JP5226653B2 - In-vehicle control device - Google Patents

Description

  The present invention relates to an in-vehicle control device.

  In recent vehicle control systems, the amount of programs tends to increase due to various demands such as market demand, fuel efficiency improvement, and exhaust emission control. Along with this, there are concerns about failures due to design / program errors due to complicated program configurations. Therefore, it is more important than ever to ensure safety when the vehicle is traveling.

  In Patent Document 1 below, it is determined whether or not the behavior change during driving is intended by the driver, and if it is abnormal, fail-safe processing is executed to ensure safety during vehicle driving. However, there is a possibility that an abnormality may occur due to a program mistake or the like instead of a behavior change during traveling. Therefore, in a generally known technique, in order to detect an abnormality caused by a program mistake, the control processing quality is managed by making the control system double redundant and comparing the calculation results with each other.

JP 2009-62998 A

  In general, in a double redundant system for vehicle control, the same calculation process is executed using a function created in a different programming language, for example, for a calculation process (for example, a process for calculating torque) having a great influence on the vehicle control. Are compared with each other. If the calculation results do not match each other, it is considered that an abnormality has occurred, and failsafe processing is executed for the functional block to ensure safety.

  Therefore, since the vehicle control double redundant system executes a plurality of the same arithmetic processing, the arithmetic load becomes large, and there is a possibility that the arithmetic processing capability of the arithmetic device cannot complete the processing.

  The present invention has been made to solve the above-described problems, and it is an object of the present invention to provide an in-vehicle control device capable of ensuring safety while reducing a processing load related to vehicle control. To do.

  The in-vehicle control device according to the present invention includes a main operation unit and a sub operation unit that executes a confirmation operation thereof, and executes the confirmation operation of the sub operation unit based on whether the input or output of the main operation unit is normal. It is determined whether or not to do.

  According to the vehicle-mounted control device according to the present invention, the sub calculation unit does not necessarily execute the confirmation calculation every time, and does not execute the confirmation calculation when it is assumed that the processing of the main calculation unit is normal. Thereby, the calculation processing load of the vehicle-mounted control device can be reduced while ensuring safety.

3 is a functional block diagram of the in-vehicle control device 100 according to Embodiment 1. FIG. It is the operation | movement flow for 1 cycle of the vehicle-mounted control apparatus 100. FIG. It is an operation | movement flow of the vehicle-mounted control apparatus 100 in Embodiment 2. FIG. FIG. 6 is a functional block diagram of a vehicle control device 100 according to a third embodiment. It is a figure which shows a mode that each abnormality detection part detects abnormality of the output value of a main calculating part. The example which changes an upper limit threshold value and a lower limit threshold value according to the driving | running state of a vehicle is shown. 12 is an operation flow of the in-vehicle control device 100 according to the third embodiment. It is a figure which shows the execution timing of each process of a main calculating part and a sub calculating part. 10 is an operation flow of the in-vehicle control device 100 according to the fourth embodiment.

<Embodiment 1>
FIG. 1 is a functional block diagram of in-vehicle control apparatus 100 according to Embodiment 1 of the present invention. The in-vehicle control device 100 is a device that executes control related to vehicle operation, such as engine control and communication control.

  The in-vehicle control device 100 includes a main calculation unit B111, a main calculation unit C112, a main calculation unit D113, a sub calculation unit B′121, a sub calculation unit C′122, a sub calculation unit D′ 123, an inconsistency diagnosis unit BB′131, A mismatch diagnostic unit CC′132 and a mismatch diagnostic unit DD′133 are provided. Here, an example in which the main calculation unit has a three-stage configuration is shown, but the number of stages of the main calculation unit and the sub calculation unit may be arbitrary. In addition, it is not always necessary to provide sub-operation units for all main operation units, and it may be provided only for particularly important control operations.

