JP2009251700A - Control unit and interrupt signal generation method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a control unit for easily verifying whether the period of an interrupt signal is normal. <P>SOLUTION: A microcomputer 14 has a first timer circuit 51, a second timer circuit 53, and a third timer circuit 55, and executes interrupt processing by an interrupt signal outputted from the timer circuits. The microcomputer has: the first timer circuit 51 for sending a reference interrupt signal; a software processing section 14 for determining the processing timing of interrupt processing based on the reference interrupt signal sent from the first timer circuit 51 and outputting a send command of an interrupt signal that becomes processing timing to the second and third timer circuits 53, 55; and the second and third timer circuits 53, 55 for sending an interrupt signal to the software processing section 14 by receiving the send command of an interrupt signal. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a control device. In particular, the present invention relates to a control device that controls equipment mounted on a vehicle.

A control device mounted on a vehicle includes a microcomputer having a CPU and a memory therein, and controls the device to be controlled by the CPU performing control according to a program recorded in the memory.
There are relatively expensive microcomputers that have ROM, RAM, and resources and can be loaded with an OS (operating system), and those that cannot be loaded with an OS and have few resources.

For example, in a microcomputer, a synchronization signal for synchronizing processing is generated at a plurality of cycles, but in a microcomputer equipped with an OS, a task for generating a synchronization signal of 1 msec, a task for generating a synchronization signal of 4 msec, A plurality of tasks are generated, such as a task that generates a synchronization signal of 8 msec, and a synchronization signal is generated. At this time, the timer referred to by the task is one of the system timers.
On the other hand, a microcomputer not equipped with an OS uses a plurality of timers provided as hardware in the microcomputer, and generates a synchronization process by an interrupt signal from each timer.

  Patent Document 1 discloses a scheduling method in which the CPU usage time is set in proportion to the program amount of a plurality of tasks so that the processing efficiency does not decrease even when the task program amount is large.

JP-A-8-328881

In a microcomputer equipped with an OS, only one system timer is referred to by a task that generates a synchronization signal. The microcomputer generates a pulse generated based on the system timer and outputs it to a watchdog timer provided in the control device, so that it is possible to detect a microcomputer runaway (period abnormality of each task).
In contrast, a microcomputer not equipped with an OS is provided with a plurality of timers, and interrupt signals from the respective timers are input to the microcomputer.
FIG. 1 shows three timers, timer 1, timer 2, and timer 3. Timer 1 outputs an interrupt signal to the microcomputer at an interval of 1 msec, timer 2 outputs an interrupt signal to the microcomputer at an interval of 4 msec, and timer 3 outputs an interrupt signal to the microcomputer at an interval of 8 msec.

The microcomputer starts interrupt processing in accordance with the input timing of the interrupt signal. Therefore, even if an abnormality in the period of the interrupt signal output from one timer can be detected by the watchdog timer that monitors the microcomputer, an abnormality in the period of the interrupt signal output from another timer must be detected. I can't. FIG. 1 illustrates a case where an abnormality occurs in the count value of the timer 2. Note that the cause of the abnormality in the count value of the timer is mainly caused by register corruption of the register in which the count value to be counted by the timer is recorded. Register corruption means that a value stored in a register becomes an indefinite value due to static electricity or voltage fluctuation.
The disclosed technique of Patent Document 1 relates to a microcomputer equipped with an OS, and does not solve the above-described problem in a microcomputer not equipped with an OS.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a control device and an interrupt signal generation method that can easily verify whether or not the period of an interrupt signal is normal.

