JP6094387B2 - Control device - Google Patents

Description

  The present invention relates to a control device. In particular, the present invention relates to a control device including a main calculation unit and a redundant calculation unit.

  Conventionally, there is a control unit disclosed in Patent Document 1 as an example of a control device including a main arithmetic unit and a redundant arithmetic unit. The control unit executes control on a drive unit (hereinafter referred to as a control target), and includes an input circuit and a microcomputer (hereinafter referred to as a microcomputer). Two measuring devices are connected to the input circuit via an input line. The microcomputer is supplied with a signal from the measuring device as an input signal via an input circuit. The microcomputer is divided into two levels with respect to the program structure. The first level (hereinafter referred to as the main arithmetic unit) is a group of programs for executing control on the controlled object. The second level (hereinafter referred to as a redundant operation unit) is a group of programs that function as monitoring functions for control functions. That is, the control function for the output of the drive unit and the monitoring of the control function can be executed by one microcomputer.

Japanese National Patent Publication No. 11-505588

  By the way, as described above, in addition to the main calculation executed by the main calculation unit, when the redundant calculation unit executes the redundant calculation, it is necessary to perform the redundant calculation and the main calculation separately.

  In the microcomputer, the input signals from the two measuring devices are supplied to the main arithmetic unit and also to the redundant arithmetic unit. Therefore, it is conceivable that the main arithmetic unit performs an operation for guaranteeing whether or not the input signal is normal (hereinafter referred to as a diag operation) using these two input signals. In this case, as described above, since it is necessary to separately perform the redundant calculation and the main calculation, the diagnostic calculation is also performed on the redundant calculation unit in the same manner as the main calculation unit. Furthermore, a storage area and a program that are used by the redundant calculation unit at the time of diagnosis are required. Therefore, in the microcomputer, the redundant calculation unit performs the diagnosis operation, so that not only the processing load of the microcomputer itself increases but also the storage area increases.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a control device that can suppress an increase in processing load and storage area.

In order to achieve the above object, the present invention provides:
Using the received input signal, a control object (5 10) control device for performing the torque calculation for generating the torque value of the engine with respect to (200, 210),
A storage unit (30), a main calculation unit (60 ) that receives a plurality of input signals and executes a torque calculation, and a redundant calculation unit (70 ) that receives a plurality of input signals and executes a redundant calculation. Prepared,
The main calculation unit
An input guarantee calculation unit (61 ) that executes torque calculation for performing input guarantee as to whether or not a plurality of input signals are normal while using the storage unit;
A first calculation unit (62 ) that performs a torque calculation using an input signal that is guaranteed to be normal by the input guarantee calculation unit;
Redundant operation unit
A comparison / selection unit (71 ) for comparing a plurality of input signals with each other and selecting one input signal having a smaller torque value from the plurality of input signals;
Using the input signal selected by comparing and selecting unit, a second arithmetic unit that executes a torque operation that generates a torque value as a redundant operation and (7 2), have a,
When the calculation result of the first calculation unit is compared with the calculation result of the second calculation unit, and the calculation result of the first calculation unit is larger than the calculation result of the second calculation unit, the main calculation unit is abnormal A comparison unit (20) for determining,
The comparison unit outputs a fixed value determined in advance or the calculation result of the second calculation unit to the control target instead of the calculation result of the first calculation unit when it is determined as abnormal .

  As described above, the present invention includes a redundant calculation unit in addition to the main calculation unit. Then, the main calculation unit performs a guarantee calculation by the input guarantee calculation unit. For this reason, the 1st calculating part can perform a control calculation using the input signal guaranteed to be normal.

  On the other hand, the redundant operation unit compares a plurality of input signals with each other by the comparison / selection unit, and selects one input signal from the plurality of input signals. Then, the second calculation unit performs a redundant calculation using the input signal selected by the comparison / selection unit. As described above, since the redundant arithmetic unit only compares a plurality of input signals with each other and selects one input signal from the plurality of input signals, it is not necessary to use a storage unit unlike the input guarantee arithmetic unit. Therefore, the present invention can suppress an increase in processing load and storage area.

  Note that the reference numerals in parentheses described in the claims and in this section indicate a corresponding relationship with specific means described in the embodiments described later as one aspect, and limit the technical scope of the invention. Not what you want.

It is a block diagram which shows schematic structure of the control apparatus in 1st Embodiment. It is a block diagram which shows schematic structure of the control apparatus in 2nd Embodiment. It is a flowchart which shows the processing operation of the control apparatus in 2nd Embodiment. It is a time chart in case a main calculating part is normal. It is a time chart when a main calculating part is abnormal.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(First embodiment)
First, the ECU 200 in the first embodiment will be described with reference to FIG. In this embodiment, the example which applied this invention to ECU200 is employ | adopted. Note that ECU is an abbreviation for Electronic Control Unit.

  The ECU 200 includes a microcomputer 100 as a main component. In addition, the ECU 200 is electrically connected to the first sensor 300, the second sensor 400, and the actuator 500. ECU 200 receives a signal indicating the detection result of first sensor 300 and a signal indicating the detection result of second sensor 400. As described above, the ECU 200 receives a plurality of signals (input signals).