  The main calculation unit B111, the main calculation unit C112, and the main calculation unit D113 are connected in series in this order. Each main calculation unit executes a control calculation related to a control target of the in-vehicle control device 100. The main calculation unit B111 receives the parameter A as an input value, and the subsequent main calculation unit receives the output value of the preceding main calculation unit. The main calculation unit D113 receives the parameter E as an input value in addition to the output value of the main calculation unit C112. The main calculation unit D113 outputs the parameter D as the final output value.

The sub operation unit B′121, the sub operation unit C′122, and the sub operation unit D′ 123 receive the same input value as the corresponding main operation unit, execute the same control operation, and perform the confirmation operation of the main operation unit, The calculation result is output to the corresponding inconsistency diagnosis unit. However, each sub operation unit is implemented by a method different from the corresponding main operation unit. For example, the following methods can be considered.
(Implementation method for sub-operation part 1)
The main calculation unit and the sub calculation unit are designed for the same control process by different designers.
(Method for mounting sub-operation part 2)
The main calculation unit and the sub calculation unit are mounted on different calculation devices (microcomputer, ROM: Read Only Memory).
(Method for mounting sub-operation part 3)
The main operation unit and the sub operation unit are implemented using different programming languages.

  The inconsistency diagnosis unit BB′131, the inconsistency diagnosis unit CC′132, and the inconsistency diagnosis unit DD′133 receive the calculation results of the corresponding main calculation unit and sub calculation unit, respectively, and whether or not they match, Diagnose whether an abnormality has occurred in the main arithmetic unit. If the difference between the two is 0, or is substantially less than a predetermined threshold and can be regarded as substantially 0, the main calculation unit is regarded as operating normally. If the difference between the two is equal to or greater than a predetermined threshold value, it is considered that an abnormality has occurred in either the main calculation unit or the sub calculation unit.

  Each functional unit described above may be realized by using hardware such as a circuit device that realizes these functions, or by using an arithmetic device such as a microcomputer or a CPU (Central Processing Unit) and software that defines the operation thereof. It can also be configured. In addition, a plurality of functional units can be integrally configured. For example, programs that implement the functions of the main calculation unit B111 and the main calculation unit C112 may be stored on the same memory device.

  The configuration of the in-vehicle control device 100 according to Embodiment 1 has been described above. Next, a method for reducing the calculation processing of the sub calculation unit will be described.

  The sub-operation unit executes a confirmation operation for confirming whether the control operation performed by the main operation unit is correct. Therefore, if the control calculation executed by the main calculation unit can be regarded as correct, it is not necessary to execute the confirmation calculation of the sub calculation unit. The in-vehicle control device 100 uses this fact to reduce the calculation load. The procedure will be described with reference to FIG.

  FIG. 2 is an operation flow for one cycle of the in-vehicle control device 100. Hereinafter, each step of FIG. 2 will be described.

(FIG. 2: Step S201)
The main calculation unit B111, the main calculation unit C112, and the main calculation unit D113 each execute a prescribed control calculation.

(FIG. 2: Step S202)
The inconsistency diagnosis unit BB′131 holds the previous values of the input value A and the output value B in an appropriate memory or the like. When the difference between the output value B and the previous value falls within a predetermined threshold value, the inconsistency diagnosis unit BB′131 operates stably with the main calculation unit B111, and performs the confirmation calculation of the sub calculation unit B′121. Determine that there is no need to do so. Thereafter, steps S203 and S204, which will be described later, are skipped and the process proceeds to step S205. If the difference exceeds the predetermined threshold, the process proceeds to step S203. Whether or not the difference between the output value B and the previous value falls within a predetermined threshold can be determined by any of the following.

(FIG. 2: Step S202: Determination method 1)
The inconsistency diagnosis unit BB′131 compares the output value B itself with the previous value. When the difference value between the current value and the previous value is within a predetermined threshold value, it is determined that it is not necessary to perform the confirmation calculation of the sub calculation unit B′121.

