JPH04295955A - Arithmetic abnormality detecting device for controller - Google Patents

Abstract

PURPOSE:To detect the abnormality of an arithmetic function of a microcomputer. CONSTITUTION:Plural microcomputers are connected so that a communication can be executed, and each microcomputer executes a prescribed operation, respectively and transmits its contents and result to the other by a communication, executes an operation, based on received data, and checks whether a result of executed operation and a received operation result identify with each other or not.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to the detection of arithmetic abnormalities in a control device such as a microcomputer.

0002

2. Description of the Related Art For example, many in-vehicle electronic devices are equipped with a microcomputer, and this type of device is provided with an abnormality detection circuit in order to improve reliability of control. This type of conventional abnormality detection circuit detects a runaway of a microcomputer, and uses software processing to output a pulse signal of a constant period from the microcomputer, and also checks whether this pulse signal appears normally. This is monitored by an external circuit called a watchdog timer.

0003

[Problems to be Solved by the Invention] In conventional abnormality detection circuits, when the processing contents change significantly, such as when a microcomputer goes out of control, the pulse stops or the pulse width decreases. Abnormalities can be detected because the values change significantly, but if a small part of the microcomputer's internals breaks down, for example, if part of the arithmetic function breaks down, the order in which programs are executed remains normal. Therefore, normal pulses will continue to be output, and there is a high possibility that the abnormality will not be detected. However, even if only a part of the calculation function fails and the abnormality cannot be detected, there is a possibility that a fatal malfunction will occur in the entire device. The possibility of this type of failure cannot be overlooked in the case of on-vehicle devices that require high reliability, such as automatic vehicle speed control devices, automatic brake control devices, power steering devices, and the like.

Therefore, it is an object of the present invention to detect abnormalities in the arithmetic function of a control device such as a microcomputer.

[0005]

[Means for Solving the Problems] In order to solve the above problems, the present invention provides a control device having a plurality of independent control means each having a memory, a data input/output function, and a data calculation function. In the abnormality detection device: the plurality of control means are connected to each other so that data can be freely input/output, and each control means has a calculation means for executing a predetermined calculation function on predetermined calculation target data; A transmitting means for transmitting the arithmetic function code of the executed computation, the computation target data, and the result of the computation to the control means of the other party; a receiving means for receiving the information transmitted by the transmitting means; and the received computation target. Abnormality detection means is provided which executes an arithmetic function corresponding to the received arithmetic function code on the data and compares the arithmetic result with the received arithmetic result to identify the presence or absence of an abnormality.

[0006]

[Operation] In the present invention, a plurality of independent control means such as microcomputers are provided, and the result of calculation in one control means is compared with the result of calculation in the other control means to determine whether there is an abnormality in calculation. is identified. In other words, the function code of the operation (a code that indicates the classification of addition, subtraction, multiplication, etc.), the data to be operated on (the code that specifies the numerical value to be operated on, or the register that holds the numerical value to be operated on, or If you send the data (memory address data) and the calculation result (on the sending side) to the other party, and execute the calculation based on the function code of the received data and the data to be calculated, the sending side Usually, the same result as the operation in is obtained. Therefore, when the received calculation result on the sending side and the calculation result on the receiving side match, the calculation function of both the sending side and the receiving side is normal.If not, the calculation function of either the sending side or the receiving side is normal. The function can be considered abnormal. Microcomputers are equipped with various calculation functions, and since the present invention also transmits the calculation function code to the receiving side, it is possible to sequentially check for abnormalities in the various calculation functions. .

In the embodiment described later, not only the numerical value but also the contents of a flag register that changes depending on the result of the calculation are sent to the other party as the result of the calculation, and the function of each flag is also compared with the result of the calculation. ing. This makes it possible to more reliably detect the presence or absence of a calculation abnormality.

[0008]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows the configuration of the main parts of one type of system for implementing the present invention. This system is an in-vehicle electronic device, specifically an anti-skid control device that detects the rotational speed of the wheels and controls the brake pressure according to the detection results. That is, it detects whether or not each wheel is locked, and when a wheel is likely to lock, the pressure control valve is controlled to weaken the brake pressure and prevent the wheels from locking. The basic structure and control method for brake pressure control of this system is the same as that of a conventional device such as that disclosed in JP-A-60-35647, and is not a feature of the present invention, so it will be explained here. is omitted.

