JP2003137045A - Vehicle electronic control unit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect communication abnormality of a control CPU with high accuracy in a vehicle electronic control unit with the control CPU and a monitor CPU. SOLUTION: This engine ECU 10 has the control CPU 11 executing various kinds of vehicle control; and the monitor CPU 12 communicably connected to the control CPU 11, monitoring operation of the control CPU 11. The monitor CPU 12 does not have a reception interrupt function and sends data back to the control CPU 11 in synchronization with data transmission from the control CPU 11. The control CPU 11 transmits data together with communication- monitoring data different from data in the preceding transmission every time transmitting data to the monitor CPU 12, while the monitor CPU 12 decides the communication abnormality according to whether the communication- monitoring data is updated or not.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a control CPU for executing various vehicle controls and a monitoring C for monitoring the control CPU.
The present invention relates to a vehicle electronic control device including a PU.

[0002]

2. Description of the Related Art As an electronic control unit (engine ECU) for a vehicle that controls an on-vehicle engine, an injection / ignition control CPU for performing injection control and ignition control, and a throttle control for performing electronic throttle control. CPU
A configuration having two CPUs consisting of and is known.

On the other hand, in recent years, the engine control (injection / ignition control) and the electronic throttle control, which have been realized by using two CPUs in the past, are constituted by one control CPU due to the high function and large capacity of the CPU. However, it is possible to reduce the cost of the engine ECU. 1 CP like this
In the engine ECU having the U configuration, a monitor CPU for monitoring the state of electronic throttle control is separately required. In this case, since the monitoring CPU is dedicated to monitoring and has a low function (inexpensive), a configuration capable of accurately detecting the communication abnormality of the control CPU is desired as the monitoring CPU. In particular, when the control CPU side has all the initiative and the monitoring CPU side sends back data in hardware in synchronization with the data transmission from the control CPU, the monitoring CPU does not have the reception interrupt function and the communication error of the control CPU occurs. Difficult to detect.

[0004]

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and it includes a control CPU and a monitoring CP.
In a vehicle electronic control device including U, a control CPU
It is an object of the present invention to provide a configuration capable of accurately detecting the communication abnormality of.

[0005]

According to a first aspect of the present invention, the control CPU executes various vehicle controls, and the monitoring CPU
Monitors the operation of the control CPU. In addition, the control CPU is
Each time data is transmitted to the monitoring CPU, data for communication monitoring different from that at the time of the previous transmission is attached and data is transmitted.
The PU determines a communication abnormality depending on whether or not the communication monitoring data has been updated. The communication monitoring data is preferably a counter value updated each time data is transmitted (claim 2). For example, when the communication from the control CPU to the monitoring CPU is stopped, the communication monitoring data in the monitoring CPU remains unchanged, so that the communication abnormality of the control CPU can be detected. As a result, in the vehicle electronic control device including the control CPU and the monitoring CPU, the communication abnormality of the control CPU can be accurately detected.

In particular, as described in claim 3, the monitoring CP
When U does not have the reception interrupt function and returns data to the control CPU in synchronization with data transmission from the control CPU,
It becomes difficult to detect an abnormality in the control CPU depending on the presence or absence of data reception. On the other hand, by using the inventions of claims 1 and 2, the abnormality of the control CPU can be easily detected from the communication monitoring data. In this case, it is possible to use a low-performance monitoring CPU, and it is possible to realize cost reduction.

According to the invention described in claim 4, the monitoring CPU
Periodically monitors the communication monitoring data, and when the current value and the previous value of the data match, it is determined that the communication from the control CPU is stopped. According to this configuration,
When the monitoring CPU cannot correctly receive the data, it is possible to determine whether the abnormality is due to the communication stop or the communication data abnormality.

In the invention described in claim 5, the monitoring CPU
Permits the fetching of the received data only when the current value and the previous value of the communication monitoring data do not match. According to this configuration, for example, when the same data is repeatedly received, whether the same data is actually received correctly,
Alternatively, it can be determined whether the communication is defective.

According to a sixth aspect of the present invention, when the communication monitoring data is not updated for a predetermined time or more, a communication abnormality is determined, and the time interval at which the control CPU transmits data to the monitoring CPU is T1. , The monitoring CPU is T1 ≧
The communication monitoring data is monitored at a time interval T2 that satisfies T2. In this case, since the monitoring interval of the communication monitoring data is shorter than the data transmission cycle, it is possible to reliably detect anomalies in which the communication monitoring data remains unchanged, and the time until the detection of a communication error is inadvertently lengthened. It can be avoided.

In the invention according to claim 7, the monitoring C
When detecting a communication abnormality based on the communication monitoring data, the PU stores and holds that fact in the backup memory, and when the communication abnormality is detected a predetermined number of times, finally determines that there is a communication abnormality. In this case, erroneous detection of communication abnormality can be prevented.

According to the eighth aspect of the present invention, the communication data is divided into two, and the control CPU is an electronic control unit for a vehicle which alternately transmits the two-divided communication data to the monitoring CPU. When one of the data is transmitted, the monitoring CPU simply updates the communication monitoring data.
To the monitoring CPU without updating the communication monitoring data when transmitting the other data. In short, when the amount of communication data is large, the communication data is divided and transmitted, but in such a case, one of the divided communication data is stopped from being transmitted, and the same data is continuously monitored by the monitoring CPU. Anomaly sent to According to the invention of claim 8, at the time of occurrence of this abnormality, no matter which data transmission is stopped, the fact that the abnormality has occurred can be reliably detected based on the communication monitoring data.

[0012]

BEST MODE FOR CARRYING OUT THE INVENTION (First Embodiment) A first embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 shows an engine E according to this embodiment.
It is a block diagram which shows the structure of CU. In FIG. 1, an engine ECU 10 is a control CPU 11 for executing engine injection control, ignition control, and electronic throttle control.
A monitoring CPU 12 for performing monitoring control related to electronic throttle control, and a WD circuit 13 for monitoring the operation of the control CPU 11. The control CPU 11 and the monitoring CPU 12 are connected so that they can communicate with each other. The control CPU 11 inputs the throttle opening and the accelerator opening via the A / D converter 14,
Engine operation information such as the intake pipe pressure is input at any time, and the drive of a fuel injection valve, an igniter, and a throttle actuator (not shown) is controlled based on the operation information. The throttle opening and accelerator opening A / D values are monitored C
It is also input to the PU 12.

Communication between the control CPU 11 and the monitoring CPU 12 is performed by a so-called CSI (Clocked Serial Interface).
A method is adopted, and data is transmitted and received between the CPUs 11 and 12 in clock synchronization. In this case, CS
In the I method, transmission and reception are not independent, and the monitoring CPU
12 is when the clock and data come from the control CPU 11,
The hardware is configured to send back data to the control CPU. That is, the monitoring CPU 12 does not have the reception interrupt function.

The control CPU 11 carries out monitoring control for monitoring the operation of the monitoring CPU 12. That is, the monitoring CPU 12 outputs a WD pulse that is inverted at a predetermined cycle to the control CPU 11, and the control CPU 11 monitors the monitoring CP.
When the WD pulse from U12 is not inverted for a predetermined time or longer, a reset signal is output to the monitoring CPU 12. Alternatively, the control CPU 11 outputs a reset signal to the monitoring CPU 12 when data is not normally received from the monitoring CPU 12.

Further, the control CPU 11 is a monitoring CPU 12
Data regarding throttle control such as throttle opening, accelerator opening, fail-safe execution flag, etc. is transmitted to the. At this time, the monitoring CPU 12 performs the throttle control monitoring processing, for example, data of the throttle opening and accelerator opening input through the A / D converter 14 and the control C.
Similarly, the throttle opening and accelerator opening data received from the PU 11 are compared with each other, and an abnormality in the throttle control state is detected depending on whether or not they match. Then, the monitoring result is returned to the control CPU 11.

Further, the control CPU 11 is a monitoring CPU 12
In accordance with the monitoring result in (3), a predetermined fail-safe process is executed when the throttle control abnormality occurs. Specifically as fail-safe processing, evacuation traveling of the vehicle (limp home)
In order to realize the above, a cylinder cut-off control that suspends fuel injection in some cylinders, an ignition retard control that retards the ignition timing, and the like are performed.