  Then, the ECU 200 uses the plurality of signals (input signals) output from the first sensor 300 and the second sensor 400 to execute a control calculation for generating a control signal for the actuator 500 that is a control target. In other words, the ECU 200 generates a control signal based on the input signal that has been input. That is, the ECU 200 can be restated as a device that controls the actuator 500. Therefore, the control signal is a signal for controlling the actuator 500.

  Further, the plurality of input signals input to the ECU 200 are a signal indicating the detection result of the first sensor 300 and a signal indicating the detection result of the second sensor 400 (in this case, a sensor value). The first sensor 300, the second sensor 400, and the actuator 500 are not particularly limited. However, the first sensor 300 and the second sensor 400 have the same detection target, and the ECU 200 outputs a signal for controlling the actuator 500. Further, the first sensor 300 and the second sensor 400 are signals for the ECU 200 to control the actuator 500, and can be employed even if they output signals that are correlated with each other.

  In the present embodiment, the first sensor 300 and the second sensor 400 are connected as the ECU 200, and an example of executing the control calculation using the input signals input from the first sensor 300 and the second sensor 400. It was adopted. However, the present invention is not limited to this. The ECU 200 can be employed even if it is connected to a communication line such as a CAN bus and executes a control calculation using an input signal input from the communication line. That is, the ECU 200 can be employed even if it executes a control calculation using a signal output from another ECU and input via a communication line. Further, the ECU 200 can be employed even if it is connected to a switch and executes a control calculation using an input signal input from the switch.

  As described above, a plurality of input devices that output input signals input to the ECU 200 can employ sensors (300, 400, etc.), switches, ECUs, and the like. Therefore, the plurality of input signals input to the ECU 200 may be the same signal output by each input device, or may be signals correlated with each other output from each input device. As described above, the signals output from the input devices are the same or correlated with each other, but when there is an abnormality in each input device or the route to the ECU 200, the ECU 200 has a different signal. May be entered as Furthermore, when each input device, the route to ECU 200, and the like are normal, ECU 200 can generate the same control signal regardless of which input signal of the plurality of input signals is used for control calculation.

  Further, in the present embodiment, an example in which two input signals are input to the ECU 200 is adopted. However, the present invention is not limited to this. ECU 200 may receive three or more input signals.

  The microcomputer 100 mainly includes an ADC 10, a CPU, a ROM, a RAM, a register, and the like. In the microcomputer 100, the CPU executes various arithmetic processes based on input signals and programs stored in the ROM while temporarily using the RAM and the register as a storage area. In addition to the above control calculations, the CPU executes a redundant calculation, a diagnosis calculation, etc., which will be described later, as the calculation process. In addition, the microcomputer 100 performs a comparison and selection process that compares a plurality of input signals and selects one input signal from the plurality of input signals without using a storage area as in the case of the diagnosis operation.

  ADC is an abbreviation for analog to digital converter. CPU is an abbreviation for Central Processing Unit. ROM is an abbreviation for Read Only Memory. RAM is an abbreviation for Random AccessMemory.

  As shown in FIG. 1, the microcomputer 100 configured as described above includes a comparison unit 20, a storage unit 30, a main calculation unit 40, and a redundant calculation unit 50 as functional blocks. Further, the main calculation unit 40 includes a diagnosis calculation unit 41, a first control calculation unit 42, and a second control calculation unit 43. The redundant calculation unit 50 includes a comparison / selection unit 51, a first control calculation unit 52, and a second control calculation unit 53.

  For example, when the microcomputer 100 includes two CPUs, one CPU can be the main arithmetic unit 40 and the other CPU can be the redundant arithmetic unit 50. Further, when the microcomputer 100 includes a multi-core type CPU, one core can be the main arithmetic unit 40 and one of the other cores can be the redundant arithmetic unit 50.

  A signal from the first sensor 300 and a signal from the second sensor 400 are input to the ADC 10 of the microcomputer 100. The ADC 10 converts a signal from the first sensor 300 that is an analog signal into a digital signal and outputs the digital signal to the main calculation unit 40 and the redundancy calculation unit 50. Similarly, the ADC 10 converts a signal from the second sensor 400 that is an analog signal into a digital signal and outputs the digital signal to the main calculation unit 40 and the redundancy calculation unit 50. Therefore, the main arithmetic unit 40 and the redundant arithmetic unit 50 are input with the digitally converted input signal. In the following description, a signal indicating the detection result of the first sensor 300 is also referred to as a first signal, and a signal indicating the detection result of the second sensor 400 is also referred to as a second signal.

  The storage unit 30 includes the ROM, RAM, register, and the like. A part of the storage unit 30 (for example, ROM) stores a program for the main arithmetic unit 40 and a program for the redundant arithmetic unit 50. Further, the main arithmetic unit 40 and the redundant arithmetic unit 50 use a part of the storage unit 30 (for example, a RAM or a register) when executing arithmetic processing.

  The storage area used by the main calculation unit 40 (part of the storage unit 30) and the storage area used by the redundant calculation unit 50 (part of the storage unit 30) may be provided separately. In other words, the storage unit used by the main calculation unit 40 and the storage unit used by the redundant calculation unit 50 may be separated.

