG is turned on or reset. When the IG is turned on, or when the reset signal RST is input and the CPU 11 of the microcomputer 10 is restarted, the CPU 11 executes the processing of the flowchart in the figure to perform various processes (processes) of the engine control and the vehicle control. Start.

In step S11, the CPU 11 performs an initialization process necessary for engine control and vehicle control processes.
In step S12, the CPU 11 determines whether there is a battery detachment history. The CPU 11 refers to the battery removal / removal history variable of the SRAM 13a and determines whether or not the battery has been removed.

  When the process is terminated without resetting, that is, when the process is terminated with IG turned off, 5AA5 should be stored in the battery desorption history variable of the SRAM 13a by the process of step S1 shown in FIG. It is. On the other hand, when the battery is detached, the backup voltage supply to the SRAM 13a is cut off, the contents of the SRAM 13a become undefined, and the value of the battery removal / desorption history variable becomes undefined. Therefore, the CPU 11 can determine whether or not the battery has been attached / detached based on the battery attachment / detachment history variable of the SRAM 13a (whether or not it is 5AA5). Even if the SRAM 13a becomes indefinite, it is assumed that the value of the battery detachment history variable is very unlikely to be 5AA5. If the battery is removed or attached, the CPU 11 proceeds to the process of step S13. If there is no battery removal, the process proceeds to step S14.

  In step S13, the CPU 11 stores 5AA5 in the initialization occurrence confirmation variable of the SRAM 13a. CPU11 complete | finishes the process of the flowchart of a figure, and performs a process required for engine control and vehicle control.

In step S <b> 14, the CPU 11 reads out the process execution history variable stored in the process execution history variable area 14 a of the EEPROM 14.
In step S15, the CPU 11 determines whether or not the read process execution history variable indicates an identifier assigned to each process. When the read process execution history variable indicates an identifier assigned to each process, the CPU 11 can determine that the reset signal RST has been input during the execution of the process indicated by the identifier (details described later). CPU11 complete | finishes the process of the flowchart of a figure, and performs the process of engine control and vehicle control, when the read process execution history variable has shown the identifier provided to each process. If the read process execution history variable does not indicate the identifier assigned to each process, the process proceeds to step S16.

  In step S16, the CPU 11 determines whether 5AA5 is stored in the initialization occurrence confirmation variable of the SRAM 13a. The CPU 11 can determine whether it has been reset or whether the end of the previous processing has been ended by turning off the IG, depending on the initialization confirmation variable of the SRAM 13a, that is, whether 5AA5 has been stored. When the initialization occurrence confirmation variable 5AA5 is not stored in the SRAM 13a, the CPU 11 proceeds to the process of step S17. If the initialization occurrence confirmation variable 5AA5 is stored in the SRAM 13a, the process proceeds to step S18.

In step S17, the CPU 11 stores the process execution storage variable stored in the SRAM 13a in the EEPROM 14 as a process execution history variable.
The process execution storage variable stores an identifier assigned to the engine control and vehicle control processes, which will be described later. This identifier is stored in the process execution storage variable when the CPU 11 executes the engine control and vehicle control processes. That is, the process execution storage variable stored in the SRAM 13a stores the identifier of the process executed by the CPU 11. Therefore, when the microcomputer 10 is reset by the reset signal RST and the CPU 11 executes the process of step S17, the EEPROM 14 stores the identifier of the process executed when the reset occurred. CPU11 complete | finishes the process of the flowchart of a figure after finishing the process of step S17, and performs various processes of engine control and vehicle control.

  In step S18, the CPU 11 clears the initialization occurrence confirmation variable to 0, for example. Thus, if the reset signal RST is reset before turning off the IG, the initialization occurrence confirmation variable remains 0 without storing 5AA5 by the process shown in step S1 of FIG. In the process of step S16 after reset, the process proceeds to step S17. On the other hand, when the process is terminated not by reset but by IG off, 5AA5 is stored in the initialization occurrence confirmation variable, and when the process of step S16 is executed by IG on, the process proceeds to step S18. Become. In this way, the operation by IG on or reset is started.

  Next, the operation of the microcomputer 10 when executing engine control and vehicle control processing will be described. FIG. 8 is a flowchart showing the operation of the microcomputer when executing the processing. The CPU 11 executes the called process according to the following steps.

  In step S21, the CPU 11 acquires an identifier of a process to be executed. The identifier is given according to each process. For example, an identifier A_ID is assigned to the process A, and an identifier B_ID is assigned to the process B.

  In step S22, the CPU 11 determines whether the process execution storage variable stored in the SRAM 13a matches the acquired identifier. Further, it is determined whether or not there are a plurality of process execution history variables stored in the EEPROM 14 that match the acquired identifier. If the process execution storage variable and the process execution history variable do not match the acquired identifier, the CPU 11 proceeds to the process of step S23. If any process execution storage variable or process execution history variable matches the acquired identifier, the process proceeds to step S25. That is, when a history that an abnormality has occurred in the process to be executed remains in the SRAM 13a or the EEPROM 14, the process proceeds to step S25.

