JPH01149143A - Fail safe method for on-vehicle computer - Google Patents

Abstract

PURPOSE:To generate the interruption of the highest priority and to restore an on-vehicle computer to an initial state by sensing an address signal when the on-vehicle computer executes the address outside of the range of an ordinary operation. CONSTITUTION:When an microcomputer 1 runs away and an execution address exceeds the range of an internal memory to enter an external ROM mode, a port 0 automatically goes to a data bus to output the address signal and data and a port 2 outputs the address signal. When a port 0 outputs the address signal, the input of an inverter INV goes to a low level and a reset terminal goes to a high level. Accordingly,the microcomputer 1 is restored to be reset to the initial state and restarted. The port 0 is refloated from the data bus to avoid the run away.

Description

DETAILED DESCRIPTION OF THE INVENTION (Field of Industrial Application) The present invention relates to a fail-safe method for a vehicle-mounted computer that controls the operation of an internal combustion engine, automatic transmission, etc.

(Prior Art) Microcomputers based on a stored program system are used to control the operations of internal combustion engines, automatic transmissions, etc. installed in automobiles, etc., but read commands may be incorrectly read due to noise generated when a spark plug fires, etc. Stop command (HAL
Therefore, there was a risk that the microcombi would stop even though it was in a state where it should be executing the program normally.

In order to avoid such malfunctions, conventionally, status information from a microcomputer detects that a stop command is being executed, and based on this detection result, an interrupt with the highest priority is issued, returning the microcomputer to its initial state. I was putting it back.

FIG. 2 is an explanatory diagram showing an example of the method (for example,
JP-A-59-68004). In Figure 2, 3
is a microcomputer that performs various arithmetic processing, program execution, etc., and usually uses a single LSI element (Intel KK 8085A, etc.). Usually, this type of microcombi has a plurality of status signal terminals that inform the outside of the operating state. In this example, two status signal terminals S and S are used, and the status signal terminals So and S are respectively connected to the input terminal of the NOR circuit NOR (7), and the output terminal is connected to the top of the CPU 1. It is connected to the priority interrupt terminal TRAP. and,
Status signals are output from these status signal terminals So and S according to the truth table below.

(Truth Table) Therefore, by decoding the state "So, S, = [o) ro", it is possible to detect that the stop command is being executed. In this example, the status signal is decoded by the NOR circuit NOR, and its output is input to the TRAP terminal, which is the interrupt request terminal with the highest priority.
Even if the microcomputer 3 malfunctions in an interrupt state and comes to a halt, it is possible to issue an interrupt. Make such an interrupt cause a jump to a specific address,
You can write a program in advance to initialize the microcombi, or after that address, or write a jump command to address ``'oooo'', which is the start address immediately after the power is turned on. The control program can be restarted.

(Problem to be Solved by the Invention) However, the above method uses status information to detect the execution of a stop command and restart it, so it is completely ineffective against a runaway CPU that does not include a stop command. Moreover, there was a problem that it could not be implemented on a computer that does not have status information.

SUMMARY OF THE INVENTION An object of the present invention is to eliminate the above-mentioned problems and provide a highly reliable seven-day safe system for a vehicle-mounted computer.

(Means for Solving the Problems) The present invention provides a fail-safe method for an in-vehicle computer that controls the operation of an internal combustion engine, etc.
- If the user executes an address outside the normal operating range, the predetermined j? A fail-safe vehicle computer characterized in that the vehicle computer outputs an address signal from (), detects the address signal, performs an interrupt with the highest priority based on the detected address signal, and returns the vehicle computer to an initial state. It's a method.

(Function) The computer has a memory and a plurality of ports internally, and if the execution address is within the range of the internal memory, a predetermined port is made to work as an I10 port,
If the range is exceeded, the I10 port is changed to a data bus and address signals etc. are output. The present invention focuses on this point, and normally sets the computer so that the execution address is within the range of the internal memory, and if it deviates from the range, it is determined that the computer has gone out of control. The output of the port is used to reset, restart, and restart. With this, the above-mentioned problem can be eliminated.

(Embodiment) FIG. 1 is a diagram for explaining a fail-safe method according to a first embodiment of the present invention. In FIG. 1, numeral 1 indicates a microcomputer that performs various arithmetic operations and executes programs, and typically uses a microcomputer (such as Intel KK 8051). 2 is a reset circuit that outputs a reset signal, and INV is an inverter for matching the reset logic. DBO of the microcomputer 1 is connected to the reset terminal RESET via the inverter INV, and the output of the reset circuit 2 is also connected to the reset terminal RESET via the resistor R and the inverter INV.