In order to achieve such an object, a control device according to the present invention includes a plurality of timer circuits, and executes interrupt processing in accordance with an interrupt signal output from the plurality of timer circuits. One timer circuit to be transmitted, and the processing timing of the interrupt processing is determined based on the reference interrupt signal transmitted from the one timer circuit, and when the processing timing is reached, an interrupt signal transmission instruction is transmitted to another timer circuit. A configuration having a control unit that outputs to the circuit and the other timer circuit that receives the interrupt signal transmission command and transmits the interrupt signal to the control unit is adopted.
The present invention measures the processing timing of interrupt processing based on an interrupt signal serving as a reference, using an interrupt signal output from one timer circuit as a reference. For this reason, it is possible to easily determine whether the period of the interrupt signal output from another timer circuit is normal or not by verifying whether or not the period of the reference interrupt signal is normal. .

In the control apparatus, when the control unit receives the reference interrupt signal from the one timer circuit, the control unit outputs the reference interrupt signal to the monitoring unit, and the monitoring unit outputs the reference interrupt signal to the monitoring unit. A configuration for monitoring the cycle is adopted.
Therefore, it is possible to ensure that the cycle of the interrupt signal output from one timer circuit is normal, and to output an interrupt signal at a normal timing to another timer circuit.

In the control device, the control unit has a configuration including a basic counter that counts up each time the interrupt signal is received from the one timer circuit, and a backup counter that stores a count value of the basic counter as a backup. is doing.
Therefore, when an error occurs in the basic counter, it can be restored with the count value of the backup counter.

  In the control apparatus, the control unit includes a plurality of backup counters, and the control unit selects a count value counted by the most backup counters from the count values of the plurality of backup counters, and counts the basic counters. Compared to the above, a configuration for detecting an error in the count value of the basic counter is adopted. Therefore, it is possible to detect the error of the basic counter and restore it to a normal value when an error occurs in the basic counter.

  The control device employs a configuration in which an interrupt signal is input from at least one of the one timer circuit and the other timer circuit, and a control signal for controlling the engine is generated as the interrupt processing.

  An interrupt signal generation method according to the present invention includes a step of receiving the reference interrupt signal from one timer circuit that transmits a reference interrupt signal among a plurality of timer circuits, and the reference interrupt signal. Determining the processing timing of the interrupt processing, outputting an interrupt signal transmission command to another timer circuit when the processing timing is reached, receiving the interrupt signal transmitted from the other timer circuit, and receiving the interrupt signal And a step of starting the process.

  According to the present invention, it is easy to verify whether or not the period of the interrupt signal is normal.

  Preferred embodiments of the present invention will be described with reference to the accompanying drawings.

FIG. 2 shows a configuration of an embodiment in which the control device of the present invention is applied to an electronically controlled fuel injection device (hereinafter referred to as EFI-ECU (Electronic Fuel Injection-Electronic Control Unit)) 10 that controls the fuel injection amount. .
As shown in FIG. 2, the EFI-ECU 10 includes a microcomputer (hereinafter abbreviated as “microcomputer”) 14 and various types of battery (BAT) 2 temperature, current, engine speed, vehicle speed, transmission state, and the like. A signal level converter 11 that converts the signal level of the sensor signal to a desired level and outputs it to the microcomputer 14 and a watchdog clear signal (hereinafter abbreviated as a WDC signal) output from the microcomputer 10 are input to the microcomputer. A watchdog timer (hereinafter abbreviated as WDT) 12 for monitoring 10 runaways, a power supply circuit 13 for controlling power supply to the microcomputer 14, for example, a signal for controlling the ignition timing of the engine and the fuel injection amount, Output that outputs the output signal of microcomputer 14 including CAN (Controller Area Network) data to the outside And a road 15.

  The WDT 12 monitors the signal level and cycle of the WDC signal output from the software processing unit 20, and determines whether or not the first timer circuit 51 is measuring the reference time normally. The software processing unit 20 receives an interrupt signal output from the first timer circuit 51 every time the first timer circuit 51 measures the reference time. Then, the signal level of the WDC signal is changed in accordance with the input timing of the interrupt signal. The reference time counted by the first timer circuit 51 will be described later.