  In step S23, the CPU 11 stores the identifier acquired in step S21 in the process execution storage variable of the SRAM 13a. Accordingly, when the initialization occurrence confirmation variable is not 5AA5 as described in step S16 of FIG. 7, that is, when the operation is started by the reset signal RST, the CPU 11 proceeds to step S17 and is stored in the SRAM 13a. The process execution storage variable is stored in the EEPROM 14 as a process execution history variable. In other words, the identifier of the process executed when the reset is performed is stored in the EEPROM 14, and the history of the process when an abnormality occurs remains in the EEPROM 14. The EEPROM 14 has a plurality of process execution history variable areas 14a, and the CPU 11 stores an identifier history for each process.

In step S24, the CPU 11 executes the called process. In step S25, the CPU 11 executes a fail safe process corresponding to the calling process.
As described above, when the microcomputer 10 tries to execute the process, the microcomputer 10 acquires the identifier assigned to the process and stores the identifier in the SRAM 13a backed up to execute the process. When there is a reset by the watchdog monitoring IC 20, the identifier stored in the SRAM 13 a is stored in the EEPROM 14. And when it is going to perform the process of the identifier memorize | stored in SRAM13a or EEPROM14, the fail safe of the process was performed. As a result, even if a process in which an abnormality has occurred is called, the process can be continued by executing the fail safe.

  Note that weighting may be provided for each process as the process transition condition from step S22 to step S25. For example, the processing execution history variable is stored including the number of times the identifier is stored. Specifically, when the identifier of the process A is stored in the process execution history variable 3 times, the information “3 times” is also included in the process execution history variable and stored. If the process A is a process related to basic control in the process of step S22, the CPU 11 proceeds to the process of step S25 when the identifier A_ID is stored three times. If the process A is not related to the basic control, the process proceeds to the process of step S25 when the identifier A_ID is stored once. The weighting for each process (the upper limit of the number of times the identifier is stored) is stored in, for example, the EEPROM 14, and the CPU 11 compares the processing weight stored in the EEPROM 14 with the number of times the process execution history variable is stored. Thus, it is determined whether the process proceeds to step S23 or step S25.

It is a figure explaining the failure recovery method of a microcomputer. It is a figure explaining abnormality detection of a microcomputer. It is the figure which showed the hardware structural example of the microcomputer. It is the figure which showed the storage area of SRAM. It is the figure which showed the storage area of EPROM. It is the flowchart which showed the operation | movement of the microcomputer when IG was turned off. It is the flowchart which showed the operation | movement of the microcomputer after IG ON or reset. It is the flowchart which showed the operation | movement of the microcomputer when performing a process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Microcomputer 2 Identifier acquisition means 3 Process execution means 4 Memory | storage means 5 Volatile memory | storage device 6 Non-volatile memory | storage device 7a, 7b, ..., 7n Process 8 Watchdog monitoring apparatus Vdd Power supply

Claims (7)

In the microcomputer failure recovery method that recovers from the failure occurrence,
Get the identifier assigned to the process to be executed,
If the identifier is not stored in a volatile storage device backed up and a rewritable nonvolatile storage device, the process identifier is stored in the volatile storage device and the process is executed.
When the identifier is stored in one or both of the volatile storage device and the non-volatile storage device, the process is made failsafe,
When reset by a watchdog monitoring device that monitors a watchdog signal output from the microcomputer, the identifier stored in the volatile storage device is stored in the nonvolatile storage device before the execution of the process is started. Remember,
A failure recovery method characterized by the above. At the end of the operation of the microcomputer, an end code is stored in a predetermined area provided in the volatile storage device,
When starting the operation of the microcomputer, before starting the execution of the processing, store a specific code in the area,
6. When the operation of the microcomputer is started, before the specific code is stored in the area, it is determined whether or not the watchdog monitoring device has been reset by the code stored in the area. Item 5. The failure recovery method according to Item 1.   The failure recovery method according to claim 2, wherein when the specific code is stored in the area, it is determined that the watchdog monitoring device has reset the specific code.   The failure recovery method according to claim 1, wherein the power is supplied by a battery mounted on a vehicle. At the end of the operation of the microcomputer, a battery history code is stored in a predetermined area provided in the volatile storage device,
5. The presence / absence of attachment / detachment of the battery is determined based on the battery history code stored in the area before starting the execution of the process when the microcomputer starts operating. Disaster recovery method. The number of times the identifier is stored in the nonvolatile storage device is stored in the nonvolatile storage device for each identifier,
The failure recovery method according to claim 1, wherein failsafe of the processing is executed when the number of times is equal to or greater than a predetermined number. In a microcomputer that recovers from a failure,
Identifier acquisition means for acquiring an identifier assigned to the process to be executed;
If the identifier is not stored in a volatile storage device backed up by a power source and a rewritable nonvolatile storage device, the process identifier is stored in the volatile storage device, and the process is executed. When the identifier is stored in one or both of the storage device and the non-volatile storage device, process execution means for executing failsafe of the process;
When reset by a watchdog monitoring device that monitors a watchdog signal output from the microcomputer, the identifier stored in the volatile storage device is stored in the nonvolatile storage device before the execution of the process is started. Storage means for storing;
A microcomputer characterized by comprising:

Images