JPH04153548A - Watchdog timing - Google Patents

Abstract

PURPOSE:To detect the operation anomaly exceedingly speedily free from the erroneous judgement for the normal operation by prolonging the standard judgement time in which a watchdog timer judges anomaly, according to the engine revolution speed. CONSTITUTION:A watchdog timer 4 carries out the interruption processing synchronized with the engine revolution. In this case, a means for prolonging the standard judgement time for judging the anomaly of the watch dog timer 4 according to the engine revolution speed is installed. Accordingly, anomaly is judged in the shorter standard judgement time in the low engine revolution region, while in the high engine revolution region, anomay is judged in the longer standard judgement time. Accordingly in the superhigh speed revolution, the revolution interruption occurs in mush times, and eve if the delay of the base processing increases, the trouble of the erroneous judgement is prevented, and the average standard judgement time is shortened.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a watchdog timer for a vehicle electronic control system.

[Conventional technology]

Conventionally, a watchdog timer has been used to quickly reset a processor and execute fail-safe control when software goes out of control due to an accidental disturbance such as noise. This type of watchdog timer determines that a runaway has occurred if the processor does not issue a clear pulse signal within a predetermined period of time, and generates a reset signal to the processor. Various methods have been proposed (in particular, Publication number 64-1813, Japanese Patent Application Publication No. 63-2715
No. 45, JP-A-58-201108, etc.).

In both of these, the processor gives a clear pulse signal to the watchdog timer every time a predetermined process is executed. In the electronic control system for engine control of a vehicle, a clear pulse signal is given every time a predetermined base process is executed.

[Problem to be solved by the invention]

However, in electronic control systems that control vehicle engines, interrupt processing that is synchronized with time and interrupt processing that is synchronized with the rotation of the engine is frequently used, and when the engine rotates at high speeds, rotational interrupts occur frequently and delays in base processing become large. . For this reason, there is a problem in that the base processing cycle time becomes long during ultra-high speed rotation, and there is a risk that the watchdog timer will operate and generate a reset signal even though it is operating normally. On the other hand, if the reference determination time for determining abnormalities in the watchdog timer is lengthened, false determinations during extremely high-speed rotation will be eliminated, but there is a problem in that abnormality detection becomes extremely slow.

The present invention has been made in view of the above-mentioned problems, and its purpose is to provide a watchdog timer that can detect abnormal operation as quickly as possible without erroneously determining normal operation. It is about providing.

[Means to solve the problem]

In order to achieve the above object, in the present invention, in a watchdog timer of a vehicle electronic control system having an interrupt process synchronized with the engine rotation, the watchdog timer has a reference judgment time for determining abnormality at the engine rotation speed. A watchdog timer is provided, characterized in that it comprises an extension means for extending the time according to the following.

[Effect]

In the watchdog timer configured as described above, an abnormality is determined in a short reference determination time in a low engine speed range, and an abnormality is determined in a long reference determination time in a high engine speed range. Therefore, even when rotational interruptions occur frequently during ultra-high-speed rotation and delays in base processing become large, there is no risk of erroneous determination, and the average reference determination time is shortened.

〔Example〕

Embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of an electronic control system (EC1J) that controls the engine and transmission of an automobile. This electronic control system includes an input circuit 1,
Main microcomputer 2 (hereinafter referred to as main microcomputer 2)
It consists of a microcomputer (hereinafter abbreviated as a sub-microcomputer), an output circuit 3, and a watchdog timer 4.

The input circuit 1 includes a rotation sensor, a water temperature sensor, a vehicle speed sensor,
This circuit performs input processing such as waveform shaping and A/D conversion of signals from various sensors such as a throttle sensor. The main microcomputer 2 is a well-known microcomputer consisting of a CPU, ROM, RAM, etc., and controls the injection pulse width (INJ), energization start timing and ignition timing (IGT), and solenoid drive (ECT) based on various signals from the input circuit 1. Performs various calculation processes such as The output circuit 3 is a circuit that outputs various drive signals according to signals from the main microcomputer 2.

A rotation signal from the input circuit 1 and a clear pulse signal from the main microcomputer 2 are input to the watchdog timer 4, and a reset signal is output from the watchdog timer 4 to the main microcomputer 2.