  Further, the program executed by the main arithmetic unit 40 and the program executed by the redundant arithmetic unit 50 are provided separately. In other words, the program executed by the main arithmetic unit 40 and the program executed by the redundant arithmetic unit 50 are separated.

  Further, the microcomputer 100 may collectively manage a storage area (storage unit 30) including a ROM, a RAM, and a register as one address space. In this case, the storage area used by the main calculation unit 40 and the storage area used by the redundant calculation unit 50 can be part of the address space.

  Here, the main calculation unit 40 will be described. The main arithmetic unit 40 receives a plurality of input signals digitally converted by the ADC 10. The diagnosis calculation unit 41 corresponds to the input guarantee calculation unit in the claims of the present invention, and uses the storage unit 30 to guarantee input (whether or not a plurality of input signals are normal). Execute a diagnosis operation. The diagnosis operation unit 41 in the present embodiment executes a guarantee operation for the first signal and the second signal.

  In addition, the diagnosis calculation unit 41 outputs, to the first control calculation unit 42 and the second control calculation unit 43, an input signal that is guaranteed to be normal among the plurality of input signals. In addition, the diagnosis calculation unit 41 outputs a fixed value (default value) to the first control calculation unit 42 and the second control calculation unit 43 when all input signals are considered abnormal.

  Note that when the plurality of input signals are guaranteed to be normal, the diagnosis calculation unit 41 outputs any one of the plurality of input signals to the first control calculation unit 42 and the second control calculation unit 43. . Thus, when a plurality of input signals are normal, the diagnosis operation unit 41 uses the first control operation unit 42 and the second control operation as a signal (input signal) output from a predetermined main input device. To the unit 43. For example, the first sensor 300 is determined as a main input device and the second sensor 400 is determined as a sub input device in advance. In this case, the diagnosis calculation unit 41 outputs the first signal to the first control calculation unit 42 and the second control calculation unit 43 when it is guaranteed that both the first signal and the second signal are normal.

  Here, an example of the guarantee calculation performed by the diagnosis calculation unit 41 will be described. For example, the diagnosis operation unit 41 determines whether each input signal is normal depending on whether each of the first signal and the second signal is a high voltage or a low voltage that cannot occur due to the characteristics of each sensor. Perform input guarantee. That is, the diagnosis operation unit 41 compares the first signal with the absolute value and performs input guarantee by comparing the second signal with the absolute value. Therefore. In other words, the diagnosis operation unit 41 executes a guarantee operation for comparing each input signal with an absolute value.

  Here, the absolute value indicates a first threshold that is a threshold voltage on the high voltage side and a second threshold that is a threshold voltage on the low voltage side. The first threshold value and the second threshold value need to be stored in the storage unit 30. Therefore, when performing the guarantee calculation, the diagnosis calculation unit 41 reads the first threshold value and the second threshold value from the storage unit 30, compares the first signal with the first threshold value and the second threshold value, and outputs the second signal. Compare with the first threshold and the second threshold. Then, the diagnosis calculation unit 41 determines that the second signal is the second signal when the first signal is higher than the first threshold, the first signal is lower than the second threshold, the second signal is higher than the first threshold. When it is lower than the threshold, it is detected as abnormal (deemed abnormal, and determined as abnormal). This abnormality can also be referred to as a Hi-Low abnormality. That is, the diagnosis operation unit 41 detects that an input signal that is lower than the first threshold and higher than the second threshold is normal (deemed normal, determined to be normal, and guaranteed to be normal).

  Further, the diagnosis calculation unit 41 may perform input guarantee as to whether or not each input signal is normal depending on whether or not each of the first signal and the second signal has continued for a certain period of time. That is, the diagnosis operation unit 41 performs input guarantee by measuring the time during which the first signal (in other words, the voltage value indicating the first signal) continues at the same value. Similarly, the diagnosis operation unit 41 performs input guarantee by measuring the time during which the second signal (in other words, the voltage value indicating the second signal) continues at the same value. Therefore, it can be paraphrased that the diagnosis calculation unit 41 executes a guarantee calculation for measuring a duration in which each of the input signals has the same value.

  Then, the diagnosis calculation unit 41 detects that the first signal is abnormal when the same value continues for a certain period of time. Similarly, the diagnosis calculation unit 41 detects that the second signal is abnormal when the second signal continues at the same value for a predetermined time or more. The diagnosis operation unit 41 detects that an input signal having the same value and not continuing for a certain period of time is normal. This abnormality can also be referred to as a sticking abnormality.

  In addition, the diagnosis operation unit 41 inputs whether each input signal is normal depending on whether a voltage difference has occurred between the detection value of the similar sensor (illustrated) in each of the first signal and the second signal. A guarantee may be made. In other words, the diagnosis operation unit 41 may perform characteristic abnormality detection. In other words, the diagnosis calculation unit 41 compares the first signal with the detection value of the similar sensor and performs input guarantee by comparing the second signal with the detection value of the similar sensor. Therefore, it can be paraphrased that the diagnosis operation unit 41 executes a guarantee operation for comparing each input signal with another detected value. More specifically, when performing characteristic abnormality detection, the diagnosis calculation unit 41 detects that a voltage difference of a predetermined value or more continues for a certain period of time, not simple comparison. Therefore, the diagnosis calculation unit 41 needs to take the difference between the detection values between the sensors, compare the difference with a predetermined value, and measure the duration. Accordingly, the diagnosis operation unit 41 performs more processing when performing characteristic abnormality detection than when performing simple comparison.

