JPH0717337A - Judgement of trouble of electronic controlled unit and trouble judging device - Google Patents

Abstract

PURPOSE:To provide a means which can detect the fault of the CPU of an electronic controlled unit with the simple constitution at a low cost. CONSTITUTION:In am electronic controlled unit C, prescribed numerical values are transmitted to a 16-bit type main CPU 1 from a 4-bit type sub-CPU 2, and in the main CPU 1, the simple calculation independent from the control calculation is carried out by using the numerical values, and correctness or error of the result of the calculation is judged by the sub-CPU 2. When it is judged that the result of the calculation by the main CPU 1 is erroneous continuously in a prescribed number of times, it is judged that the main CPU 1 fails. Accordingly, the necessity of installing two main CPU 1 having the large calculation capacity is obviated, the electronic controlled unit can be made simple, and cost can be reduced.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a failure determination method and failure determination device for an electronic control unit.

[0002]

2. Description of the Related Art In recent years, in automobiles, various control targets such as an engine, an automatic transmission, and a brake system are precisely controlled by using an electronic control unit equipped with a microcomputer to improve fuel efficiency, running performance or braking. It is often used to improve performance.

However, the CPU of such an electronic control unit sometimes fails (failures), and when the CPU failure occurs, the controlled object does not operate normally, so the failure of the CPU is detected early. Then you need to inform the driver. For this reason, the electronic control unit is generally provided with a fail detecting means for detecting a CPU failure.

In the conventional electronic control unit for automobiles, usually, two CPUs having the same function are provided, the same control information is given to both CPUs to perform the same control operation, and the two CPUs communicate with each other. When the calculation results of the CPUs are compared with each other and at least one of the calculation results is inconsistent, it means that at least one of the CPUs has failed. Therefore, the driver is notified of such a failure (for example, JP (See Japanese Patent Laid-Open No. 59-130768). In this case, even when one of the CPUs is normal, it is not possible to determine which CPU is failing, so that the electronic control unit eventually loses its function.

[0005]

However, in such a conventional fail detection method, since two CPUs having a large calculation capacity capable of controlling the controlled object must be provided, the cost for the CPU is doubled, In addition, the circuit around the CPU becomes complicated and large-scaled, and the cost of the electronic control unit becomes very high.

The present invention has been made in order to solve the above-mentioned conventional problems, and is a CPU of an electronic control unit.
It is an object of the present invention to provide a simple and inexpensive means capable of detecting a failure of.

[0007]

In order to achieve the above object, the first invention provides a main control means for controlling an object to be controlled with a predetermined numerical value, and the main control means has a predetermined value unrelated to control calculation. After the calculation is performed using the above numerical value based on the calculation formula, the correctness of the calculation result is judged, and when the calculation result is incorrect, it is judged that the main control means is out of order. A method for determining a failure of an electronic control unit is provided.

A second aspect of the invention is characterized in that main control means for controlling the controlled object and sub control means for judging the presence / absence of failure of the main control means without controlling the controlled object are provided. A failure determination device for an electronic control unit is provided.

According to a third aspect of the present invention, in a failure determination device for an electronic control unit according to the second aspect, the main control means has a control arithmetic unit for performing a control arithmetic operation for controlling an object to be controlled, and the control arithmetic operation described above. Is provided with a sub-calculation unit that can perform calculation using a predetermined calculation formula that is irrelevant, and
The sub-control unit is provided with a numerical value output unit that outputs a predetermined numerical value to the sub-calculation unit and a failure determination unit that determines whether or not there is a failure in the main control unit. After the calculation is performed using the numerical value input from the numerical value output unit, the calculation result is output to the failure determination unit, and the failure determination unit of the sub-control unit causes the calculation input from the sub-operation unit. There is provided a failure determination device for an electronic control unit, which is configured to determine whether the result is correct or incorrect, and to determine that the main control means has failed when the calculation result is incorrect.

According to a fourth aspect of the invention, in the failure determination device for an electronic control unit according to the third invention, when the failure determination section has an incorrect operation result input from the sub-operation section a predetermined number of times or more, the main control is performed. There is provided a failure determination device for an electronic control unit, characterized in that the means is configured to determine that there is a failure.