FIG. 2 is a flowchart showing the processing by the main microcomputer 2, and FIG. 3 is a flowchart showing the processing by the watchdog timer 4 constituted by the sub-microcomputer.

As shown in Figure 2, the main microcomputer 2 handles the first timer interrupt every 110.4 ms for base processing.
20. Second timer interrupt processing every 16m5ec] 30
will be held.

In the base processing 1]0 shown in FIG. 2(a), step 1
11, various correction amounts such as water temperature correction and intake temperature correction are calculated in order to calculate the injection pulse width (INJ), ignition timing (IGT), etc. Next, in step ]]12, flag 8 is set to indicate that base processing has been executed, and step ]]]
Return to

In the first timer interrupt processing 120 every 4m5ec shown in FIG. 2(b), processing such as execution of A/D conversion is performed in step 121, and the first timer interrupt processing is performed in the next step 122. A flag B indicating this is set. Then, the process returns to the base process 110 from step 123.

In the second timer interrupt process 130 every 6m5ec shown in FIG. 2(c), processing such as idle determination is executed in step 13. Next, in step 132, it is checked whether flags A and B set in steps 112 and 122 are set. If both flags are set, it means that both the base processing 110 and the first timer interrupt processing 120 were executed normally, so the process advances to step 133 and the watchdog timer 4 is set.
Outputs a clear pulse signal to And step】34
Then, the flags A and B are reset and step 135
Then, the process returns to base processing 110.

On the other hand, if either flag A or B is reset in step 132, steps 132 to 13
5 and returns to base processing 110 without executing anything.

In the watchdog timer 4, as shown in FIG. 3, base processing 2: timer interrupt processing 220 every 0.16 msec, and clear interrupt processing 230 based on the clear pulse signal from the main microcomputer 2 are performed.

In the base processing 210 shown in FIG. 3(a), step 2
At step 11, the rotation signal Ne from the input circuit 1 is read, and at the next step 212, it is checked whether or not the read engine rotation speed Ne is larger than a predetermined value NO. If the engine speed Ne is greater than the predetermined value No, step 213
, set Ka to the reference value Ko, and set the engine speed N.
If e is smaller than the predetermined value No, the process proceeds to step 214, where Kb is set as the reference value Ko. Here, Ka is K
It is a larger value than b. Then, the process returns to step 211 and repeats the above process.

In the timer interrupt processing 220 shown in FIG. 3(b), in step 221, the value of the variable is counted up (K
=+1). In the next step 222, the value of the counted up variable is set to the reference value Ko (the value of Ko is Ka
or Kb). If the value of the variable is greater than the reference value Ko, it is determined that there is some kind of abnormality, and the process proceeds to step 223, where a reset signal is output to the main microcomputer 2. The main microcomputer 2 is returned to its initial state by a reset signal from the watchdog timer 4, and starts over from the first process, which is a fail-safe operation. If the value of the variable is smaller than the reference value Ko, it is determined to be normal, and the process jumps from step 222 to step 224 without executing anything, and returns to base processing 2]0.

In the clear interrupt processing 230 by the clear pulse signal from the main microcomputer 2 shown in FIG. 3(b), in step 231, the value of the variable is reset to 0, and in step 23
2 returns to base processing 210. In this manner, the main microcomputer 2 is confirmed to be normal by outputting a clear pulse signal in step 32 before the value of the variable counts up and exceeds the predetermined reference value Ko.

When the engine is running at high speed, the reference value Ko is changed from Kb to a larger value Ka in step 213 to extend the reference determination time for the watchdog timer 4 to determine an abnormality. That is, the processing in steps 212, 213, 2]4 constitutes an extension means for extending the standard determination time for the watchdog timer 4 to determine abnormality in accordance with the engine speed.

Therefore, even if the rotation of the base processing 110 is delayed due to a rotation synchronization interrupt when the engine is running at high speed, there is no risk that the watchdog timer 4 will erroneously determine that the main microcomputer 2 is abnormal. On the other hand, when the engine speed is low, the reference value KO is changed to a smaller value Kb in step 2]4, so the reference judgment time for the watchdog timer 4 to judge an abnormality is shortened, and the abnormality of the main microcomputer 2 can be quickly determined. do.