  The similar sensor is a sensor that outputs a detection result (detection value) similar to that of the first sensor 300 and the second sensor 400. Therefore, a similar sensor that outputs a detection value that is compared with the first signal is a sensor that outputs a detection result similar to that of the first sensor 300. Similarly, a similar sensor that outputs a detection value that is compared with the second signal is a sensor that outputs a detection result similar to that of the second sensor 400.

  The detection value of the similar sensor needs to be stored in the storage unit 30. Therefore, when executing the guarantee calculation, the diagnosis calculation unit 41 reads the detection value from the storage unit 30, compares the first signal with the detection value, and compares the second signal with the detection value. Then, when the first signal and the detection value are different (when there is a voltage difference), the diagnosis calculation unit 41 detects that there is an abnormality when the second signal and the detection value are different. This abnormality can also be referred to as a characteristic abnormality. That is, the diagnosis calculation unit 41 detects that the same input signal as the detected value is normal. Note that the diagnosis calculation unit 41 may regard the detected value and the input signal as the same as long as they are within a certain range even if they do not completely match.

  Further, when performing the characteristic abnormality detection, the diagnosis calculation unit 41 can employ the second signal as the detection value of the similar sensor to be compared with the first signal. That is, the diagnosis calculation unit 41 can perform the characteristic abnormality detection using the first signal and the second signal.

  The first control calculation unit 42 and the second control calculation unit 43 correspond to the first calculation unit in the claims of the present invention, and are guaranteed to be normal in the diagnosis calculation unit 41 while using the storage unit 30. The control calculation is executed using the input signal. Further, the ECU 200 uses one of the two input signals when it is ensured that both the input signal input from the first sensor 300 and the input signal input from the second sensor 400 are normal. Control execution. As described above, when both the signal input from the first sensor 300 and the signal input from the second sensor 400 are normal, the first control calculation unit 42 and the second control calculation unit 43 are both input signals. However, it can be used for the control calculation. Furthermore, the first control calculation unit 42 and the second control calculation unit 43 execute the control calculation using a fixed value when the diagnosis calculation unit 41 regards the plurality of input signals as abnormal (fail). Safe treatment). In addition, ECU200 is a case where three or more signals are input as an input signal, and when all three input signals are guaranteed to be normal, one of the three input signals is used. Perform control calculations.

  In the present embodiment, the main calculation unit 40 including the first control calculation unit 42 and the second control calculation unit 43 is employed as the first calculation unit. However, the present invention is not limited to this. The main calculation unit 40 can be employed as long as it has one of the first control calculation unit 42 and the second control calculation unit 43. That is, the main calculation unit 40 can be employed as long as it includes at least one calculation unit (first calculation unit) that executes the control calculation. Therefore, the main calculation unit 40 may include three or more calculation units (first calculation units) that execute control calculations.

  Next, the redundant calculation unit 50 will be described. Similarly to the main calculation unit 40, the redundant calculation unit 50 receives a plurality of input signals digitally converted by the ADC 10. The comparison / selection unit 51 compares a plurality of input signals with each other and selects one input signal from the plurality of input signals (comparison / selection process). Therefore, the comparison / selection unit 51 can employ a circuit that compares a plurality of input signals with each other and outputs one input signal from the plurality of input signals. Note that this comparison is a size comparison of a plurality of input signals. Further, selecting one input signal from a plurality of input signals can also be referred to as selecting and outputting one input signal from a plurality of input signals.

  The comparison / selection unit 51 in the present embodiment compares the first signal and the second signal, and selects one input signal of the first signal and the second signal. That is, the comparison / selection unit 51 selects one input signal used by the first control calculation unit 52 and the second control calculation unit 53, which will be described later, from the first signal and the second signal. The comparison / selection unit 51 selects one input signal from the three input signals when three or more signals are input as the input signals. The comparison / selection unit 51 selects an input signal in which the abnormality of the main calculation unit 40 is least likely to be undetected in the detection by the comparison unit 20.

  As described above, the comparison / selection unit 51 selects one input signal by relatively comparing the first signal and the second signal. Therefore, the comparison / selection unit 51 can select one input signal without using a storage area, unlike the diagnosis operation unit 41. That is, the comparison / selection unit 51 can select one input signal without using the storage unit 30 used when the redundant calculation unit 50 executes the calculation process. Further, since the comparison / selection unit 51 only compares the first signal and the second signal relatively, the processing load can be reduced as compared with the diagnosis calculation unit 41.

