JP2005240631A - Malfunction monitoring system for internal combustion engine control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a malfunction monitoring system for reasonably and simply detecting the malfunction of a slave CPU control device by additionally mounting control software only without giving poor effects to an original system. <P>SOLUTION: The system is provided for an internal combustion engine control system consisting of the several slave CPU control devices 104 for performing control in synchronization with a crank angle and at least one master CPU control device 101 for totally managing them. It is constructed so that example computation is executed in the slave CPU control devices 104 with the input of a control command value fed from the master CPU control device 101 to the slave CPU control devices 104 and its computation result is fed back to the master CPU control device 101. In the master CPU control device 101, an expected value internally generated by the same example computation is collated with the computation result from the slave side to detect the malfunction of the slave CPU control devices 104. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an abnormality monitoring system for a control system that controls the operation of an internal combustion engine used in an automobile or the like, and in particular, several slave CPU control devices (smart actuators) that perform control in synchronization with a crank angle; The present invention relates to an abnormality monitoring system for an internal combustion engine control system composed of at least one master CPU control unit (ECU) that controls them.

  In the current internal combustion engine control, various output devices are being adopted with the advancement and refinement of the control. Among them, a device called a smart actuator can perform intelligent and autonomous operations to some extent without involving a control device one by one, and includes a dedicated CPU inside.

  Also, there is an ECU (electronic control unit) that controls these movements, and also includes a CPU inside, apart from the smart actuator group. For example, it is connected to these smart actuator groups by star connection. It is.

  In this specification, for the sake of convenience, the smart actuator group is referred to as a slave CPU control device group, and the ECU that controls them is referred to as a master CPU control device.

  Therefore, the master CPU control device is required to have a function of accurately recognizing a function abnormality around the CPUs of these slave CPU control devices during engine operation and stopping the engine or shifting the entire system to fail-safe operation.

  Conventionally, as a method of easily giving this kind of diagnostic function to the system, the watchdog timer signals of the CPU with built-in smart actuator are aggregated and monitored by the central ECU, and the stoppage of the watchdog timer signal is detected on the central ECU side It is generally known to determine the malfunction of an actuator by doing so.

  However, the determination by the watchdog timer signal only proves at least the soundness around the watchdog output driver of the CPU and the non-stopability of the software part that calls it, and the soundness of the function of the entire CPU. It is a well-known fact that it does not represent sex.

  Moreover, in a CPU abnormality monitoring system that is slightly more sophisticated than this, for example, as described in Patent Document 1 below, the same calculation is performed by two CPUs, and the result of the calculation is collated, so that the CPU abnormality is detected. CPU abnormality monitoring system to detect is known.

According to the known example, the monitoring CPU transmits example data that is not directly related to the monitored CPU as a system control request, and the monitored CPU is previously negotiated with the monitoring CPU for the data. After performing the example operation, the result is returned to the monitoring CPU. In the monitoring CPU, the returned calculation result is compared with the expected value data calculated in advance in the monitoring CPU to determine whether or not there is an abnormality in the CPU.
JP 2000-29734 A (pages 1 to 7, FIGS. 1 to 4)

First, an outline of a master CPU controller-slave CPU controller system which is a premise of the present invention will be described.
As a feature of the configuration, the master CPU controller and slave CPU controller group (smart actuator group) are connected in a star shape as an example, and the master CPU controller issues a command by one-to-many communication. The time and functional resources that the control device spends on a specific slave CPU control device are limited.

  The typical operation mode is that the master CPU controller first selects a specific mode from the environment information that the slave CPU controller (smart actuator) itself cannot collect and the operation variations of various actuators themselves. In many cases, a two-step operation is required in which a trigger signal is transmitted at a timing at which an operation should actually be started after command information configured based on the above command is transmitted.

  In addition, a time margin is necessary between the command information (environment information / command) and the activation trigger for the slave CPU control device (smart actuator) itself to interpret the preceding information. In addition, the start trigger issued from the master CPU control device should be angle-modulated back and forth with a predetermined angular bandwidth depending on the operating state of the engine. For this angular bandwidth, For the slave CPU control device, there arises a situation in which no operation can be performed in preparation for an upcoming trigger. That is, for this period, the slave CPU control device must continue the idle state that is a standby operation.

  In consideration of such a situation, the above-described known technique cannot be adopted. The reason is that there is no time / functional resource for giving example data to the slave CPU controller from the master CPU controller.

  Moreover, when a plurality of slave CPU control devices are provided in the internal combustion engine, the problem becomes significant. Normally, even if the startup trigger line is connected to each slave CPU controller from the master CPU controller, the wiring for passing the above command information (environment information / command) is shared and consolidated for line saving. In many cases, a polling / selecting serial communication path is used. In this case, assuming a one-to-one communication between the master CPU controller and each slave CPU controller in a specific temporal (angular) slot, this communication path is a shared resource that each slave CPU controller should compete for exclusively. It becomes. Therefore, in order to avoid concentration and competition of communication traffic, the master CPU controller side job that activates this communication path must also be assigned to each crank angle to distribute processing (load). Apart from that, there is no room for resources to add example data transmission for monitoring the abnormality of the slave CPU controller.