In the embodiment described above, a sub-microcomputer is used for the watchdog timer 4, but it is also possible to configure it with an analog circuit.

FIG. 4 is a circuit diagram showing an example thereof. This circuit is discharged by an F/V converter (frequency/voltage converter) 41 that converts the rotation signal from the input circuit 1 into a voltage signal, and a clear pulse signal a from the main microcomputer 2, and charged at a constant time constant. A charging/discharging circuit 42 that generates a reference voltage that is the sum of the output voltage of the F/V converter and the voltage of the reference power source 43
It is composed of a comparator 44 that compares the output voltage C of 2 and a monostable multivibrator 45 that is triggered by the output d of the comparator 44, and the output e of the monostable multivibrator 45 is sent to the main microcontroller as a reset signal. 2 and is also returned to the input of the charging/discharging circuit 42.

FIG. 5 is a waveform diagram illustrating the operation of the watchdog timer circuit. The charging/discharging circuit 42 is discharged every time the clear pulse signal a is input from the main microcomputer 2, and if the clear pulse signal a is not input for a predetermined period of time or more, the charging/discharging circuit 4 is discharged.
The output voltage C of the comparator 44 becomes higher than the reference voltage C.
The monostable multivibrator 45 is triggered by the output d, and a reset signal e is output. Here, the reference voltage is increased by the F7V converter 41 as the engine speed increases, and the watchdog timer circuit 4 extends the reference determination time for determining abnormality.

That is, the F/V converter (frequency/voltage converter) 41 constitutes an extension means for extending the reference determination time for the watchdog timer circuit 4 to determine abnormality according to the engine rotation speed.

In the above circuit, the reference voltage is increased by the F/V converter 41 according to the engine speed, but the reference voltage is fixed at a constant value, and the charging time constant of the charging/discharging circuit is set to the engine speed. It may be possible to switch depending on the situation.

In each of the embodiments described above, the extension means for extending the reference judgment time for determining an abnormality according to the engine rotation speed is configured in the watchdog timer 4, but it is also possible to configure the extension means in the main microcomputer 2. It is. In this case, the watchdog timer circuit may be a normal watchdog timer circuit that outputs a reset signal after a predetermined period of time unless a clear pulse signal is input.

FIG. 6 is a flowchart of the main microcomputer 2 showing a third embodiment, which is an example thereof. In base processing 3]0 shown in FIG. 6(a), after finishing the process (step 3]), the variable C] is reset to the mouth (step 31
2). In the first timer interrupt 320 every 4 ms e c shown in FIG. 6(b), the processing (step 321)
After finishing, count up variable C1 by 1 (
Step 322). Then, 16m shown in Figure 6(c)
In the second timer interrupt 330 for each s e c, after finishing the processing (step 331), step 332
Then, the reference number CIO is set in accordance with the engine rotational speed Ne, for example, as shown in FIG. 7, the reference number CIO becomes larger as the rotational speed Ne becomes higher.

Then, in step 333, it is checked whether the variable C] is larger than the reference number 010. If not, the clear pulse signal is sent to watchdog timer 4 in step 334.
Output to. It is thicker than the reference number CIO (if it is, nothing is executed and the process jumps to step 335 and returns to base processing 310).

If the clear pulse signal is not output, a reset signal is output from the watchdog timer 4 after a predetermined period of time has elapsed. Here, the process of step 332 constitutes an extension means for extending the reference determination time for determining abnormality according to the engine rotation speed.

FIG. 8 is a flowchart of the main microcomputer 2 showing a fourth embodiment, which is another example. Here, the number of occurrences 02 of rotational interrupts during the base processing round is counted, and the reference determination time is extended.

First, in the rotation interrupt process 420 shown in FIG. 8(b), after finishing the process (step 421), the variable C2
is counted up by 1 (step 422).

Then, in the base processing 410 shown in FIG. 8(a), after completing the processing (step 4] 1), the variable C31 is determined from the formula C31=C30+A¥C2.

Here, C30 is a basic value obtained by adding a predetermined margin to the time required for the base processing cycle when there is no rotation interrupt, and A is a positive coefficient. Next, in steps 413 and 414, the variable 02
and reset variable 03 to O.

