JPH0728507A - Microcomputer system - Google Patents

Abstract

PURPOSE:To diversify the backup control and to reduce the cost by increasing the number of degrees of freedom of design change while enhancing the backup function. CONSTITUTION:A second microcomputer 2 reads in data outputted from various sensors, switches, or the like through an A/D converter 16 and an input buffer 15 and transfers these data to a first microcomputer 1 in serial. Meanwhile, the first microcomputer 1 controls a controlled system based on data transferred from the second microcomputer 2. In this case, the second microcomputer 2 performs parallel processings of an L task (program which has no branch instructions and is made into a fixed loop and has a high reliability) and an A task (program capable of even complicated processing) in time division and. monitors the operation of the first microcomputer 1 by the L task and takes over the control of the controlled system by the A task in the case of the abnormal operation of this first microcomputer 1.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a microcomputer system having a function of monitoring the operation of a microcomputer.

[0002]

2. Description of the Related Art Generally, a program executed by a microcomputer is usually used for fine control.
A relatively complicated program including many branch instructions (jump instructions) is used, and therefore, the microcomputer is prone to runaway or deadlock due to noise, address error, erroneous recognition of operation code or operand, etc. There is. For this reason, conventionally, a microcomputer incorporated in a control device that requires reliability has a watchdog circuit for backup runaway and a backup circuit incorporated as external hardware circuits.

[0003]

However, in backup control using an external hardware circuit such as a watchdog circuit and a backup circuit, the degree of freedom in design changes (changes in control contents) is low and the versatility is low. There is. Moreover, backup control has become too crude, and there is a strong demand for more diverse backup control.

Therefore, in recent years, as disclosed in Japanese Patent Laid-Open No. 3-70837, two microcomputers, a main computer and a sub computer, are provided, and when the operation of the main computer becomes abnormal, the sub computer backs up the data. There is something.

However, even with this configuration, it is necessary to provide a watchdog circuit outside in order to ensure the reliability of the sub computer. Moreover, since the data used for controlling the controlled object is read by both the main and sub microcomputers, the number of input ports in the entire system increases, and the watchdog circuit described above is required. Combined with this, there is a drawback that it leads to a significant cost increase.

The present invention has been made in view of the above circumstances, and an object thereof is to enhance the degree of freedom of design change (change of control content), diversify backup control, while enhancing the backup function. It is to provide a microcomputer system that can realize cost reduction.

[0007]

In order to achieve the above object, the microcomputer system of the present invention includes a first microcomputer for controlling an object to be controlled and data input of data output from various sensors and switches. A second microcomputer that reads through a unit and transfers to the first microcomputer;
Executes a program in a fixed loop without a branch instruction, monitors the operation of the first microcomputer by this program, and controls the control target when the operation becomes abnormal. Second
Is configured to act on behalf of a microcomputer.

[0008]

The second microcomputer reads the data output from various sensors and switches through the data input section such as the A / D converter and the read data is the first data.
Transfer to the microcomputer. On the other hand, the first microcomputer controls the control target based on the data transferred from the second microcomputer.
At this time, the second microcomputer monitors the operation of the first microcomputer and, when the operation becomes abnormal, acts as a proxy for the control target (on behalf of the subject).

The program executed by the second microcomputer to monitor the operation of the first microcomputer during the control of the controlled object is a fixed loop without branch instructions which may lead to program runaway or deadlock. Since the second microcomputer is composed of a computerized program, there is no risk of the second microcomputer running out of control or deadlocking, and a predetermined program is repeatedly executed to ensure the role of runaway monitoring. Therefore, the backup control can be surely executed by the second microcomputer even without the external hardware circuit such as the conventional watchdog circuit.

Moreover, the first microcomputer is
Since the data is fetched from the highly reliable second microcomputer, the first microcomputer does not require an input port or an A / D converter for reading data output from various sensors or switches. . Furthermore,
Since the backup control can be performed only by software, the degree of freedom of design change (change of control content) can be expanded and the content of backup control can be diversified.

