JP2003267205A - Microcomputer monitoring circuit of electronic control device for controlling on-vehicle system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a monitoring circuit of a simple configuration to monitor any malfunction caused by abnormality of a control signal which cannot be detected by the monitoring of the operation by a watchdog pulse WDP signal synchronous to the operational period of a microcomputer to control an actuator of a hydraulic circuit to operate a wheel brake of a car. <P>SOLUTION: Operations by various operation programs are performed from detection signals from various sensors, and the control signal based on the operations is output. A monitoring circuit 12 to monitor the operation of the microcomputer is connected to the microcomputer Mc used as an operation control circuit 11 to control solenoid valves 15 (15T, 15A, 15K and 15G). The monitoring circuit 12 includes a watchdog monitoring circuit to monitor the operation by the watchdog pulse WDP signal and a control signal time monitoring circuit to monitor abnormality of a control operational condition by the microcomputer. The control signal time monitoring circuit detects abnormality by detecting that the operational condition is continued over a predetermined time to continue the operational condition set by the combination of the solenoid valves. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a microcomputer monitoring circuit of an on-vehicle control electronic control device for monitoring a failure of a microcomputer used in the on-vehicle control electronic control device during runaway.

[0002]

2. Description of the Related Art An electronic control unit for vehicle-mounted control plays an important role as a device that controls functions related to running of an automobile such as antilock control (ABS), brake assist control (BA), and vehicle running stability control (ASC). To fulfill. The microcomputer used in such a control device may lead to a serious situation if control is continued with a failure or a runaway. Therefore, in general, an external monitoring circuit (watchdog circuit) is provided outside for monitoring. I am trying to do it. A watchdog pulse WDP synchronized with the program cycle of various arithmetic programs executed in the microcomputer is sent to the external monitoring circuit, and monitoring is performed by measuring the cycle and timing of the pulse signal.

Japanese Patent Laid-Open No. 6-119210 discloses an example in which such an external monitoring circuit is provided for two sets of microcomputers so as to cross each other for monitoring. It is said that the method of measuring and monitoring WDP by such an external monitoring circuit can be sufficiently dealt with by providing one external monitoring circuit for one microcomputer from the viewpoint of improving the reliability of the microcomputer and reducing the cost thereafter. However, the method of monitoring by measuring WDP has been inherited as it is.

On the other hand, as a control device for performing the ABS control and the vehicle running stability control (ASC), a predetermined brake pressure is sent to the wheel cylinders for pressurization by using the hydraulic pressure generated in the master cylinder by the depression force of the brake pedal. ,
In order to reduce pressure, solenoid valves for pressurization and pressure reduction are provided in the hydraulic circuit, and a cut valve (solenoid valve) is provided in the path from the master cylinder to the solenoid valve for pressurization to increase and decrease pressure from the hydraulic pump. A hydraulic circuit is known in which the hydraulic circuit is used. The cut valve of this hydraulic circuit is used not only during ABS control but also during brake assist control (BA) to assist the lack of pedaling force during sudden braking and during ASC control to ensure stable driving when the steering wheel is being operated. Is also provided for closing the hydraulic pressure line from the master cylinder to prevent the pump hydraulic pressure from escaping to the master cylinder.

A voltage is applied to the electromagnetic coil of the cut valve according to a command from the microcomputer of the electronic control unit, or a voltage is shut off to open or close the cut coil. Therefore, the cut valve is called a T-switch (T-sw). I'm out. The cut valve is set to be opened during normal traveling and closed by being applied with a voltage, for example, during BA or ASC control. During BA control operation, the signal from the pressure sensor that detects the oil pressure in the path from the master cylinder to the cut valve is used to
At the time of control, the closing operation is performed based on signals from the acceleration sensor (G-sensor), the yaw sensor, and the like in addition to the pressure sensor.

[0006]

By the way, in the above electronic control unit, various calculations are performed by a calculation program in the microcomputer based on the detection signals from the G-sensor, yaw sensor, speed sensor, pressure sensor and the like.
Although BS control, BA control, ASC control, etc. are performed, especially in the pressure control during ASC control, if erroneous pressure is applied, a yaw moment may be generated in the vehicle, which may lead to vehicle body spin in the worst case. . When the steering wheel is operated during traveling, the ASC control applies pressure to any one of the four wheels and applies a brake to make the bending operation easier to bend within a range that does not cause discomfort, and enables stable traveling. Pressurization time is very short.

However, if this pressurizing operation is erroneously applied for a longer time than necessary, the above-mentioned inconvenience occurs. For this reason, the external monitoring circuit measures the WDP signal to monitor whether erroneous pressurization due to such a microcomputer runaway has occurred. However, as a cause of such erroneous pressurization, the WDP signal itself is output to the normal side even if the microcomputer of the electronic control circuit is abnormal due to some electrical failure, and the state continues more than necessary. However, the conventional external monitoring circuit cannot detect such a case because such a case is not assumed.

In view of the above problems, the present invention is simple even if the watchdog pulse WDP signal is normal, but an abnormality occurs in the control operation by the control signal from the microcomputer to the solenoid valve which is the actuator. An object of the present invention is to provide a microcomputer monitoring circuit of an on-vehicle control electronic control device that can detect an abnormal operation of a microcomputer at an economical cost by including a monitoring circuit.

[0009]

According to the present invention, as means for solving the above problems, an electronic control device using a microcomputer for sending control signals to a plurality of actuators to be controlled is synchronized with a calculation by a calculation program. A monitoring circuit is connected to the microcomputer that outputs the periodic watchdog pulse WDP signal, and this monitoring circuit connects the watchdog monitoring circuit that measures the pulse period and pulse width of the WDP signal to the actuator based on the calculation of the microcomputer. And a control signal time monitoring circuit for monitoring a predetermined control operation state by the control signal of
Regardless of the normal reception of the WDP signal by the watchdog monitoring circuit, the control signal time monitoring circuit detects a control abnormality of the microcomputer by detecting that the control operation state by the microcomputer continues for a predetermined time or more which should not be maintained. The microcomputer monitoring circuit of the on-vehicle control electronic control device is characterized in that the detection is performed. The microcomputer monitoring circuit can be configured with hardware and / or software as described later.

In the microcomputer monitoring circuit of the on-vehicle control electronic control device having the above-mentioned configuration, even if the watchdog pulse WDP signal output by the microcomputer is normal, the control operation state is abnormal due to a failure of the arithmetic program or the like. To detect. The watchdog monitoring circuit included in the monitoring circuit constantly monitors the WDP signal that is synchronized with the signal serving as the reference for the calculation of the calculation program. Even if this WDP signal is normal, if an abnormality occurs in the control operation state due to some failure, the control signal time monitoring circuit detects such an abnormality.

A monitor signal from the actuator is input to the control signal time monitoring circuit, and the control operation state is monitored based on these signals.
Abnormality in such a control operation state, for example, in the vehicle stability control (ASC) for controlling the wheel brakes of an automobile, when the solenoid valve of the actuator is opened / closed to control the pressure of the brake cylinder, the pressure control passes a predetermined time. However, an abnormal operation may occur such that the reduced pressure state is not restored.

With regard to such an operation abnormality, since the control signal time monitoring circuit is configured so as to judge that the operation state of the solenoid valves is abnormal when the operation state continues for a predetermined time or more, When the continuation of the predetermined time or more is detected, an abnormal signal is output. When this abnormal signal is output, the control by the microcomputer is desensitized, or the solenoid valve is turned off by the fail-safe relay to return to the normal braking state, that is, the state of braking with the foot brake, to ensure safety. To do.

[0013]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is an overall block diagram of an electronic control circuit that controls an actuator of a hydraulic circuit that operates a wheel brake of an automobile. As shown, the electronic control circuit includes a control unit 10 including a main control unit and a sub control unit.
Specifically, based on the detection signals from the wheel speed sensors S _{1 to} S ₄ and the combine sensor Cs, ASC control and BA
An arithmetic control circuit 11 that is a main control unit that performs various logical operations for control, antilock control (ABS), etc., and outputs a control signal, and a sub that monitors the arithmetic operation and control operation of the arithmetic control circuit 11. The monitoring circuit 12 is a control unit. Although the monitoring circuit 12 is described here as an example having a software program configuration, it may have a hardware configuration instead of the software configuration, and the hardware configuration will be described later as a modified example.

The arithmetic control circuit 11 of the main control section is a single controller.
The micro computer Mc is used and its fixed storage unit
(ROM) ASC control, ABS control, BA control, etc.
Various control programs are stored in the temporary storage unit (RA
M) is a wheel speed sensor S₁~ S _Four, Combine sensor C
s, the detection signal from the pressure sensor Ps, etc. is input,
In various control programs based on these data
To store and hold the data necessary for the logical operation to be performed
It has the necessary memory.

The combine sensor Cs is a sensor in which a G sensor (acceleration sensor), a lateral G sensor (same), and a yaw rate sensor (swing angle sensor) are integrally formed, and respective detection signals are individually supplied to the microcomputer Mc. Sent to. Although not shown, the microcomputer M
c is provided with a single reference oscillator, is provided with an output terminal for performing various logical operations using a predetermined frequency signal of the oscillator as a reference clock signal, and outputting a watchdog pulse WDP signal synchronized with the operation cycle, It outputs the WDP signal for monitoring at.

The monitoring circuit 12 of the sub-control unit includes an auxiliary circuit 12d for sending a control signal to a drive circuit of a motor for driving a hydraulic pump of a hydraulic control circuit, which will be described later, and a fail safe relay 1.
7 includes a circuit for outputting a control signal to a relatively simple control target that only directly performs ON / OFF control, such as a fail-safe circuit 12c that sends a control signal to the device 7, and receives a WDP signal from the microcomputer Mc. A watchdog monitoring circuit 12a is provided to check whether the arithmetic operation of the microcomputer is normal.

Further, the monitoring circuit 12 also includes a control signal time monitoring circuit 12b which is a feature of the present invention for monitoring control of erroneous pressurization by a control signal sent to various solenoid valves 15 controlled by the control device. include. The monitor signal 13M from the solenoid drive circuit 13 for driving the solenoid valve 15 is sent back to and input to the control signal time monitoring circuit 12b. Although the WDP signal is normal, the pressurization state is abnormally long. Subsequently, it is designed to monitor the abnormal state of the microcomputer, which causes erroneous pressurization.

FIG. 4 shows an example of the hydraulic pressure control circuit 20. This hydraulic pressure control circuit 20 has only one wheel for simplification of illustration.
Only the wheels are shown, whereas the solenoid valves 15T, 15A, 15K, 15G for pressurizing and depressurizing are shown. However, in an actual automobile, generally, four wheels are provided with brake means, so the solenoid valve 15K, Four sets of 15G are provided corresponding to four wheels. However, two sets of pumps are provided, one set for each of the front and rear wheels on the left and right diagonal lines, and the hydraulic pressure of one pump is commonly used for the front and rear wheels on the diagonal line.

In the hydraulic control circuit 20, when ABS control is performed, the hydraulic pressure corresponding to the force on the brake pedal 21 is sent out from the master cylinder 22, and when the pressure is reduced, the solenoid valve 15K is closed and the solenoid valve 15G is opened. The pressure of the wheel cylinder 24a is reduced. 25 is a reservoir for the pressure reducing valve, 2
Reference numeral 6 is a pump reservoir.

Further, in the case of ASC control, not a detection signal of a pressure increase caused by stepping on the brake pedal 21 during traveling, but a lateral acceleration or a centrifugal acceleration caused by a curve drawn by the steering wheel operation. Detection signals are input to the microcomputer Mc, the solenoid valve 15T is closed based on these detection signals, and the solenoid valves 15K and 15G of the wheels required to use the pump pressure as a pressure force.
Are respectively operated to the pressurizing side and the depressurizing side. The signal line 15L for detecting the drive state of the solenoid valve 15 (15T, 15A, 15K, 15G) of FIG. 1 is connected to the microcomputer Mc of the arithmetic control circuit 11.

In the control device constructed as described above, when the electronic control circuit determines that ASC control or ABS control is necessary based on the detection signals from various sensors, the electromagnetic valve 15 and the motor 16 are controlled. A signal is sent, pressurization, depressurization, starting of the motor 16 according to each control content,
Shutdown takes place. Since such control contents themselves are not the subject of the present invention, detailed description thereof will be omitted.

When the microcomputer Mc of the electronic control circuit performs various logical operations required for ASC control or ABS control, a control signal is sent to the solenoid drive circuit 13 via the control line 13L based on the result of the operation.
The required electromagnetic valve 15 is opened and closed via this drive circuit. When the watchdog pulse WDP signal synchronized with the reference signal for such logical operation is output from the microcomputer Mc, This is received by the watchdog monitoring circuit 12a in the monitoring circuit 12 of the sub control unit, and the operating state of the microcomputer Mc is constantly monitored. This monitoring is performed by the WDP signals t ₁ and t ₂ shown in FIG.
Is performed by measuring the time.

While the WDP signal synchronized with the operation of the microcomputer is normal in parallel with the above-mentioned monitoring of the WDP signal, the operation content itself may be abnormal and abnormal control may occur. For example, when an automobile is curving and traveling by operating the steering wheel during ASC control, the state is generally 200 ms, and considering various factors, the maximum time is about 500 ms. In this case, the same control may continue for a long time that has been exceeded, and nevertheless, the WDP signal is received by the watchdog monitoring circuit as a normal signal and is not detected as abnormal.

As described above, when the WDP signal is normal but the control signal becomes an abnormal control signal and driving continues for a long time or switching continues in an extremely short cycle (see FIG. 6), This is a failure that cannot be detected by the watchdog monitoring circuit, and is considered to be caused by some kind of defect in the microcomputer. Therefore, a control signal time monitoring circuit 12b is provided in the monitoring circuit 12 in order to detect such abnormal control.

In the illustrated example, the control signal time monitoring circuit 12b includes a solenoid valve 15 (15T, 15A, 15K, 15).
The monitor signal for detecting the operating state of G) is the monitor line 1
It is adapted to be input to the monitoring circuit 12 via 3M. Monitoring by the control signal time monitoring circuit 12b is performed as follows. The following description will be given with reference to the flowchart of FIG. Also, such abnormal control monitoring is
It is intended for pressure control such as SC and BA.

As described above, in the ASC control, when the steering wheel is operated while traveling and the vehicle travels in a curve, the detection signals from the G sensor, the lateral G sensor, and the yaw rate sensor are input to the microcomputer Mc of the main control unit, Pressurization control is performed on any of the four wheels based on this signal. This pressurization control is generally completed in a short time as described above, but if either of the following two modes occurs, it is determined that the erroneous pressurization state has occurred. (1) Failure mode I The solenoid valve 15T called T-sw is closed (T-sw is closed) The pressurizing solenoid valve 15K is open and the depressurizing solenoid valve 15G.
The motor 16 is turned on. If this state continues for a certain time (for example, 500 ms) [Fig. 6 (a)], it is determined that an abnormal state has occurred. (2) Failure mode II The solenoid valve 15K for pressurization continues to open and close in a very short cycle, and continues to open and close from closed to open for a predetermined time [(b) of FIG. 6].
[Figure] It is determined that an abnormal state has occurred also in this state. (3) Failure Mode III The pressurizing solenoid valve 15K cannot be opened / closed or closed / opened at regular time intervals for a predetermined time (when pressurizing for a long time, the drive signal is turned on → off momentarily during that time). off
→ Switch to on, but if this confirmation operation is not normal)
[Refer to FIG. 7] It is determined that an abnormal state has occurred also in this state.

In order to check that the erroneous pressurization state has occurred, the control signal time monitoring circuit 12b monitors the failure mode according to the flowchart of FIG. First, in step S ₁ , T-sw (solenoid valve 15T) is turned on.
ON if ASC control is being performed
Therefore, if it is OFF, the process proceeds to S ₆ which will be described later. The solenoid valve 15T of T-sw is normally open (OFF), and when T-sw is turned on, the solenoid valve 15T is turned on.
T is closed (ON). When the steering wheel is operated during traveling, the T-sw curves the movement of the traveling vehicle body. When detection signals of various sensors of the combine sensor Cs are input to the microcomputer Mc of the arithmetic and control circuit 11, as required. The solenoid valve 15T is closed, and the monitor circuit 12 detects the monitor signal to determine whether T-sw is ON. When T-sw is turned on, the subsequent pressurization control to the wheel cylinder is performed by the pressurizing force of the hydraulic pump.

Next, in S ₂ , the solenoid valve 15K which is a pressurizing valve.
Is determined to be OFF. The solenoid valve 15K is normally opened (when not controlled), and when the ASC control is in progress, it is opened (O when the pressurizing command is issued by the judgment of the ASC control as in the case of T-sw).
FF), if a pressure reduction command is issued, it is operated as closed (ON). Further, in S ₃ , the solenoid valve 15G which is also a pressure reducing valve is OF
It is judged whether it is F or not. The solenoid valve 15G is normally closed, and is closed (OFF) if a pressurization command is issued during ASC control, and is opened (ON) if a decompression command is issued. These solenoid valves 15
The solenoid valves 15K,
It is determined by the monitor signal for 15G.

In step S ₄ , it is determined whether the motor operation is ON. Regarding the operating state of the motor, the auxiliary circuit provided in the monitor circuit 12 sends a drive signal to the motor drive circuit to detect the drive state, and the detected signal is detected in the monitor circuit 12 by the control signal time monitor circuit. 12b and is judged based on the detection signal. Further, in S ₅ , the operations of S _{1 to} S ₄ are all YES, and the predetermined time T
_Judge whether the operating condition is ₀ or more.

At the predetermined time T ₀ , the reason that all the operations of S _{1 to} S ₄ are YES for a certain time or more is that some abnormality has occurred in the judgment of the pressurization control, and the ASC
In the control, the ASC control is to temporarily pressurize one of the four wheels in order to stabilize the vehicle body running posture, but the control operation is always released after a certain period of time. Because it is considered. The predetermined time T ₀ is generally about 200 ms as the longest time, but in this case, it is set to 500 ms with a large margin (FIG. 6 (a)).