The microcomputer 1 has a built-in memory,
When operating within the range of the memory (hereinafter referred to as internal ROM)
(hereinafter referred to as external R
OM mode). Further, the microcomputer 1 usually has a plurality of ports (in this embodiment, three ports) DBO to DB2, and corresponds to the microcombi-1 execution mode as shown in the mode table below. change its role.

In other words, port 0 is connected to the internal R
When in OM mode, it becomes an open collector I10 port, and when in external ROM mode, it becomes a data bus from the open collector I10 port, and sequentially outputs address signals and data.

When the microcombi 1 is used to control the operation of an internal combustion engine or the like, it is normally set to operate in the internal ROM mode. Therefore, if the execution address exceeds the internal memory range and shifts to external ROM mode, it is considered abnormal.

Now, in FIG. 1, when the microcombi 1 is operating normally, that is, when it is in the internal ROM mode, the DBO is in a floating state. The microcomputer 1 is reset by the reset circuit 2 as necessary.However, for some reason, the microcomputer 1 goes out of control, and the execution address exceeds the internal memory range (FFFH in this embodiment), causing it to enter the external ROM mode. If you enter
Port 0 automatically becomes a data bus and outputs address signals and data, and port 2 outputs address signals. When the port 0 outputs an address signal, that is, outputs a low level, the input of the inverter INV becomes a low level, and the reset terminal RESET2>D becomes a high level. Therefore, the microcomputer 1 is reset, returns to its initial state, and restarts. Port O
becomes floating again from the data bus. In this way, runaway behavior is avoided.

As explained above, according to this embodiment, when the microcomputer goes out of control and executes an address that is not normally allowed to be executed, /-)0 becomes a data bus from the port and outputs an address signal. Since we decided to return the microcomputer to its initial state using this output trap, runaway can be reliably detected and reset quickly, the circuit configuration is extremely simple, and a highly reliable fail-safe method can be realized. can.

FIG. 3 is an explanatory diagram of a fail-safe method according to a second embodiment of the present invention, in which a NAND circuit NAND is used in place of the inverter INV shown in FIG. The same effects as the first embodiment shown in FIG. 1 can be obtained.

In the embodiments shown in FIGS. 1 and 3, the output of port 0 of the microcomputer 1 is input to the reset terminal RESET via the inverter INV or the NAND circuit NAND, but the maximum output of the reset terminal RESET is If you input it to the priority interrupt terminal and write a glodarum that returns the microcombi and 1 to the initial state at the jump destination of the interrupt, the same effect as the embodiment shown in Figs. 1 and 3 can be obtained. Obtainable.

Further, in the embodiments shown in FIGS. 1 and 3, the output of port 0 is used to reset the microcomputer 1.

However, since port 2 outputs an address signal when the external ROM mode is entered, it is naturally possible to use port 2 in place of port 0.

(Effects of the Invention) As described above in detail, according to the present invention, when a computer goes out of control and executes an address that is not normally allowed to be executed, it outputs an address signal from a predetermined port, and the address signal is Based on this, we decided to issue the highest priority interrupt and return to the initial state, so runaway can be reliably detected, and it can be realized with an extremely simple circuit configuration, making it a highly reliable in-vehicle computer. A fail-safe method can be obtained.

[Brief explanation of the drawing]

Fig. 1 is an explanatory diagram of the 7-ail safe method according to the first embodiment of the present invention, and Fig. 2 is an explanatory diagram of the conventional 7-ail safe method.
FIG. 3 is an explanatory diagram of a fail-safe method according to a second embodiment of the present invention. 1... Microcomputer, 2... Reset circuit, INV... Inverter circuit, NAND... NAND circuit, R... Resistor. Patent Applicant: Oki Electric Industry Co., Ltd. 7E4L T-F Wanda #1 Appearance Map Figure 1 柾rai #171 pier T-7 side S floor 3L Mingguo 2nd figure shore (we - Kawame Sai 2's 11th 7t4L℃ - 75,000 thick 1 light color 3rd figure

Claims (1)

[Claims] In a fail-safe method for an on-vehicle computer that controls the operation of an internal combustion engine, etc., when the on-vehicle computer executes an address outside the normal operating range, an address signal is output from a predetermined port. 1. A fail-safe method for a vehicle-mounted computer, comprising detecting a signal, performing an interrupt with the highest priority based on the detected address signal, and returning the vehicle-mounted computer to an initial state.