[0011]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A first embodiment in which the present invention is applied to vehicle engine control will be described below with reference to FIGS. The microcomputer system of this embodiment is configured by combining a first microcomputer 1 and a second microcomputer 2. The first microcomputer 1 normally executes a program (see FIG. 5) for controlling the injectors # 10, # 20, ... And the igniter 3, which are control targets, and outputs the calculation result to the output ports INJ1, INJ2 ,. , Output from IGT.
From each of the output ports INJ1, INJ2, ...
Output to the base of Tr2, ..., injector # 10,
Drive # 20. Also, from the output port IGT,
When the ignition timing comes, the ignition signal is sent to the PNP type transistor T.
It is output to the base of r to drive the igniter 3.

On the other hand, the second microcomputer 2 is
As shown in FIG. 2, a CPU 11, a program memory 12 composed of a ROM, a data memory 13 composed of a RAM, a timing generator (not shown) for generating a CPU switching signal (clock signal) described later, and the like. Are connected by a bus line 14. On the input side of this second microcomputer 2,
An input buffer 15 that takes in digital signals such as an idle switch signal and an ignition switch signal that are output from various switches, and an analog signal such as a water temperature signal, a battery voltage signal, an intake air amount signal, and a knocking signal that are output from various sensors A / D converter 16 is provided, and these input buffer 15 and A / D converter 16 are provided.
The "data input section" is composed of and.

A serial input / output interface (hereinafter abbreviated as "serial I / O") 17 is provided on the output side of the second microcomputer 2, and the input buffer 15 and the A / D converter 16 described above are provided. The data taken in through is processed (for example, in the case of the water temperature signal, A / D conversion is performed from an analog signal corresponding to the water temperature to a digital signal), and the serial I / O 17 is connected to the first microcomputer 1
Serial transfer to. However, the processing of the knocking signal is
Since the sum of products is mainly processed, the second microcomputer 2 makes knock determination, and the determination result is serial I / O.
17 to the first microcomputer 1.

The first microcomputer 1 controls the controlled object based on the data transferred from the second microcomputer 2 and outputs a watchdog signal (hereinafter abbreviated as "WDC signal") to the second microcomputer 1. Transfer to the microcomputer 2. On the other hand, the second microcomputer 2 monitors the WDC signal transferred from the first microcomputer 1 by the L task described later to determine whether the operation of the first microcomputer 1 becomes abnormal (main abnormality). It is determined whether or not the main abnormality occurs, the reset signal RST is output to the first microcomputer 1 to reset the first microcomputer 1, and the injection amount signal calculated in the task A described later Ignition signals are output from the output ports FINJ and FIGT. The output port FINJ that outputs the injection amount signal is
Transistor Tr of injector # 10, # 20, ...
1, Tr2, ... Are connected to the signal lines on the base side, and injection of all cylinders is performed at the same time when a main abnormality occurs. The output port FIGT that outputs the ignition signal is
It is connected to the base side signal line of the transistor Tr of the igniter 3.

On the other hand, the power supply IC 18 supplies a power supply voltage of, for example, +5 V to both the first and second microcomputers 1 and 2, and resets both microcomputers 1 and 2 when the power is turned on.

In this embodiment, as shown in FIG. 3, the CPU 11 of the second microcomputer 2 executes, for example, pipeline processing of two kinds of programs (L task, A task) in parallel in a time division manner, as shown in FIG. Two address registers 19 and 20 and two arithmetic registers 21 and 22 are provided, and these address registers 19 and 20 and arithmetic registers 21 and 22 are generated by a timing generator.
Apparently, by switching alternately by PU switching signal,
It functions so that the two CPUs are alternately switched to operate. In this case, the one address register 19 and the arithmetic register 21 are registers for the CPU0 (for the L task), and the other address register 20 and the arithmetic register 22 are the registers for the CPU1 (for the A task). The value of the program counter 23 (address of the instruction to be fetched next) according to the switching of the address registers 19 and 20.
Is updated, and the CPU0 from the program counter 23 is updated.
(For L task) and CPU 1 (for A task) address signals are alternately output to the program memory 12.

Further, in the CPU 11, an error detection circuit 24 for determining the type of task to which an instruction read from the program memory 12 belongs and detecting an error thereof, and an instruction passed through the error detection circuit 24 are decoded ( An instruction decoder / instruction sequencer 25 for decoding) is provided. In accordance with the content of the instruction decoded by the instruction decoder / instruction sequencer 25, the arithmetic unit 26 (ALU) performs arithmetic operations using the arithmetic registers 21 and 22, and reads. A signal or a write signal is output to the bus line 14.

