JPH08328885A - Fault detection method for microcomputer - Google Patents

Abstract

PURPOSE: To provide a detection method which can detect the faults of a microcomputer in a small circuit scale and at low cost. CONSTITUTION: A microcomputer 1 is provided with a light-weight monitoring circuit 2 which contains only an arithmetic circuit part that can carry out the same instructions as those of the microcomputer 1. Then both microcomputer 1 and circuit 2 carry out the same arithmetic processing based on the same data, and both arithmetic results are compared with each other for detection of a fault. In such a constitution, the faults of the microcomputer 1 can be detected at low cost.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a failure detection method for a microcomputer used in, for example, an ABS (antilock brake system) electronic control unit.

[0002]

2. Description of the Related Art Conventionally, as one method of detecting a failure of a microcomputer (hereinafter referred to as a microcomputer), there is a so-called double microcomputer as shown in FIG. 9 in which two identical microcomputers 1 are used. In this method, the same signal is input to both microcomputers 1 from the outside, the signals output as the respective calculation results are mutually monitored, their own output signals are compared with the other output signal, and if they do not match, a failure occurs. It is a method of detecting as.

For example, ABS using such a method
In the electronic control unit of (anti-lock brake system), the wheel speed signals of the four wheels are input to both microcomputers 1, and each microcomputer 1 outputs A based on the wheel speed.
The BS control calculation is performed, and the hydraulic control solenoid output signals and the like obtained as a result are compared with each other to detect a failure.

[0004]

However, the above-mentioned double microcomputer configuration has a problem that two microcomputers having the same function are required to detect a failure, resulting in a large circuit scale and high cost.

SUMMARY OF THE INVENTION An object of the present invention is to provide a microcomputer failure detection method which can be implemented at a low cost and a small circuit scale without using two microcomputers having the same function.

[0006]

In order to solve the above-mentioned problems, in the first invention, a microcomputer for failure detection is provided with arithmetic processing for failure detection, and an original function of the microcomputer (for example, In the case of a lock system, the monitoring circuit is provided separately from the anti-lock control process) and has an arithmetic circuit unit capable of executing an arithmetic command necessary for realizing the arithmetic process for detecting the failure of the microcomputer. Is provided, and the microcomputer and the monitoring circuit are caused to execute the same arithmetic processing based on the same setting data. At that time, the output operation results of both are compared and collated, and a failure is detected from the collation difference. It was adopted.

At this time, in the second invention, communication means is provided in each of the microcomputer and the monitoring circuit,
At the time of detecting the failure, a method of exchanging setting data and a calculation result based on the data is adopted.

According to a third aspect of the present invention, in the above second aspect, the communication program for controlling the communication means is composed of a main routine and a sub-routine subordinate to the main routine. The method of exchanging the result of the arithmetic processing between the microcomputer and the monitoring circuit was adopted.

Further, in the fourth invention, when the microcomputer and the monitoring circuit execute arithmetic processing, the same arithmetic processing executes all instructions of the microcomputer, and an internal bus of the microcomputer. Assuming that all of them are accessed, at that time, the output operation results of both are compared and collated,
The method of detecting the failure from the matching difference was adopted.

At this time, in the fifth invention, when the microcomputer and the monitoring circuit are caused to execute arithmetic processing,
A method is adopted in which a calculation process based on random setting data is executed each time, the output calculation results of both are compared and collated, and a failure is detected from the collation difference.

Further, in the sixth aspect of the invention, when comparing and collating the calculation results of the microcomputer and the monitoring circuit, a method is adopted in which both the microcomputer and the monitoring circuit perform the matching independently. is there.

In the seventh invention, a method is adopted in which the failure detection is repeatedly performed at a predetermined cycle when the microcomputer operates.