  The first control calculation unit 52 and the second control calculation unit 53 correspond to the second calculation unit in the claims of the present invention, and use the storage unit 30 and the input signal selected by the comparison / selection unit 51. To perform redundant operations. More specifically, the first control calculation unit 52 and the second control calculation unit 53 generate redundant signals for monitoring whether or not the main calculation unit 40 is operating normally by executing redundant calculations. . Therefore, the 1st control calculating part 52 and the 2nd control calculating part 53 perform the calculation similar to the control calculation which the 1st control calculating part 42 and the 2nd control calculating part 43 perform as a redundant calculation. However, the 1st control calculating part 52 and the 2nd control calculating part 53 perform simpler calculation than the control calculation which the 1st control calculating part 42 and the 2nd control calculating part 43 perform as a redundant calculation. There may be. Naturally, the first control calculation unit 52 and the second control calculation unit 53 are simpler than the control calculation executed by the first control calculation unit 42 and the second control calculation unit 43, and the first control calculation unit 42 and the calculation which correlates with the control calculation which the 2nd control calculating part 43 performs are performed.

  As described above, the redundant calculation unit 50 generates a redundant signal for monitoring whether or not the main calculation unit 40 is operating normally, and thus can be rephrased as a monitoring unit. This redundant signal can also be used as a substitute signal for the control signal when the main arithmetic unit 40 is not operating normally.

  In the present embodiment, the redundant calculation unit 50 including the first control calculation unit 52 and the second control calculation unit 53 is employed as the second calculation unit. However, the present invention is not limited to this. The redundant calculation unit 50 can be employed as long as it has one of the first control calculation unit 52 and the second control calculation unit 53. That is, the redundant calculation unit 50 can be employed as long as it includes at least one calculation unit (second calculation unit) that performs redundant calculation. Therefore, the redundant calculation unit 50 may include three or more calculation units (second calculation units) that perform redundant calculation.

  The comparison unit 20 receives the calculation result of the control calculation in the main calculation unit 40 and the calculation result of the redundant calculation in the redundant calculation unit 50. That is, the comparison unit 20 receives the control signal and the redundant signal. The comparison unit 20 compares the control signal and the redundant signal to detect an abnormality in the main calculation unit 40. The comparison unit 20 determines that the main calculation unit 40 is abnormal when the control signal is larger than the redundant signal by a predetermined value or more, and determines that the main calculation unit 40 is normal when the control signal is not larger than the redundant signal. judge. In this way, the ECU 200 can detect whether or not the main calculation unit 40 is abnormal. Here, it is assumed that the redundancy calculation unit 50 operates normally.

  In addition, when the comparison unit 20 determines that the main calculation unit 40 is normal, a control signal is output from the main calculation unit 40 to the actuator 500. In other words, the comparison unit 20 enables the control signal output from the main calculation unit 40 to be output to the actuator 500 when it is determined that the main calculation unit 40 is normal.

  However, when the comparison unit 20 determines that the main calculation unit 40 is abnormal, the comparison unit 20 stops the actuator 500 or executes fail-safe. For example, the comparison unit 20 outputs a predetermined fixed value to the actuator 500 instead of the control signal output from the main calculation unit 40. Further, the comparison unit 20 may output the redundant signal output from the redundant calculation unit 50 to the actuator 500 instead of the control signal output from the main calculation unit 40.

  As described above, the ECU 200 includes the redundant calculation unit 50 in addition to the main calculation unit 40. The main calculation unit 40 performs a guarantee calculation by the diagnosis calculation unit 41. For this reason, the 1st control calculating part 42 and the 2nd control calculating part 43 can perform a control calculation using the input signal guaranteed to be normal among the 1st signal and the 2nd signal.

  On the other hand, the redundancy calculation unit 50 compares the first signal and the second signal with each other by the comparison / selection unit 51 and selects one input signal from the first signal and the second signal. Then, the first control calculation unit 52 and the second control calculation unit 53 perform a redundant calculation using the input signal selected by the comparison / selection unit 51. As described above, since the redundant calculation unit 51 compares only two input signals and selects one input signal from the two input signals, it is not necessary to use the storage unit 30 unlike the diagnosis calculation unit 41. . Therefore, the ECU 200 can suppress an increase in processing load and storage area (resources such as ROM and RAM). That is, the ECU 200 suppresses the increase in processing load and storage area, compared to the case where the redundant calculation unit 50 includes a diagnosis calculation unit similar to the diagnosis calculation unit 41 provided in the main calculation unit 40. it can.

  Further, the redundancy calculation unit 50 simply compares two input signals with each other and selects one input signal from the two input signals. Therefore, the program executed by the redundant calculation unit 50 can be simplified more than the program executed by the main calculation unit 40. That is, the program executed by the redundant calculation unit 50 can be smaller (less) than the program executed by the main calculation unit 40. Therefore, the ECU 200 has a storage area in the storage unit 30 (for example, the ROM of the storage unit 30) rather than the case where the redundant calculation unit 50 has a diagnosis calculation unit similar to the diagnosis calculation unit 41 provided in the main calculation unit 40. ) Increase.

  Note that the ECU 200 may perform a third level test of Patent Document 1. That is, the ECU 200 may perform a test as to whether or not the redundant calculation unit 50 is operating normally. For this third level, see US Pat.