(FIG. 2: Step S202: Determination method 2)
The inconsistency diagnosis unit BB′131 compares the input value A with the previous value. If the input value A is close to the previous value, the calculation result is expected to be close to the previous value. Therefore, if the difference value between the current value and the previous value of the input value A is within a predetermined threshold, the inconsistency diagnosis unit BB′131 determines that it is not necessary to perform the confirmation calculation of the sub-operation unit B′121.

(FIG. 2: Step S202: Determination method 3)
The inconsistency diagnosis unit BB′131 compares both the input value A and the output value B with the previous value. When only one of them is different from the previous value and the difference value of the output value B from the previous value is within the predetermined range, it is determined that it is not necessary to perform the confirmation calculation of the sub-operation unit B′121. If both values are different from the previous value, it is determined that it is necessary to perform a confirmation operation of the sub-operation unit B′121.

(FIG. 2: Step S202: common judgment methods 1 to 3)
When the difference value from the previous value of the output value B does not fall within the predetermined range, it is determined that it is necessary to perform the confirmation calculation of the sub calculation unit B′121.

(FIG. 2: Step S203)
The sub calculation unit B′121 executes the same control calculation as the main calculation unit B111, and outputs the calculation result to the inconsistency diagnosis unit BB′131 as an output value B ′.

(FIG. 2: Step S204)
The inconsistency diagnosis unit BB′131 determines whether the output value B of the main calculation unit B111 matches the output value B ′ of the sub calculation unit B′121, or whether the difference between the two is less than a predetermined threshold. judge. If they match or the difference is less than the predetermined threshold value, it is determined that the main operation unit B111 is operating normally, and the process proceeds to step S205. If they do not match or the difference is greater than or equal to a predetermined threshold, the process proceeds to step S211.

(FIG. 2: Steps S205 to S207)
The main calculation unit C112 and the sub calculation unit C′122 execute these steps in the same manner as steps S202 to S204.

(FIG. 2: Steps S208 to S210)
The main calculation unit D113 and the sub calculation unit D′ 123 execute these steps in the same manner as steps S202 to S204. However, since these arithmetic units have two input values, processing is performed as follows.

(FIG. 2: Steps S208 to S210: Processing Example 1)
When the difference value between at least one of the input value C and the input value E and the previous value thereof does not fall within the predetermined range, it is determined that the confirmation calculation of the sub calculation unit D ′ needs to be performed. The output value D is the same as steps S202 to S204.

(FIG. 2: Steps S208 to S210: Processing example 2)
When the difference value between both the input value C or the input value E and the previous value does not fall within the predetermined range, it is determined that it is necessary to perform a confirmation operation of the sub-operation unit D ′. If only one of the difference values does not fall within the predetermined range, it is determined that it is not necessary to perform the confirmation calculation of the sub calculation unit D ′. The output value D is the same as steps S202 to S204.

(FIG. 2: Step S211)
The main arithmetic unit that is determined to be abnormal or an alternative arithmetic unit that replaces the main arithmetic unit degenerates the function of the function block that is determined to be abnormal and executes that function in fail-safe mode. To do. For example, if the inconsistency diagnosis unit BB′131 determines that an abnormality has occurred in the main calculation unit B111, the main calculation unit B111 performs the function within a range in which the function is degenerated and no abnormality occurs.

  The operation flow for one cycle of the in-vehicle control device 100 has been described above. The in-vehicle control device 100 repeatedly executes the operation flow described with reference to FIG. 2 in units of, for example, every few ms, every few seconds, or the like according to the contents of the processing.

  In the first embodiment, the threshold value for determining whether the input value and the output value of the main calculation unit have changed from the previous value, and whether the calculation results of the main calculation unit and the sub calculation unit match. The threshold value to be determined may be the same for each main calculation unit, or may be a different value. Further, the former threshold value and the latter threshold value may be the same value or different values. The same applies to the following embodiments.

  As described above, the in-vehicle control device 100 according to the first embodiment does not execute the calculation of the sub calculation unit when the output value of the main calculation unit falls within a predetermined range of difference compared to the previous value. Thereby, it is possible to maintain the reliability of the main calculation unit while reducing the calculation load of the sub calculation unit.

  Further, when the in-vehicle control device 100 according to the first embodiment determines whether or not the sub-operation unit needs to perform a confirmation operation, the amount of change from the previous value of the input value of the main operation unit is predetermined. It can be based on whether or not it falls within the range. Thereby, determination can be processed in parallel and completed before the control calculation of the main calculation unit is completed.

  Further, when the in-vehicle control device 100 according to the first embodiment determines whether or not the sub-operation unit needs to perform a confirmation operation, the amount of change in both the input value and the output value of the main operation unit is It can be based on whether or not it falls within a predetermined range from the previous value. As a result, it is possible to perform a stricter determination than in the case where only the change amount of the output value falls within the predetermined range. For example, although the input value has changed significantly from the previous value, there is a possibility that the calculation result accidentally becomes the same value as the previous value due to an abnormal operation of the main calculation unit. If only the output value is checked, it is difficult to detect such an abnormal operation. Such a check omission can be prevented by checking both the input value and the output value.

<Embodiment 2>
In Embodiment 1, the example which determines whether the process of a sub calculating part is performed for every main calculating part was demonstrated. On the other hand, when the control calculations of a plurality of main calculation units are closely related, these main calculations can be regarded as executing one control calculation collectively. Therefore, whether or not to perform the processing of the sub-operation unit can also be determined integrally. In the second embodiment of the present invention, one example of the operation will be described.

  FIG. 3 is an operation flow of the in-vehicle control apparatus 100 according to the second embodiment. Here, an example in which the main calculation unit B111 and the main calculation unit C112 are closely related and can be regarded as one control calculation together is shown. Hereinafter, each step of FIG. 3 will be described.

(FIG. 3: Step S301)
This step is the same as step S201 in FIG.

(FIG. 3: Step S302)
When the difference between the output value C and the previous value falls within a predetermined threshold, the inconsistency diagnosis unit CC′132 operates stably with the main calculation unit B111 and the main calculation unit C112, and the sub calculation unit B ′. It is determined that it is not necessary to perform the confirmation calculation of 121 and the sub calculation unit C′122. Thereafter, steps S303 to S306 are skipped, and the process proceeds to a step (step S307) for checking a change in the output value D.

(FIG. 3: Steps S303 to S306)
These steps are the same as steps S203 to S204 and S206 to S207 in FIG.

(FIG. 3: Steps S307 to S310)
These steps are the same as steps S208 to S211 in FIG.

  The operation flow for one cycle of the in-vehicle control device 100 according to the second embodiment has been described above. In FIG. 3, the example in which the main calculation unit B111 and the main calculation unit C112 are integrally handled has been described. However, when the control calculations of two or more consecutive main calculation units are closely related, the other main calculation units This combination can also be handled in the same manner.

  As described above, according to the second embodiment, when the control calculations of two or more consecutive main calculation units are closely related, the determination as to whether or not to execute the process of the sub calculation unit is summarized. Can be done. Thereby, in addition to the same effects as those of the first embodiment, the calculation load can be further reduced by omitting the step of checking the change amount of the output value C (step S205 in FIG. 2).

  Further, according to the second embodiment, the processing corresponding to step S202 in FIG. 2 is omitted, and it is only necessary to check the amount of change in the output value C. Therefore, the calculation load can be reduced accordingly. .

<Embodiment 3>
In the first and second embodiments described above, even if the calculation results of the main calculation unit and the sub calculation unit match, the output value of the main calculation unit may be abnormal. For example, even if the calculation of the main calculation unit is normally performed, an output value that should not be output may be output due to the influence of the external environment of the vehicle.

  Therefore, in the third embodiment of the present invention, in addition to the method described in the first and second embodiments, a viewpoint other than whether or not the abnormality of the output value of each main arithmetic unit matches the arithmetic result of the sub arithmetic unit. The method to detect is demonstrated.

  FIG. 4 is a functional block diagram of the vehicle control apparatus 100 according to the third embodiment. In addition to the configurations of the first and second embodiments, an abnormality detection unit B141, an abnormality detection unit C142, and an abnormality detection unit D143 are newly provided. The abnormality detection unit B141 corresponds to the main calculation unit B111, the abnormality detection unit C142 corresponds to the main calculation unit C112, and the abnormality detection unit D143 corresponds to the main calculation unit D113.

  Each abnormality detection unit receives the output value of the corresponding main calculation unit, and performs an abnormality detection process from a viewpoint different from that of the sub calculation unit, using the method described in FIGS. The reason why abnormality detection is performed separately from the sub-operation unit is to detect an abnormality that cannot be detected by the sub-operation unit as described above.

  The abnormality detection unit B141, the abnormality detection unit C142, and the abnormality detection unit D143 may be realized by using hardware such as a circuit device that realizes these functions, or defines an arithmetic device such as a microcomputer or a CPU and its operation. It can also be configured using software. Moreover, any one of them can be configured integrally with other functional units.

  FIG. 5 is a diagram illustrating how each abnormality detection unit detects an abnormality in the output value of the main calculation unit. The calculation result of the main calculation unit changes with time as the driving state changes to, for example, “accelerating”, “constant speed driving”, “decelerating”, “stopping state”, etc. after the vehicle starts driving operation. . “Output value” in FIG. 5 indicates a change with time of the output value of the main calculation unit.

  In an actual vehicle, there is a value range that is not normally possible as an output value of the main calculation unit. For example, when the engine temperature rises beyond the allowable range, it is apparent that some abnormality has occurred. Therefore, the abnormality detection unit sets at least one of the upper limit threshold and the lower limit threshold of the output value of the main calculation unit, and when the output value of the main calculation unit reaches outside these ranges, there is an abnormality in the main calculation unit. It is considered to have occurred. Hereinafter, each section in FIG. 5 will be described.

(Figure 5: (1) Change in output value)
In section (1) of FIG. 5, the output value of the main calculation unit is within the range between the upper limit threshold and the lower limit threshold, so the abnormality detection unit considers that the main calculation unit is operating normally. On the other hand, since the output value of the main arithmetic unit greatly changes with time, the processing of the sub arithmetic unit and the inconsistency diagnosis unit is necessary. When the calculation results of the main calculation unit and the sub calculation unit do not match, fail-safe processing is executed.

(Figure 5: (2) Output value fixed)
In the section (2) in FIG. 5, the output value of the main calculation unit is within the range between the upper limit threshold and the lower limit threshold, so the abnormality detection unit considers that the main calculation unit is operating normally. On the other hand, since the output value of the main operation unit is substantially constant, the main operation unit is regarded as operating stably, and the processing of the sub operation unit is not necessary. Similarly, fail-safe processing is not necessary.

(Figure 5: (3) Out of output value range)
In section (3) in FIG. 5, the output value of the main calculation unit exceeds the upper limit threshold value, so the abnormality detection unit considers that an abnormality has occurred in the main calculation unit. In this case, it is not necessary to execute the processing of the sub-operation unit. The inconsistency diagnosis unit determines that the diagnosis result is NG. Further, fail-safe processing is executed.

  FIG. 6 shows an example in which the upper and lower thresholds are changed in accordance with the driving state of the vehicle. In FIG. 5, the upper limit threshold and the lower limit threshold are fixed regardless of the change in the driving state of the vehicle. However, in an actual vehicle, the range that the output value of the main calculation unit can take varies depending on the driving state. Therefore, in FIG. 6, the upper threshold and the lower threshold are changed in accordance with the change in the driving state.

  In the case of FIG. 6, the abnormality detection unit receives the driving state of the vehicle as an input in addition to the output value of the corresponding main calculation unit. The abnormality detection unit changes at least one of the upper threshold and the lower threshold in accordance with the received operating state. Other processes are the same as those in FIG. The abnormality detection unit can use any of the methods shown in FIGS.

  For the correspondence between the upper threshold and the lower threshold described with reference to FIGS. 5 to 6 and the operation state, for example, these values and the correspondence are stored in advance in an appropriate memory device and the like is referred to as appropriate. What should I do?

  FIG. 7 is an operation flow of the in-vehicle control device 100 according to the third embodiment. Hereinafter, each step of FIG. 7 will be described.

(FIG. 7: Step S701)
The main calculation unit B111 executes a control calculation using the input value A and outputs an output value B.

(FIG. 7: Step S702)
The abnormality detection unit B141 determines whether or not the output value B is between the upper limit threshold and the lower limit threshold described with reference to FIGS. If necessary, the driving state of the vehicle is received in advance. If the output value B is between the upper threshold and the lower threshold, the process proceeds to step S703, and if not, the process proceeds to step S708.

(FIG. 7: Steps S703 to S706)
The main calculation unit C112, the abnormality detection unit C142, the main calculation unit D113, and the abnormality detection unit D143 perform the same processing as steps S701 to S702.

(FIG. 7: Step S707)
The subsequent processing is the same as that after step S202 in FIG. 2 or after step S302 in FIG.

(FIG. 7: Step S708)
This step is the same as step S211 in FIG.

  The operation flow for one cycle of the in-vehicle control device 100 according to the third embodiment has been described above. Although FIG. 4 shows an example in which an abnormality detection unit is provided for each main calculation unit, it is not always necessary to provide an abnormality detection unit for all main calculation units.

  As described above, according to the third embodiment, even when the output value of the main operation unit is abnormal, even when the operation results of the main operation unit and the sub operation unit match, the abnormality detection unit An abnormality is detected based on whether or not the output value of the main arithmetic unit is between the upper threshold and the lower threshold. That is, it is possible to detect an abnormality in the main calculation unit regardless of the calculation result of the sub calculation unit. Thereby, the detection precision of the abnormality which generate | occur | produces in the main calculating part can be improved.

  Further, in the third embodiment, the abnormality detection unit can change the upper and lower thresholds for performing the abnormal operation determination of the main calculation unit according to the driving state of the vehicle. Thereby, the abnormality detection process optimized for every driving | running state can be performed.

<Embodiment 4>
In the first to third embodiments, it has been described that if the input value or the output value of the main calculation unit is substantially constant, the processing of the sub calculation unit and the inconsistency diagnosis unit is not executed. However, there is a possibility that the functions of these units do not operate normally while the processes of the sub-operation unit and the inconsistency diagnosis unit are not executed. For example, a failure of a memory device that stores a program that realizes the function of each unit, a data abnormality on the memory device that each unit uses in the calculation process, and the like can be considered.

  Therefore, in the fourth embodiment of the present invention, an example of an operation that avoids the above situation by executing the processing of the sub-operation unit at predetermined intervals, for example, regardless of the input value and output value of the main operation unit will be described. . Since the other configuration is the same as that of any one of the first to third embodiments, the difference will be mainly described below.

  FIG. 8 is a diagram illustrating execution timings of the processes of the main calculation unit and the sub calculation unit. The calculation timing in FIG. 8 is a timing at which a series of control calculations from the main calculation unit B111 to the main calculation unit D113 is started, and corresponds to one operation flow shown in any of FIGS. This corresponds to the timing of starting the process.

  In FIG. 8, all the main arithmetic units always execute the control arithmetic at each arithmetic timing, but only one of the sub arithmetic units executes the confirmation arithmetic at each arithmetic timing. At the next calculation timing, another sub-operation unit executes the confirmation calculation, and once complete, returns to the first order and repeats the same. According to the calculation timing shown in FIG. 8, the confirmation calculation of the sub calculation unit is always executed every three calculation timings.

  FIG. 9 is an operation flow of the in-vehicle control device 100 according to the fourth embodiment. Hereinafter, each step of FIG. 9 will be described.

(FIG. 9: Step S901)
This step is the same as that after step S202 in FIG. 2 or after step S302 in FIG.

(FIG. 9: Step S902)
The sub calculation unit B′121 checks the value of CNT and whether or not the confirmation calculation of the sub calculation unit B′121 has been executed in step S901. If CNT = 0 and the confirmation calculation of the sub calculation unit B′121 has not been performed, the process proceeds to step S903, and otherwise, the process proceeds to step S905.

(FIG. 9: Step S902: Supplement)
As described in the first embodiment, if the input value or output value of the main calculation unit is substantially constant, the confirmation calculation of the sub calculation unit B′121 is omitted. Therefore, the process of the sub operation unit B ′ 121 is not necessarily executed in step S901. This step is meaningful to check that such a state does not last for a long time. However, as described with reference to FIG. 8, in order to cycle the order in which the processing of the sub-operation unit is executed, the value of the cyclic counter CNT is also checked. .

(FIG. 9: Step S903)
The sub calculation unit B′121 executes the confirmation calculation of the main calculation unit B111.

(FIG. 9: Step S904)
The inconsistency diagnosis unit BB′131 compares the calculation result of the main calculation unit B111 with the calculation result of the sub calculation unit B′121. If they match, the process proceeds to step S912, and if not, the process proceeds to step S911.

(FIG. 9: Steps S905 to S907)
In these steps, the sub-operation unit C′122 and the inconsistency diagnosis unit CC′132 perform the same processing as steps S902 to S904.

(FIG. 9: Steps S908 to S910)
In these steps, the sub-operation unit D′ 123 and the inconsistency diagnosis unit DD′133 perform the same processing as steps S902 to S904.

(FIG. 9: Step S911)
This step is the same as step S211 in FIG.
(FIG. 9: Step S912)
The sub-operation unit that executed the confirmation operation immediately before increases the value of the cyclic counter CNT by 1 and takes the remainder of 3. As a result, the value of CNT cycles while increasing by 1 between 0 and 2.

  The operation flow for one cycle of the in-vehicle control device 100 according to the fourth embodiment has been described above.

  In the operation flow described with reference to FIG. 9, the number of processing times of the sub-operation unit and the inconsistency diagnosis unit is increased as compared with the first to third embodiments, so that the calculation load increases. Therefore, it is desirable to appropriately select which method is used by balancing the reliability required for the in-vehicle control device 100 and the calculation performance.

  Alternatively, for example, only the sub-operation unit B′121 and the sub-operation unit C′122 are cyclically executed as shown in FIG. 8 and the sub-operation unit D′ 123 is executed as in the first to third embodiments. It is also possible to appropriately combine the methods of the forms.

  In the fourth embodiment, the example in which the operation timing of the sub-operation unit is circulated has been described. However, it is not always necessary to circulate regularly. For example, a method of randomly selecting a sub-operation unit that executes a confirmation operation is conceivable. However, from the viewpoint of confirming the operation of the sub-operation unit, it is desirable that the confirmation operation of each sub-operation unit is always executed at least every predetermined period.

  As described above, the in-vehicle control device 100 according to the fourth embodiment forcibly executes the confirmation calculation of the sub calculation unit at predetermined calculation timing intervals. As a result, it is possible to prevent a situation in which a failure or the like occurs and the discovery is delayed while the processing of the sub-operation unit is not executed, and improve the reliability of the in-vehicle control device 100.

<Embodiment 5>
In the above-described first to fourth embodiments, the in-vehicle control device 100 can also include a notification unit that notifies that when an abnormality such as a failure occurs in any of the main calculation units. For example, a specific configuration is conceivable in which a signal notifying that an abnormality has occurred is output to a host device or a host application of the vehicle-mounted control device 100, or the vehicle-mounted control device 100 itself outputs a notification sound. Further, the notification unit may provide more detailed error information such as which main arithmetic unit has failed.

  Furthermore, on the vehicle side that has received the notification, the driver may be notified of the occurrence of an abnormality, for example, by turning on an emergency lamp in the driver's seat.

  100: In-vehicle control device, 111: Main operation unit B, 112: Main operation unit C, 113: Main operation unit D, 121: Sub operation unit B ′, 122: Sub operation unit C ′, 123: Sub operation unit D ′ 131: Inconsistency diagnostic unit BB ′, 132: Inconsistency diagnostic unit CC ′, 133: Inconsistency diagnostic unit DD ′, 141: Abnormality detection unit B, 142: Abnormality detection unit C, 143: Abnormality detection unit D

Claims (8)

A main calculation unit that executes a control calculation related to the operation of the vehicle;
A sub-operation unit that executes a confirmation operation for confirming the operation of the main operation unit;
A diagnosis unit for diagnosing whether or not an abnormality has occurred in the main calculation unit based on a result of the confirmation calculation of the sub calculation unit;
With
The diagnostic unit
Based on whether the amount of change from the previous value of the input value to the main operation unit or the amount of change from the previous value of the output value from the main operation unit is within a predetermined range, the sub operation unit performs a confirmation operation. It is determined whether or not it is necessary to execute the vehicle-mounted control device. The diagnostic unit
Compare at least one of the input value to the main calculation unit or the output value from the main calculation unit with the previous value,
When the amount of change from the previous value of the output value falls within a predetermined range, the sub-operation unit determines that it is not necessary to perform a confirmation operation,
The in-vehicle control device according to claim 1, wherein when the amount of change of the output value from the previous value does not fall within the predetermined range, the sub-operation unit determines that it is necessary to execute a confirmation operation. . The diagnostic unit
Each time the main computation unit outputs the output value, it compares it with its previous value,
When the amount of change from the previous value of the output value falls within a predetermined range, the sub-operation unit determines that it is not necessary to perform a confirmation operation,
3. The sub-operation unit determines that it is necessary to perform a confirmation operation when the amount of change from the previous value of the output value does not fall within the predetermined range. In-vehicle control device. The diagnostic unit
Compare both the input value to the main calculation unit and the output value from the main calculation unit with the previous value,
When only one of them is different from the previous value and the amount of change from the previous value of the output value is within a predetermined range, the sub-operation unit determines that it is not necessary to perform a confirmation operation,
When the amount of change from the previous value of the output value does not fall within the predetermined range, the sub-operation unit determines that it is necessary to perform a confirmation operation,
The in-vehicle control according to any one of claims 1 to 3, wherein when both values are different from a previous value, the sub-operation unit determines that a confirmation operation needs to be executed. apparatus. An abnormality detection unit for detecting an output value abnormality of the main arithmetic unit,
The abnormality detection unit
A threshold for determining whether or not the output value from the main calculation unit is normal is set for each driving state of the vehicle,
5. The apparatus according to claim 1, wherein whether or not an abnormality has occurred in the main calculation unit is detected based on the driving state of the vehicle and the threshold value corresponding to the driving state. The vehicle-mounted control apparatus as described in. The abnormality detection unit
2. It is determined that an abnormality has occurred in the main calculation unit when an output value from the main calculation unit becomes a value that cannot be generated in any driving state of the vehicle. The vehicle-mounted control apparatus of any one of Claim 5. The sub-operation unit is
Regardless of whether the amount of change from the previous value of the input value to the main arithmetic unit or the amount of change from the previous value of the output value from the main arithmetic unit is within a predetermined range, be sure to at least every predetermined cycle. The in-vehicle control device according to any one of claims 1 to 6, wherein the confirmation calculation is executed.   The in-vehicle control device according to any one of claims 1 to 7, further comprising a notification unit that notifies that an abnormality has occurred in the main calculation unit.

Images