JPH05233577A - Electronic controller - Google Patents

Abstract

PURPOSE:To provide an electronic controller which can decrease the number of communication lines. CONSTITUTION:At least three or more pieces of central processors ECU 21-24 are provided. Then a host ECU 21 is defined together with the slave ECU 22-24 defined respectively. A fail communication line 25 and the help communication lines 26-28 output the fail signals when the faults are caused between the ECU 21 and the ECU 22-24 only. If one of ECU 21-24 has a fault, this faulty ECU transmits a fail signal to the ECU 21. Thus the ECU 21 and receives the fail signal informs the ECU 22-24 of occurrence of the fault via the lines 25-28.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control device, and more particularly to an electronic control device having a fail-safe function.

[0002]

2. Description of the Related Art In recent years, there has been a remarkable development of an electronic control unit using a central processing unit such as a microcomputer. For example, in a vehicle or the like, a plurality of microcomputers are mounted and various controls (for example, fuel injection amount control, throttle control, automatic transmission control, traction control, etc.) are performed in a suitable and precise manner.

Further, by connecting the central processing units used for the above various controls through a communication means and transmitting the data calculated by each central processing unit to other central processing units, more precise precision control is performed. System configuration.

On the other hand, when an abnormality occurs in any of the plurality of central processing units thus configured as a system, data generated by the central processing unit in which the abnormality occurs (hereinafter referred to as abnormal central processing unit) Becomes unreliable data (abnormal data), and if another normal central processing unit performs control processing based on this abnormal data, there is a possibility that proper control cannot be performed.

For this reason, a communication line (fail communication line) for communicating the occurrence of an abnormality is provided between the central processing units, and the abnormal central processing unit uses this fail communication line to connect other central processing units. The normal central processing unit that has transmitted the fail signal to and received the fail signal is configured to perform a predetermined fail-safe process corresponding to the occurrence of the abnormality.

In this type of conventional electronic control unit, all the fail communication lines arranged between a plurality of central processing units are arranged between the respective central processing units (see, for example, Japanese Patent Laid-Open No. Hei 10 (1999) -264242).
1-131466). FIG. 6 is a diagram schematically showing the configuration of the electronic control device 1 having the above-described conventional configuration, and in the same figure, it is configured by four central processing units (ECU) 2-5.

As shown in FIG. 1, in the conventional electronic control unit 1, when focusing on, for example, the ECU 2, the ECU 2 is EC
The fail communication lines 6 to 8 for transmitting a fail signal and the fail communication lines 9 to 11 for receiving a fail signal are arranged between the U3 and the ECU 5, respectively. Further, the other ECUs 3 to 5 have the same configuration.

[0008]

SUMMARY OF THE INVENTION In the above-described conventional electronic control unit, one ECU is provided with fail communication lines for all other ECUs in order to send and receive a fail signal. Therefore, a large number of wirings are required as fail communication lines. As described above, since a large number of fail communication lines are required, there is a high possibility that the fail communication lines will be disconnected or a short circuit will occur between the fail communication lines, and the reliability of the electronic control unit will be reduced. ..

The present invention has been made in view of the above points, and an object thereof is to provide an electronic control device capable of reducing the number of communication lines by providing a master-slave relationship among a plurality of central processing units. And

[0010]

FIG. 1 shows the basic system of the present invention. As shown in the figure, in order to solve the above-mentioned problems, the present invention has at least three central processing units (ECU1 to ECU4), and one of the central processing units is the main central processing unit. Processing unit (ECU
1) and a fail signal output when an abnormality occurs in each of the central processing units (ECU1 to ECU4) only between the other central processing units (ECU2 to ECU4) and the main central processing unit (ECU1). Communication line (L1 to L
4) is provided, and the central processing unit (ECU1 to ECU
When an abnormality occurs in any of 4), the central processing unit in which the abnormality occurs (hereinafter referred to as "abnormal central processing unit")
Transmits a fail signal to the main central processing unit (ECU1) and receives the fail signal from the main central processing unit (ECU)
1) is characterized in that it is configured to communicate to each central processing unit (ECU2 to ECU4) that an abnormality has occurred in the abnormal central processing unit via the communication lines (L1 to L4). is there.

[0011]

In the electronic control unit having the above construction, the communication line for transmitting the fail signal is arranged only between the main central processing unit and the other central processing units. Therefore, it is possible to reduce the number of communication lines as compared with the configuration in which the communication lines are respectively provided between the central processing units, and accordingly, the possibility of disconnection and short circuit of the communication lines decreases, and the electronic control unit The reliability of can be improved.