  Furthermore, the example calculation based on the known example is a heavy burden for the slave CPU controller on the side where the question is given.

  As described above, for the slave CPU control device, the time between the time when the slave CPU control device itself interprets the command information between the command information (environment information / command) issued from the master CPU control device and the activation trigger. There must be a margin. Moreover, as described above, the activation trigger is issued from the master CPU control device with a certain angular bandwidth, and the slave CPU control device cannot execute any operation during this standby period. In addition, the angle synchronization process caused by the start trigger to the slave CPU controller side is the most important operation in the master CPU controller-slave CPU controller system that is the basis of the present invention. There is no room to perform the example operations described in.

  After all, from the command value output time point on the master CPU controller side as described above, until the slave CPU controller side finishes executing a series of angle synchronization processing, the example calculation for monitoring the abnormality of the slave CPU controller is performed. There is no time for execution in the slave CPU controller.

  Therefore, with respect to the above-mentioned known technology, the problem that the above-mentioned master CPU controller restricts the questions to be given to the slave CPU controller, and the slave CPU controller side performs an example operation on the question data. The problem that the timing of performing is restricted is a major issue.

  The present invention has been made in view of such conventional problems, and an object of the present invention is to provide at least one slave CPU control device that performs control in synchronization with a crank angle and at least one master that controls them. In an internal combustion engine control system configured with a CPU controller, it is possible to reasonably and easily detect abnormalities in the slave CPU controller by simply implementing additional control software without adversely affecting the original system. An object of the present invention is to provide an anomaly monitoring system that can be used.

  In order to achieve the above object, a first aspect of the abnormality monitoring system according to the present invention includes at least one slave CPU control device and at least one master CPU control device that controls them. A command assigned to each predetermined crank angle is sent to the slave CPU control device, whereby the slave CPU control device is applied to an internal combustion engine control system adapted to perform control synchronized with the crank angle, The slave CPU control device receives a command value from the master CPU control device, performs a function calculation for abnormality detection that has been negotiated in advance between the master and slave CPU control devices, and outputs the calculation result at a predetermined crank angle. Return to the master CPU controller, and the master CPU controller checks the function operation value calculated in advance and the returned operation result. Thus it is characterized in that it is adapted to detect the abnormality of the slave CPU controller.

  The first aspect discloses a method for solving the above-described question resource limitation. More specifically, the master CPU control device conventionally transfers the example data as an input of the example operation in the slave CPU control device. The command information (environment information / command), which has been implemented from the conventional control, is regarded as the data for example calculation, instead of being sent to the slave CPU control device independently of the data communication. . As a result, for the master CPU control device, the resource consumption due to the questions is greatly reduced.

  In the first aspect, command information (environment information / command) that is a “seed” of the example calculation does not change every time, and a situation in which the sensitivity related to abnormality detection of the slave CPU may be expected.

  Therefore, in the second aspect, measures against this problem are disclosed. That is, in the second aspect of the abnormality monitoring system according to the present invention, the command value that is sent from the master CPU controller to the slave CPU controller and becomes the function calculation input for abnormality detection is used only for the function calculation input. It is characterized by including a data portion of a random value generated by a master CPU control device that is not used for purposes other than abnormality monitoring.

  More specifically, the random number generated on the master CPU controller side is inserted into the empty bit field of the command information, and the “seed” of the example operation that is different every time the slave CPU example operation cycle is supplied to the slave CPU controller. To be done.

  The third aspect of the abnormality monitoring system according to the present invention is applied to the internal combustion engine control system having the same configuration as the first aspect, and the slave CPU control device collects the data independently of the master CPU control device. Using the value as input, perform the function calculation for abnormality detection that has been negotiated between the master and slave CPU controllers in advance, and return the function input value and the calculation result to the master CPU controller at a predetermined crank angle. The control device reproduces the function calculation for abnormality detection based on the function input value, and detects the abnormality of the slave CPU control device by comparing this reproduction result with the calculation result returned from the slave CPU control device. It is characterized by being made to do.

  In the third aspect, the “seed” for the above example calculation is not generated from the master CPU control device to the slave CPU control device, but is generated independently on the slave CPU control device side. More specifically, in the example calculation, the slave CPU control device generates a “seed” of the example calculation based on data such as A / D conversion values and timer device values that can be collected on the slave CPU control side. . Here, the command value sent from the master CPU controller to the slave CPU controller only has a meaning of supplying the timing as a pacemaker for the example calculation on the slave CPU controller side.

  As a result, the master CPU controller must receive the “seed” (function input value) of the example operation and the result (function output value) as a set of data from the slave CPU controller. Compared to the aspect, resource consumption can be saved by setting questions.

  A fourth aspect of the abnormality monitoring system according to the present invention corresponds to the relationship between the first aspect and the second aspect, and is an abnormality collected by the slave CPU control device independently of the master CPU control device. A value that is a function calculation input for detection includes a data portion of a random value generated by a slave CPU control device that is used only for the function calculation input and is not used for purposes other than abnormality monitoring. .