Referring to FIG. 1, vehicle speed signals (two) output from a vehicle speed sensor 1L that detects the rotational speed of the front left wheel (FL) and the rear left wheel (RL) are transmitted via an interface 2. Input to microcomputer 3, right front wheel (FR)
and a vehicle speed sensor 1 that detects the rotational speed of the right rear wheel (RR).
The vehicle speed signals (two) output by R are connected to interface 2.
The data is inputted to the microcomputer 4 via. One microcomputer 3 controls each brake of the left front wheel and the left rear wheel.
The other microcomputer 4 controls the pressure control valve (not shown) that controls the brake pressure of the right front wheel and the right rear wheel. energization control of a solenoid (not shown). However, in order to perform pressure control on the left front wheel and left rear wheel, wheel speed information on the right front wheel and right rear wheel is also required. Since wheel speed information is also required, microcomputer 3
By communicating with each other via a serial communication line, the microcomputer 4 also obtains wheel speed information detected by the other party. In this embodiment, microcomputers 3 and 4 are connected to each other via three signal lines so that they can communicate serially.

As described later, the microcomputer 3
and 4 are designed to detect abnormalities, respectively.
If an abnormality is detected, an abnormality signal (low level L) is applied to the input terminal of the OR gate 7. Or Gate 7 is
When any of the input terminals becomes L level, an L level inhibition signal is output from the output terminal. This prohibition signal is
It is applied to the control inhibit terminals of the solenoid drivers 5 and 6. Each solenoid driver inhibits energization of the solenoid when an inhibit signal is applied. In the prohibited state, the reduction control of each brake pressure is not performed, and the brake pressure is generated in accordance with the degree to which the driver presses the brake pedal, so it is safe.

Microcomputers 3 and 4 are single-chip microcomputers with the same configuration (internal ROM programs are slightly different), and each includes a microprocessor, ROM, RAM, programmable timer, serial Interfaces and the like are provided as hardware.

FIG. 2 shows the configuration of the serial interface. Referring to FIG. 2, this unit includes a transmission register 31, a parallel-in/serial-out shift register 32, a transmission control circuit 33, a mode control circuit 34, an interrupt control circuit 35, a flag register 36, and a flag control circuit 3.
7, a rate generator 38, a reception register 39, a serial-in/parallel-out shift register 40, a reception control circuit 41, and an internal clock generator 42. Although this unit itself does not have a special configuration, the contents of the serial communication processing performed using this unit are important, so the operation of this unit will be briefly explained.

The serial signal input from the serial signal input terminal RX is converted into an 8-bit (1 byte) parallel signal by the shift register 40, and then sent to the reception register 39.
will be forwarded to. The contents of the receive register 39 can be read by microcomputer software processing. Furthermore, the 8-bit transmission data stored in the transmission register 31 is applied to the shift register 32, where it is converted into 1-bit serial data and outputted from the serial signal output terminal TX. Any 8-bit data can be written into the transmission register 31 by software processing by a microcomputer. shift register 32
The timing of the bit shift of 40 and 40, that is, the transfer rate of the serial signal, is determined by the cycle of the clock output from the internal clock generator 42 or the clock input from the external clock input terminal CKI and the mode control circuit 34. The rate generator 38 determines the rate based on the set transfer rate information. In this example, one microcomputer 3 uses its own internal clock for serial communication, while the other microcomputer 4 uses a clock input from an external clock input terminal CKI. Therefore, as shown in FIG. 1, the clock output terminal CKO of the microcomputer 3 is connected to the external clock input terminal CKI of the microcomputer 4. Therefore, microcomputers 3 and 4 transmit serial data using clock pulses of the same period. When the output of all bits, ie, one byte of data, is completed by bit shifting of the shift register 32, one bit (transmission enable flag) on the flag register 36 is set under the control of the flag control circuit 37. Further, when all bits, that is, one byte of data input is completed by bit shifting of the shift register 40, one bit (receiving flag) on the flag register 36 is set under the control of the flag control circuit 37. The contents of each bit of the flag register 36 can be read by software processing of a microcomputer. The information in the flag register 36 is also applied to the interrupt control circuit 35, and when the transmit enable flag or the receive flag is set, a communication interrupt request is generated to the microcomputer. However, each of the communication interrupt requests for the transmittable flag and the communication interrupt request for the receive flag can be inhibited by software processing of the microcomputer.