[0012]

Embodiments of the present invention will now be described with reference to the drawings. FIG. 2 shows an electronic control unit 20 which is an embodiment of the present invention.
The system configuration of is shown. In this embodiment, an example in which the present invention is applied to an electronically controlled throttle system is shown.

The electronic control unit 20 shown in FIG. 1 includes four central processing units (ECUs) 21 to 24 and a fail (FAI).
L) communication line 25, help (HELP) communication lines 26-2
8, duty communication lines 29 to 31 and the like.

Of the four ECUs 21 to 24, the ECU 21
Is a throttle ECU, which controls the opening degree of a sub-throttle valve arranged in the intake pipe of the engine. Here, the sub-throttle valve is arranged separately from the main throttle valve that operates in conjunction with the accelerator pedal operated by the driver, and is driven by an actuator (for example, a stepping motor). Since the sub-throttle valve can be driven independently of the main throttle valve as described above, the throttle ECU 21 can control the engine output regardless of the accelerator pedal operation by the driver.

The ECU 22 is a fuel control ECU (E
FI ECU), which controls the amount of fuel injected from the injector. The EFIECU 22 receives various data such as the intake air amount, engine water temperature, and oxygen concentration of exhaust gas, calculates the optimum fuel injection amount based on these various data, and drives the injector based on the calculated fuel injection amount to drive the optimum amount of fuel. Is to be injected.

The ECU 23 is an EC for automatic transmission control.
U (ECT ECU), which calculates an appropriate shift amount with less shift shock based on various data such as engine speed and intake air amount, and controls the automatic transmission based on this.

Further, the ECU 24 is an E for traction control.
CU (TRCECU) is a CU (TRCECU) that calculates the slip amount of the vehicle speed based on various data such as the rotational speed of each wheel, the vehicle speed, and the throttle opening, and performs control so that the driving torque is adapted to this slip amount It is intended to improve the stability of the vehicle at the time of occurrence.

Each of the ECUs 21 to 24 is configured to perform the above-described various control operations and communicate the contents calculated by each of the ECUs 21 to 24 to other ECUs to perform more accurate proper control. .. For example, TRC
The slip amount calculated by the ECU 24 is transmitted to the ECT ECU 23, and the ECT ECU 23 performs a control operation for selecting a shift that can maintain the stability of the vehicle based on the slip amount.

As described above, the ECUs 21 to 24 communicate data with each other and perform control operations based on the data transmitted from other ECUs. Therefore, when an abnormality such as a failure occurs in any of the ECUs 21 to 24, the data transmitted from the ECU in which the abnormality has occurred (abnormal ECU) is unreliable data, and based on this abnormality data, When another ECU performs a control operation, proper control cannot be performed. Therefore, the electronic control unit 2
0 means that if an abnormal ECU occurs, E
As described above, the CU is configured to notify that an abnormal ECU has occurred, stop the control based on the abnormal data, and perform a predetermined fail-safe process.

In the present invention, the main ECU is set as a system for notifying that an abnormal ECU has occurred.
A communication line for communicating a fail signal when an abnormal ECU occurs is provided only between the CU and a subordinate ECU other than the main ECU, and no communication line is provided between the other ECUs. It is characterized by. Therefore, in this embodiment,
The throttle ECU 21 is selected as the main ECU, and the fail communication line 25 and the help communication lines 26 to 28 for communicating a fail signal are provided only between the throttle ECU 21 and the other subordinate ECUs 22 to 24.

Here, the fail communication line 25 is a communication line used to inform the other ECUs 22 to 24 of the occurrence of an abnormality when the throttle ECU 21 has an abnormality, and the help communication line 26 to. Reference numeral 28 is a communication line used to notify each of the ECUs 22 to 24 of the occurrence of an abnormality when an abnormality occurs in the ECU 22 to 24 other than the throttle ECU 21.

When the throttle ECU 21 is normal, the throttle ECU 21 is connected to the fail communication line 25.
A signal (hereinafter, referred to as RUN PALSE) that has a high level and a low level as a constant cycle is output to
When an abnormality occurs in the throttle ECU 21, a high level signal is output to the fail communication line 25. Therefore, the other ECUs 22 to 24 can know the occurrence of an abnormality in the throttle ECU 21 from the signal communicated via the fail communication line 25.

