Method of and apparatus for ensuring correct operation of a microcomputer in the event of power outage

• US 4,402,057 A
• Filed: 01/05/1979
• Issued: 08/30/1983
• Est. Priority Date: 01/11/1978
• Status: Expired due to Term

• Current Assignee: Nissan Motor Co., Ltd.
• Original Assignee: Nissan Motor Co., Ltd.
• Inventors: Mizote, Masanori, Itou, Tomio
• Primary Examiner(s): Shaw, Gareth D.
• Assistant Examiner(s): Mills, John G.
• Application Number:
  US06/001,168
• Time in Patent Office: 1,698 Days
• Field of Search: 364/200 MS File, 364/900 MS File, 364/424, 364/119, 340/52 F
• US Class Current: 714/22
• CPC Class Codes: F02P 5/151 with means for compensating the variation of the characteristics of the engine or of a sensor, e.g. by ageing
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/23215 Check data validity in ram, keep correct validity, compare rom ram
• CPC Class Codes: G05B 2219/24139 Recovery from power loss, failure
• CPC Class Codes: G06F 11/0763 by bit configuration check, e.g. of formats or tags
• CPC Class Codes: G06F 11/1441 Resetting or repowering
• CPC Class Codes: G06F 11/167 Error detection by comparing the memory output
• CPC Class Codes: G07C 5/10 using counting means or digital clocks
• CPC Class Codes: Y02T 10/40 Engine management systems

Abstract

A reference check bit pattern is stored in a nonvolatile storage medium of a vehicle-mounted microcomputer. A portion of a volatile storage medium is allocated for the purpose of storing the reference check bits. The microcomputer is programmed to compare the check bits stored in both the volatile and nonvolatile storage mediums. In response to a command signal, a mismatch is detected between the reference check bits of the volatile and nonvolatile mediums to indicate that data stored in the volatile memory have failed due to a power outage. The failed check data of the volatile memory is rewritten with the reference check data in the nonvolatile memory for later comparison. At the same time all data stored in the remaining portion of the volatile memory is erased so the remaining portion can accept a set of fresh input data. When a match occurs the computer proceeds with the normal computing functions.

Claims

1. A method of operating a microcomputer provided with nonvolatile storage means storing a check data signal and read/write volatile storage means of the type that store bit values only while power is supplied thereto, said method enabling the volatile storage means to be tested to determine if the contents thereof have changed in response to power not being supplied thereto, the check data enabling the volatile storage means to be checked to determine if data stored therein has changed as a result of power not being supplied thereto, comprising

storing the check data signal in an allocated portion of said read/write storage means and storing in the remaining portion of said read/write storage means other data needed to perform computer functions,

detecting a match or mismatch between the check data signal stored in said nonvolatile storage means and the data signal stored in said allocated portion of said read/write storage means each time power is applied to the microcomputer,

setting all bits stored in said remaining portion of said read/write storage means to a predetermined state and writing said check data signal stored in said nonvolatile storage means into said allocated portion of said read/write storage means in response to a mismatch being detected, and

operating said microcomputer in accordance with the normal computer functions thereof using data stored in said remaining portion of said read/write storage means in response to a match being detected between the stored check data in said nonvolatile storage means and the data signal stored in said allocated portion of said read/write storage means.

2. The method of claim 1 wherein the check data signal stored in said nonvolatile storage medium is a plurality of data words, and performing said detection on a word-at-a-time basis.

3. The method of claim 2 wherein said check data signal stored in said nonvolatile storage medium is in the form of instruction data to successively generate said data signal.

4. The method of claim 1, 2 or 3 wherein said nonvolatile storage medium comprises a read-only memory.

5. The method of claim 1 wherein said power source is mounted in an engine-powered vehicle, and generating the command signal for detecting the match or mismatch in response to start of the engine of said vehicle.

6. The method of claim 1 wherein said power source is mounted in an engine-powered vehicle including an ignition switch, and generating the command signal for detecting the match or mismatch in response to the operation of the ignition switch of the vehicle.

7. Apparatus for fail-safe operating a programmed digital system energized by a power source that is subject to being applied to and removed from the system comprising a memory system including a nonvolatile binary memory and a volatile binary memory, the nonvolatile binary memory storing a predermined arrangement of bit values that form a check signal, the volatile binary memory being subject to loss of bit values in the event of the power source being removed from the system, one portion of the volatile memory storing the bit values of the check signal, the check signal enabling the volatile storage means to be checked to determine if the signal stored therein has changed as a result of power not being supplied thereto, another portion of the volatile memory storing bit values in connection with operation of the system, a binary comparator, a command signal source activated to derive a signal in response to power being initially applied to the system, means responsive to the signal from the command signal source for supplying the bit values that form the check signal from the nonvolatile memory to the binary comparator, said binary comparator responding to the bit values supplied to it in response to derivation of the signal from the command signal source to derive an output signal indicative of a match and mismatch between the bit values for the check signal and from the one portion of the volatile memory, means responsive to the output signal for activating a program section of the memory system so that the digital system proceeds with its normal operation when the output signal indicates a match, and responsive to the output signal indicating a mismatch for setting all binary values stored in the volatile memory to a predetermined value and for transferring the bit values of the check data signal from the nonvolatile memory to the one portion of the volatile memory.

8. The apparatus of claim 7 wherein the program section of the memory system is in a segment of the nonvolatile memory different from a region of the nonvolatile memory where the check bits are stored so that the bit values associated with the program and read from the nonvolatile memory segment in response to the first value of the output signal.

9. The apparatus of claim 7 or 8 wherein the system includes a start switch, and means responsive to energization of the start switch for activating the command signal source.

10. The apparatus of claim 7 or 8 wherein the system includes an input data means, and means responsive to the comparator output signal indicating a mismatch for transferring signals from the input data means to the volatile memory.

11. A programmed digital system energized by a power source that is subject to being applied to and removed from the system comprising data source means, a memory system including a nonvolatile binary memory and a volatile binary memory, the nonvolatile memory storing a program for controling operation of the system, the nonvolatile binary memory storing a predetermined arrangement of bit values that form a check signal, the volatile binary memory being subject to loss of bit values in the event of the power source being removed from the system, the system capable of determining whether the volatile binary memory has lost bit values in response to the power source being removed from the system, the check signal enabling the volatile storage means to be checked to determine if the signal stored therein has changed as a result of power not being suplied thereto, one portion of the volatile memory storing the bit values of the check signal, another portion of the volatile memory storing bit values in connection with signal values derived from the data source means, a source of command signals, control means responsive to (a) a signal from the command signal source and a mismatch between the check signals in the nonvolatile memory and bit values in the one portion of the volatile memory for supplying the check signal from the nonvolatile memory to the one portion of the volatile memory and for supplying signals from the data source means to the another portion of the volatile memory and for thereafter activating the program stored in the nonvolatile memory, and (b) a signal from the command signal source and a match between the check signal in the nonvolatile memory and bit values in the one portion of the volatile memory for activating the program stored in the nonvolatile memory without either supplying the check signal from the nonvolatile memory to the one portion of the volatile memory or supplying signals from the data source means to the another portion of the volatile memory.

12. The apparatus of claim 11 wherein the system includes an input data means, the control means responding to the mismatch for transferring signals from the input data means to the volatile memory.