[0013]

According to the first aspect of the invention configured as described above, the monitoring circuit provided in the failure detection target microcomputer is the same as the failure target microcomputer, for example, addition / subtraction of data by an accumulator or transfer of data between registers. By providing an arithmetic unit for executing arithmetic instructions such as storing data in a register, it is possible to execute the same data processing as that of the microcomputer, and the same microcomputer and monitoring circuit based on the same setting data. When the arithmetic processing is executed, if both are functioning normally, the arithmetic result should be the same. Therefore, if there is a difference when comparing and collating the calculation results of both, it means that there is an abnormality in one of them, and from this, a failure of the microcomputer can be detected.

At this time, since the failure is detected by collating the calculation results, the processing of both does not have to be synchronized, and the failure can be detected even if the processing speeds of the both are not the same. The circuit used can be slower than the microcomputer.

Further, the monitoring circuit may be any as long as it can perform the arithmetic processing as described above, and therefore the failure can be detected without using the same microcomputer as the failure detection target.

In the second aspect of the invention, communication means are provided in the microcomputer and the monitoring circuit respectively, and when the failure is detected, the setting data and the calculation result based on the data are exchanged, so that the microcomputer and the monitoring circuit both exchange. Faults can be detected by sending and receiving data.

In the third invention, the communication program for controlling the communication means is constituted by a main routine and a subroutine subordinate to the main routine, and when the failure is detected, the main routine and the subroutine of the program are activated. Otherwise, the setting data and the calculation result based on that data cannot be exchanged between the microcomputer and the monitoring circuit, so that the microcomputer runs away.For example, if a partial infinite loop occurs in the processing of the main routine When an infinite loop occurs in a subroutine due to or interrupt processing, the communication means is not activated, which causes a difference in the collation result, and a failure in the runaway mode can be detected.

In a fourth aspect of the invention, the arithmetic processing executes all the instructions of the microcomputer, and
By accessing all the internal buses of the microcomputer, it is possible to check all instructions using the setting data and the result of accessing the internal bus, so check all functions of the microcomputer. The failure can be detected.

According to the fifth aspect of the invention, the setting data is set to have a random value each time a failure is detected, so that the state of the data bit is changed at each detection.
That is, since it is possible to perform a bit-by-bit check by comparing "1" and "0" of bits and comparing and collating operation results using data having different bit states, for example, a microcomputer It is also possible to detect a sticking failure in which the bits of the internal accumulator, register, program counter, internal bus, etc. are stuck to either "1" or "0".

According to the sixth aspect of the present invention, when comparing and collating the calculation results of the microcomputer and the monitoring circuit, the comparison and collation are independently performed by both the microcomputer and the monitoring circuit, so that even if one device fails. A failure can be determined by the other determination.

According to the seventh aspect of the present invention, when the microcomputer is operated, the above-mentioned failure detection is repeatedly performed at a predetermined cycle, so that the failure can be always detected during the operation of the system using the microcomputer.

[0022]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the drawings.

FIG. 1 shows a block diagram of a microcomputer 1 according to the failure detecting method of the first invention as a first embodiment.

As shown in FIG. 1, the microcomputer 1 of this embodiment comprises a microcomputer 1 and a monitoring circuit 2, both of which are connected by a common bus 3 so that data can be input and output. There is.

The microcomputer 1 uses a monitor program or O
A processing program for failure detection is built in S as failure detection means, and the failure is detected by activating this processing program.

As shown in FIG. 2, this processing program is composed of a setting section, an execution section, and a determination section. The setting section sets initial value data, and the execution section uses the microcomputer 1 based on the initial value data. To execute a predetermined calculation process. At the same time, the setting unit outputs the set initial value data to the monitoring circuit 2. Further, the determination unit detects a failure by collating the data of the calculation result of the microcomputer 1 obtained by the calculation processing of the execution unit with the data of the calculation result obtained from the monitoring circuit 2.

On the other hand, the monitoring circuit 2 includes an input / output circuit section, an arithmetic circuit section and a control circuit section, and the input / output circuit section is connected to the bus 3 to exchange data between the monitoring circuit 2 and the microcomputer 1. The operation circuit unit includes, for example, an accumulator, an adder / subtractor, and an input / output register, and executes the same operation instruction as that of the microcomputer 1.