Further, other E except for the throttle ECU 21
When all the CUs 22 to 24 are normal, the RUN PU is sent from the throttle ECU 21 to the help communication lines 26 to 28.
When LSE is output and one or more of the ECUs 22 to 24 is abnormal, a high-level signal is sent to the ECU in which the abnormality has occurred and to the ECU in which no abnormality has occurred. On the other hand, a low level signal is output to the help communication lines 26 to 28. Therefore, each ECU 2
2 to 24 are signals communicated by the help communication lines 26 to 28 (hereinafter, HELP1 to HE when distinguishing these signals.
The abnormality occurrence of the ECUs 22 to 24 can be known by (denoted as LP3).

The duty communication lines 29 to 31 are connected to each ECU.
22 to 24 are throttle ECUs in the control operation.
21 is a communication line for sending a throttle opening request signal. In the present embodiment, the duty communication line 29-
Throttle opening request signal transmitted via 31 (hereinafter, DUTY1 to DUTY when distinguishing these signals)
3)), the throttle ECU 21
It is configured to detect abnormalities 22 to 24. As a method of detecting an abnormality, for example, when the output value of the throttle opening request signal is an excessively required opening (90 ° or more) or an excessively required opening (less than 0 °), the throttle opening request is made. The ECU that outputs the signal is determined to be abnormal.

As described above, in the case of this embodiment, the throttle ECU 21 is adapted to receive throttle opening request signals from all the other ECUs 22 to 24. Therefore, if the throttle ECU 21 is provided with an abnormality detecting means, all the other ECUs 22 in the throttle ECU 21 are provided.
It is possible to detect the abnormality of 24. For this reason,
In this embodiment, the throttle ECU 21 is the main ECU and the other ECUs 22 to 24 are the ECUs subordinate to the throttle ECU 21.

Further, when a plurality of ECUs 21 to 24 constituting the electronic control unit 20 are provided with a master-slave relationship and an abnormality occurs in any of the ECUs, the main ECU 21 causes an abnormality in each of the subordinate ECUs 22 to 24. With the configuration for notifying the occurrence, the communication line for notifying the abnormality can be only the fail communication line 25 and the help communication lines 26 to 28 connecting the main ECU 21 and the respective subordinate ECUs 22 to 24, and each ECU. The number of communication lines can be significantly reduced as compared with the electronic control device 1 (see FIG. 6) having a conventional configuration in which communication lines are provided between the communication lines. As described above, since the number of communication lines can be significantly reduced, the possibility that the communication lines 25 to 28 will be disconnected or short-circuited is reduced, and the reliability of the electronic control device can be improved.

Next, the operation of the electronic control unit 20 having the above system configuration when an abnormality occurs will be described with reference to FIGS. 3 and 4.

First, the control operation when an abnormality occurs in the main ECU 21 will be described with reference to FIG. When the process shown in the figure is started, first, the throttle ECU 21 determines whether or not an abnormality has occurred in the throttle opening request signal DUTY1 transmitted from the EFIECU 22 via the duty communication line 29 (step 100. Note that, Hereinafter, the step is abbreviated as S). Here, if it is determined that the throttle opening request signal DUTY1 is abnormal, the process proceeds to S102, and the throttle ECU 21 sets E
It determines that an abnormality has occurred in the FIECU 22, and outputs a high level signal to the help communication line 26. On the other hand, S1
If it is determined at 00 that no abnormality has occurred in the throttle opening request signal DUTY1, the process proceeds to S104.

In S104, it is determined whether or not an abnormality has occurred in the throttle opening request signal DUTY2 transmitted from the ECT ECU 23 via the duty communication line 30. Here, the throttle opening request signal DUTY2
If it is determined that an abnormality has occurred in step S106, the process proceeds to step S106.
Then, the throttle ECU 21 determines that an abnormality has occurred in the ECT ECU 23 and outputs a high level signal to the help communication line 27. On the other hand, if it is determined in S104 that the throttle opening request signal DUTY2 is not abnormal, the process proceeds to S108.

In step S108, it is determined whether or not the throttle opening request signal DUTY3 transmitted from the TRCECU 24 via the duty communication line 31 is abnormal. Here, the throttle opening request signal DUTY3
If it is determined that an abnormality has occurred in S110, the process proceeds to S110.
Then, the throttle ECU 21 determines that an abnormality has occurred in the TRCECU 24 and outputs a high level signal to the help communication line 28. On the other hand, if it is determined in S108 that the throttle opening request signal DUTY3 has no abnormality, the process proceeds to S112.