FIG. 3 shows the main processing routine of the microcomputer 3. This will be explained with reference to FIG. In step S1, initialization processing is executed. That is, various modes
After executing the code setting, output port initialization, memory clearing, etc., initial values are stored in various memories to be used later, and internal timer and interrupt settings are executed. The processing of steps S3 to S10 is performed at a constant cycle (5 msec)
Executed once every time. That is, in step S2, the value of the internal timer is checked, and every time the value reaches 5 msec, the timer is reset and the process proceeds to the next step S3. When step S10 is completed, the process returns to S2 and repeats this operation.

In step S3, the two signals (FL, RL) output by the vehicle speed sensor 1L are read, the vehicle speed is detected, and the results are stored in the memory. In reality, each signal output by the vehicle speed sensor is a pulse whose period changes depending on the vehicle speed, so the vehicle speed is measured by counting the number of pulses that appear in a certain period of time.

In step S4, transmission data for checking the arithmetic functions of the microcomputers 3 and 4 is generated, and the data is stored in the memory. Details of this processing will be explained later.

In the next step S5, a flag TFG is set, and in step S6, an input end command (1-byte data of a predetermined value) is transmitted to the microcomputer 4 via the serial communication line TX. In step S7, the process waits until the flag TFG is reset.

After executing step S6, when data is sent from the microcomputer 4, a reception interrupt request is generated, and in response, a ``reception interrupt processing'' IN is issued.
T1 is executed. When the flag TFG is reset in the "receiving interrupt processing" INT1, the main routine processing advances to the next step S8. That is, the "reception interrupt processing" is executed between S6 and S7 of the main routine.

In step S8, the arithmetic functions of the microcomputers 3 and 4 are checked. Details of this processing will be explained later.

In step S9, various calculations for controlling the brake pressure are executed based on the detected rotation speeds of the four wheels, and in the next step S10, the brake pressure at the left front wheel and left rear wheel positions is adjusted. A control signal that determines the control amount of each control valve that controls pressure is output to the solenoid driver 5. The details of this control are the same as those of the generally known brake pressure control, so a description thereof will be omitted.

FIG. 4 shows the main processing routine of the microcomputer 4. This will be explained with reference to FIG. In step S21, initialization processing is executed. That is, after setting various modes, initializing output ports, clearing memory, etc., it stores initial values for each type of memory that will be used later, and also sets internal timers and interrupts. . The processing of steps S23 to S32 is performed at a fixed period (5 msec).
) is executed once for each That is, the value of the internal timer is checked in step S22, and the timer is reset every time the value reaches 5 msec, and the process proceeds to the next step S23. When step S32 is completed, the process returns to S22 again.
Repeat this action.

In step S23, the two signals (FR, RR) output by the vehicle speed sensor 1R are read, the vehicle speed is detected, and the results are stored in the memory. In reality, each signal output by the vehicle speed sensor is a pulse whose period changes depending on the vehicle speed, so the vehicle speed is measured by counting the number of pulses that appear in a certain period of time.

In step S24, the microcomputer
Transmission data for checking the arithmetic functions of the data processors 3 and 4 is generated, and the data is stored in memory. Details of this processing will be explained later.

In the next step S25, the flag ENDFG is
Waits until ENDFG is set, and when it is set, resets ENDFG in step S26, and then returns to step S2.
The flag TFGB is set in step S28, and the data is set in step S28.
Data transfer request command (1 byte data with predetermined value)
is transmitted to the microcomputer 3 via the serial communication line TX. In the next step S29, the flag TFG
Wait until it is reset.

When data (input end command) is sent from the microcomputer 3, a reception interrupt request is generated, and in response, a "reception interrupt process" INT2 is executed. When the flag ENDFG is set in "reception interrupt processing" INT2, the process advances from S25 to S26. After the data transfer request command is output in step S28, when data is sent from the microcomputer 3, a reception interrupt request is generated again, and in response, the
Reception interrupt processing "INT2" is executed. When flag TFGB is reset in this interrupt processing INT2,
The main routine processing advances to the next step S30.

In step S30, the microcomputer
Check the arithmetic functions of data controllers 3 and 4. Details of this processing will be explained later.

In step S31, various calculations for controlling the brake pressure are executed based on the detected rotational speeds of the four wheels, and in the next step S32, the brake pressure at the right front wheel and right rear wheel positions is adjusted. A control signal that determines the control amount of each control valve that controls pressure is output to the solenoid driver 6. The contents of this control are generally known as
Since the details are the same as the key pressure control, the explanation thereof will be omitted.