Further, the control CPU 11 outputs a WD pulse which is inverted at a predetermined cycle to the WD circuit 13. WD
The circuit 13 outputs a reset signal to the control CPU 11 when the WD pulse from the control CPU 11 has not been inverted for a predetermined time or longer.

In this embodiment, in particular, the monitoring CPU 12 can directly reset the control CPU 11, and when the communication with the control CPU 11 is not performed correctly, the monitoring CPU 12 sends a reset signal to the control CPU 11. Is output. Further, in this configuration, the WD circuit 13
The reset signal from the monitoring CPU 12 is loaded into the reset terminal for loading the reset signal from the. As a result, when a reset signal is input to the control CPU 11 from either the WD circuit 13 or the monitoring CPU 12, the control CPU 11 is reset by the reset signal, and the monitoring CPU 12 is simultaneously reset by the control CPU 11.

Next, details of inter-CPU communication between the control CPU 11 and the monitoring CPU 12 will be described. 2 and 3 are flowcharts showing the processing of the control CPU 11, and FIG. 4 is a flowchart showing the processing of the monitoring CPU 12. In the present embodiment, the control CPU 11 is 4 m in FIG.
Periodically (4 m
Data is transmitted every sec), and the reception completion processing shown in FIG. 3 is executed by a reception interrupt. Also, the monitoring CPU 12
Determines whether or not there is a communication abnormality of the control CPU 11 by the 2 msec processing of FIG. Hereinafter, the processes of FIGS. 2 to 4 will be sequentially described.

In the 4 msec process (FIG. 2) by the control CPU 11, first, in step 101, the communication number counter CMS as "data for communication monitoring" is incremented by one, and in step 102, the data is transmitted to the monitoring CPU 12. . At this time, data transmission is performed by adding the communication counter CMS. After that, in step 103, the communication stop time counter CS1 is incremented by 1, and in subsequent step 104, it is determined whether or not the communication stop time counter CS1 becomes larger than a value corresponding to a predetermined time (a value corresponding to 48 msec in the present embodiment). To determine. In the case of YES, it is considered that there is a communication error in the monitoring CPU 12, and in step 105 the communication error flag XNG1
Turn on. Further, in step 106, the reception data abnormality number counter CE1 is set to a predetermined number (2 in the present embodiment).
(0 times). If CE1> 20 times, it is considered that there is a communication abnormality in the monitoring CPU 12, and the communication abnormality flag XNG1 is turned on in step 107.

After that, in step 108, it is determined whether or not the communication abnormality flag XNG1 is ON. XNG1
= ON, the process proceeds to step 109 to output a reset signal to the monitoring CPU 12 to reset the CPU 12.

In the reception completion process (FIG. 3) by the control CPU 11, the communication stop time counter CS1 is cleared to 0 in step 201, and in step 202,
It is determined whether the received data is abnormal. At this time,
Abnormality detection of received data is performed by a well-known sum check, parity check, or the like. If the received data is normal, the routine proceeds to step 203, where the received data abnormality number counter CE1 is cleared to zero. If the received data is abnormal, the routine proceeds to step 204, where the received data abnormal number counter CE1 is incremented by 1.

On the other hand, in the 2 msec process (FIG. 4) by the monitoring CPU 12, first, at step 301, it is judged if the current value of the communication counter CMS and the previous value +1 match. If they match, go to step 302,
The communication stop time counter CS2 is cleared to 0, and when they do not match, the process proceeds to step 303, and the communication stop time counter C
Increment S2 by 1. Then step 304
Then, the current value of the communication counter CMS is updated as the previous value.

At step 305, the communication suspension time counter CS2 indicates a value corresponding to a predetermined time (100 in the present embodiment).
It is determined whether or not the value is larger than (a value corresponding to msec). In the case of YES, it is considered that the communication of the control CPU 11 is abnormal, and the communication abnormality flag XNG2 is set to O in step 306.
N

After that, in step 307, it is determined whether or not the received data is abnormal by a sum check, a parity check, or the like. If the received data is normal, step 30
In step 8, the reception data abnormality number counter CE2 is cleared to 0. If the received data is abnormal, step 309
Then, the received data abnormality number counter CE2 is incremented by 1. Further, in step 310, it is determined whether or not the reception data abnormality number counter CE2 is larger than a predetermined number (20 times in the present embodiment). CE2> 20
If it is, it is considered that the control CPU 11 has a communication error,
In step 311, the communication error flag XNG2 is turned on.

Then, in step 312, it is determined whether or not the communication abnormality flag XNG2 is ON. XNG2
= ON, the process proceeds to step 313, a reset signal is output to the control CPU 11, and the CPU 11 is reset.

FIG. 5 is a time chart for explaining the processes of FIGS. 2 to 4 more specifically. In FIG. 5, (a) shows the operation of the control CPU 11, and (b) shows the monitoring C.
The operation of the PU 12 is shown, and further, a state in which no communication abnormality occurs before the timing t1 and a state after the communication abnormality occurs after the timing t1 are shown. Note that FIG. 5 exemplifies an abnormality when communication from the control CPU 11 to the monitoring CPU 12 is interrupted.

In the control CPU 11, the communication number counter CMS is incremented every 4 msec. On the other hand, the monitoring CPU 12 monitors the value of the communication number counter CMS at a cycle of 2 msec. In this case, since the monitoring CPU 12 correctly receives the CMS operation in the control CPU 11 before the timing t1, the communication stop time counter CS2 only repeats the values of 0 and 1, and the communication abnormality flags XNG1 and XNG2 are set in this period. It is kept off.

When the communication from the control CPU 11 to the monitoring CPU 12 is interrupted at timing t1, the monitoring CPU 12 cannot receive communication data. Therefore, the count-up operation of the communication counter CMS in the monitoring CPU 12 is stopped, and instead, the communication stop time counter CS2 is counted up. Then, the communication stop time counter CS
2 reaches a value equivalent to 100 msec (timing t
2) The communication abnormality flag XNG2 is turned on, and the control CPU 11 is reset by the monitoring CPU 12 accordingly. When the control CPU 11 is reset, the control CPU
The monitoring CPU 12 is also reset by 11. When the CPUs 11 and 12 are restarted after the reset, the counters and the like are initialized.

Here, each CPU 11, 12 is provided with a standby RAM as a backup memory, and the communication abnormality flags XNG1, XNG2 are stored in this standby RAM. Therefore, the states of the communication abnormality flags XNG1 and XNG2 are retained even after the reset.
Then, when the communication abnormality by the communication counter CMS is detected again, it is finally determined that the communication is abnormal, and a warning lamp or the like warns the user of the occurrence of the abnormality. In addition,
The configuration may be such that, when the communication abnormality is detected three times or more, the communication abnormality is finally determined.

According to this embodiment described in detail above, the following effects can be obtained. The monitoring CPU 12 determines whether the communication counter CMS (communication monitoring data) transmitted from the control CPU 11 is updated.
Since the communication abnormality of No. 1 is determined, the abnormality determination can be performed easily and accurately. In particular, even if the monitoring CPU 12 does not have the reception interrupt function, the abnormality of the control CPU can be detected. In this case, the low-performance monitoring CPU 1
2 can be used, and cost reduction can be realized.

Further, since the monitoring interval (2 msec) of the communication number counter CMS is shorter than the data transmission cycle (4 msec), an abnormality that the communication number counter CMS does not change can be surely detected without fail, and the time until the communication abnormality is detected. It is possible to avoid the situation where it is lengthened carelessly.

Further, when an abnormality occurs in which data cannot be correctly received by the monitoring CPU 12, it is possible to determine whether the abnormality is due to communication stop or communication data abnormality. That is, when the current value and the previous value of the communication number counter CMS match, it can be determined that there is an abnormality due to the communication stop from the control CPU 11. In this case, finer control can be realized according to the abnormal state, such as initializing only the block related to the abnormal data.