Further, this arithmetic circuit unit is the same as the microcomputer 1 described above.
It is controlled by a control circuit unit in which a processing program similar to that of the execution unit is stored in the memory and executes the same arithmetic processing as that of the microcomputer 1 based on the initial value data output from the microcomputer 1.

Although the monitoring circuit 2 is arranged on the bus 3 of the microcomputer 1 in the embodiment, the invention is not limited to this. For example, the monitoring circuit 2 may be provided in the chip of the microcomputer 1. You may

This embodiment is constructed as described above. Next, the operation of the embodiment will be described to explain the failure detecting method of the first invention.

The microcomputer 1 detects a failure by activating a monitor as a failure detecting means or a processing program for detecting a failure in the OS. At this time, the started processing program executes arithmetic processing in accordance with a predetermined procedure based on preset initial value data. At the same time, the microcomputer 1 outputs the initial value data to the monitoring circuit 2 via the bus 3 together with the activation command, activates the monitoring circuit 2 and executes the arithmetic processing based on the initial value data. At this time, the arithmetic processing executed by the monitoring circuit 2 is the arithmetic processing of the data input from the microcomputer 1 by the same processing program as the execution unit of the microcomputer 1 stored in the control circuit unit. Further, the result calculated by the monitoring circuit 2 in this way is returned to the microcomputer 1 by the input / output circuit section.
The microcomputer 1 which has received the response and inputs the calculation result to the determination circuit unit and compares and collates it with the result calculated by the microcomputer 1. At this time, the calculation results of the microcomputer 1 and the monitoring circuit 2 which are compared and collated are subjected to the same calculation processing based on the same data, and if both are functioning normally, the difference is not output. Absent. On the other hand, if there is an abnormality in either or both of them (the probability that both will be abnormal and the same result is output) is abnormal,
Since there is a difference in the calculation results, the failure of the microcomputer 1 can be detected.

As described above, according to this method, the same arithmetic processing based on the same data is applied to the microcomputer 1 and the lightweight monitoring circuit 2 only having the arithmetic circuit section capable of executing the same instruction as the microcomputer 1. Since the failure is detected by executing it, the failure of the microcomputer 1 can be detected at low cost without increasing the circuit scale.

Further, at this time, since the failure is detected by collating the calculation results, the processings of the both need not be synchronized, and the processing speeds of the both need not be the same. For the circuit 2, it is possible to use a microcomputer 1 having a lower speed than the microcomputer 1 or a lower microcomputer 1 having a low processing capacity.

Next, a fault detecting method according to the second invention will be described as a second embodiment.

In this embodiment, as shown in FIG. 3, instead of the bus connection for connecting the microcomputer 1 and the monitoring circuit 2 of FIG. 1 of the first embodiment, the microcomputer 1 and the monitoring circuit 2 are provided with communication means. By providing a port 4 for serial transmission, connecting the ports 4 to each other, and exchanging setting data and a calculation result based on the data when a failure is detected, by using such a method, the bus 3 The monitoring circuit 2 can be provided regardless of whether or not there is a fan-out margin.

The other functions and effects are the same as those of the first embodiment, and therefore the description thereof will be omitted.

As a third embodiment, the fault detecting method of the third invention will be described.

In this embodiment, as shown in FIG. 4, in the second invention, the program for communication control of the communication means is composed of a main routine and a subroutine subordinate to the main routine, and Therefore, when the main routine is activated, the subroutine is activated.

By carrying out such a method, for example, if the communication data is set in the register of the communication port 4 in the main routine and the communication is started in the subroutine, the cause of the runaway of the microcomputer 1 is caused. If an infinite loop occurs in the main routine or subroutine, the main routine or subroutine will no longer be executed due to that loop, and the communication control program will not be able to start, making it possible to send and receive setting data and calculation results. Since there is no such difference, a difference occurs between the outputs of the two during comparison and verification, and the runaway mode can be detected by detecting this difference.

The other functions and effects are the same as those of the second embodiment, so the description thereof will be omitted.

A failure detecting method according to the fourth invention will be described as a fourth embodiment.