Further, in the first timer interrupt 430 every 4 msec shown in FIG. 8(c), after the processing (step 431) is finished, the variable C3 is counted up by 1 (step 432).

Then, in the second timer interrupt 440 every 64 ms e c shown in the 8th IN (cl), after finishing the process (step 44]), in step 442, the variable 03
It is checked whether C31 is larger than variable C31. If not, the process advances to step 443 and a clear pulse signal is output to the watchdog timer 4.

If variable 03 is larger than variable C31, nothing is executed and the process jumps to step 444, returning to base processing 410.

If the clear pulse signal is not output, a reset signal is output from the watchdog timer 4 after a predetermined period of time has elapsed. Here, the process of step 412 constitutes an extension means for extending the reference determination time for determining abnormality according to the engine rotation speed.

In this embodiment, only the number C2 of occurrences of rotational interrupts is counted, but the number of occurrences of all interrupts such as timer interrupts may be counted.

Furthermore, since the processing time varies depending on the type of interrupt processing, each interrupt processing may be weighted and counted.

FIG. 9 is a flowchart of the main microcomputer 2 showing another example of the fifth embodiment. Here, the time required for the base processing cycle is determined, and the reference determination time is extended from the average time.

In the base processing 510 shown in FIG. 9(a), the processing (
After completing step 511), the value T1 of the free run counter (FRC) is read in step 512. Next, in step 513, the previously read FRCO value T
2 and the current value T1, the time T required for the current base processing round is calculated (ΔT=T2-TI). In step 514, value T2 is replaced with the current value T1, and in step 515, variable 04 is reset to 0.

Further, in the first timer interrupt 520 every 4m5ec shown in FIG. 9(b), after the processing (step 521) is finished, the variable 04 is counted up by 1 (step 522).

Then, the second
In the timer interrupt 530, in step 53I, TO is set to the average value of the base processing cycle time ΔTO=(7XΔ
It is determined by the formula: TO+8T)/8. Next, in step 532, the reference variable C40 is calculated from the average value ΔTO.
is determined.

Furthermore, the third
The timer interrupt 540 executes the corresponding process (step 54
After completing step 1), it is checked in step 542 whether variable 04 is greater than variable C40. If not, the process advances to step 543 and a clear pulse signal is output to the watchdog timer 4.

If variable 04 is greater than variable C40, nothing is executed and the process jumps to step 544, returning to base processing 510.

If the clear pulse signal is not output, a reset signal is output from the watchdog timer 4 after a predetermined period of time has elapsed. Here steps 512.513.53], 532
This process constitutes an extension means for extending the reference determination time for determining abnormality according to the engine rotation speed.

〔Effect of the invention〕

The present invention has the above-mentioned configuration and is equipped with an extension means for extending the standard judgment time for the watchdog timer to judge abnormality according to the engine rotational speed. This has the excellent effect of being able to detect abnormalities in motion as quickly as possible without making erroneous judgments about the motion.

[Brief explanation of the drawing]

The drawings show embodiments of the present invention, and FIG. 1 is a block diagram showing the configuration of an electronic control system (ECU) that controls the engine and transmission of an automobile, and FIGS.
b) and (c) are flowcharts showing processing in the main microcomputer, Figures 3(a), (b), and (C) are flowcharts showing processing in the submicrocomputer, and Figure 4 is an example of a watchdog timer. 5 is a waveform diagram showing its operation, FIGS. 6(a), (b), and (c) are flowcharts showing the third embodiment, FIG. 7 is a characteristic diagram, and FIG. a), (b), (c) and (d) are flowcharts showing the fourth embodiment, and Fig. 9 (a), (b), (c) and (d) show the fifth actual flow side. FIG. 11. Input circuit, 2. , main microcomputer, 31. Output circuit, 40. Woo-y-chi dog timer. Figure rotation speed Ne Figure (c) (G) Figure (b) (c) 310, Figure (b) 320, (c) (a) (b) Figure (C) (d) (G) (b ) figure

Claims (1)

[Scope of Claims] A watchdog timer for a vehicle electronic control system having an interrupt process synchronized with the rotation of the engine, the watchdog timer comprising an extension means for extending the reference judgment time for determining an abnormality according to the engine rotation speed. A watchdog timer characterized by: