JPH0760393B2 - Preventing malfunction of automobile computer - Google Patents

Description

Detailed Description of the Invention

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for preventing malfunction of a computer for a vehicle, which prevents malfunction in computer control.

[Prior art]

An electronic circuit including a control microcomputer mounted on an automobile is placed in a bad environment such as temperature, humidity, vibration, and electrical noise, and thus requires high-level electronic technology.
With respect to the destruction of electronic equipment, the corresponding technology has advanced remarkably due to technological progress, so at this stage, using these, it is almost in a satisfactory state, but the problem of malfunction in program control is It has not been fully resolved. In particular, a microcomputer that executes long steps in sequence may run out of control when only one noise enters, causing a serious situation such as engine stop during running due to a malfunction of the computer for engine control. become. Therefore, in order to avoid such a worst situation, a lot of filters are used in the electronic control section to prevent noise from entering, or a watchdog circuit is externally attached to identify the noise periodically in the process of computer software processing. "H" and "L" state pulses are alternately output to the output port of as a program run signal, monitored by the above watchdog circuit, and when it stops, it judges "CPU runaway", CPU And reset other parts,
Proposals have been made to restore normal conditions. Recently, there are dedicated ICs for the above "watch dock circuit", and the on-chip watch dock circuit microcomputer has been announced. However, since the watchdog circuit is added, the cost increases, and a problem of malfunction of the circuit itself arises. In particular, the decisive flaw of this method is that the malfunction cannot be returned to the normal state until the malfunction of the CPU affects the outside (until the watchdog circuit works). Malfunction of the control computer of a car is an extremely rare phenomenon, and occurs at a rate of, for example, 1 in tens of thousands, and
Although it occurs only about once every tens of thousands of kilometers running, various tests have shown that the information obtained indicates that the internal registers of the CPU may be affected by ignition noise or power surge immediately before the computer malfunctions. It was found that this was due to changes in the content held in. That is, the CPU
Despite the execution of a normal program, malfunctions are caused by changes in the register contents. Incidentally, in Japanese Patent Laid-Open No. 51-92145, the following five sampling data including the present time of the alternating current amount sampled in a constant cycle are taken in as first to fifth data, and
The first estimated value for the third data is calculated based on the first and second data, and the second estimated value for the third data is calculated based on the fourth and fifth data, and the first and second estimated values are calculated. The allowable range of the third data is determined from the above, and when the third data deviates from the allowable range, a signal indicating that an error has occurred in the sampling data is output, and the abnormal processing is performed by the abnormal processing unit. , A technique that enables detection of a data error of an input digital amount converted from a continuous analog amount, and performs processing at the time of abnormality when a data error of an input digital amount is detected. Further, in Japanese Patent Laid-Open No. 59-27355, when the central processing unit fails, a fault signal is output from the central processing unit to the initial setting signal generating circuit (initial setting supply means), and the initial setting signal generating circuit fails. When a signal is input, the initialization signal generator circuit outputs an initialization signal to the central processing unit to set the contents of each register and flip-flop to a predetermined initial value to initialize the central processing unit. Techniques for setting are disclosed.

[Problems to be Solved by the Invention]

However, in the first prior art example described above, only one detection target (AC amount) can detect an error in the sampling data, and when the detection target is the sensor output value, the sampling data Cannot continuously be detected when indicates an abnormal value. It also stores past consecutive data including five consecutive present times, and calculates the first and second estimated values for the third data based on the first, second data and fourth, fifth data, respectively. The permissible range is set according to the above, and when the third data deviates from the permissible range, it is determined to be abnormal.
The configuration of the control system is complicated. Furthermore, there is no specific disclosure of processing in the event of an abnormality. Further, in the second prior art example, since the initial setting signal generating circuit is added, the cost is increased, and a problem of malfunction of the circuit itself newly occurs. In addition, unless the central processing unit has a failure and exerts an influence on the outside, the system cannot be returned to the normal state, and a malfunction due to computer control cannot be prevented. The present invention has been made in view of the above circumstances, and provides a malfunction prevention method for a vehicle computer that does not require an external circuit and can prevent malfunction in computer control. With the goal.

[Means for Solving the Problems]

In order to achieve the above object, a method for preventing malfunction of an automobile computer according to the present invention is, in an automobile computer equipped with a programmable option register, reading output values of first and second sensors through the register, Based on the read value corresponding to the first sensor output value, the output value of the second sensor is predicted and the predicted value is set, and the second value is set.
The read value corresponding to the sensor output value of the second sensor and the predicted value are compared, and when the read value of the second sensor and the predicted value do not match within an allowable range, it is determined to be abnormal, and It is characterized in that the values of the registers associated with the sensors are initialized respectively.

[Action]

In the present invention, the output values of the first and second sensors are read through the register, and the predicted value for the second sensor output value is set based on the read value corresponding to the first sensor output value. When the read value corresponding to the sensor output value and the predicted value do not match within the allowable range, it is determined to be abnormal, and the value of the register associated with each sensor is initialized.

【Example】

An embodiment of the present invention will be described below with reference to FIGS. 1 and 2. FIG. 1 shows an example of a vehicle-mounted computer embodying the present invention, which is used for engine control such as fuel injection and ignition control, or for vehicle speed control. In FIG. 1, reference numeral 1 denotes various sensors that supply necessary control parameters to the CPU 6, and these sensors 1 are connected to an input / output unit 5 via an input interface 3. Reference numeral 2 denotes various control actuators, which are driven by drive signals output from the input / output unit 5 via the output interface 4. The input / output unit 5 is connected to the CPU 6 via the bus line 9, and the CPU 6 processes the output of the sensor 1 to output commands for driving various actuators 2.
An interrupt line 10 is connected to the CPU 6 from the input / output unit 5, and an interrupt processing request to the CPU 6 can be made from the input / output unit 5 for an input / output signal. In addition, reference numeral 8 is a ROM having a built-in processing procedure of the CPU 6,
Reference numeral 7 is a RAM used for temporary saving of data, etc., and each is connected to the CPU 6 via a bus line 9. The input / output unit 5 is usually composed of a general-purpose LSI and employs a programmable option that selects a plurality of functions by software. In this programmable option, a constant is written from a CPU 6 to a predetermined register. , The function is uniquely determined. Next, the malfunction prevention method according to the present invention will be specifically described with reference to FIG. First, in step S1, the output value of the first sensor (1) is read and the data is stored in the RAM 7. Next, in step S2, data prepared in advance in the ROM 8 corresponding to the read value is read to obtain a predicted value for the output value of the second sensor (2). Then, in step S3, the output value of the second sensor (2) is read, and in step S4, the read value corresponding to the second sensor output value and the predicted value are compared. As a result, if the read value corresponding to the second sensor output value matches the predicted value within the allowable range and it is determined that there is no abnormality, the process proceeds to the next routine, but if it is determined that there is abnormality Has
In step S5, the value of the associated register is initialized for each sensor (1) and (2). Then, in step S6, the record of the above-mentioned abnormality occurrence is left in the RAM 7, and the values of the sensors (1) and (2) are read again. By processing in this way, normal processing routines are not executed with incorrect data, normal data can be restored while the program is in progress, and this can be done without causing a large malfunction to the outside. It can be prevented. In this embodiment, the first sensor is single and the predicted value for the second sensor output value is set based on the read value corresponding to the first sensor output value. A plurality of sensors may be used as the sensor, and the predicted value may be set based on the read values of the plurality of sensor output values.

【The invention's effect】

As described above, according to the present invention, the predicted value for the second sensor output value is set based on the read value corresponding to the first sensor output value, and the read value and prediction corresponding to the second sensor output value are set. When the value does not match within the allowable range, it is judged as abnormal and the value of the register related to each sensor is initialized, so the read value corresponding to the sensor output value of the detection target is The predicted value based on the sensor output value is used to judge the abnormality of the content held in the register related to that sensor, and the abnormality is definitely judged, and even if the content held in the register changes due to ignition noise, power surge, etc. It can be detected and reliability is improved. In addition, the register value is initialized when an abnormality is detected, the cause of malfunction is eliminated, and it is possible to reliably prevent the CPU from running away by a very simple method without adding a special external circuit. It is possible to prevent malfunction due to control.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of a computer for carrying out the method of the present invention, and FIG. 2 is a flow chart showing a control procedure. 1 ... Sensor, 2 ... Actuator, 3 ... Input interface, 4 ... Output interface, 5 ... Input / output unit, 6 ... CPU, 7 ... RAM, 8 ... ROM, 9
…… Bus line, 10 …… Interrupt line.

Claims (1)

[Claims] 1. A vehicle computer having a programmable option register, wherein each output value of a first sensor and a second sensor is read through the register, and a first value is read based on the read value corresponding to the first sensor output value. The output value of the second sensor is predicted, the predicted value is set, the read value corresponding to the second sensor output value is compared with the predicted value, and the read value of the second sensor is compared within the allowable range. A method for preventing malfunction of an automobile computer, comprising determining that an abnormality occurs when the predicted values do not match, and initializing the values of registers associated with the respective sensors.