Next, the content of serial data communication between microcomputer 3 and microcomputer 4 will be explained in more detail. Microcomputer 3's ``
FIG. 6 shows the contents of the "receiving interrupt process" INT1, FIG. 7 shows the contents of the "receiving interrupt process" INT2 of the microcomputer 4, and FIG. 5 shows the flow of the process mainly consisting of serial data communication. Note that in FIG. 5 and the following explanation, the microcomputer is referred to as a microcomputer. In this example, the serial data communication mode is
A clock synchronization method, a transfer rate of 1M baud, a data length of 8 bits, a start bit of 1 bit, a stop bit of 1 bit, and full duplex communication are set.

The flow of communication processing will be explained step by step with reference to each figure. As shown in Figure 5, when the microcomputer 3 sends the "input end command", the reception flag is set on the serial interface of the microcomputer 4, and an interrupt request is generated. Processing (INT2)
Start. In this case, first, in step S61, the contents of the reception register (39) are read. At this time, the flag TFG
Since B has not yet been set, the next step is step S62.
The process then proceeds to S71. In this case, since the value of the data read from the reception register is a predetermined input end command, the flag ENDFG is set in the next step S72, and then in step S73, the registers SARB and SCB allocated in advance on the memory are , LARB, and LCB respectively store the received data storage address, the number of received data bytes, the transmitted data load address, and the number of transmitted data bytes. The address values entering registers SARB and LARB are respectively stored in the receive buffer (IN
PBUF) and the start address of the transmission buffer (OUTBUF). After this, the microcomputer 4 ends the interrupt processing.

After the microcomputer 4 finishes the interrupt processing, it sends a data transfer request command to the microcomputer 3 in step S28 of the main routine. As a result, the reception flag is set on the serial interface of the microcomputer 3 and an interrupt request is generated, so the microcomputer 3 starts interrupt processing (INT1). In this case, the contents of the reception register (39) are first read in step S41, and serial communication interrupts are prohibited in the next step S42. While this interrupt is prohibited, no interrupt is generated even if serial data is transmitted from the microcomputer 4 to the microcomputer 3. In other words, multiple interrupts do not occur. At this time, since the content read from the reception register matches the predetermined "data transfer request command", the data is then passed through step S43 and sent to step S4.
Proceed to step 4. In step S44, registers SAR, SC
, LAR, and LC store the received data storage address, the number of received data bytes, the transmitted data load address, and the number of transmitted data bytes, respectively. register SA
The address values entering R and LAR are respectively stored in the receive buffer (INPBUF) and transmit buffer (O
Corresponds to the start address of UTBUF).

After this, data transmission from the microcomputer 3 to the microcomputer 4 is started. That is, steps S46-S4
8-S50-S51 or S46-S47-S5
1 to step S52, the register LAR
Memory whose address is the contents of (transmission buffer OUTB
The contents of the transmit register (any 1 byte on the UF) are sent to the transmit register (3
1), increment the contents of register (pointer) LAR by +1, and decrement the contents of register (counter) LC by -1. By writing one byte of data to the transmission register, the data is converted into a serial signal and transmitted to the microcomputer 4. In step S51, the transmission enable flag of the serial interface is checked. In other words,
Each time the data transmission of 1 byte is completed, the transmittable flag is set, so step S52 is executed every time the data transmission of 1 byte is completed, the next data is transmitted, and the data is actually sent. Data transmission is performed continuously. Also, in step S48, the reception flag of the serial interface is checked, and when data is received from the microcomputer 4, the reception flag is set, so when data is received, The next step S49 is executed. In step S49, the contents of the receive register (39) are stored in the memory (any one byte on the receive buffer INPBUF) whose address is the value of the register (pointer) SAR, the contents of the register SAR are incremented by 1, and the contents of the register (39) are
Counter) Decrement the contents of SC by 1.

When all the data to be transmitted has been transmitted, the value of the register LC becomes 0 and the process does not proceed to step S51, so step S52 is not executed and the data transmission ends. Furthermore, when all of the scheduled reception data has been received, the contents of register SC become 0, and from then on, step S
Since the process does not proceed to step S48, step S49 is not executed and the data is
Data reception ends. When data transmission and reception are completed, that is, when LC=0 and SC=0, the process advances from step S47 to S53. And flag TF in S53
G is reset, serial communication interrupt is enabled in the next step S54, and the process returns to the main routine.