  Specifically, the “seed” data for example computations uniquely generated on the slave CPU controller side is regulated to change every time the example computation cycle, preventing the slave CPU abnormality detection sensitivity from being lowered. To do. That is, similar to the second aspect, by making a part (or all) of the “seed” data of the example operation input random number data, the output expected value changes every example operation cycle, and the slave CPU control device Even when an abnormality occurs, the probability that the abnormal output value maps to the same data as the expected value of the example calculation is reduced.

  The fifth aspect of the abnormality monitoring system according to the present invention discloses a technique for eliminating the execution timing restriction of the example calculation on the slave CPU control device side. That is, the execution of the abnormality detection function calculation in the slave CPU control device and the return of the calculation output value to the master CPU control device are performed after the master CPU control command reaches the slave CPU control device. The CPU control device is prohibited until the end of the crank angle synchronization control operation.

  As described above, for the slave CPU control device, the example calculation is executed (or the result of the master CPU control device side until the master CPU control device side finishes executing the series of angle synchronization processing) (Returned to the CPU controller) There is no time margin. Rather, if the example calculation is executed irregularly during these periods, the responsiveness of the original angle control operation may be impaired, or the command command may be misinterpreted as unchanged from the past. obtain. In order to avoid this, the execution of the example operation and the return operation of the result to the master CPU controller are to be prohibited until after the above series of control executions.

  The sixth aspect of the anomaly monitoring system according to the present invention discloses a technique for reducing the collection resource consumption of example calculation results. That is, the output value return of the function calculation for abnormality detection from the slave CPU control device to the master CPU control device is performed by full-duplex communication at the same timing as the command from the master CPU control device to the slave CPU control device. The current command value from the control device to the slave CPU control device and the previous function calculation output value return from the slave CPU control device to the master CPU control device are executed simultaneously.

  Since the master CPU control device and the slave CPU control device perform one-to-many communication as described above, a resource for collecting the example calculation results from each slave CPU control device is required in the same manner as the example question resource. Originally, the master CPU controller sets time (angular) slots in the same way as command information output, and collects the results from each slave CPU controller by one-to-many communication. The additional consumption of resources is in a situation that cannot be ignored by the system, as it was in the questions.

  In order to solve this problem, in the sixth aspect, using full-duplex communication, when the command information that originally exists is output (that is, when “seed” is output for the current example calculation), This example attempts to collect operation results from the slave CPU controller. Thereby, resource consumption due to the data collection can be greatly reduced.

  A seventh aspect of the abnormality monitoring system according to the present invention discloses a configuration of an abnormality detection function that is executed by an example calculation. That is, the abnormality detection function previously determined between the master-slave CPU control device includes the arithmetic / logic operation circuit, register file, address bus and data bus, cache control mechanism, and program of the slave CPU control device. In order to demonstrate the soundness of at least one of the program execution control mechanisms including the counter and the stack pointer, the operation result includes an instruction sequence reflected in the function output value.

  In order to correctly reflect the functional soundness of the slave CPU in the example computation, it is desirable to configure the abnormality detection function with the above instruction sequence.

  That is, the functional parts of the CPU to be reflected in the example operation include an arithmetic / logical operation circuit, a register file, an address bus and a data bus, a cache control mechanism, a program execution control mechanism including a program counter and a stack pointer.

  The eighth aspect of the abnormality monitoring system according to the present invention discloses another configuration of the abnormality detection function that is executed by the example calculation as in the seventh aspect. In other words, the abnormality detection function previously negotiated between the master-slave CPU control device demonstrates the soundness of the floating point arithmetic unit coupled to the slave CPU control device. It is characterized by including an instruction sequence reflected in.

  It is known that the floating point unit has a mode of failure regardless of the main processor core in the event of an electromagnetic failure.

  Therefore, when adopting floating-point arithmetic in the system, it is possible to include not only the CPU but also the soundness of the floating-point unit if it is configured to include the operation instruction of the floating-point unit as the instruction sequence used in the abnormality detection function. Can be verified.

  The ninth aspect of the abnormality monitoring system according to the present invention discloses another configuration of the abnormality detection function to be executed by the example calculation as in the seventh aspect and the eighth aspect. That is, the function for detecting an abnormality that has been negotiated between the master and slave CPU controllers in advance determines the operation mode of peripheral devices such as A / D converters and timer devices coupled to the slave CPU controller. In order to demonstrate the invariance of the values of the configuration registers, the bit pattern of the configuration registers includes an instruction sequence reflected in the function output value.

  Built-in peripheral devices such as A / D converters and timer devices are connected to the CPU core. These built-in peripheral devices have a configuration register that determines the operation mode, and specific values are set when the slave CPU control program is initialized. Thereafter, these values are logically rewritten. Absent. However, it is generally known that these values are destroyed by electromagnetic interference, alpha error, or CPU runaway.

  Therefore, in order to demonstrate the invariance of the values of the configuration register, the abnormality detection function is configured by including an instruction sequence in which the bit pattern of the configuration register is reflected in the output value of the abnormality detection function. Then, not only the CPU but also the soundness of the built-in peripheral devices can be verified.

  According to the present invention, the abnormality monitoring of the internal combustion engine control system can be performed rationally and simply, and the conventional system can be embodied in the form of additional implementation using only the control software, thereby suppressing an increase in additional cost. be able to.

  In addition, in the additional implementation, there is also an advantage that diagnosis for abnormality monitoring can be given without adversely affecting the control execution speed and responsiveness of the original system or the communication traffic of the original inter-CPU communication system. Have.

  Furthermore, since the example calculation mechanism according to the present invention has an extremely high diagnostic ability as compared with a conventional system such as watchdog signal monitoring, the reliability in a multi-CPU system can be greatly improved.

Hereinafter, embodiments of an abnormality monitoring system of the present invention will be described with reference to the drawings.
FIG. 1 is a schematic configuration diagram showing an embodiment of an abnormality monitoring system according to the present invention together with an in-vehicle internal combustion engine to which it is applied.

  The illustrated internal combustion engine 10 is a multi-cylinder engine having, for example, four cylinders, and includes a cylinder 12 and a piston 15 slidably inserted into each cylinder of the cylinder 12. A combustion chamber 17 is defined above. In the combustion chamber 17, a spark plug 26 is provided, and an intake port 24 that forms the most downstream portion of the intake passage 20 and an exhaust port 25 that forms the most upstream portion of the exhaust passage 30 are opened. Electromagnetically driven valves (intake valves and exhaust valves) 34 and 35 are provided to open and close the 24 and the exhaust port 25.

  In the intake passage 20, an air cleaner 21, an electric throttle valve 22, a fuel injection valve 23, and the like are arranged. The air-fuel mixture formed by the air sucked into the intake passage 20 and the fuel injected from the fuel injection valve 23 is sucked into the combustion chamber 17 from the intake port 23 via the electromagnetically driven valve (intake valve) 34, The combustion exhaust gas (exhaust gas) is ignited by the spark plug 26 and explosively burned, and the combustion waste gas (exhaust gas) is exhausted from the combustion chamber 17 to the exhaust passage 30 via the electromagnetically driven valve (exhaust valve) 35, and exhaust purification not shown After being purified by the catalyst for use, it is discharged outside.

  In addition to the above configuration, the electromagnetically driven valves 34 and 35 are attached with slave CPU control devices 104 and 105 which are smart actuators, and further, the slave CPU control devices 104 and 105 and other slave CPUs (not shown). A master CPU control unit (ECU) 101 that controls the control unit is provided.

  After the starter switch 102 recognizes the start (cranking) of the internal combustion engine by the starter switch 102, the master CPU control device 101 detects the rotation angle (crank angle) of the crankshaft 16 based on the signal from the crank angle sensor 103, and performs control. The job assigned to the crank angle is executed in accordance with the software setting stored in the apparatus 101. The job execution intention is mainly to control the slave CPU control devices 104 and 105 which are smart actuators for the electromagnetically driven valves 34 and 35.

  The master CPU control device 101 and the slave CPU control devices 104 and 105 are connected by high-speed trigger lines 106 and 107 and low-speed communication lines 108 and 109.

  The master CPU control device 101 exchanges information with the slave CPU control devices 104 and 105 through the low-speed communication lines 108 and 109. To list specific examples of these information, as information from the master CPU controller 101 to the slave CPU controllers 104 and 105, environmental information (oil temperature, intake / exhaust ports) that cannot be collected by the smart actuator itself as the slave CPU controller These are commands for the master CPU control device 101 to select a specific mode from disturbance information such as differential pressure) and operation variations of various actuators themselves. On the other hand, examples of information from the slave CPU control devices 104 and 105 to the master CPU control device 101 include environmental information and diagnostic information independently collected by the actuator itself.

  After setting the above information, the master CPU control device 101 sends an activation trigger to the slave CPU control devices 104 and 105 through the high-speed trigger lines 106 and 107, and executes the opening / closing operation of the electromagnetically driven valves (intake and exhaust valves). Let

  In the figure, the connection relationship is shown only for one cylinder of the internal combustion engine 10, but actually, similar to the slave CPU control attached to the electromagnetically driven valves of the other cylinders starting from the master CPU controller 101. The device is wired in a star shape by the above-described low-speed communication line and high-speed trigger line.

  FIG. 2 is a chart for explaining the operation of the master CPU control device 101 and the slave CPU control devices 104 and 105 based on the crank angle. However, in order to avoid bothering the drawing and explanation, the operation of the slave CPU control device 104 on the intake valve 34 side of the two slave CPU control devices is shown as a representative (the same applies to the following drawings).

  A large circle 201 indicates an operation based on the crank angle of the master CPU control device 101, and a small circle 202 indicates an operation of the slave CPU control device 104.

  As described above, the command information 203 is first sent from the master CPU controller 101 to the slave CPU controller 104 through the low-speed communication line 108 at a predetermined crank angle A. The slave CPU control device 104 interprets the environment value and command information included in the command information 203, and this value is used later as a “seed” for the example calculation.

  At the subsequent predetermined crank angle B, the master CPU control device 101 sends an activation trigger signal 204 to the slave CPU control device 104 through the high-speed trigger line 106. As a result, the slave CPU control device 104 executes the original predetermined control operation 205 synchronized with the crank angle, and ends the processing at the crank angle C.

  As described above, the transmission crank angle B of the start trigger signal 204 varies back and forth with a predetermined bandwidth depending on the operating state of the internal combustion engine 10. Therefore, the execution end angle C of the control operation 205 in the slave CPU control device 104 also fluctuates back and forth. However, in FIG. 2, the crank angle range θa from the command information 203 (crank angle A) to the end crank angle C of the control operation 205 is avoided, and the execution 206 of the example calculation and the return of the calculation result to the master CPU controller 101 are performed. 207 is shown. This shows an example of a technique for solving the execution timing restriction of the example calculation on the slave CPU control device side disclosed in the fifth aspect of the present invention.

  However, in FIG. 2, since the example operation result return 207 from the slave CPU control device 104 to the master CPU control device 101 is performed at a predetermined crank angle, the low-speed communication line 108 is occupied by this communication at this time. ing.

  The low-speed communication line 108 is a part of the same serial communication path connected to the other slave CPU control apparatus groups in a star shape (a part of the low-speed communication line 109) for the master CPU control apparatus. When the communication path is occupied by this, there is a problem that a signal similar to the command information 203 cannot be sent to other slave CPU control devices (for example, 105) at the same time.

  FIG. 3 is a chart showing another operation example of the master CPU control device 101 and the slave CPU control device 104 based on the crank angle. In FIG. 3, the reply 307 of the example calculation output from the slave CPU control device 104 to the master CPU control device 101 is transmitted simultaneously with the transmission of the command information 303 from the master CPU control device 101 to the slave CPU control device 104 (crank angle A). It is executed by duplex communication. Therefore, unlike the example shown in FIG. 2, the consumption of communication path resources spent for collecting the calculation output of the example is saved, and the abnormality monitoring system does not increase traffic on the low-speed communication lines 108 and 109 of the current system. Implementation is possible. This is an example of a technique for reducing the collection resource consumption of the example calculation results disclosed in the sixth aspect of the present invention described above.

  FIG. 4 is a block diagram (data flow diagram) corresponding to the first aspect and the second aspect of the present invention described above, illustrating an example of processing executed by the master CPU control device 101 and the slave CPU control device 104.

  In the master CPU control device 101, environment information that cannot be collected from the slave CPU control device 104 (for example, A / D conversion values of sensors connected only to the master CPU control device 101), commands to the slave CPU control device 104, etc. , An environmental value 405 is generated. Separately from this, a random number value 404 is generated by a random number generation source 403 (specifically, a time stamp of a free-run timer) and combined with the environmental value. These values are sent as the command value 406 to the slave CPU controller 104 at the timing of the command information 203 (crank angle A) in FIG. 2 or the timing of the command information 303 (crank angle A) in FIG. Are stored in the reception buffer 408 in the slave CPU control device 104, and a set 407, 409 of anomaly detection function between the master and the slave is calculated using this same value as an input. The abnormality detection function 407 in the master CPU control device 101 and the abnormality detection function 409 in the slave CPU control device 104 are the same functions that are determined in advance by the master and the slave.

  The example calculation result 410 calculated by the slave CPU controller 104 is sent to the master CPU controller 101 as the reply 411 in FIG. 4 at the timing of the reply 207 in FIG. 2 or the reply 307 in FIG. 3 as described above. And stored in the reception buffer 412 in the master CPU controller 101.

  When these values are obtained, the master CPU controller 101 compares the result 413 of the master side abnormality detection function 407 and the result of the slave CPU in the reception buffer 412 by the comparison unit 414. Is determined by the determination unit 415 to determine that the slave CPU control device 104 is normal, and if there is a mismatch, the determination unit 415 determines that the slave CPU control device 104 is abnormal and is determined to be abnormal. If so, an alarm command 416 is issued to the outside.

  FIG. 5 is a block diagram (data flow diagram) corresponding to the third aspect and the fourth aspect of the present invention described above, showing another example of processing executed by the master CPU control device 101 and the slave CPU control device 104. .

  An environment value 505 is generated based on environment information uniquely collected by the slave CPU control device 104 (for example, an A / D conversion value of a sensor connected only to the slave CPU control device 104). Separately, a random number value 504 is generated by a random number generation source 503 (specifically, a time stamp of a free-run timer) and combined with the environment value.

