JPH0599061A - Controller for automobile - Google Patents

Abstract

PURPOSE:To surely provide a normal output after resetting by resetting the slave side microcomputer in synchronization with an engine rotation signal by the master side microcomputer after the engine control is changed over by a back-up circuit. CONSTITUTION:This controller for an automobile is provided with a microcomputer (master side) 3 for controlling fuel injection for example and a microcomputer (slave side) 4 for controlling ignition for example. When abnormalities like a runaway take place in either one of the microcomputers 3, 4, first and second control is performed by a control output SO formed by a back-up circuit 2. That is, the microcomputers 3, 4 are monitored by a monitoring circuit 1. In the runaway of the microcomputer 3, the back-up circuit 2 executes control for both microcomputers 3, 4, while thereafter the monitoring circuit 1 resets the microcomputer 3 and then resets the microcomputer 4 in synchronization with an engine rotation signal to shift the control to the normal one.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a vehicle controller for controlling a plurality of types of control items relating to an engine by using a plurality of microcomputers.

[0002]

2. Description of the Related Art In a vehicle controller using a microcomputer (hereinafter referred to as "microcomputer"), high reliability is required for compensation of control operation against runaway or failure of the microcomputer. For this reason, for example, in Japanese Unexamined Patent Publication No. 61-49154, two microcomputers of the same configuration capable of executing a main task and a sub task are used, and when normal, each microcomputer executes the control process by the main task. When the microcomputer of (1) fails, the normal microcomputer executes the main task and the sub-task, and the normal microcomputer performs the processing of the control item of the abnormal microcomputer such as runaway instead. In this case, the main task is a program that properly controls the control items assigned to each, and the subtask is a program that simplifies the main task assigned to the other.

In Japanese Patent Laid-Open No. 60-212655, a backup circuit for converting a direct signal from various sensors into a required signal format and sending the signal to a controlled object is provided for one microcomputer, and an abnormality such as runaway occurs. At the same time, it is described that the backup circuit is operated by a signal from a monitoring timer, the microcomputer is reset during the backup mode period, and normal operation is restored after the reset period. According to such a backup circuit, one microcomputer handles a plurality of control items, and the backup circuit
It can be configured by a simple gate circuit, a signal conversion circuit (integration circuit), etc., and is a cheaper configuration than the former system in which two microcomputers share the same.

[0004]

By the way, by increasing the control, for example, a microcomputer for controlling the injection,
It has become necessary to separately configure a microcomputer that controls ignition. In such a system, two microcomputers operate normally to control injection and ignition. Therefore, in order to deal with an abnormality in either one or both microcomputers, as in the latter prior publication,
When a backup circuit that substitutes the functions of the two microcomputers is provided, the function of the monitoring timer switches to the backup mode. However, if the abnormal microcomputer is reset by a timer operation at an appropriate time (for example, at fixed time intervals), a reset pulse is frequently generated during the reference crank angle period in the low speed rotation range, and the normal Since the ignition output (or the injection output) is not continuous, it may not be possible to return from the backup mode even after a long time. Further, in the high speed rotation region, the reset period becomes longer than the reference crank angle period, and the recovery may be extremely delayed.

FIG. 7 is a time chart for explaining the above-mentioned return delay in the low speed rotation region. (A) and (B) represent two-phase reference crank angle signals with different phases, which are generated at every 720 ° crank angle (CA) of the engine, (C) is a reset signal, and (D) is an ignition output. Represents. The reset signal C is a pulse P1 at a fixed interval arbitrary time with respect to the crank angle
Present. The pulse P1 resets the abnormal microcomputer. The reset microcomputer generates the pulse P3 of the ignition output D by the pulse P2 in the reference crank angle signal A or B. When the pulse P3 is normally obtained, the operation of the backup circuit is canceled, and the ignition control is performed by the output signal from the original microcomputer which has returned to the normal operation. However, conventionally, the pulse P2
However, since the time T1 until the pulse P1 is generated and the interval T2 between the pulses P1 are appropriately set, the ignition output is generated after the reset is applied until the pulse P2 is obtained (since the crank position is indefinite). Pulse P3 is not obtained, resulting in omission (see dotted line pulse). Therefore, the ignition control by the reset microcomputer cannot be performed (it cannot escape from the backup mode).

SUMMARY OF THE INVENTION It is an object of the present invention to solve the above-mentioned problems and provide a control device for an automobile, in which the microcomputer reset in the backup mode quickly returns to normal operation.

[0007]

According to the present invention, a plurality of types of control items relating to an engine are shared and processed, and
One is a master side and a slave side microcomputer having a function of resetting the other slave side as a master side, and a predetermined signal from these master side and slave side microcomputers causes abnormality of the master side and slave side microcomputers. A backup circuit for detecting and controlling the engine instead of these is provided, and after switching the engine control by the backup circuit, the master side microcomputer resets to the slave side microcomputer in synchronization with the engine rotation signal. It is characterized in that it is configured to apply.

[0008]

According to the present invention, after the engine control is switched by the backup circuit, the master side microcomputer resets the slave side microcomputer in synchronization with the engine rotation signal. In the period, the control output after the reset pulse is generated can be stably obtained,
The return operation can be performed quickly.

[0009]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows the basic configuration of a vehicle control device according to the present invention. The vehicle to which the present invention is applied is configured such that, for example, control regarding fuel injection (referred to as first control) is performed by the microcomputer 3
Control for ignition (second control)
Is performed by the microcomputer 4, and the microcomputer 3 and the microcomputer 4
When either or both of the above two or more abnormalities such as runaway occur, the first and second controls are performed by the control output SO generated by the backup circuit 2.

The microcomputer 3 uses the signal S1 for the first control.
Is sent to a predetermined controlled object via the backup circuit 2, and the microcomputer 4 supplies the signal S2 for the second control to the predetermined controlled object via the backup circuit 2. The microcomputers 3 and 4 are connected by a communication line 5, and the monitoring IC 1 is connected to the microcomputer 3. The microcomputer 3 and the monitoring IC 3 supply the watchdog signal WD1 from the microcomputer 3 to the monitoring IC 1, and the monitoring IC 1 sends a reset signal RS1 in response to the watchdog signal WD1 to the microcomputer 3. The microcomputer 4 supplies the watchdog signal WD2 to the microcomputer 3 using the communication line 5, for example, and the microcomputer 3 supplies a reset signal RS2 responsive to the watchdog signal WD2.
According to such a configuration, the microcomputer 3 is on the master side with respect to the microcomputer 4, and the microcomputer 4 is on the slave side with respect to the microcomputer 3.

The backup circuit 2 includes a first control circuit and a second control circuit.
The engine control function has a simple method of converting direct signals from various sensors (not shown) and sending them to the controlled object. Then, in the normal mode, the signals S1 and S2 from the microcomputers 3 and 4 can be directly supplied to the controlled object, and in the backup mode, the controlled object can be controlled by the above-mentioned simple method. The watchdog signal WD3 is supplied from the microcomputer 3 to the backup circuit 2 and the backup circuit 2
From the above, a fail-safe signal FA is supplied to the microcomputer 3. The watchdog signal WD3 is
This is a signal for causing the backup circuit 2 to monitor the operation of the microcomputer 3 or the microcomputer 4, and is a fail-safe signal F.
A is a signal that informs the microcomputer 3 whether or not it is in the backup mode.

The microcomputers 3 and 4 having the above-mentioned configuration are monitored by the monitoring circuit 1, and when the microcomputer 3 runs out of control, the backup circuit 2 takes over the control of both the microcomputers 3 and 4. Then, the monitoring circuit 1 resets the microcomputer 3, and then the microcomputer 3 resets the microcomputer 4 to shift the second control to the normal control by the microcomputers 3 and 4 in accordance with the first control. It is what makes them.

Next, the operation when the slave microcomputer 4 runs out of control will be described with reference to the time chart of FIG. When the slave side microcomputer 4 runs out of control, the watchdog signal WD
2 stops (see time t1). Master side microcomputer 3
Monitors the stop of the watchdog signal WD2 for a certain delay time a. If the watchdog signal WD2 does not return to normal even after the time a has elapsed, the microcomputer 3 similarly stops the watchdog signal WD3 (see time t2). The backup circuit 2 waits for the watchdog signal WD3 to recover from the time t2 for a time period b, and when it does not recover, transfers the fail-safe signal FA from the high level to the low level as shown at the time t3 to perform the backup. Move to mode. As a result, the second control is performed by the simplified method of the backup circuit 2. After the shift to the backup mode, the microcomputer 3 resets the microcomputer 4 by forming a pulse P3 in the reset signal RS2. The pulse interval (reset period c) of the reset signal RS2 is a time sufficient for the signal S2 from the microcomputer 4 to show a normal output. If the backup mode is released without the signal S2 indicating a normal output, the operation will be hindered.

Conventionally, the timing for applying the reset and the reset period c have been set appropriately, so that the signal S
However, there is a problem in that the output of 2 is delayed in normal output and the time required for recovery is long. In the present invention, the timing of forming the pulse P3 in the reset signal RS2 is synchronized with a signal indicating the engine rotation angle (referred to as an engine rotation signal in this specification).

An embodiment of the vehicle control device in which the reset operation performed from the master side to the slave side during the backup period as described above is synchronized with the engine rotation signal will be described more specifically. FIG. 3 is a configuration diagram of a specific embodiment of the vehicle control device according to the present invention. Note that, for convenience, the same reference numerals are given to the elements common to the configuration of FIG.

The backup circuit 2 includes a waveform shaping circuit 1
Crank angle from rotation sensor 11 via 2 CA
The signal S3 for each of them and the reference crank angle signals S4, S5 of two phases for every 720 ° CA are supplied, and the switch signal 13a from the idle switch 13 is supplied. The output of the waveform shaping circuit 12 is also supplied to the master side microcomputer 3 and the slave side microcomputer 4, and the switch signal 13a from the idle switch 13 is transmitted to the master side microcomputer 3 as well.
Is also supplied to.

The master side microcomputer 3 mainly performs injection control, and a detection signal 15a based on sensor signals from the water temperature sensor 16, the throttle position sensor 17, the air flow meter 18 and the like that have passed through the buffer 14 and the A / D converter 15. Is designed to take in. The injection control signal S1 formed based on these various detection signals 15a is input to the backup circuit 2, and when the microcomputer is normal, the injection control signal S1 becomes the control output SO1 and the fuel injection valve 20 via the drive circuit 19. Operate.

The slave-side microcomputer 4 mainly performs ignition control, and is connected to the master-side microcomputer 3 through a communication line 6 and a reset signal RS2 line. The ignition control signal S2 formed based on the output from the waveform shaping circuit 12 is input to the backup circuit 2, and when the microcomputer is normal, the ignition control signal S2 becomes the ignition control output SO2 and the igniter 21 via the drive circuit 19. Drive.

However, the backup circuit 2 constantly monitors the ignition control signal S2 and the watchdog signal WD3 output from the master side microcomputer 3, and when either of them is abnormal, the respective microcomputers 3 and 4 are monitored. The injection control signal S1 and the ignition control signal S2 output from the reference crank angle signal S supplied via the waveform shaping circuit 12 are ignored.
4, S5 or 30 ° C A signal S3 and idle switch 1
The pulse generated by the switch signal 13a from 3 is supplied to the drive circuit 19 as control outputs SO1 and SO2. At the same time, the backup circuit 2 indicates that the switching to the backup mode has failed fail signal FA.
Is transmitted to the microcomputer 3. Control output S at this time
O1 and SO2 do not have information on the water temperature sensor 16, etc.
It does not allow precise control like in normal operation, but contains the minimum information required for the vehicle to drive.

Reference numeral 22 is a battery, and the IG switch 23
When is turned on, the input voltage is supplied to the power supply circuit 24.
The power supply circuit 24 corresponds to the monitoring circuit 1 in the configuration of FIG. In this case, the IG switch 23 goes from OFF to O
When switched to N (at the start of operation), or the microcomputer 3
When the watchdog signal WD1 from
A pulse is formed in the reset signal RS1 to reset the microcomputer 3.

4 and 5 show the flow chart of the above embodiment.
Indicates the For example, assume that the microcomputer 4 has runaway. Normally, the pulse of the ignition control signal S2 shown in FIG. 2 should also be stopped, so that, for example, when six pulses of the ignition control signal S2 are continuously missing, the backup mode is switched to. However, a runaway in a state where the ignition control signal S2 is normally output is also conceivable (for example, when the base routine runs out of control and only the interrupt process of the injection / ignition control is normally performed, the ignition is performed. Since the output is performed by interruption, the abnormality determination based on the signal S2 cannot be performed.) Therefore, it is necessary to determine that the watchdog signal WD3 does not output a pulse. Therefore, when the microcomputer 3 recognizes that the watchdog signal WD2 of the microcomputer 4 shown in FIG. 2 has become abnormal, the watchdog signal from the microcomputer 3 to the backup circuit 2 is processed by steps 201 → 202 → 204 of FIG. WD
3, the injection / ignition control is switched to the backup state when it is determined that, for example, 96 mS or more is not reversed. After that, in the determination step 205 of FIG. 5, after detecting that the backup mode has been switched to, the reset pulse P1 is output to the microcomputer 4 (step 20).
6). As a result, when the reset is applied, the ignition output is performed by the backup circuit 2, so that the ignition omission does not occur. Note that the process of steps 201 → 203 in FIG. 4 is the flow of the normal mode.

Next, the microcomputer 4 is reset to return to normal. However, if it is reset irregularly as in the conventional case, it may cause a misfire, which adversely affects the driving performance. FIG. 6 is a time chart in the backup mode according to the present invention.
Reference numerals 5 and 2 respectively represent a two-phase reference crank angle signal, S3 is a 30 ° CA crank angle signal, S2 is an ignition control signal,
RS2 indicates a reset signal.

In this embodiment, the pulse period Tc of the reset signal RS2 is the pulse P of the reference crank angle signals S4 and S5.
It is synchronized with the cycle of 2. Moreover, the reset pulse P3
Appears immediately before the pulse P2 of the reference crank angle signals S4 and S5. As a result, the number of ignition output pulses P3 that escape through the reset operation of the microcomputer 4 is at most one or two (there is one in the figure), and the pulse P3 that follows thereafter is normally obtained. This can be clearly understood by comparing with a time chart (FIG. 7) in the case of resetting irregularly as in the conventional case.

Therefore, the backup circuit 2 uses the pulse P
If three 3 are continuously output as shown by, for example, it is determined that the ignition is normal. The reset pulse P1 in this case is
Since the cycle Tc corresponds to the crank speed, the cycle Tc is long at low rotations and short at high rotations, and a continuous ignition pulse P3 is obtained during that period without being concerned with the rotation speed. If the abnormality continues, 720 ℃ A
Reset after.

As described above, when the slave side microcomputer 4 which controls ignition is out of control, the ignition output is not lost and the backup mode is entered, so that the normal operation can be promptly restored. The time chart of FIG. 6 describes a 6-cylinder engine.

[0026]

As described above, according to the present invention, after the injection / ignition control is shifted to the backup mode, the runaway microcomputer is reset in synchronization with the rotation of the engine to start the operation. It can return to normal quickly without any trouble.

[Brief description of drawings]

FIG. 1 is a configuration diagram illustrating a basic configuration of the present invention.

FIG. 2 is a time chart explaining the operation of FIG.

FIG. 3 is a configuration diagram showing a specific embodiment of the present invention.

FIG. 4 is a flowchart showing the operation of shifting to the backup mode in the embodiment of FIG.

5 is a flowchart showing a return operation of the embodiment of FIG.

FIG. 6 is a time chart showing the operation in the backup mode in the embodiment of FIG.

FIG. 7 is a time chart showing the operation in the conventional backup mode.

[Explanation of symbols]

1 ... Monitoring circuit, 2 ... Backup circuit, 3 ... Master side microcomputer, 4 ... Slave side microcomputer, 5 ... Communication line.
11 ... Rotation sensor, 13 ... Idle switch, 16 ... Water temperature sensor, 17 ... Throttle position sensor, 18 ...
Air flow meter, 19 ... Drive circuit, 20 ... Fuel injection valve,
21 ... Igniter, 22 ... Battery, 23 ... IG switch, 24 ... Power supply circuit. WD3 ... Watchdog signal, F
A ... Fail-safe signal, RS2 ... Reset signal, S
1, S2 ... Control signal, S3, S4, S5 ... Crank angle signal.

Claims (1)

[Claims] 1. A master-side microcomputer and a slave-side microcomputer each having a function of sharing a plurality of types of control items related to an engine and processing the other, and resetting the other slave side as one master side, and these master side and slaves. A microcomputer which detects an abnormality of the master side and slave side microcomputers by a predetermined signal from the side microcomputer, and which has a backup circuit for controlling the engine instead of these, after switching the engine control by the backup circuit, The control device for an automobile, wherein the master side microcomputer is configured to reset the slave side microcomputer in synchronization with an engine rotation signal.