When the microcomputer 4 (see FIG. 7) receives the first byte of data (the data following the input end command) from the microcomputer 3, it restarts the interrupt processing and Since the flag TFGB is sometimes set, the process advances to step S63. At S63, serial communication interrupts are prohibited. While this interrupt is disabled, an interrupt will not occur again even if data is received from microcomputer 3 or even if the transmit enable flag is set on the serial interface of microcomputer 4. There isn't. In other words, multiple interrupts do not occur.

In the next step S64, the receiving register (
39) in the memory (1 byte on the receive buffer INPBUF) whose address is the contents of register (pointer) SARB, and save the contents of register SARB to +
1, and the contents of register (counter) SCB are decremented by 1. Therefore, immediately after the data transmission from the microcomputer 3 to the microcomputer 4 is started, the data receiving operation of the microcomputer 4 is started. At the same time, the data transmission operation of the microcomputer 4 is also started. That is, each time the process passes through steps S65-S66 or passes through S68-S75-S66 and proceeds to S67,
The contents of the memory (1 byte on the transmit buffer OUTBUF) whose address is the contents of the register (pointer) LARB are stored in the transmit register (31), and the contents of the register LARB are stored in the transmit register (31).
The contents of RB are incremented by +1, and the contents of register (counter) LCB are decremented by -1. When data is stored in the transmission register, the data is converted into a serial signal and transmitted to the microcomputer 3. In step S66, the transmission enable flag on the serial interface of the microcomputer 4 is checked. In other words, each time transmission of 1 byte of data is completed, the transmission enable flag is set, so each time transmission of 1 byte of data is completed, step S67 is executed and the next data is transmitted. , data transmission is performed substantially continuously.

When data from the second byte onward is received, the process advances to step S70 through step S69, and the received one-byte data is input in the same manner as step S64. In step S69, the reception flag on the serial interface of the microcomputer 4 is checked. That is, each time one byte of data is received, step S70 is executed and the received data is input. If data is transmitted continuously, data reception is also performed continuously.

When all the data to be transmitted has been transmitted, the value of the register LCB becomes 0 and the process does not proceed to step S66, so step S67 is not executed and the data transmission ends. Furthermore, when all the scheduled reception data has been received, the contents of the register SCB become 0, and the process does not proceed to step S69, so step S70 is not executed.
Data reception ends. When data transmission and reception are completed, that is, when LCB=0 and SCB=0, the process advances from step S75 to S76. Then, in step S76, the flag TFGB is reset, and in the next step S77, serial communication interrupt is enabled, and the process returns to the main routine.

In other words, in this embodiment, as shown in FIG. After synchronizing the start of communication operation, microcontroller 3 sends and receives data as many times as necessary, and microcontroller 4 also sends and receives data.
Data reception and transmission are performed as many times as necessary. Microcomputer 3
Both the microcomputer 4 and the microcomputer 4 can receive data while transmitting data, and can transmit data while receiving data. Moreover, since no interrupt occurs after the serial communication operation is started, the operation of saving and restoring various registers does not occur repeatedly, and communication control can be processed in the shortest possible time. Since multiple interrupts can be avoided, the consumption of stack memory for saving registers can also be reduced. If the number of bytes of transmitted data is equal to the number of bytes of received data, data transmission and reception are completed almost simultaneously.

Next, abnormality detection in the arithmetic functions of the microcomputers 3 and 4 will be explained. Simply put, the microcomputers 3 and 4 are made to execute the same calculation, and by checking whether the results are equal or not, it is possible to identify whether or not an abnormality has occurred. In order to have two microcontrollers execute the same operation, one microcontroller sends the function code, operation target data, and operation result of the operation executed to the other microcontroller, and the other microcontroller transmits the received function. An operation corresponding to the code is executed on the received operation target data, and the result is compared with the received operation result. Further, this operation is performed by both the microcomputer 3 and the microcomputer 4.