On the other hand, in the program memory 12, the CP
Program area 27 for U0 (for L task) and CPU
A program area 28 for 1 (for A task) and a table immediate data area 29 are provided. In this embodiment, the L task program stored in the program area 27 for the CPU 0 is a program for monitoring the operation of the first microcomputer 1, and a branch instruction which may cause program runaway is prohibited and It consists of a fixed loop program. As a result, when the L task program is executed, execution starts from address 0,
Instructions are sequentially executed in order of address 1, address 2, address 3, and so on, and when the program reaches a predetermined address after that, the program counter 23 overflows and returns to address 0, and thereafter, instruction execution in the address order described above. Will be repeated. Further, in this L task, all instructions are fixed to 1-word instructions. The reason for this is that in a command system in which the number of words of a command is not fixed (for example, a command system in which there is a one-word command or a two-word command), when a two-word command is misread and interpreted as a one-word command. , Because the next word is not the original instruction, it is not known what to execute.

This L-task program monitors the operation of the first microcomputer 1 by taking advantage of the feature that it is a highly reliable program with no risk of program runaway as described above. Furthermore, the L task also monitors the operation of the A task and also has a function as a timer by a fixed loop operation. For example, when an increment instruction or a decrement instruction is executed and the count value reaches a predetermined set value. , By generating an interrupt in the processing of the A task, it is possible to perform constant time processing equivalent to a timer interrupt.

On the other hand, the A task program stored in the program area 28 for the CPU 1 (for the A task) is L
A branch instruction that is prohibited by a task is also allowed, and while processing such as data control is performed, when the operation of the first microcomputer 1 becomes abnormal (main abnormality), control of the control target is performed (shoulder). Instead of). Like the L task, all the instructions of the A task are fixed to one word instruction, and both the operation code and the operand (address) are assigned in one word.

Next, the pipeline control executed by the second microcomputer 2 will be described with reference to FIG. The pipeline of the present embodiment is configured as, for example, a three-stage pipeline including stages of instruction fetch, instruction decode, and instruction execution, and is designed so that all instructions can be processed by this three-stage pipeline without delay. ing. Each stage is executed in one cycle, and one instruction is executed in three cycles. By processing three instructions in parallel by a three-stage pipeline,
Apparently, it is equivalent to executing one instruction in one cycle. The time for one cycle (each stage) is defined by the CPU switching signal (clock signal) output from the timing generator. This CPU switching signal has the same low level time TLo and high level time THi, and is C during the low level period of this CPU switching signal.
By fetching the instruction of PU0 (L task) and fetching the instruction of CPU1 (A task) in the high level period, CPU0 (L task) and CPU1 (A task)
Both programs are pipeline processed in parallel at a time division ratio of 1: 1. As a result, the instruction fetch and instruction decode of both tasks have an inverse CPU relationship (the relationship of decoding the instruction of the other task while fetching the instruction of the one task).

During this pipeline processing, as shown in FIG. 4, for example, if the instruction at address X + 1 of CPU0 is a branch instruction (JMP), at the instruction decode stage for decoding the branch instruction at address X + 1, The branch destination address (address XX) is set, and the instruction at the branch destination address (address XX) is fetched at the instruction fetch stage next to the task (CPU0) including the branch instruction. Therefore, even if there is a branch instruction, a wasteful cycle (delay cycle) does not occur in the pipeline, and delay of the pipeline can be prevented. In this case, as a result of setting the branch destination address (execution of branch instruction) at the instruction decode stage,
No processing is performed on the branch instruction at the instruction execution stage.

The operation contents of the microcomputer system configured as described above will be described. In normal times, the first microcomputer 1 performs the injection control based on the data transferred from the second microcomputer 2, so as shown in FIG. It is calculated by the equation 1) (step 100).

TAV = GN × FEFI + FMW + TAUV (1) where GN: intake air amount FEFI: water temperature correction, OTP correction, idle stability correction,
Correction coefficient FMW that comprehensively considers post-start increase correction and air-fuel ratio feedback correction; wall adhesion correction TAUV; invalid injection time After that, the injection timing is calculated based on the data transferred from the second microcomputer 2. (Step 1
10).