  Between the power supply circuit 13 and the battery 2, an ignition switch IGSW that is opened and closed by an operation of an ignition key (not shown) is provided. When the ignition switch IGSW is turned on, the voltage supplied from the battery 2 is adjusted to a predetermined voltage by the power supply circuit 13 and supplied to the microcomputer 14, and the microcomputer 14 is activated.

The microcomputer 14 includes a software processing unit 20 realized by software control, a first timer circuit 51, a second timer circuit 53, a third timer circuit 55 that output an interrupt signal to the software processing unit 20 at predetermined intervals, 1 timer register 52, second timer register 54, and third timer register 56.
In the first timer register 52, the software processor 20 sets an interval time counted by the first timer circuit 51. The first timer circuit 51 outputs an interrupt signal to the software processing unit 20 when the interval time set in the first timer register 52 is counted. Similarly, the second timer circuit 53 and the third timer circuit 55 output an interrupt signal to the software processing unit 20 when the interval time set in the second timer register 54 and the third timer register 56 is counted.
The interval time set in the first timer register 52 is set to a reference time such as 1 [msec], for example. The software processing unit 20 inputs an interrupt signal from the first timer circuit 51 every reference time of 1 [msec]. Therefore, the software processing unit 20 can measure the reference time.

  The software processing unit 20 is realized by the hardware shown in FIG. A ROM 32 storing a program for realizing a control process by the ECU, a program for writing control of a memory to be described later, a central processing unit (CPU) 31 for reading and executing the program stored in the ROM 32, It comprises a RAM 33 for storing temporary data used when executing the program, a data input / output unit 34, and the like.

When the ignition switch IGSW is turned on, the microcomputer 14 is activated and the program stored in the ROM 32 is executed by the CPU 31. By this program, a predetermined control process is performed based on the signal from the signal level converter 11 and the like. Various control data is learned during the control process, and the control data obtained by the learning is stored in a standby RAM (not shown) and used for the subsequent control process.
Further, the count value determination means 21, the interval time setting / timer start means 22, the interrupt processing means 23, the counter increment means 24, and the WDC signal output means 25 shown in FIG. Is done. These means will be described with reference to FIG.

The count value determination means 21 reads the count value of the internal counter (basic counter) 331 incremented by the counter increment means 24 and determines whether or not this count value is a predetermined value. If the count value of the internal counter 331 is a predetermined value as a result of the determination, the interval time setting / timer start means 22 is requested to set the interval time and the timer circuit is requested to start counting.
For example, the case where the cycle of inputting an interrupt signal from the second timer circuit 53 is 4 [msec] will be described. In this case, if the count value of the internal counter is a multiple of 4, the count value determination means 21 requests the second timer register 54 to set the interval time. The interval time setting / timer start means 22 sets the interval time in the second timer register 54 in accordance with the request of the count value determination means 21. At this time, the interval time setting / timer start means 22 sets the interval time as the shortest time that the second timer circuit 53 can measure. Then, the count of the second timer circuit 53 is started.
The second timer circuit 53 whose interval time is set to the shortest time outputs an interrupt signal to the interrupt processing means 23 of the software processing unit 20 simultaneously with the start of counting. The software processing unit 20 starts an interrupt process set in advance by inputting an interrupt signal to the interrupt processing unit 23.

Similarly, for example, a case where the cycle of inputting an interrupt signal from the third timer circuit 55 is 8 [msec] will be described. In this case, the count value determination means 21 requests the third timer register 56 to set the interval time when the value of the internal counter is a multiple of 8. The interval time setting / timer start means 22 sets the interval time in the third timer register 56 in accordance with the request of the count value determination means 21. At this time, the interval time setting / timer start means 22 sets the interval time as the shortest time that the third timer circuit 55 can measure. Then, the count of the third timer circuit 55 is started.
The third timer circuit 55 outputs an interrupt signal to the interrupt processing means 23 of the software processing unit 20 simultaneously with the start of counting. The software processing unit 20 starts an interrupt process set in advance by inputting an interrupt signal to the interrupt processing unit 23.