According to a fifth aspect of the present invention, in the failure determination device for an electronic control unit according to any one of the second to fourth aspects, the calculation capacity of the sub control means is set smaller than the calculation capacity of the main control means. A failure determination device for an electronic control unit is provided.

According to a sixth aspect of the present invention, in the failure determining apparatus for an electronic control unit according to the third aspect, the sub-control means can perform an arithmetic operation using the same arithmetic expression as the sub-arithmetic element. Is provided and the numerical value output section outputs a predetermined numerical value to the sub-calculation section and the main calculation section, and the main calculation section of the sub-control means uses the numerical value input from the numerical value output section. After performing the calculation, the calculation result is output to the failure determination section, and the failure determination section of the sub-control unit causes the calculation result input from the sub-calculation section and the calculation result input from the main calculation section. And a failure determination device for an electronic control unit, characterized in that when the two calculation results are different, it is determined that the main control means has failed.

According to a seventh aspect of the present invention, in the failure determination device for an electronic control unit according to any one of the third to fifth inventions, the failure determination section of the sub-control means is predetermined based on the predetermined arithmetic expression. It is provided with a map of the correct answer when the calculation is performed using the numerical value of, and the correctness of the calculation result of the sub-calculation unit is judged by comparing the calculation result input from the sub-calculation unit with the map. A failure determination device for an electronic control unit is provided.

According to an eighth aspect of the invention, in the failure determination device for an electronic control unit according to any one of the third to seventh inventions, the failure determination section of the sub-control means is a control calculation section of the main control means. Provided is a failure determination device for an electronic control unit, which is configured to determine that the main control means has failed even when the calculation result suddenly changes.

According to a ninth aspect of the present invention, in the failure determination device for an electronic control unit according to any one of the third to seventh inventions, the failure determination section of the sub control means is a control calculation section of the main control means. Provided is a failure determination device for an electronic control unit, which is configured to determine that the main control means is out of order even when the state in which the calculation results are the same continues.

In a tenth aspect of the invention, in the failure determination device for an electronic control unit according to any one of the third to seventh aspects, the sub-control means monitors the watchdog pulse of the main control means, and the watch. Provided is a failure determination device for an electronic control unit, which is configured to determine that the main control means has failed even when the disturbance of the dog pulse is detected.

In an eleventh aspect of the invention, in the failure determination device for an electronic control unit according to any one of the third to seventh aspects, the main control means monitors its own watchdog pulse and the watchdog pulse is detected. A failure determination device for an electronic control unit, characterized in that it is configured to determine that the main control means is out of order when the disturbance is detected.

[0018]

EXAMPLES Examples of the present invention will be specifically described below. <First Embodiment> As shown in FIG. 1, an ABS for an automobile.
The electronic control unit C that controls (anti-lock brake system) includes a main CPU 1 mainly for performing control calculation of ABS control and a main CP mainly.
A sub CPU 2 for detecting a failure (failure) of U1 is provided. Then, the main CPU 1 and the sub CP
U2 via the mutual communication line L ₃ and is able to communicate freely with each other. The main CPU 1 and the sub CPU 2 correspond to the "main control unit" and the "sub control unit" described in the claims, respectively.

The main CPU 1 has a large computing capacity of 16
Although not shown in detail, the CPU is a bit type CPU, and inside thereof, a control unit for fetching various instructions and an arithmetic unit for executing various instructions (arithmetic operations) are provided. Here, the arithmetic unit of the main CPU 1 is further provided with ABS.
Is divided into a control calculation unit for performing a control calculation for controlling the control and a sub-calculation unit for performing a calculation unrelated to the control calculation as described later. A main CPU memory 3 is attached to the main CPU 1.

The sub CPU 2 is a 4-bit type CPU having a small calculation capacity, and although not shown in detail, a control unit and a calculation unit are provided inside the sub CPU 2 like the main CPU 1. Here, the arithmetic unit of the sub CPU 2 further includes a main arithmetic unit that performs the same arithmetic operation as the sub arithmetic unit of the main CPU 1, a sub arithmetic unit of the main CPU 1 and a main arithmetic unit of the sub CPU 2 as described later. It is divided into a numerical value output unit that outputs a predetermined same numerical value and a failure determination unit that determines whether or not there is a failure (failure) of the main CPU 1 as described later. The sub CPU 2 has a sub C
A PU memory 4 is attached.

The electronic control unit C receives signals output from various sensors via the line L ₁ , while
An input interface 5 is provided for sending the signal to the main CPU 1 via the line L ₂ . The first through the line L ₄ to the input terminal main CPU1 output signal (A
BS control signal) is input, and the line L ₅ is input to the second input terminal.
An AND circuit 6 to which an output signal of the sub CPU 2 is input is provided via the, and the output signal of the AND circuit 6 is sent to the output interface 7 via the line L ₆ .

When the 1 signal (ON signal) indicating that the main CPU has not failed is input from the sub CPU 2, the AND circuit 6 receives the main CPU.
When the 0 signal (OFF signal) indicating that the main CPU 1 has failed is input from the sub CPU 2 to the output interface 7 side as it is, the output signal of 1 is output to the output interface 7 of the main CPU 1. It has the function of blocking output to the side.

The output signal of the output interface 7 is sent to the base 11a of the NPN first transistor 11 via the line L ₇ . A resistor 9 (resistor) whose other end is grounded to the vehicle body 10 is connected to the line L ₇ . This first transistor 11 is used as a switch, and when one signal (ON signal) is input to the base 11a, the electric resistance between the collector 11b and the emitter 11c becomes almost 0 (switch ON), and the 0 signal is output. When (OFF signal) is input, collector 11b and emitter 11
The electric resistance with c becomes ∞ (switch off).

That is, one signal from the output interface 7
When the (ON signal) is output, the first transistor 11 is switched on, the conductor 12 is energized (only when the relay switch 15 described later is not turned off), and the solenoid 13 is excited. The ABS actuator 14 is activated. On the other hand, when the 0 signal (OFF signal) is output from the output interface 7, the first transistor 11 is switched off, the conductor 12 is not energized, the solenoid 13 is demagnetized, and the ABS actuator 14 is deactivated. Activated.

Further, the electronic control unit C is provided with a watchdog pulse monitor 8 (hereinafter referred to as W / D monitor 8
It is provided). In this W / D monitor 8,
A watchdog pulse output from the watchdog pulse output unit 1a of the main CPU 1 (hereinafter referred to as W / D output unit 1a) is input via the line L ₈ and a watchdog pulse output unit 2a of the sub CPU 2 is also input.
(Hereinafter referred to as W / D output section 2a) watchdog pulses to be output are input via a line L ₁₀ from. Where the watchdog pulse is
Basically, it is a rectangular wave signal that repeatedly turns on and off in a fixed cycle, and the on time T ₁ and the off time T ₂ in one cycle are set to constant values.

The watchdog pulse is the main C
W / D output unit 1a of PU1 or W / D of sub CPU 2
Although it is generated in the D output section 2b, when the main CPU 1 or the sub CPU 2 is failing, the watchdog pulse is disturbed, and the ON time T ₁ or the OFF time T ₂ becomes larger or smaller than the above set value. . Therefore, when the on-time T ₁ or the off-time T _{2 of the} watch dog pulse does not fall between the predetermined lower limit value and upper limit value, it is determined that the CPUs 1 and 2 have failed.

Then, the W / D monitor 8 detects that the on-time T ₁ and the off-time T _{2 of the} watchdog pulse input via the line L ₈ or the line L ₁₀ are between predetermined lower and upper limits, respectively. if entered (the fail no) line L ₁₁ to 1 signal outputs (oN signal), if not contained between the other lower and upper limits (fail) line L ₁₁ to 0 signal (oFF signal) Output.

The output signal of the W / D monitor 8 is sent through the line L ₁₁ to the base 17 of the second NPN transistor 17.
sent to a. The other end of the line L ₁₁ is the vehicle body 10
A second resistor 16 (resistor) which is grounded to is connected to. This second transistor 17 is also used as a switch, and when a 1 signal (ON signal) is input to the base 17a, the electric resistance between the collector 17b and the emitter 17c becomes almost 0, and a 0 signal (OFF signal) is output. When input, the electric resistance between the collector 17b and the emitter 17c becomes ∞.

That is, when one signal (ON signal) is output from the W / D monitor 8, the second transistor 11
Is turned on, and the relay switch 15 is turned on. On the other hand, when the 0 signal (off signal) is output from the W / D monitor 8, the second transistor 1
7 is switched off and the relay switch 15
Turns off.

The failure determination method by the electronic control unit C or the operation when the failure determination is made will be described below. In the electronic control unit C,
The control calculation for controlling the ABS and the detection of the system abnormality other than the failure of the main CPU 1 itself are all performed by the main CPU 1, and the sub CPU 2 operates by the main CP.
Only the failure (failure) of U1 is detected.

In the electronic control unit C, the mutual output line L _{3 is} transmitted from the numerical value output section of the sub CPU 2 at a predetermined cycle.
The predetermined numerical value α is transmitted to the sub-calculation unit of the main CPU 1 via the, and at the same time, the numerical value α is also transmitted to the main calculation unit of the sub CPU 2. Here, the sub-calculation unit of the main CPU 1 performs the calculation using the numerical value α based on a predetermined calculation formula that is unrelated to the control calculation of the ABS. Here, the arithmetic expression is set as, for example, the following Expression 1.

[Equation 1] f (x) = (Ax + B) / C …………………………………………………… In Expression 1, A, B, and C are constants, and x is independent. Is a variable. Then, the sub-calculation unit of the main CPU 1 substitutes α for x on the right side of Expression 1, and obtains f (α) as the calculation result. After that, the calculation result f (α) calculated by the sub-calculation unit is transmitted to the failure determination unit of the sub CPU 2 via the mutual communication line L ₃ .

The main operation unit of the sub CPU 2 also substitutes α for x on the right side of Expression 1 to obtain f '(α) as the operation result.
Then, the calculation result f ′ (α) calculated by the main calculation unit is also sent to the failure determination unit of the sub CPU 2.

The failure determination unit of the sub CPU 2 is the main CP.
The calculation result f (α) of the sub-calculation unit of U1 is compared with the calculation result f ′ (α) of the main calculation unit of the sub CPU2. When the calculation results are different, the calculation result f (α) of the sub-calculation unit of the main CPU1 is compared. ) Is wrong. When such a discrepancy between the calculation result f (α) of the sub-calculation unit and the calculation result f ′ (α) of the main calculation unit continues for a predetermined number of times or more, the main CPU 1 fails (fails). It is determined that there is. It should be noted that when such a discrepancy occurs, it may be immediately determined that the main CPU 1 has failed.

Further, in the sub CPU memory 4, correct calculation values f "(α ₁ ), f" (α ₂ ) ... When x is a predetermined plurality of numerical values α ₁ , α ₂ ... It is also possible to map and store (memory) f "(αn) and compare the calculation result f (α) of the sub-calculation unit of the main CPU 1 with the calculated value of this map.

Specifically, any one of α ₁ to α n from the numerical value output unit of the sub CPU 2 to the sub operation unit of the memory CPU 1
(For example, α ₁ ) is transmitted to calculate f (α ₁ ), while the failure determination unit of the sub CPU 2 causes the sub CPU memory 4 to operate.
To call the correct calculated value f "(α ₁ ) corresponding to α ₁ ,
When the calculation result f (α ₁ ) of the sub calculation unit is compared with the correct calculation value f ″ (α ₁ ), and there is a discrepancy between them, the memory C
You may make it judge that the calculation result f ((alpha) ₁ ) of the sub-calculation part of PU1 is incorrect. By doing this, the sub-CP
Since it is not necessary to provide a main operation unit in U2, the sub CP
U2 is simplified.

When the failure determination unit of the sub CPU 2 determines that the main CPU 1 has failed, a 0 signal (OFF signal) is sent from the control unit of the sub CPU 2 to the AND circuit 6 via the line L _5. Is output. Therefore, regardless of the output signal of the main CPU 1,
Always 0 signal from AND circuit 6 to output interface 7
Therefore, the first transistor 11 is constantly switched off, the solenoid 13 is constantly demagnetized, the actuator 14 is deactivated, and the ABS stops operating. Therefore, the malfunction of the ABS is prevented.

When the failure determination section of the sub CPU 2 determines that the main CPU 1 has failed, the driver is notified of the occurrence of such failure by a warning light, a buzzer, or the like.

In parallel with the failure detection of the main CPU 1 by the sub CPU 2, the failure detection of the main CPU 1 and the sub CPU 2 is performed by the W / D monitor 8.

That is, the on-time T _{1 of the} watchdog pulse input to the W / D monitor 8 from the W / D output unit 1a of the main CPU 1 or the W / D output unit 2a of the sub CPU 2
Alternatively, when the off time T ₂ does not fall between the predetermined lower limit value and the predetermined upper limit value, the W / D monitor 8 determines that a failure has occurred in the main CPU 1 or the sub CPU 2. At this time, a 0 signal (OFF signal) is sent from the W / D monitor 8 to the second transistor 17 via the line L _11.
Is output. Therefore, the second transistor 17 is constantly switched off and the relay switch 15 is turned off. Therefore, the solenoid 13 is constantly demagnetized, the actuator 14 is deactivated, the ABS stops operating, and the malfunction of the ABS is prevented.

The W / D monitor 8 allows the main C
When it is determined that the PU 1 or the sub CPU 2 is failing, the driver is notified of the occurrence of such failing by a warning light, a buzzer, or the like.

As described above, in the first embodiment, the sub CPU 2 (4 bits) having a small operation capacity is used by the main CPU 1 (16 bits).
Since the bit (failure) is detected, it is not necessary to provide two main CPUs having a large calculation capacity as in the conventional electronic control unit, and therefore the structure of the electronic control unit C is simplified. And, the cost is greatly reduced. Further, the failure of the main CPU 1 is surely detected, and the reliability of the electronic control unit C is enhanced. In addition, a W / D monitor 8 is provided so that the main CPU 1
Further, since the failure (failure) of the sub CPU 2 is detected, the failure of the electronic control unit C is surely detected, and the reliability of the electronic control unit C is further enhanced.

<Second to Fifth Embodiments> The second to fifth embodiments will be described below with reference to FIGS. 2 to 5, but the second to fifth embodiments will be described.
Since the basic parts of the embodiment are common to those of the first embodiment shown in FIG. 1, in order to avoid duplication of description, the parts common to those of the first embodiment are designated by the same reference numerals as those of the first embodiment and their description is omitted. Will be omitted and only differences from the first embodiment will be described below.

As shown in FIG. 2, in the second embodiment, when the failure determination unit of the sub CPU 2 detects a failure of the main CPU 1, the W / D output unit 2a of the sub CPU 2 transfers the data to the W / D monitor 8. A predetermined fail signal is output. Here, the fail signal is, for example, a flat wave, that is, a signal whose on-time T ₁ is 0. Therefore, the W / D monitor 8 applies the output cut signal to the output interface 7 because the ON time T ₁ is less than the lower limit value. And the output interface 7
When an output cut signal is input to the output interface 7, a 0 signal (OFF signal) is constantly output from the output interface 7, the first transistor 11 is switched off, the actuator 14 is deactivated, and the ABS control is stopped. (See Figure 1).

As shown in FIG. 3, in the third embodiment, the output signal of the main CPU 1, that is, the control signal for ABS control is input to the sub CPU 2. Then, the sub CPU 2 determines that the main CPU 1 has failed when the output signal of the main CPU 1 suddenly changes or when the same state continues without changing for a predetermined time or longer. At this time, a predetermined fail signal (for example, a flat wave) is output from the W / D output unit 2a of the sub CPU 2 to the W / D monitor 8. Therefore, the W / D monitor 8 applies the output cut signal to the output interface 7. When the output cut signal is input to the output interface 7 in this way, the output interface 7 always outputs the 0 signal (OFF signal), and the first transistor 1
1 is switched off, the actuator 14 is deactivated, and the ABS control is stopped (see FIG. 1).

As shown in FIG. 4, in the fourth embodiment, the watchdog pulse output from the W / D output section 1a of the main CPU 1 is input to the sub CPU 2, and based on this watch dog pulse, the sub CPU 2 outputs the watch dog pulse. Whether or not the main CPU 1 has failed is determined. If the sub CPU 2 determines that the main CPU 1 is failing, a predetermined fail signal (for example, a flat wave) is output from the W / D output unit 2a of the sub CPU 2 to the W / D monitor 8. Therefore, the W / D monitor 8 applies the output cut signal to the output interface 7. When the output cut signal is input to the output interface 7 in this way, the output interface 7 always outputs a 0 signal (OFF signal), the first transistor 11 is switched off, and the actuator 14 is deactivated. Then, the ABS control is stopped (see FIG. 1).

As shown in FIG. 5, in the fifth embodiment, the presence / absence of a failure of the main CPU 1 is determined by the main CPU 1 itself based on the watchdog pulse of the main CPU 1. When it is determined that the main CPU 1 is failing, a predetermined fail signal (for example, from the W / D output unit 2a of the sub CPU 2 to the W / D monitor 8) (for example,
Flat wave) is output. Therefore, the W / D monitor 8
Applies an output cut signal to the output interface 7. When the output cut signal is input to the output interface 7 in this way, the output interface 7 always outputs the 0 signal (OFF signal), and the first transistor 1
1 is switched off, the actuator 14 is deactivated, and the ABS control is stopped (see FIG. 1).

[0047]

According to the first aspect of the present invention, since the failure of the main control means can be detected with a simple structure in which only one main control means is provided, the reliability of the electronic control unit can be improved. The electronic control unit can be simplified and the cost can be reduced.

According to the second aspect of the invention, since the failure of the main control means is detected by the sub-control means, only one large-capacity and expensive main control means need be provided, and the reliability of the electronic control unit can be improved. The electronic control unit can be simplified while being increased, and the cost thereof can be reduced.

According to the third invention, basically, the same operation and effect as those of the second invention can be obtained. Furthermore, since the failure of the main control means can be detected simply by causing the main control means to execute a simple calculation, the structure of the electronic control unit is further simplified.

According to the fourth invention, basically, the same operation and effect as those of the third invention can be obtained. Further, since it is determined that the main control means is out of order only after the calculation error is repeated a predetermined number of times, erroneous determination of failure is prevented and the stability of failure determination is enhanced.

According to the fifth invention, basically, the same operation and effect as any one of the second to fourth inventions can be obtained. Further, since the calculation capacity of the sub control means is set small, the electronic control unit is further simplified and made compact.

According to the sixth invention, basically the same action and effect as those of the third invention can be obtained. Furthermore, since the presence / absence of a failure in the main control means can be determined by a simple control logic that simply compares the calculation result of the sub-calculation unit and the calculation result of the main calculation unit, the electronic control unit is simplified.

According to the seventh invention, basically the same action and effect as any one of the third to fifth inventions can be obtained. Furthermore, since it is not necessary to provide the main calculation unit in the sub control means, the electronic control unit is further simplified.

According to the eighth invention, basically the same action and effect as any one of the third to seventh inventions can be obtained. Furthermore, with a simple configuration in which only the calculation result of the main control means is monitored, the failure of the main control means can be detected more reliably, and the reliability of the electronic control unit is further enhanced.

According to the ninth invention, basically, the same action and effect as any one of the third to seventh inventions can be obtained. Furthermore, with a simple configuration in which only the calculation result of the main control means is monitored, the failure of the main control means can be detected more reliably, and the reliability of the electronic control unit is further enhanced.

According to the tenth invention, basically the third to
The same action and effect as any one of the seventh inventions can be obtained. Further, since the sub control means is adapted to detect the presence / absence of failure of the main control means based on the watchdog pulse of the main control means, the configuration of the sub control means is simplified.

According to the eleventh invention, basically the third to
The same action and effect as any one of the seventh inventions can be obtained. Further, since the main control means is adapted to detect its own failure based on the watchdog pulse, the configuration of the sub control means is further simplified.

[Brief description of drawings]

FIG. 1 is a system configuration diagram of an electronic control unit showing a first embodiment of the present invention.

FIG. 2 is a system configuration diagram of an electronic control unit showing a second embodiment of the present invention.

FIG. 3 is a system configuration diagram of an electronic control unit showing a third embodiment of the present invention.

FIG. 4 is a system configuration diagram of an electronic control unit showing a fourth embodiment of the present invention.

FIG. 5 is a system configuration diagram of an electronic control unit showing a fifth embodiment of the present invention.

[Explanation of symbols]

C ... electronic control unit L ₃ ... intercommunication line 1 ... main CPU 2 ... sub CPU 8 ... watchdog pulse monitoring (W / D monitor) 14 ... actuator

Claims (11)

[Claims] 1. A predetermined numerical value is given to a main control means for controlling an object to be controlled, and the main control means is caused to perform an arithmetic operation using the numerical value based on a predetermined arithmetic expression irrelevant to a control arithmetic operation. A failure determination method for an electronic control unit, comprising determining whether the operation result is correct or incorrect, and determining that the main control means is out of order when the operation result is incorrect. 2. Main control means for controlling a controlled object,
A failure determination device for an electronic control unit, comprising: sub-control means for determining whether or not there is a failure in the main control means without controlling the controlled object. 3. A failure determination device for an electronic control unit according to claim 2, wherein the main control means has a control calculation unit for performing a control calculation for controlling a control target, and is independent of the control calculation. A sub-calculation unit capable of performing a calculation using a predetermined calculation formula is provided, and the sub-control unit has a numerical value output unit for outputting a predetermined numerical value to the sub-calculation unit and a failure of the main control unit. A failure determination unit for determining the presence / absence is provided, and the sub-operation unit of the main control means performs an operation using the numerical value input from the numerical value output unit, and then outputs the operation result to the failure determination unit. The failure determination unit of the sub-control unit determines whether the operation result input from the sub-operation unit is correct, and when the operation result is incorrect, it is determined that the main control unit is out of order. Specially Failure determination device for an electronic control unit according to. 4. The failure determination device for an electronic control unit according to claim 3, wherein the failure determination unit fails the main control unit when the operation result input from the sub-operation unit is erroneous a predetermined number of times or more. A failure determination device for an electronic control unit, wherein the failure determination device is configured to determine that it is operating. 5. The failure determination device for an electronic control unit according to claim 2, wherein the computing capacity of the sub control means is set smaller than the computing capacity of the main control means. An electronic control unit failure determination device characterized by the above. 6. The failure determination device for an electronic control unit according to claim 3, wherein the sub-control means is provided with a main arithmetic unit capable of performing arithmetic operation using the same arithmetic expression as the sub-arithmetic unit. In addition, the numerical output unit outputs a predetermined numerical value to the sub-calculation unit and the main calculation unit, and the main calculation unit of the sub-control means performs calculation using the numerical value input from the numerical output unit. After that, the operation result is output to the failure determination section, and the failure determination section of the sub-control means compares the operation result input from the sub operation section with the operation result input from the main operation section. However, when the two calculation results are different, it is determined that the main control means is out of order. 7. The failure determination device for an electronic control unit according to claim 3, wherein the failure determination unit of the sub-control means has a predetermined numerical value based on the predetermined arithmetic expression. Is provided with a map of the correct answer when the calculation is performed using, and the correctness of the calculation result of the sub-calculation unit is judged by comparing the calculation result input from the sub-calculation unit with the map. A failure determination device for an electronic control unit, characterized in that 8. The failure determination device for an electronic control unit according to any one of claims 3 to 7, wherein the failure determination section of the sub-control means is an operation result in the control operation section of the main control means. A failure determination device for an electronic control unit, characterized in that it is configured to determine that the main control means has failed even when a sudden change occurs. 9. The failure determination device for an electronic control unit according to any one of claims 3 to 7, wherein the failure determination section of the sub-control means is a calculation result in the control calculation section of the main control means. A failure determination device for an electronic control unit, characterized in that it is determined that the main control means is in failure even when the same state continues. 10. The failure determination device for an electronic control unit according to any one of claims 3 to 7, wherein the sub-control means monitors the watchdog pulse of the main control means and detects the disturbance of the watchdog pulse. A failure determination device for an electronic control unit, which is characterized in that the main control means is also determined sometimes. 11. The failure determination device for an electronic control unit according to claim 3, wherein the main control means monitors the watchdog pulse of itself and detects the disturbance of the watchdog pulse. A failure determination device for an electronic control unit, characterized in that it determines that the control means has failed.