Further, the communication abnormality detection result (flag information X
NG1, XNG2) is stored and held in the standby RAM,
When the communication abnormality reaches a predetermined number of times, the communication abnormality is finally determined, so that it is possible to prevent erroneous detection of the communication abnormality.

(Second Embodiment) Next, a second embodiment of the present invention will be described focusing on the differences from the above-described first embodiment. In the present embodiment, when the communication data amount is large and the communication is performed twice (communication A and communication B), the communication number counter CMS is updated only in either communication A or communication B. Further, originally, in the configuration in which the communication A and B are alternately performed, when only one of the communication A and B is continuously performed, the abnormality is detected by the process of FIG.

In FIG. 6, the communication data is transmitted to the communication A and the communication B.
It is a flowchart which shows the periodical data transmission process in the case of division. In FIG. 6, (a) shows a 4 msec process for performing communication A, and (b) shows a 4 msec process for performing communication B, and these processes are alternately performed at equal intervals. Further, each of these processes is replaced with FIG. 2 and is executed by the control CPU 11, and the processes after step 103 are based on FIG. Since the processing of the monitoring CPU 12 uses the processing of FIG. 4 as it is, the description thereof is omitted here.

In FIG. 6A, the communication counter CMS is incremented by 1 in step 401, and in step 402, data a is transmitted to the monitoring CPU 12 as communication A. At this time, only the data a is transmitted without adding the communication counter CMS. The steps after step 103 are as described above.

On the other hand, in FIG. 6B, step 50
In 1, data b is sent to the monitoring CPU 12 as communication B.
To send. At this time, the communication number counter CMS incremented in FIG. 6A is added and the data b is transmitted. The steps after step 103 are as described above.

FIG. 7 is a time chart for explaining the process of FIG. 6 more concretely, and FIG. 7 shows a basic operation when communication is normal. (A) of the figure shows the control CPU 1
1 shows the operation at 1, and (b) shows the operation at the monitoring CPU 12.

In FIG. 7, the control CPU 11 to the monitoring CPU
Data a and data b are alternately transmitted to 12 in a constant cycle. At this time, the communication counter CMS is counted up when transmitting the data a, and the counter CMS is transmitted to the monitoring CPU 12 when transmitting the data b. In the monitoring CPU 12, the communication counter CMS is repeatedly held and counted up each time the data a and b are received, and the communication stop time counter CS2 repeats the value of 0 and 1 accordingly. Therefore, the communication abnormality flag XNG2 is never turned ON.

Further, FIG. 8 shows an abnormality in which communication A continues, and FIG.
[Fig. 4] is a time chart for explaining respective abnormalities of continuous communication B. In the figure, (a) shows the operation of the control CPU 11, and (b) shows the operation of the monitoring CPU 12.

In FIG. 8, the data a is continuously transmitted from the control CPU 11, and the communication counter CMS is incremented on the control CPU 11 side each time. However, since the communication B is not executed, the CMS value is not transmitted to the monitoring CPU 12. At this time, the monitoring CPU 12
Since the value of the communication number counter CMS remains unchanged, the communication suspension time counter CS2 is gradually counted up.
Therefore, the communication error flag XNG2 is turned on when the CS2 value reaches the predetermined value.

On the other hand, in FIG. 9, the data b is continuously transmitted from the control CPU 11, and the value of the communication counter CMS on the control CPU 11 side becomes unchanged. At this time, the monitoring CP
In U12 as well, the value of the communication counter CMS remains unchanged, so that the communication suspension time counter CS2 is gradually incremented. Therefore, the communication error flag XNG2 is turned on when the CS2 value reaches the predetermined value.

As described above, according to the present embodiment, the communication error can be reliably detected by the communication counter CMS regardless of whether the communication A or the communication B divided into two is disconnected. Further, in this case, the communication number counter CMS is incremented only for one of the communications A and B, so that each CPU
The load on 11 and 12 is reduced.

The present invention can be embodied in the following modes other than the above. In the monitoring CPU 12, the reception data is permitted only when the current value and the previous value of the communication counter CMS (data for communication monitoring) do not match. According to this configuration, for example, when the same data is repeatedly received, it is possible to determine whether the same data was actually received correctly or the communication was defective. Also,
When the same data is transmitted n times from the control CPU 11, it may be determined whether or not the communication counter CMS has been updated n times, and the communication abnormality may be determined.