  Based on this value, the example calculation result 508 is calculated by the abnormality detection function 507 in the slave CPU control device 104, and the input value (environment value 505 and random number value 504) and output value ( 508) is the master CPU controller 101 as the data 506 and 509 constituting the same communication frame ensuring the simultaneity at the timing of the reply 207 in FIG. 2 or the timing of the reply 307 in FIG. (The contents of the reception buffer 510 are the input values of the abnormality detection function, while the contents of the reception buffer 512 are the output values of the abnormality detection function).

  In the master CPU control device 101, the master side abnormality detection function 511 corresponding to the slave side abnormality detection function 507 is executed based on the contents of the reception buffer 510. The abnormality detection function 511 in the master CPU control device 101 and the abnormality detection function 507 in the slave CPU control device 502 are the same functions that are determined in advance by the master and the slave.

  When these values are obtained, in the master CPU control apparatus 101, the result 513 of the master side abnormality detection function 511 and the result of slave CPU side calculation in the reception buffer 512 are compared and matched by the comparison unit 514. In this case, the determination unit 515 determines that the determination slave CPU control device 104 is normal, and in the case of mismatch, the determination unit 515 determines that the slave CPU control device 104 is abnormal and determines that it is abnormal If necessary, an alarm command 516 is issued to the outside.

  6 is a block diagram showing an example of functional parts of slave CPU hardware that must be verified as an abnormality detection function (reference numeral 409 in FIG. 4 or reference numeral 507 in FIG. 5) on the slave CPU control device 104 side.

  These abnormality detection functions are implemented in the form of a software program (an entity 606 of the abnormality detection function f (x)) stored in the ROM 604 in the slave CPU control device 104.

  Here, as a method for verifying the soundness of the CPU core 601 as a function of the abnormality detection function, the following example can be considered (corresponding to the seventh aspect of the present invention described above).

  The entity 606 of the abnormality detection function f (x) is copied to the instruction cache 611 and executed by the CPU core 601. At that time, if the output of the abnormality detection function f (x) matches the expected value at a predetermined function input, the functional devices involved in a series of instruction execution flows, that is, ROM 604, address bus 609, data bus 610, cache The soundness of the control mechanism 611, the execution control mechanism 612 including the program counter and the stack pointer, and the register file 608 for storing the progress of calculation of the program has been proved.

  As another example, a plurality of intermediate calculation results are stored in the register file 608 during the above instruction calculation. Thereafter, if the arithmetic or logical operation is executed between the plurality of intermediate results, and the result is reflected in the result of the abnormality detection function f (x), the soundness of the arithmetic / logical operation circuit 607 can be verified. It becomes.

  The above is about the CPU in the slave CPU control device 104. If the architecture of the slave CPU and the master CPU does not match, that is, if the register bit width is different or there is a difference in the presence or absence of cache, the master The slave CPU architecture must be properly emulated by the slave CPU, and the master error detection function must be considered so that the expected output can be correctly predicted.

  As a method for verifying the soundness of the floating-point arithmetic unit 602 as a function of the abnormality detection function, the following example can be considered (corresponding to the eighth aspect of the present invention described above).

  During the calculation of the above-described abnormality detection function, the calculation result on the register file 608 is converted into a floating point by the floating point calculation unit 602. Further, the floating point arithmetic unit 602 performs some constant operation as a floating point operation on the floating point number, and then converts it to a fixed point again and writes it back to the register file 608. If this calculation process is reflected in the result of the abnormality detection function f (x) in consideration of rounding errors, the soundness of the floating-point calculation unit 602 can also be verified.

  Again, the above is about the CPU in the slave CPU controller 104. If the slave CPU and the master CPU have different architectures with or without a floating-point arithmetic unit, the master-side abnormality detection function must be considered so that the master-side CPU properly emulates the floating-point arithmetic function of the slave CPU. It goes without saying that it doesn't happen.

  As a technique for verifying the invariance of the initialization data of the peripheral device 603 coupled to the CPU as a function of the abnormality detection function, the following example can be considered (corresponding to the ninth aspect of the present invention described above) To do).

  As the CPU built-in peripheral device, an A / D converter 613, a timer device 614, and the like are conceivable, and each holds a register called a configuration register (615, 616). These are used for pre-selecting the operation mode of each device, and are not rewritten after a predetermined value is set upon initialization at the time of starting the program.

  Therefore, if these values (bit patterns) are regarded as constant values used during the calculation of the abnormality detection function f (x), the invariance of these set values during the system operation period can be verified. it can.

  Again, the above is about the CPU in the slave CPU controller 104. When the slave CPU environment differs from the master CPU environment due to the presence or absence of peripheral devices or mismatched setting values, the master side abnormality detection function properly emulates the expected operation of the slave CPU on the master CPU. Needless to say, you have to consider.

  FIG. 7 is a flowchart corresponding to the above-described first aspect and second aspect of the present invention, showing an example of processing executed by the master CPU control device 101 and the slave CPU control device 104. A series of flowcharts on the left side of the figure shows the flow of processing in the master CPU controller 101 (abbreviated as master CPU), and a series of flowcharts on the right side shows the flow of processing in the slave CPU controller 104 (abbreviated as slave CPU). ing. The wavy lines (706, 711) connecting the left and right charts indicate data exchange between the master CPU and the slave CPU via the low-speed communication line 108 shown in FIG.