During the base process of this injection control, the interrupt process of FIG. 5 (b) is performed in synchronization with the engine speed Ne, and it is judged whether or not the calculated injection timing (for example, BTDC 60 ° CA) has been reached ( Step 111). This step 111
If the determination is “YES”, proceed to step 112,
It is determined which cylinder to inject, and an injection amount signal is output from the output port INJ corresponding to the corresponding cylinder, and the fuel is independently injected into each corresponding cylinder (steps 113 and 114).

In normal times, the first microcomputer 1 calculates the ignition timing based on the data transferred from the second microcomputer 2, and when the calculated ignition timing is reached, the ignition is performed from the output port IGT. A signal is output to drive the igniter 3 to ignite the fuel injected into each cylinder.

On the other hand, the second microcomputer 2 is
WD transferred from the first microcomputer 1
The operation of the first microcomputer 1 is monitored by the L task based on the C signal, and when the operation becomes abnormal (main abnormality), the reset signal RST is output to the first microcomputer 1 to output the first signal. The microcomputer 1 of 1 is reset.

Further, the second microcomputer 2 is
At the time of main abnormality, the A task performs injection control and ignition control on behalf (on behalf of the shoulder) as follows. That is, FIG.
As shown in (a), when a main abnormality occurs, the determination in step 200 of the base process of the A task becomes "YES", the process proceeds to step 201, and the injection amount TAV is calculated by the following equation (2).

TAV = GN × FEFI ′ + TAUV (2) This equation (2) is a simplified one in which the wall adhesion correction FMW is omitted as compared with the above equation (1), and FEFI ′.
As for the above, the simple process is performed in consideration of only the water temperature correction, the OTP correction, and the air-fuel ratio feedback correction.

Further, during the base processing of the A task, the interrupt processing shown in FIG. 6 (b) is performed in synchronization with the engine rotation Ne. If there is no main abnormality, the routine proceeds from step 210 to step 211, where the second The output port FINJ of the microcomputer 2 is maintained in a high impedance state,
The injection control by the first microcomputer 1 is continued. At this time, the output port FIGT is also maintained in the high impedance state, and the ignition control by the first microcomputer 1 is continued.

After that, when a main abnormality occurs, the determination at step 210 becomes "YES", and the routine proceeds to step 212, at which the output port F of the second microcomputer 2 is output.
When INJ is switched from the high impedance state to the output state and a predetermined injection timing (for example, BTDC60 ° CA) is reached, an injection amount signal is output from the output port FINJ to drive all the injectors # 10, # 20, ... Simultaneously. Then, fuel is injected into all the cylinders simultaneously (step 2
13, 214). At this time, the output port FIGT is also switched from the high impedance state to the output state, and when the predetermined ignition timing is reached, an ignition signal is output from the output port FIGT to drive the igniter 3 and the fuel injected into each cylinder is changed. Ignite.

After that, if the first microcomputer 1 returns to the normal operating state, the judgment at step 210 becomes "NO", and the routine proceeds to step 211, where the output port FINJ of the second microcomputer 2 is set to high. Switch to impedance state, and control injection and ignition first
The normal control by the microcomputer 1 is restored.

According to the first embodiment described above, the program (L task) executed by the second microcomputer 2 to monitor the operation of the first microcomputer 1 leads to program runaway / deadlock. This second microcomputer 2 is composed of a fixed loop program without any dangerous branch instructions.
There is no risk of runaway or deadlock, and a predetermined program can be repeatedly executed to reliably perform the role of runaway monitoring, and the backup control by the second microcomputer 2 can be reliably executed. Therefore, external hardware circuits such as a watchdog circuit and a backup circuit are unnecessary.

Moreover, the first microcomputer 1
Captures data from the highly reliable second microcomputer 2, so the first microcomputer 1 has an input port for reading data output from various sensors and switches, an A / D converter, etc. Is unnecessary, and the external hardware circuit such as the watchdog circuit described above is not necessary, so that the circuit configuration can be simplified and the cost can be significantly reduced. Furthermore, since backup control can be performed only by software, the degree of freedom of design change (change of control content) can be expanded and the content of backup control can be diversified.

In the first embodiment described above, both the injection control and the ignition control are performed by the first microcomputer 1. However, as in the second embodiment of the present invention shown in FIG. The control may be performed by the A task of the second microcomputer 2.