  In this case, the redundant calculation unit 50 is a target range of a test performed by the third level of Patent Document 1. However, the redundant calculation unit 50 has a smaller processing load than the main calculation unit 40. Therefore, when performing the third level test of Patent Document 1, the ECU 200 can reduce the test processing performed by the third level.

  The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the embodiments described above, and various modifications can be made without departing from the spirit of the present invention.

(Second Embodiment)
Next, the ECU 210 according to the second embodiment will be described with reference to FIGS. In this embodiment, the example which applied this invention to ECU210 is employ | adopted. ECU 210 is a control device that is provided in the vehicle and executes torque calculation for calculating the torque value of the engine using the signal output from first accelerator sensor 310 or second accelerator sensor 410. . That is, the torque value corresponds to a control signal in the ECU 200, and the torque calculation corresponds to a control calculation in the ECU 200.

  Since ECU 210 has many parts similar to ECU 200, a description of parts similar to ECU 200 is omitted. Here, the difference between ECU 210 and ECU 200 will be mainly described. Further, in the ECU 210, the same reference numerals are given to the same portions as the ECU 200.

  First, the configuration of the ECU 210 will be described with reference to FIG. The ECU 210 includes a microcomputer 110 as a main component. The ECU 210 is electrically connected to the first accelerator sensor 310, the second accelerator sensor 410, and the actuator 510. ECU 210 receives a signal indicating the detection result of first accelerator sensor 310 and a signal indicating the detection result of second accelerator sensor 410. Thus, the ECU 210 receives a plurality of signals (input signals).

  The first accelerator sensor 310 corresponds to the first sensor 300 connected to the ECU 200. Similarly, the second accelerator sensor 410 corresponds to the second sensor 400 connected to the ECU 200. Each of the first accelerator sensor 310 and the second accelerator sensor 410 detects the amount of depression of the accelerator provided in the vehicle (in other words, the accelerator opening), and outputs a signal corresponding to the amount of depression. Therefore, ECU 210 receives a signal corresponding to the depression amount as an input signal. Then, ECU 210 performs torque calculation for generating a torque value for actuator 510 using the input signal that has been input.

  The first accelerator sensor 310 and the second accelerator sensor 410 assume that the input voltage (input signal) to the ECU 210 increases as the accelerator opening increases. That is, the torque of actuator 510 controlled by ECU 210 decreases as the input voltage to ECU 210 decreases. Therefore, the vehicle speed of the vehicle on which the ECU 210 is mounted decreases as the input voltage to the ECU 210 decreases. In the present embodiment, a signal indicating the detection result of the first accelerator sensor 310 is also referred to as a first signal, and a signal indicating the detection result of the second accelerator sensor 410 is also referred to as a second signal.

  As illustrated in FIG. 2, the microcomputer 110 includes a comparison unit 20, a storage unit 30, a main calculation unit 60, and a redundant calculation unit 70 as functional blocks. Further, the main calculation unit 60 includes a diagnosis calculation unit 61 and a torque calculation unit 62. The redundancy calculation unit 70 includes a comparison / selection unit 71 and a torque calculation unit 72.

  The main calculation unit 60 corresponds to the main calculation unit 40 of the ECU 200. Therefore, the main calculation unit 60 includes a diagnosis calculation unit 61 corresponding to the diagnosis calculation unit 41 of the ECU 200 and a torque calculation unit 62 corresponding to the first control calculation unit 42 and the second control calculation unit 43 of the ECU 200. Yes. The torque calculation unit 62 performs the torque calculation using the input signal that is guaranteed to be normal by the diagnosis calculation unit 61.

  The redundant calculation unit 70 corresponds to the redundant calculation unit 50 of the ECU 200. Therefore, the redundancy calculation unit 70 includes a comparison selection unit 71 corresponding to the comparison selection unit 51 of the ECU 200 and a torque calculation unit 72 corresponding to the first control calculation unit 52 and the second control calculation unit 53 of the ECU 200. Yes. The torque calculation unit 72 performs a redundant calculation using the input signal selected by the comparison / selection unit 71. The torque calculation unit 72 performs the same calculation as the torque calculation performed by the torque calculation unit 62 as the redundant calculation. However, the torque calculation unit 72 may execute a simpler torque calculation than the torque calculation performed by the torque calculation unit 62 as the redundant calculation.

  Here, the processing operation of the ECU 210 will be described with reference to FIG. The ECU 210 executes processing shown in the flowchart of FIG. 3 at every predetermined time. Steps S10 to S13 are processes executed by the main calculation unit 60. Steps S14 to S17 are processes executed by the redundant calculation unit 70. And step S18-21 is the process which the comparison part 20 performs. Here, an example in which the processing of the redundant calculation unit 70 is performed after the processing of the main calculation unit 60 is adopted. However, the present invention is not limited to this. In the present invention, after the processing of the redundant arithmetic unit 70, the processing of the main arithmetic unit 60 may be performed, or the processing of the redundant arithmetic unit 70 and the processing of the main arithmetic unit 60 may be performed in parallel.