The interrupt processing means 23 inputs interrupt signals output from the first timer circuit 51, the second timer circuit 53, and the third timer circuit 55, and starts an interrupt process for controlling the engine, for example.
The interrupt processing unit 23 requests the counter increment unit 24 to increment the internal counter (331) when an interrupt signal is input from the first timer circuit 51.
Furthermore, when an interrupt signal is input from the first timer circuit 51, the interrupt processing unit 23 requests the WDC signal output unit 25 to switch the signal level of the WDC signal output to the WDT 12.

In the first timer register 52 of the first timer circuit 51, for example, a reference time used by the software processing unit 20 for measuring time, such as 1 [msec], is recorded. Each time the reference time is counted, the first timer circuit 51 outputs an interrupt signal to the software processing unit 20. The interrupt processing unit 23 causes the WDC signal output unit 25 to change the signal level of the WDC signal every time an interrupt signal is input from the first timer circuit 51.
The WDT 12 determines whether or not the first timer circuit 51 accurately measures the reference signal based on a change in the signal level of the WDC signal. When the WDT 12 determines that the WDC signal is abnormal, the WDT 12 outputs a reset signal to reset the microcomputer 14.

The processing procedure of the software processing unit 20 will be described with reference to the flowchart shown in FIG. In this flow, the interval time measured by the first timer circuit 51 is assumed to be 1 [msec]. The second timer circuit 53 outputs an interrupt signal to the software processing unit 20 every 4 msc, and the third timer circuit 55 outputs an interrupt signal to the software processing unit 20 every 8 [msec]. However, the interval time measured by the first timer circuit 51 is not limited to 1 [msec]. Similarly, the timing at which the second timer circuit 53 outputs the interrupt signal is not limited to 4 mesc, and the timing at which the third timer circuit 55 outputs the interrupt signal is not limited to 8 msec.
First, the software processing unit 20 inputs an interrupt signal from the first timer circuit 51 to measure 1 [msec] which is a reference time. When measuring the reference time, the software processing unit 20 increments the count value of the internal counter 331 by 1 (step S1). Next, the software processing unit 20 changes the signal level of the WDC signal. By changing the signal level of the WDC signal output to the WDT 12, the WDT 12 determines whether or not the first timer circuit 51 is measuring the reference time (1 [msec]) normally.

  Next, the software processing unit 20 determines whether or not the count value of the internal counter 331 is a multiple of 4 (step S3). When the count value of the internal counter 331 becomes a multiple of 4 (step S3 / YES), the software processing unit 20 sets the interval time of the second timer circuit 53 to the shortest time that can be measured (step S4), and the second The timer circuit 53 is started (step S5). Since the second timer circuit 53 has the interval time set to the shortest time, the second timer circuit 53 outputs an interrupt signal to the software processing unit 20 simultaneously with the start of timing. The software processing unit 20 receiving the interrupt signal from the second timer circuit 53 starts processing for engine control with the input of the interrupt signal as a start timing.

  Next, the software processing unit 20 determines whether or not the count value of the internal counter 331 is a multiple of 8 (step S6). When the count value of the internal counter 331 becomes a multiple of 8 (step S6 / YES), the software processing unit 20 sets the interval time of the third timer circuit 55 to the shortest time that can be measured (step S7), and the third The timer circuit 55 is started (step S7). The third timer circuit 55 outputs an interrupt signal to the software processing unit 20 at the same time as the start of timing because the interval time is set to the shortest time. The software processing unit 20 receiving the interrupt signal from the third timer circuit 55 starts processing for engine control with the input of the interrupt signal as a start timing.

  Next, the software processing unit 20 determines whether or not the ignition key is turned off (step S9). If the ignition key is not turned off (step S9 / NO), the software processing unit 20 returns to step S1 and repeats the processing from S1. If the ignition key is turned off (step S9 / YES), the software processing unit 20 ends this process.