In this embodiment, in the first to third embodiments, the arithmetic processing of the monitor program of the microcomputer 1 or the processing program for failure detection incorporated as failure detection means in the OS and the control circuit of the monitoring circuit 2 are performed. The operation processing of the processing program stored in the unit is performed by all instructions of the microcomputer 1, for example, data transfer to an accumulator as shown in FIG. This is a method in which setting data for input / output and the like is used as an offset, and that data is used to access all the internal buses of the microcomputer 1.

Therefore, by carrying out such a method, all the functions of the microcomputer 1 can be checked, so that the reliability of failure detection can be improved.

The other functions and effects are the same as those of the first to third embodiments, and the description thereof will be omitted.

As a fifth embodiment, a fault detecting method according to the fifth invention will be described.

In this embodiment, the microcomputer 1 of the first and second embodiments is provided with a free running counter 5 as shown in FIG. 6, and the counter 5 is always run.
By using the output data of the counter 5 as the initial value data of the arithmetic processing of the microcomputer 1 and the monitoring circuit 2 at the time of failure detection, the setting data can be set to a random value. It is possible to prevent the setting data from being fixed for each. Therefore, if the arithmetic processing with the data is performed multiple times, the state of each bit of the accumulator, register, program counter, internal bus, etc. inside the microcomputer is changed to "1" and "0", and the arithmetic results are compared and collated. However, since the bit can be checked, even if the bit is stuck to "1" or "0", the sticking failure can be detected.

In the embodiment, the counter 5 is provided in order to obtain a random value, but instead of the counter 5, for example, the microcomputer 1 generates a random number by software to calculate the random value. Good.

Further, other operational effects are the same as those of the first to fourth embodiments, and therefore the description thereof will be omitted.

A fault detecting method according to the sixth invention will be described as a sixth embodiment.

In this embodiment, the monitoring circuit 2 of the first to fifth embodiments is provided with a determination circuit section 6 for performing the same processing as that of the microcomputer 1 as shown in FIG. A method of independently comparing and collating operation results exchanged with each other, and enabling a failure to be detected by the judgment of the other judgment unit even when one device has a failure Is. As a result, it is possible to reduce the situation in which the determination unit of the microcomputer 1 fails and cannot make a determination, and the reliability can be improved.

The other functions and effects are the same as those of the first to fifth embodiments, and the description thereof will be omitted.

A fault detecting method according to the seventh invention will be described as a seventh embodiment.

In this embodiment, in the first to sixth inventions, for example, as shown in FIG. 8, a timer 7 is provided in the microcomputer 1, and the failure detection program is activated at a predetermined cycle by the interrupt processing by the timer 7. Therefore, the failure is always detected even during the operation of the system using the microcomputer 1. As a result of using the method, it is possible to constantly detect a failure during operation of the system using the microcomputer 1 and improve reliability.

Other functions and effects are the same as those of the first to sixth embodiments, and therefore will be omitted.

[0055]

According to the failure detecting method for the microcomputer of the first aspect of the invention configured as described above, the same data is stored in the lightweight monitoring circuit including only the microcomputer and the arithmetic unit capable of executing the same instruction as the microcomputer. Since the failure is detected by executing the same arithmetic processing based on the above, it is possible to realize the failure detection function of the microcomputer at a low cost without increasing the circuit scale like the conventional double microcomputer configuration. .

In the microcomputer failure detection method of the second invention, in addition to the effect of the first invention, a communication means is provided in each of the microcomputer and the monitoring circuit, and when the failure is detected, the setting data and the setting data are set. By adopting the method of exchanging the calculation result based on the data, it is possible to provide the effect that the monitoring circuit can be provided regardless of whether or not there is a fan fan-out margin of the bus.

In the microcomputer failure detection method of the third invention, in addition to the effects of the above invention, the program for communication control of the communication means is composed of a main routine and a subroutine subordinate to the main routine,
When the main routine is started for communication, the subroutine is started. For example, if an infinite loop occurs in the main routine or the subroutine, the communication means can be prevented from starting by the loop. The effect that it can be detected.