In S112, the throttle ECU 21 performs self-diagnosis to determine whether or not an abnormality has occurred in the throttle ECU 21 itself. When it is determined that an abnormality has occurred, a high level signal is transmitted to the fail communication line 25 in S114. On the other hand, S11
If it is determined in 2 that no abnormality has occurred in the throttle ECU 21 itself, the process proceeds to S116.

In S116, the transmission state of the help communication lines 26 to 28 is determined. And each help communication line 26-2
If the output of 8 is not high level, R is connected to the fail communication line 25 and the help communication lines 26 to 28 in S118.
Send UN PULSE and finish the process. On the other hand, in S116, if any or a plurality of the help communication lines 26 to 28 are at the high level, a low level signal is output to the help communication line that is not at the high level in S120.

With this configuration, each ECU 22
24 are fail communication lines 25 and help communication lines 26-2
It is possible to detect the occurrence state of the abnormality based on the signal transmitted via 8. That is, each of the ECUs 22-24
Will send all ECs if RUN PULSE is sent.
It is determined that U22 to 24 are normal, and when a high level signal is transmitted, it is determined that an abnormality has occurred in itself, and when a low level signal is transmitted, it is not the one other than itself. It is determined that an abnormality has occurred in another subordinate ECU.
In addition, each of the ECUs 22 to 24 can determine that an abnormality has occurred in the throttle ECU 21 due to the fail communication line 25 becoming high level.

At S122, it is determined whether the vehicle condition is unstable. If the vehicle condition is unstable, the vehicle stability control is performed in S124, and if it is determined in S122 that the vehicle condition is stable, S12 is performed.
The process is terminated without executing 4.

Here, vehicle stability control means normal ECU
This is a control (that is, fail-safe) for ensuring safety when the vehicle is running to the maximum extent possible only by itself. One example of this fail-safe is T during traction control.
When an abnormality occurs in the RC ECU 24 and a driving torque that is not adapted to the road surface condition is output and the vehicle condition becomes unstable, the throttle ECU 21 fully closes the sub-throttle valve to reduce the driving torque and stabilize the vehicle stability. It is possible to carry out a control for holding. By performing the vehicle stability control, even if any of the ECUs 22 to 24 has an abnormality, the normal ECU can cover the abnormal ECU and maintain the vehicle stability.

Next, the operation when an abnormality occurs in the subordinate ECUs 22 to 24 will be described with reference to FIG.
In the following description, the EFI is used as the subordinate ECU.
The ECU 22 will be described as an example.

When the processing shown in FIG.
The ECU 22 determines whether the signal HELP1 transmitted via the help communication line 26 in S200 is RUN PULSE. Signal HE transmitted in S200
If LP1 is judged to be RUN PULSE, each EC
Since U22 to U24 are all normal, the process ends.
On the other hand, the signal HELP1 transmitted in S200 is R
If it is determined that it is not UN PULSE, the process proceeds to S202, and it is determined whether the signal HELP1 is a low level signal.

When it is determined in S202 that the signal HELP1 is a low level signal, the process proceeds to S204. Here, the signal HELP1 being a low-level signal means that one of the ECUs 22 to 24 is abnormal,
Moreover, it is indicated that the ECU in which the abnormality has occurred is not the EFIECU 22 (the EFIECU 22 is normal). Therefore, in this case, the EFIECU 22 carries out stable control of the vehicle (fail safe). An example of this fail-safe is TRC during traction control.
When an abnormality occurs in the ECU 24 and a driving torque that is not adapted to the road surface condition is output and the vehicle condition becomes unstable,
It is conceivable that the ECT ECU 23 reduces the drive torque transmitted to the road surface by increasing the shift speed and performs control for maintaining the stability of the vehicle. By performing this vehicle stability control, even if an abnormality occurs in any of the subordinate ECUs 22 to 24, in addition to the vehicle stability control by the main ECU 21 described above, the abnormal ECU by the vehicle stability control by the subordinate normal ECU is performed. It is possible to cover the vehicle and maintain the stability of the vehicle.

On the other hand, if it is determined in S202 that the signal HELP1 is not a low level signal, the process proceeds to S2.
Proceed to 06. Here, the fact that the signal HELP1 is a high level signal indicates that the EFIECU 22 itself is abnormal.

In S206, the EFIECU 22 executes the own system protection control. Here, the own system protection control means a control operation for preventing a secondary failure of the own system due to an abnormality of the own ECU. Specifically, ECTE
When the throttle opening degree request signal DUTY2 from the CU 23 becomes abnormal and the throttle opening degree correction request for shock reduction at the time of shifting is not accepted by the throttle ECU 21, the ECT ECU 23 changes the ECT shifting pattern to shifts with less shifting shock. The control to switch to the pattern can be mentioned. The process ends when S206 is performed. Further, in the above-described embodiment, the EFIECU22 is described as an example of the subordinate ECU, but the other subordinate ECUs 23 and 24 are also configured to perform the same processing as the processing shown in FIG. The vehicle stability control and the own system protection control are executed in the state.

As described above, even if the system configuration of the electronic control unit 20 is configured as shown in FIG. 2 and the number of communication lines is smaller than that of the conventional system, the fail-safe process may be inconvenient. Therefore, it is possible to reduce the cost and improve the reliability of the electronic control unit 20 while ensuring the safety in traveling the vehicle.

In the above embodiment, the number of ECUs is four and the number of communication lines is four, but the present invention is not limited to this. Although the fail communication line 25 and the help communication lines 26 to 28 are connected from the main ECU 21 to the subordinate ECUs 22 to 24 in the above embodiment, the communication lines can be further selected by appropriately selecting the type and combination of signals to be communicated. It is also possible to reduce the number of.

On the other hand, the conventional electronic control unit 1 shown in FIG.
Then, since the ECUs 2 to 5 have an equal relationship,
There are various types of abnormalities that occur in each of the ECUs 2 to 5 (in the case of four ECUs, there are 16 types). on the other hand,
A predetermined failsafe process is executed when an abnormality occurs in the ECUs 2-5, but this failsafe process is not uniform, and the most suitable failsafe process is performed depending on the type of abnormality that occurs in the ECUs 2-5. Is configured to be. This fail-safe operation is performed in advance for each ECU 2
5 to 5 are executed based on the programs stored in the memories, but if there are various kinds of abnormalities occurring in the ECUs 2 to 5 as described above, the programs for fail safe to be stored also increase, and the fail safe programs are stored. There is a problem that the processing becomes complicated and a large capacity memory is required for each of the ECUs 2 to 5.

However, as in this embodiment, the ECUs 21-
By providing a master-slave relationship to the ECU 24,
As shown in FIG. 5, there are five types of abnormalities that occur in No. 4, and the capacity of the program for fail-safe to be stored can be reduced, so that the memory capacity can be reduced and the processing speed can be increased. Can be planned.

[0045]

As described above, according to the present invention, a master-slave relationship is provided for a plurality of central processing units, and a communication line for transmitting a fail signal is provided only between the main central processing unit and another central processing unit. Since the configuration is provided, the number of communication lines can be reduced as compared with the configuration in which communication lines are provided between the central processing units, respectively, so that there is a possibility that disconnection and short circuit will occur in the communication lines. It has a feature that it becomes low and the reliability of the electronic control device can be improved.

[Brief description of drawings]

FIG. 1 is a diagram showing a basic system of the present invention.

FIG. 2 is a system configuration diagram showing an electronic control device that is an embodiment of the present invention.

FIG. 3 is a flowchart for explaining an operation performed by the throttle ECU when an abnormality occurs.

FIG. 4 is a flowchart for explaining an operation performed by the EFIECU when an abnormality occurs.

FIG. 5 is a diagram showing a mode in which an abnormality of the ECU occurs and fail-safe processing for each mode in the present embodiment.

FIG. 6 is a system configuration diagram showing an example of a conventional electronic control device.

[Explanation of symbols]

 20 Electronic Control Unit 21 Throttle ECU 22 EFIECU 23 ECT ECU 24 TRCECU 25 Fail Communication Line 26-28 Help Communication Line 29-31 Duty Communication Line

─────────────────────────────────────────────────── ─── Continuation of the front page (51) Int.Cl. ⁵ Identification code Office reference number FI technical display location G06F 11/16 310 B 7313-5B

Claims (1)

[Claims] 1. At least three central processing units are provided, and one of the central processing units serves as a main central processing unit, and is provided only between another central processing unit and the main central processing units. In the case where an abnormality occurs in any of the central processing units, a communication line for communicating a fail signal output when an abnormality occurs in each of the central processing units is provided.
The central processing unit in which the abnormality has occurred (hereinafter, referred to as abnormal central processing unit) transmits a fail signal to the main central processing unit, and the main central processing unit which has received the fail signal transmits to the respective central processing units. An electronic control unit configured to communicate that an abnormality has occurred in the abnormality central processing unit via the communication line.