  In step S10, the diagnosis operation unit 61 performs the diagnosis operation as described above. In step S11, the diagnosis operation unit 61 determines whether there is an abnormality. Then, the diagnosis calculation unit 61 proceeds to step S12 when it is determined to be normal, and proceeds to step S13 when it is determined that there is an abnormality.

  If the diagnosis calculation unit 61 determines that there is an abnormality, it may set a flag to indicate that at least one of the first signal and the second signal is abnormal. This flag can also be referred to as a sensor diagnosis flag. For example, as shown in the time chart of FIG. 4, when a sensor abnormality occurs at timing t1, the diagnosis operation unit 61 can determine that there is an abnormality at timing t2. Then, the diagnosis calculation unit 61 sets a sensor diagnosis flag at timing t2. This sensor diagnosis flag can also be employed in the ECU 200.

  In step S12, the torque calculation unit 62 executes main torque calculation. That is, the torque calculation unit 62 executes the torque calculation using the input signal guaranteed to be normal by the diagnosis calculation unit 61. On the other hand, in step S13, the torque calculation unit 62 determines that the sensor is abnormal, and executes a control calculation using a fixed value (fail-safe treatment).

  In step S14, the comparison / selection unit 71 compares the first signal with the second signal. That is, the comparison / selection unit 71 compares the voltage value indicated by the first signal with the voltage value indicated by the second signal. In step S15, the comparison / selection unit 71 proceeds to step S16 when determining that the first signal is smaller than the second signal, and proceeds to step S17 when determining that the second signal is smaller than the first signal. move on.

  In other words, when the comparison / selection unit 71 determines that the first signal is smaller than the second signal, the detection by the comparison unit 20 causes the first signal to be input as an input signal that is most unlikely to cause an abnormality in the main calculation unit 60. select. That is, when the comparison / selection unit 71 determines that the first signal is smaller than the second signal, the first signal is less abnormal than the second signal in the detection by the comparison unit 20. It is regarded as an input signal that is difficult to detect.

  Similarly, when the comparison / selection unit 71 determines that the second signal is smaller than the first signal, in the detection by the comparison unit 20, the second signal is input as the input signal that is most unlikely to cause an abnormality in the main calculation unit 60. In other words, select. That is, if the comparison / selection unit 71 determines that the second signal is smaller than the first signal, the second signal is less than the first signal in the detection by the comparison unit 20 and the main calculation unit 60 is not abnormal. It is regarded as an input signal that is difficult to detect. By doing in this way, in this embodiment, a signal with a smaller accelerator pedal opening degree is selected among a 1st signal and a 2nd signal. Therefore, in the present embodiment, a signal having a smaller torque value calculated by the torque calculator 72 is selected from the first signal and the second signal.

  In step S16, the torque calculation unit 72 performs torque calculation (redundancy calculation) using the first signal. On the other hand, in step S17, the torque calculation unit 72 executes torque calculation (redundancy calculation) using the second signal.

  In step S18, the comparison unit 20 performs torque comparison. That is, the comparison unit 20 compares the result of the torque calculation performed by the torque calculation unit 62 of the main calculation unit 60 with the result of the torque calculation performed by the torque calculation unit 72 of the redundancy calculation unit 70. Therefore, the comparison unit 20 compares the voltage value indicated by the result of the torque calculation performed by the torque calculation unit 62 with the voltage value indicated by the result of the torque calculation performed by the torque calculation unit 72.

  In step S19, the comparison unit 20 determines whether the main calculation result is larger than the redundant calculation result. That is, the comparison unit 20 determines whether or not the voltage value indicated by the result of the torque calculation performed by the torque calculation unit 62 is greater than the voltage value indicated by the result of the torque calculation performed by the torque calculation unit 72. If the comparison unit 20 determines that the main calculation result is larger than the redundant calculation result, the comparison unit 20 proceeds to step S20. If the comparison unit 20 determines that the main calculation result is not larger than the redundant calculation result, the comparison unit 20 proceeds to step S21.

  Note that the voltage value indicated by the result of the torque calculation performed by the torque calculation unit 62 is a torque value corresponding to the control signal. On the other hand, the voltage value indicated by the result of the torque calculation performed by the torque calculation unit 72 is a torque value corresponding to the redundant signal. These torque values are target torque values when the actuator 510 is controlled. Further, these torque values can be rephrased as target torque values necessary for controlling the actuator 510.

  In step S <b> 21, the comparison unit 20 outputs the control signal output from the main calculation unit 60 to the actuator 510. That is, the comparison unit 20 considers the main calculation unit 60 to be normal when it determines that the main calculation result is not larger than the redundant calculation result. Then, the comparison unit 20 can output the control signal output from the main calculation unit 60 to the actuator 510.

  In step S20, the comparison unit 20 determines that the operation is abnormal and performs fail-safe treatment. That is, the comparison unit 20 regards the main calculation unit 60 as abnormal (calculation abnormality) when it is determined that the main calculation result is larger than the redundant calculation result. For example, when an abnormality of the storage unit 30 occurs in the main calculation unit 60, a calculation error may occur. Note that the abnormality of the storage unit 30 can be an arithmetic RAM abnormality or the like.