  Step 701 indicates the start of the slave CPU diagnostic routine on the master side. In step 702, random numbers are generated, and in step 703, a command group is selected that selects environment values or slave-side operation modes that cannot be collected by the slave CPU. To generate a command value (x). As described above, this command value (x) is used as a command for slave CPU side control, and becomes an input (a “seed” of calculation) of the slave CPU side abnormality detection function f (x).

  In step 704, the command value (x) is transmitted to the slave CPU side (dashed line 706) and the slave side data reception routine (707) is started. On the other hand, on the master side, in step 705, the expected value (a) of the abnormality detection function f (x) is calculated in advance to prepare for the subsequent diagnosis.

  On the slave side, based on step 708, the operation prohibiting operation is performed at the prohibition crank angle of the example calculation (crank angle range θa in FIGS. 2 and 3). In step 709, the calculation of the abnormality detection function f (x) is executed, whereby the calculation result (b) on the slave side is calculated and returned to the master side CPU in step 710 (dashed line 711).

  On the master side, the waiting operation is executed until the slave side operation result is returned in step 712. However, since the master side operation result (a) and the slave side operation result (b) are now complete, In step 713, the comparison and collation operation is started. If the values match, it is determined in step 714 that the slave CPU is normal. If the values do not match, it is determined in step 715 that the slave CPU is abnormal. If necessary, an external alarm is issued.

  FIG. 8 is a flowchart corresponding to the third aspect and the fourth aspect of the present invention described above, showing another example of processing executed by the master CPU control device 101 and the slave CPU control device 104. A series of flowcharts on the left side of the figure shows the flow of processing in the master CPU controller 101 (abbreviated as master CPU), and a series of flowcharts on the right side shows the flow of processing in the slave CPU controller 104 (abbreviated as slave CPU). ing. The wavy lines (803 and 810) connecting the left and right charts indicate data exchange between the master CPU and the slave CPU via the low-speed communication line 108 shown in FIG.

  Step 801 indicates the start of the slave CPU diagnostic routine on the master side. In step 802, the command value is transmitted to the slave CPU side (dashed line 803) and the slave side data reception routine (804) is started. In this example, the command value does not become an input (an “seed” of the calculation) of the abnormality detection function f (x), but serves as a pacemaker that executes the slave-side example calculation every predetermined crankshaft rotation. This is as described above.

  On the slave side, a calculation prohibiting operation is performed at the crank angle (crank angle range θa in FIGS. 2 and 3) of the example calculation based on the subsequent step 805.

  In step 806, random numbers are generated so that the input (operation “seed”) of the abnormality detection function f (x) is different every time. In step 807, an environmental value (A / D conversion thereof) available to the slave CPU side. Value) and the input value (x) of the abnormality detection function is generated. In step 808, the slave side abnormality detection function f (x) is calculated based on the input value (x) to generate the calculation result (b). In step 809, the function input value described above is used. A set of (x) and output value (b) is transferred to the master CPU side as a reply (x, b) (dashed line 810).

  The combination of the function input value (x) and output value (b) should be sent to the master side in the same communication frame so that the relationship as the paired data that is the input / output value of the function is guaranteed at each communication timing. This is as described above.

  On the master side, a waiting operation is executed until the slave-side operation data pair is answered in step 811. Here, the combination data of the slave-side function input value (x) and output value (b) has been prepared. Therefore, the verification operation is entered in subsequent steps 812 and thereafter.

  In step 812, it is confirmed whether or not the input value (x) of the slave-side abnormality detection function (calculation “seed”) has changed compared to the previous time. If there is no change, there is a possibility that a problem has occurred in the slave-side example calculation mechanism, so jump to Step 816 to determine that the slave CPU is abnormal and issue an alarm command to the outside if necessary. .

  If it has changed, the expected operation value (a) on the master side is generated on the basis of the input value (x) sent from the slave side in the next step 813.

  In step 814, a comparison / collation operation between the master side expected value (a) and the slave side operation result (b) is executed. If the values match, it is determined in step 815 that the slave CPU is normal, and if they do not match, it is determined in step 816 that the slave CPU is abnormal.

  In the above-described embodiment, it is exemplified that the diagnosis is performed once for one rotation of the crankshaft. However, for the diagnosis for every predetermined crank angle which is less than one rotation of the crankshaft even once every plural times. Needless to say, the present invention is applicable.

  In the above-described embodiment, the electromagnetically driven valves (intake and exhaust valves) 34 and 35 are controlled. However, the present invention is not limited to the electromagnetically driven valves, and is synchronized with the crankshaft rotation. Any smart actuator that can be controlled can be any slave CPU controller.

  For example, the present invention can be applied to various types such as a variable valve mechanism actuator, a fuel injection actuator, a mixture ignition actuator, an intake / exhaust braking / resonance actuator, and an engine block damping actuator.