As described above, in this embodiment, if it is verified whether or not the cycle of the reference interrupt signal output from the first timer circuit 51 is normal, the cycle of the interrupt signal output from another timer circuit is normal. It can be easily determined whether or not.
The software processing unit 20 measures a predetermined period based on the reference time counted by the first timer circuit 51 that is guaranteed to operate, and sends an interrupt signal to the second timer circuit 53 and the third timer circuit 55 every predetermined period. Output.
Therefore, it is possible to reduce the rate of occurrence of an abnormality in the period of the interrupt signal output from the second timer circuit 53 and the third timer circuit 55.

A second embodiment of the present invention will be described with reference to the accompanying drawings.
The EFI-ECU 10 of the second embodiment will be described with reference to FIG. As shown in FIG. 6, the software processing unit 20 of the second embodiment newly includes a comparison unit 26 and an internal counter restoration unit 27. In addition to the internal counter (corresponding to the basic counter of the present invention) 331, the RAM 33 includes a first backup counter (corresponding to the backup counter of the present invention) 332, a second backup counter (corresponding to the backup counter of the present invention). 333) and a third backup counter (corresponding to the backup counter of the present invention) 334 are formed.
The first backup counter 332 to the third backup counter 334 are areas prepared for backup. The comparison means 26 detects whether an error has occurred in the count value of the internal counter 331 by comparing the count value of the internal counter 331 with the count values of the first backup counter 332 to the third backup counter 334. To do. As the comparison method, for example, it may be determined whether or not the count value of the internal counter 331 and the count values of the first backup counter 332 to the third backup counter 334 all match. Further, among the count values of the first backup counter 332 to the third backup counter 334, the count value in which the same value is stored most often is set as the count value determined by majority decision, and this count value and the count value of the internal counter 331 are You may compare.

FIG. 7 shows a case where the values of the first backup counter 332 to the third backup counter 334 are the same as the count value of the internal counter. In this case, the software processing unit 20 determines that no abnormality has occurred in the count value of the internal counter, and uses the count value of the internal counter 331 to determine the start timing of the second timer circuit 53 and the third timer circuit 55. Count.
FIG. 8 shows a case where the values of the first backup counter 332 to the third backup counter 334 are different from the count value of the internal counter. If the comparison unit 26 determines that an error has occurred in the count value of the internal counter 331 as a result of the comparison, the comparison unit 26 requests the internal counter recovery unit 27 to restore the internal counter 331. The internal counter recovery means 27 writes the count value determined by majority vote among the count values of the first backup counter 332 to the third backup counter 334 as the count value of the internal counter 331.

Next, the processing procedure of the present embodiment will be described with reference to the flowchart shown in FIG.
The procedure from when the software processing unit 20 increments the count value of the internal counter 331 by the interrupt signal from the first timer circuit 51 and changes the signal level of the WDC signal is the same as in the first embodiment. Is omitted.

  When the signal level of the WDC signal is changed, the software processing unit 20 reads the count values of the first backup counter 332 to the third backup counter 334. Then, the count value having the largest number of identical values among the read count values is determined by majority vote (step S14). Next, the software processing unit 20 adds [+1] to the count value of the backup counter determined by the majority decision and compares it with the count value of the internal counter. If the count value of the backup counter + 1 matches the count value of the internal counter (step S14 / NO), the software processing unit 20 determines that no error has occurred in the count value of the internal counter. . In this case, the subsequent processing is performed using the count value of the internal counter 331 as it is. If the count value of the backup counter + 1 and the count value of the internal counter do not match (step S14 / NO), a value obtained by adding [+1] to the count value of the backup counter determined by majority decision is set as a normal value. Then, it writes in the internal counter 331 (step S15).