In addition to the effects of the above-described invention, in the microcomputer failure detection method of the fourth invention, when the microcomputer and the monitoring circuit perform the operation processing, all the instructions of the microcomputer are executed as the operation processing. In addition, since all the internal buses of the microcomputer are accessed, all the functions of the microcomputer can be checked, so that the reliability can be improved.

In addition to the effects of the above-mentioned invention, in the microcomputer failure detection method of the fifth invention, the bit is set to "1" by setting the setting data to a random value each time a failure is detected. Even if it is fixed to "0" or "0", the effect that the fixing failure can be detected can be obtained.

In addition to the above-mentioned invention, in the microcomputer failure detection method of the sixth invention, in the comparison and comparison of the calculation results of the microcomputer and the monitoring circuit, the comparison and verification are independently performed by both the microcomputer and the monitoring circuit. By doing so, even if one of the devices fails, the failure can be detected by the determination of the other. As a result, there is an effect that the reliability can be improved.

In addition to the above-mentioned invention, in the microcomputer failure detection method of the seventh invention, the failure detection during the operation of the microcomputer is repeated at a predetermined cycle so that the failure occurs during the operation of the system using the microcomputer. Can be constantly detected to improve reliability.

[Brief description of drawings]

FIG. 1 is a block diagram of a first embodiment.

FIG. 2 is a flow chart for explaining the first embodiment.

FIG. 3 is a block diagram of a second embodiment.

FIG. 4 is a flowchart for explaining the third embodiment.

FIG. 5 is an operation diagram for explaining a fourth embodiment.

FIG. 6 is a block diagram of a fifth embodiment.

FIG. 7 is a block diagram of a sixth embodiment.

FIG. 8 is a block diagram of a seventh embodiment.

FIG. 9 is a block diagram showing a conventional failure detection method.

[Explanation of symbols]

 1 Microcomputer 2 Monitoring circuit 3 Bus 4 Communication port 5 Free running counter 6 Judgment circuit 7 Timer

Claims (7)

[Claims] 1. A microcomputer for failure detection is provided with an arithmetic processing program for failure detection, in addition to a processing program for executing an original function other than the function required for failure detection, and the microcomputer. Is provided with a monitoring circuit having an arithmetic circuit unit capable of executing an arithmetic instruction necessary for arithmetic processing for detecting a failure, and the same data is input to the microcomputer and the monitoring circuit, and the same data based on the data is input. A failure detection method for a microcomputer, which executes a calculation process, compares and outputs the calculation results of the two output at that time, and detects a failure from the comparison difference. 2. The failure detection method for a microcomputer according to claim 1, wherein the microcomputer and the monitoring circuit are each provided with communication means, and when the failure is detected, the setting data and a calculation result based on the data are exchanged. . 3. The control communication program of the communication means comprises a main routine and a subroutine subordinate to the main routine, and the arithmetic processing result according to claim 1 is stored in the microcomputer and the monitoring circuit. The microcomputer failure detection method according to claim 2, wherein the failure detection method is performed between two computers. 4. When causing the microcomputer and the monitoring circuit to execute arithmetic processing, the same arithmetic processing executes all instructions of the microcomputer and accesses all internal buses of the microcomputer. 4. The microcomputer failure detection method according to claim 1, wherein the calculation results of the both output at that time are compared and compared, and the failure is detected from the comparison difference. 5. When the microcomputer and the monitoring circuit are caused to perform arithmetic processing, arithmetic processing based on random setting data is executed each time, and at that time, the arithmetic results of both output are compared and collated. The failure detection method for a microcomputer according to claim 1, wherein the failure is detected from the matching difference. 6. The failure of the microcomputer according to claim 1, wherein, when comparing and collating the calculation results of the microcomputer and the monitoring circuit, the comparison and collation are independently performed by both the microcomputer and the monitoring circuit. Detection method. 7. When the microcomputer operates,
7. The microcomputer failure detection method according to claim 1, wherein the failure detection is repeatedly performed at a predetermined cycle.