Also in the second embodiment, the second microcomputer 2 pipeline-processes the L task and the A task in parallel in a time division manner, and the A task and the first microcomputer 1 are both processed by the L task. To monitor. Then, if the operation of the first microcomputer 1 becomes abnormal (main abnormality), the output port FINJ of the second microcomputer 2 is switched from the high impedance state to the output state, and a predetermined injection timing (for example, BTD).
C60 ° CA), the injection amount signal is output from the output port FINJ, and all the injectors # 10 and # 2 are output.
0, ... Are driven simultaneously and fuel is injected into all cylinders at the same time.

In both the first and second embodiments described above, the second microcomputer 2 pipelines the L task and the A task in a time-sharing manner, and when the main abnormality occurs, A
Although the engine control is performed by the task, it may be performed by the L task. As described above, when both the runaway monitoring and the backup control are performed by one L task, the second microcomputer may be configured to execute only a single program (L task).

Further, in each of the above-described embodiments, the second microcomputer 2 is adapted to perform two tasks in a time-division parallel processing, but it is also possible to perform three or more tasks in a time-division parallel processing. In this case, multiple tasks may be composed of a fixed loop program without branch instructions). Of course, it goes without saying that the first microcomputer 1 may be multitasked.

In addition, the present invention is not limited to engine control, and may be applied to vehicle attitude control, air conditioning control, or the like, or may be applied to a control device other than the vehicle, for example, within the scope not departing from the gist. Various modifications are possible within.

[0040]

As is apparent from the above description, according to the present invention, the program executed by the second microcomputer to monitor the operation of the first microcomputer leads to program runaway / deadlock. Since it is composed of a fixed loop program without dangerous branch instructions, there is no risk of this second microcomputer running out of control or deadlocking, and it certainly plays the role of runaway monitoring and ensures backup control. Therefore, external hardware circuits such as a watchdog circuit and a backup circuit are unnecessary. Moreover, since the first microcomputer takes in data from the second microcomputer having high reliability, the first microcomputer has an input port for reading data output from various sensors, switches, etc. The D / D converter and the like are not necessary, and the external hardware circuit such as the watchdog circuit described above is not necessary, so that the circuit configuration can be simplified and the cost can be significantly reduced. Furthermore, since backup control can be performed only by software, the degree of freedom of design change (change of control content) can be expanded and the content of backup control can be diversified.

[Brief description of drawings]

FIG. 1 is a block diagram of an entire microcomputer system showing a first embodiment of the present invention.

FIG. 2 is a block diagram schematically showing an internal configuration of a second microcomputer.

FIG. 3 is a block diagram showing in detail a configuration of a main part of a second microcomputer.

FIG. 4 is a time chart illustrating pipeline processing.

FIG. 5 is a flowchart showing the flow of injection control by the first microcomputer.

FIG. 6 is a flowchart showing the processing of the A task by the second microcomputer.

FIG. 7 is a block diagram of an entire microcomputer system showing a second embodiment of the present invention.

[Explanation of symbols]

1 ... 1st microcomputer, 2 ... 2nd microcomputer, 3 ... Igniter (control object), 11 ... C
PU, 12 ... Program memory, 13 ... Data memory,
15 ... Input buffer (data input section), 16 ... A / D converter, 17 ... Serial input / output interface, 19,
20 ... Address register, 21, 22 ... Operation register,
23 ... Program counter, 24 ... Error detection circuit, 2
5 ... Instruction decoder / instruction sequencer, 26 ... Operation unit, 2
7 ... CPU0 (L task) program area, 28 ... CP
U1 (A task) program area, 29 ... Table immediate data area, # 10, # 20 ... Injector (control target).

─────────────────────────────────────────────────── ─── Continuation of front page (51) Int.Cl. ⁶ Identification number Internal reference number FI Technical indication location G06F 15/16 470 B 7429-5L (72) Inventor Shuji Nakazaki 1-chome, Showa-cho, Kariya city, Aichi prefecture Address: Nippon Denso Co., Ltd.

Claims (1)

[Claims] 1. A first microcomputer for controlling an object to be controlled, and a data input section for reading data output from various sensors, switches, etc., and a first microcomputer for transferring the read data to the first microcomputer. And a second microcomputer, wherein the second microcomputer executes a program in a fixed loop having no branch instruction, the operation of the first microcomputer is monitored by this program, and the operation is abnormal. The microcomputer system is configured such that the control of the controlled object is performed by the second microcomputer when the control becomes low.