  Thereafter, the software processing unit 20 determines whether or not the count value of the internal counter is a multiple of 4 or a multiple of 8 as in the first embodiment (step S16 or step S19). When the number is four times (step S16 / YES), the interval time of the second timer circuit 53 is set to the shortest time, and an interrupt signal is generated in the second timer circuit 53 (step S18). If the count value of the internal counter is a multiple of 8 (step S19 / YES), the interval time of the third timer circuit 55 is set to the shortest time (step S20), and the third timer circuit 55 is set. An interrupt signal is generated (step S21).

  As described above, this embodiment can detect an error in the count value of the internal counter. Further, the detected error can be easily recovered with the backup value stored in the backup counter.

  The embodiment described above is a preferred embodiment of the present invention. However, the present invention is not limited to this, and various modifications can be made without departing from the scope of the present invention. For example, in the above-described embodiments, the electronically controlled fuel injection device is described as an example. However, the present invention can be applied to any electronic control device that controls a vehicle device. Further, the present invention can be applied to a device other than an electronic control device mounted on a vehicle.

It is a figure which shows the case where abnormality generate | occur | produces in the time measuring time of the timer. It is a figure which shows the structure of EFI-ECU of Example 1. FIG. It is a figure which shows the hardware constitutions of a microcomputer. It is a block diagram which shows the structure of the software processing part of 1st Example. It is a flowchart which shows the process sequence of the software process part of 1st Example. It is a figure which shows the structure of the software processing part of 2nd Example. It is a figure which shows the process outline | summary when abnormality has not generate | occur | produced in the count value of the internal counter. It is a figure which shows the process outline | summary in case abnormality has generate | occur | produced in the count value of the internal counter. It is a flowchart which shows the process sequence of the software process part of 2nd Example.

Explanation of symbols

2 Battery 10 EFI-ECU
11 Signal level converter 12 WDT
13 Power supply circuit 14 Microcomputer (control means)
DESCRIPTION OF SYMBOLS 15 Output circuit 20 Software processing part 21 Count value determination means 22 Interval time setting and timer start means 23 Interrupt processing means 23
24 counter increment means 25 WDC signal output means 51 first timer circuit (one timer circuit)
52 First timer register 53 Second timer circuit (other timer circuit)
54 Second timer register 55 Third timer circuit (second timer circuit)
56 Third timer register

Claims (6)

A control device including a plurality of timer circuits and executing an interrupt process by an interrupt signal output from the plurality of timer circuits,
A timer circuit for sending a reference interrupt signal;
A control unit that determines a processing timing of the interrupt processing based on the reference interrupt signal transmitted from the one timer circuit, and outputs an interrupt signal transmission command to another timer circuit when the processing timing is reached;
The other timer circuit that receives the interrupt signal sending command and sends the interrupt signal to the control unit;
A control device comprising:   When the control unit receives the reference interrupt signal from the one timer circuit, the control unit outputs the reference interrupt signal to the monitoring unit, and causes the monitoring unit to monitor the cycle of the reference interrupt signal. The control device according to claim 1.   2. The control unit according to claim 1, further comprising a basic counter that counts up each time the interrupt signal is received from the one timer circuit, and a backup counter that stores a count value of the basic counter as a backup. Or the control apparatus of 2. A plurality of backup counters;
The control unit selects a count value counted by the largest number of backup counters from the count values of the plurality of backup counters, compares the selected count value with the count value of the basic counter, and determines an error in the count value of the basic counter. The control device according to claim 3, wherein the control device is detected.   The control device receives an interrupt signal from at least one of the one timer circuit and the other timer circuit, and generates a control signal for controlling the engine as the interrupt processing. The control device according to claim 4. A step of receiving the reference interrupt signal from one timer circuit that transmits a reference interrupt signal among the plurality of timer circuits;
Determining the processing timing of the interrupt processing based on the reference interrupt signal, and outputting an interrupt signal sending instruction to another timer circuit when the processing timing is reached;
Receiving the interrupt signal sent from the other timer circuit, and starting the interrupt processing;
An interrupt signal generation method comprising:

Images