FIG. 10 shows the transmission buffer O on the microcomputer 3 side.
UTBUF, receive buffer INPBUF, and instruction table
shows the memory map of the bull. The microcomputer 4 side is also provided with a transmission buffer, a reception buffer, and an instruction table, and the vehicle speed data in the transmission buffer is stored in the FR and R.
The vehicle speed data in the reception buffer changes to FL and RL.
The only difference is that it changes to . All the data in the transmission buffer OUTBUF is transmitted to the other party's microcomputer by the aforementioned serial communication operation, and the transmitted data is stored in the reception buffer INPBUF. Before starting data transmission, data for a calculation function check is prepared on the transmission buffer OUTBUF in step S4 shown in FIG. 3 (or step 24 in FIG. 4).

Details of step S4 are shown in FIG. This will be explained with reference to FIG. Note that step S in microcomputer 4
24 is the same as in FIG. 8, so its explanation will be omitted. In step S81, the contents of the register INSCNT are incremented by 1. In the next step S82, the contents of the register INSCNT are checked, and if the contents are 13 or more, INSCNT is cleared to 0 in the next step S83. That is, the value of the register INSCNT is updated by 1 every time the process shown in FIG. 8 is executed, and changes in the range of 0 to 12. In step S84, the next process is selected depending on the contents of the register INSCNT.

[0041] That is, the value of INSCNT is 0, 1, 2, 3.
, 4, 5, 6, 7, 8, 9, 10, 11 and 12, addition operation processing, subtraction operation processing, multiplication operation processing, division operation processing, right shift operation processing, left shift operation processing is performed in step S85, respectively. processing, AND (logical product) operation processing,
OR (logical sum) processing, EXOR (exclusive OR) processing, NEG (binary complement) processing, INC (1
addition) calculation processing, DEC (1 subtraction) calculation processing, and CL
R (clear) Executes arithmetic processing. In any calculation process, the calculation target data is stored on the transmission buffer OUTBUF.
After storing the data, the data is operated on. The data to be operated on is stored in the first operand (L, H) and second operand positions of the transmission buffer. For example, in addition operation processing, when calculating A+B, A becomes the first operand and B becomes the second operand. In this embodiment, for addition, subtraction, multiplication, AND, OR, and EXOR operations, 0 is stored in the first operand (L, H), and a predetermined fixed value is stored in the second operand. I'll keep it. During division, the upper 8 bits of the first operand (
A predetermined fixed value is also stored in H). Right shift, left shift, NEG, INC, DEC and CL
In the calculation process of R, a fixed value to be calculated is stored in the second operand. The result of the calculation in step S85 is stored in the transmission buffer at the position of the calculation result (L, H) in the next step S86. Note that in multiplication and division, the result is 16 bits, so the upper 8 bits and lower 8 bits are stored in the operation result (H) and operation result (L), respectively, but for other operations, the result is 8 bits. Since the result is a bit, the result is stored in the operation result (L) of the transmission buffer, and 0 is stored in the operation result (H). Furthermore, the microprocessor is provided with a register that holds a plurality of flags that can change depending on the result of an operation, and the contents of the register are also stored as the operation result in the location of the operation flag in the transmission buffer.

Flags that change depending on the result of the operation include:
N (determined according to the state of the most significant bit of the operation result),
Z (determined depending on whether the operation result is 0 or not), V (determined depending on the presence or absence of overflow), C (carry up from the most significant bit or down from the least significant bit) (determined depending on the presence or absence) etc.

In this way, the transmit buffer OUTBUF
The arithmetic function check data prepared above is transmitted to the other party's microcomputer together with the vehicle speed data, and stored on the other party's receiving buffer INPBUF. Then, in step S8 of FIG. 3 or step S30 of FIG. 4, the arithmetic function is checked with reference to the data on the reception buffer. Details of the process in step S8 are shown in FIG. This will be explained with reference to FIG. Note that the contents of step S30 are the same as S8, so the explanation thereof will be omitted.

In step S91, the reception buffer INP
Check the value of the receive instruction code INSRCV on the BUF. INSRCV corresponds to INSCNT on the transmitting side. In other words, since the value of INSRCV indicates the type of operation executed on the sending side, in step S91, INSRCV is
The next calculation process is selected according to the value of CV. That is, the received instruction code is 0, 1, 2, 3, 4, 5, 6, 7, 8, 9.
, 10, 11, and 12, in step S92, addition operation processing, subtraction operation processing, multiplication operation processing, division operation processing, right shift operation processing, left shift operation processing, A
ND operation processing, OR operation processing, EXOR operation processing, NE
G calculation processing, INC calculation processing, DEC calculation processing, and C
Executes LR calculation processing.