In the above embodiment, the communication count counter CMS is used as the "communication monitoring data", and the communication abnormality of the control CPU 11 is detected by the counter CMS.
Other configurations such as using flag information may be used as the “communication monitoring data”. Further, when the communication counter CMS is used, it is possible to appropriately change the width of updating the counter value. The point is that the communication monitoring data may be configured so as to change with each communication.

In the above embodiment, the detection result (flag information XNG1, XNG2) of the communication abnormality is stored in the standby RAM.
However, the configuration may be eliminated and a user may be alerted to the occurrence of an abnormality by a warning lamp or the like each time a communication abnormality is detected.

In the above embodiment, when the monitoring CPU 12 detects the communication abnormality of the control CPU 11, the monitoring CPU 12
Although the configuration is such that 12 resets the control CPU 11, the configuration can be changed. For example, the monitoring CPU 12 may notify the control CPU 11 side when the control CPU 11 has a communication error.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing an outline of an engine ECU according to an embodiment of the invention.

FIG. 2 is a flowchart showing a 4 msec process by a control CPU.

FIG. 3 is a flowchart showing a reception completion process by the control CPU.

FIG. 4 is a flowchart showing 2 msec processing by the monitoring CPU.

FIG. 5 is a time chart specifically showing a communication operation.

FIG. 6 is a flowchart showing a 4 msec process by the control CPU.

FIG. 7 is a time chart specifically showing a communication operation.

FIG. 8 is a time chart specifically showing a communication operation.

FIG. 9 is a time chart specifically showing a communication operation.

[Explanation of symbols]

10 ... Engine ECU, 11 ... Control CPU, 12 ... Monitoring CPU.

Claims (8)

[Claims] 1. A control CPU for executing various vehicle controls,
The control CPU is communicably connected to the control CPU.
In the vehicle electronic control device including the monitoring CPU that monitors the operation of the control CPU, the control CPU transmits data with communication monitoring data different from the previous transmission every time data is transmitted to the monitoring CPU. The electronic control device for a vehicle, wherein the CPU determines a communication abnormality based on whether or not the communication monitoring data is updated. 2. The electronic control unit for a vehicle according to claim 1, wherein the communication monitoring data is a counter value that is updated each time data is transmitted. 3. The monitoring CPU does not have a reception interrupt function,
3. The vehicle electronic control device according to claim 1, wherein data is returned to the control CPU in synchronization with data transmission from the control CPU. 4. The monitoring CPU periodically monitors the communication monitoring data, and when the current value and the previous value of the data match, it is determined that the communication from the control CPU is stopped. The vehicle electronic control device according to any one of 1 to 3. 5. The vehicle electronic control according to claim 1, wherein the monitoring CPU permits the reception data to be taken in only when the current value and the previous value of the communication monitoring data do not match. apparatus. 6. When the communication monitoring data is not updated for a predetermined time or more, a communication abnormality is determined, and when the time interval at which the control CPU transmits data to the monitoring CPU is T1, the monitoring CPU has T1 ≧ T2. Time interval T2 that satisfies
6. The data for monitoring communication is monitored by
An electronic control unit for a vehicle according to any one of 1. 7. The monitoring CPU stores and retains a communication abnormality in the backup memory when the communication abnormality is detected based on the communication monitoring data, and when the communication abnormality is detected a predetermined number of times, finally determines the communication abnormality. The electronic control unit for a vehicle according to any one of claims 1 to 6. 8. An electronic control unit for a vehicle, wherein communication data is divided into two, and the control CPU alternately transmits the divided communication data to the monitoring CPU. One of the two divided communication data is transmitted. At the time of transmission, only the communication monitoring data is updated and is not transmitted to the monitoring CPU. At the time of transmitting the other data, the communication monitoring data is not updated and the monitoring CPU is not updated.
The electronic control unit for a vehicle according to any one of claims 1 to 7, which is transmitted to