  Note that the comparison unit 20 may indicate a calculation abnormality of the main calculation unit 60 by setting a flag when it is regarded as abnormal. This flag can also be referred to as a calculation abnormality flag. The calculation abnormality flag can also be adopted in the ECU 200.

  For example, as shown in the time chart of FIG. 5, when an abnormality occurs in the main calculation unit 60, the diagnosis calculation unit 61 cannot determine that there is an abnormality at the timing t2 even if a sensor abnormality occurs at the timing t1. . In this case, when the first signal is handled as the main sensor, the torque calculation unit 62 may perform torque calculation using the first signal as shown between the timings t2 and t3 in FIG. It is done. That is, the main calculation unit 60 cannot determine that the diagnosis calculation unit 61 is abnormal at the timing t <b> 2, and thus the torque calculation result by the torque calculation unit 62 becomes large. On the other hand, the torque calculation unit 72 performs torque calculation using the second signal.

  Therefore, as shown between timings t2 and t3 in FIG. 5, the main calculation result is larger than the redundant calculation result. For this reason, the comparison unit 20 compares the main calculation result with the redundant calculation result, determines that the main calculation result is larger than the redundant calculation result, and regards it as an abnormality of the main calculation unit 60. Then, the comparison unit 20 sets an operation abnormality flag at timing t3. As described above, the ECU 210 causes the main calculation unit 60 to perform a simple magnitude comparison even if the main calculation unit 60 is abnormal and the redundant calculation unit 70 does not perform the diagnosis calculation. Abnormalities can be detected. When the abnormality determination of the input signal by the diagnosis calculation unit 61 and the abnormality determination of the main calculation unit 60 by the comparison unit 20 are separated, as shown in the time charts of FIGS. It is necessary to confirm.

  When the comparison unit 20 determines that the main calculation unit 60 is abnormal, for example, the comparison unit 20 supplies a predetermined fixed value to the actuator 510 instead of the control signal output by the main calculation unit 60. Output. Further, the comparison unit 20 may output the redundant signal output from the redundant calculation unit 70 to the actuator 510 instead of the control signal output from the main calculation unit 60. Furthermore, the comparison unit 20 may stop the actuator 510 when it is determined that the main calculation unit 60 is abnormal.

  Thus, the comparison unit 20 of the present embodiment detects an excessive torque state of the engine. When the comparison / selection unit 71 selects one of the first signal and the second signal for which the torque calculation unit 72 calculates a larger torque, the comparison unit 20 causes the main calculation unit 60 to store the storage unit 30. If an abnormality has occurred, this abnormality may not be detected. However, in the present invention, as described above, the comparison / selection unit 71 selects one of the first signal and the second signal for which the torque calculation unit 72 calculates a smaller torque. When an abnormality or the like of the storage unit 30 occurs, it is easy to detect this abnormality.

  Further, in the present embodiment, the first accelerator sensor 310 and the second accelerator sensor 410 are employed in which the input voltage (input signal) to the ECU 210 increases as the accelerator opening increases. However, the present invention is not limited to this. The first accelerator sensor 310 and the second accelerator sensor 410 can be employed even if the input voltage (input signal) to the ECU 210 decreases as the accelerator opening increases. However, in this case, the comparison / selection unit 71 selects the larger one of the first signal and the second signal.

  10 ADC, 20 comparison unit, 30 storage unit, 40 main calculation unit, 41 diagnostic calculation unit, 42 first control calculation unit, 43 second control calculation unit, 50 redundant calculation unit, 51 comparison selection unit, 52 first control calculation Part, 53 second control operation part, 100 microcomputer, 200 ECU, 300 first sensor, 400 second sensor, 500 actuator

Claims (2)

A control device ( 210) that executes torque calculation for generating an engine torque value for a control object ( 510) using an input signal that is input,
A storage unit (30), a main calculation unit (60 ) that receives a plurality of the input signals and executes the torque calculation, and a redundant calculation unit (70 ) that receives a plurality of the input signals and executes a redundancy calculation And comprising
The main calculation unit is
An input guarantee operation unit (61 ) for performing a guarantee operation for performing input guarantee as to whether or not the plurality of input signals are normal while using the storage unit;
A first calculation unit (62 ) that executes the torque calculation using the input signal that is guaranteed to be normal by the input guarantee calculation unit;
The redundant operation unit is
A comparison / selection unit (71 ) that compares a plurality of the input signals with each other and selects one input signal having a smaller torque value from the plurality of input signals;
Using the input signal selected by the comparison selecting unit, the second arithmetic unit for executing the torque calculation to generate the torque value as a redundant operation and (7 2), I have a,
When the calculation result of the first calculation unit is compared with the calculation result of the second calculation unit, and the calculation result of the first calculation unit is larger than the calculation result of the second calculation unit, the main calculation unit Is provided with a comparison unit (20) for determining that is abnormal.
When the comparison unit determines that there is an abnormality, the comparison unit outputs a predetermined fixed value or the calculation result of the second calculation unit to the control object instead of the calculation result of the first calculation unit. Control device. The control device according to claim 1, wherein the comparison / selection unit selects an input signal in which an abnormality of the main calculation unit is least likely to be undetected in detection by the comparison unit .

Images