In these calculation processes, the values of the first and second operands on the reception buffer INPBUF are used as calculation targets, and the same calculation processes as those actually executed by the transmitting side are executed. The result of the calculation is then sent to the reception buffer INPBU in the next step S93.
Compare with the calculation result (L, H) on F and the calculation flag. If they both match, step S9
The process proceeds from step 4 to S95, but if either one does not match, the process proceeds to step S97 to execute error processing. In step S95, it is checked whether the arithmetic function regarding its own comparison instruction is normal. In reality, a comparison command is executed for two different numerical values (predetermined fixed values: for example, 5 and 6), and if the results do not match, it is considered normal, but when it is determined that they match, it is considered abnormal. The process proceeds to a deemed step S97. In step S97, since the calculation function of at least one of the two microcomputers 3 and 4 is abnormal, a prohibition signal (L) is applied to the OR gate 7.
Activation of both solenoid drivers 5 and 6 is prohibited.

In the above embodiment, a case was explained in which the value of the instruction counter (INSCNT) is sent to the other microcomputer as the function code of the computation in order to check the computation function. Command code that can be used
The value of the send buffer OUTB instead of INSCNT.
The data may be written to the UF and sent to the other microcomputer. In that case, for example, an instruction table (B1 to
Each BD contains the microcomputer's instruction code shown in hexadecimal notation.
If a code (code) is provided, the instruction code can be easily obtained from the value of the instruction counter.

Note that in the above embodiment, the detection of runaway of the microcomputer is omitted; however, the abnormality detection of the embodiment can detect an abnormality in the arithmetic function, but cannot detect runaway of the microcomputer, so a watchdog timer or the like is used. Of course, it is preferable to add a known runaway detection circuit.

[0048]

As described above, according to the present invention, since each of the plurality of control means (microcomputers 3 and 4) compares its own calculation results with the calculation results of the other side, the calculation of any control means Even if an abnormality occurs in a function, the abnormality on the other party can be reliably detected. Moreover, since the function code of the calculation, the data to be calculated, and the result of the calculation are transmitted to the other party through communication, the calculations executed by one control means and the other control means are always the same, and the calculations performed by one control means and the other control means are always the same. Even when changing the contents, there is no need to change the programs of both control means, and the type and contents of calculations (numerical values to be calculated, etc.) can be changed arbitrarily in each control means.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing the configuration of main electrical components of a system according to an embodiment.

FIG. 2 is a block diagram showing the configuration of a serial interface of a microcomputer.

[Figure 3] Flowchart showing the main routine of microcomputer 3
It is a chart.

[Figure 4] Flowchart showing the main routine of microcomputer 4
It is a chart.

5 is a time chart showing a communication procedure between microcomputers 3 and 4. FIG.

6 is a flowchart showing communication interrupt processing of the microcomputer 3. FIG.

7 is a flowchart showing communication interrupt processing of the microcomputer 4. FIG.

8 is a flowchart showing details of step S4 in FIG. 3. FIG.

9 is a flowchart showing details of step S8 in FIG. 3. FIG.

FIG. 10 is a memory map showing major memory allocation on the microcomputer.

[Explanation of symbols]

1L, 1R: Vehicle speed sensor 3, 4: Microcomputer (first and second control unit) 5, 6: Solenoid driver 32: Parallel in/serial out/shift register (transmission means) 40: Serial in/parallel Out shift register (reception means) INT1, INT2: Communication interrupt processing OUTBUF: Transmission buffer INPBUF: Reception buffer S4, S24: (calculation means) S8, S30: (abnormality detection means)

Claims (1)

[Claims] [Claim 1] Memory, data input/output function, and data
In a calculation abnormality detection device for a control device equipped with a plurality of independent control means each having a data calculation function: The plurality of control means are connected to each other so that data can be freely input/output, and each control means is provided with predetermined data to be calculated. - arithmetic means for executing a predetermined arithmetic function on the data; arithmetic function code of the executed arithmetic;
Transmitting means for transmitting data to be computed and results of computation to control means on the other side; Receiving means for receiving information transmitted by the transmitting means; and a computing function received for the received data to be computed. An arithmetic anomaly detection device for a control device, comprising: an anomaly detecting means for executing an arithmetic function corresponding to the code and comparing the arithmetic result with the received arithmetic result to determine whether there is an anomaly. .