BRIEF DESCRIPTION OF THE DRAWINGS The schematic block diagram which shows embodiment of the abnormality monitoring system which concerns on this invention with the vehicle-mounted internal combustion engine to which it is applied. The chart which shows the operation example of the master CPU control apparatus of this invention embodiment, and a slave CPU control apparatus. 6 is a chart showing another operation example of the master CPU control device and the slave CPU control device of the embodiment of the present invention. The block diagram which shows an example of the process which the master CPU control apparatus and slave CPU control apparatus of this embodiment perform. The block diagram which shows the other example of the process which the master CPU control apparatus and slave CPU control apparatus of embodiment of this invention perform. The block diagram which shows an example of the hardware of the slave CPU control apparatus of this invention embodiment. It is a flowchart which shows an example of the process which the master CPU control apparatus of this invention embodiment and a slave CPU control apparatus perform. 6 is a flowchart showing another example of processing executed by the master CPU control device and the slave CPU control device of the embodiment of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Vehicle-mounted internal combustion engine 16 ... Crankshaft 34, 35 ... Electromagnetic drive valve (intake / exhaust valve)
101 ... Master CPU controller 102 ... Starter switch 103 ... Crank angle sensor 104, 105 ... Slave CPU controller 106/107 ... High speed trigger line 108/109 ... Low speed communication line

Claims (9)

  Consists of at least one slave CPU control device and at least one master CPU control device that supervises them, from the master CPU control device is sent to the slave CPU control device for each predetermined crank angle, Thus, in the abnormality monitoring system of the internal combustion engine control system in which the slave CPU control device performs control synchronized with the crank angle, the slave CPU control device receives the command value from the master CPU control device as an input in advance. Performs the function calculation for abnormality detection decided between the master and slave CPU control devices, returns the calculation result to the master CPU control device at a predetermined crank angle, and the master CPU control device calculates the function calculated in advance inside Abnormalities in the slave CPU controller are detected by comparing the calculated value with the returned calculation result. Abnormality monitoring system, characterized in that.   The master CPU control device that is used only for the function calculation input and is not used for purposes other than abnormality monitoring, is used as a function calculation input for abnormality detection, which is sent from the master CPU control device to the slave CPU control device. 2. The abnormality monitoring system according to claim 1, comprising a data portion of a random value generated by.   Consists of at least one slave CPU control device and at least one master CPU control device that supervises them, from the master CPU control device is sent to the slave CPU control device for each predetermined crank angle, Thus, in the abnormality monitoring system for the internal combustion engine control system in which the slave CPU control device performs control in synchronization with the crank angle, the slave CPU control device inputs the collected values regardless of the master CPU control device. As described above, the function calculation for abnormality detection that has been negotiated between the master and slave CPU control devices is performed in advance, and the function input value and the calculation result are returned to the master CPU control device at a predetermined crank angle. The function calculation for detecting the abnormality is reproduced based on the function input value, and the reproduction result is returned from the slave CPU controller. Abnormality monitoring system characterized by being adapted to detect the abnormality of the slave CPU controller by matching the calculation result.   The slave CPU control device collects values that are used as function calculation inputs for abnormality detection regardless of the master CPU control device, and is used only for the function calculation inputs. 4. The abnormality monitoring system according to claim 3, further comprising a data portion of a random value generated by the control device.   Execution of abnormality detection function calculation in the slave CPU control unit and return of the calculation output value to the master CPU control unit is performed after the master CPU control unit command reaches the slave CPU control unit. 5. The abnormality monitoring system according to claim 1, wherein the abnormality monitoring system is prohibited until the end of the crank angle synchronization control operation of the apparatus.   The master CPU controller performs full-duplex communication at the same timing as the command from the master CPU controller to the slave CPU controller to return the output value of the abnormality detection function calculation from the slave CPU controller to the master CPU controller. 5. The current command value from the slave CPU control device to the slave CPU control device and the previous function calculation output value return from the slave CPU control device to the master CPU control device are simultaneously executed. The anomaly monitoring system described.   The abnormality detection functions previously determined between the master-slave CPU control device are the arithmetic / logic operation circuit, register file, address bus and data bus, cache control mechanism, and program counter of the slave CPU control device. And an instruction sequence in which the operation result is reflected in the function output value in order to demonstrate the soundness of at least one of the program execution control mechanisms including the stack pointer. The abnormality monitoring system according to any one of the above.   The function for detecting an abnormality that has been negotiated between the master and slave CPU controllers in advance is to verify the soundness of the floating point arithmetic unit coupled to the slave CPU controller, and the operation result is reflected in the function output value. 7. The abnormality monitoring system according to claim 1, further comprising an instruction sequence to be executed.   The function for detecting an abnormality previously negotiated between the master-slave CPU controller is a configuration for determining the operation mode of peripheral devices such as an A / D converter and a timer device coupled to the slave CPU controller. 7. The abnormality according to claim 1, wherein the bit pattern of the configuration register includes an instruction sequence reflected in the function output value in order to verify the invariance of the register value. Monitoring system.

Images