When it is detected in S ₅ that the operating state continues for a predetermined time T ₀ or more, an abnormal signal is output and S
Failsafe processing of ₇ is performed. This fail-safe processing is to desensitize the control or send a signal to the fail-safe relay 17 to return the operation of the solenoid valve 15 to the non-controlled state and stop the ASC control. Judgment of S ₅ indicates that the operation status of S _{1 to} S ₄ is within the normal time (T ₀ or less)
If so, return to the beginning of the flowchart. When the pressurization control exceeds T ₀ as described above, as shown in FIG. 7, a signal for switching the drive signal from ON to OFF and from OFF to ON is output during that moment, and this may not be performed normally. Including.

In the determination in S ₆ , as shown in FIG. 6B, the solenoid valve 15K is normally opened and closed every Δt time (for example, 2 ms) during the predetermined time t ₀ (for example, 50 ms). I will check. Therefore, an opening / closing (ON, OFF) operation signal is repeatedly sent to the solenoid valve 15K every Δtms, and this check operation is continued for t ₀ ms. If the opening / closing operation is normally performed during this t ₀ ms, the control signal time monitoring circuit 12b detects a corresponding monitor signal and determines that it is normal, and the opening / closing operation is performed within the time t _0. If a part of the monitor signal is missing, it is judged as abnormal.

If the determination in S ₆ is normal, the flow returns to the beginning of the flowchart and the same checking operation as above is repeated. If it is determined to be abnormal, as in the case of S ₅ S
Proceed to ₇ and fail-safe processing is performed.

In the above operation check, the ASC control is taken as an example, but the brake hydraulic circuit and the electronic control circuit control not only the ASC control but also the ABS control and the BA (brake assist) control. Based on the detection signal from each sensor, it is possible to instantaneously determine which control is required, and to open / close the solenoid valve according to the corresponding control. Therefore, AS
In addition to C control, a program for checking fault content, which has a common basic idea, is programmed in the control signal time monitoring circuit 12b according to each control content to check erroneous pressurization due to abnormal control for higher safety. Can be realized at an economical cost.

FIG. 8 schematically shows a modified example of the hardware configuration of the microcomputer monitoring circuit of the electronic control circuit. In the illustrated example, the solenoid valve 15 (15T, 15K, 1
5G) and the detection signal from the motor 16 are AND gate 19
Input to the abnormality counter 12 'which is a monitoring circuit via
The abnormality of each detection signal is detected by hardware. The abnormality counter 12 'detects abnormality control with the same operation as monitoring the control signal time for each solenoid valve 15 and motor 16 in the above embodiment.

[0036]

As described above in detail, the monitoring circuit of the microcomputer of the present invention is connected to the microcomputer, and together with the watchdog monitoring circuit for monitoring the watchdog pulse WDP signal sent from the microcomputer, the microcomputer. Includes a control signal time monitoring circuit for monitoring, based on the monitor signal, an operation state obtained by a predetermined operation combination of the actuators operated by the control signal from the control signal time monitoring circuit Since the abnormal state is detected by measuring the persistence above, the output of the abnormal control signal of the microcomputer, which cannot be detected only by monitoring the abnormal operation by the WDP signal, can be detected by the economical cost detection mechanism. Is obtained.

[Brief description of drawings]

FIG. 1 is an overall block diagram of an electronic control circuit according to an embodiment.

FIG. 2 is a block diagram of a monitoring circuit of the above.

FIG. 3 is a flowchart illustrating the operation of a control signal time monitoring circuit.

FIG. 4 is a diagram of an example of a hydraulic circuit.

FIG. 5: Pulse waveform of watchdog pulse WDP

FIG. 6 (a) Waveform of solenoid valve 15K during continuous driving for a long time (B) Waveform of solenoid valve 15K during short-term intermittent abnormal drive

FIG. 7: Waveform at momentary shutoff during long-time pressurization of solenoid valve 15K

FIG. 8 is a schematic diagram of a hardware configuration example of a control signal time monitoring circuit.

[Explanation of symbols]

10 control unit 11 operation control circuit 12 monitoring circuit 13 solenoid driver circuit 14 motor drive circuit 15 electromagnetic valve (solenoid) 16 motor 17 fail safe relay Ps pressure sensor S ₁ to S ₄ speed sensor Cs combine sensor

Claims (4)

[Claims] 1. An electronic control device using a microcomputer that sends control signals to a plurality of actuators to be controlled, wherein a monitoring circuit is provided to the microcomputer that outputs a periodic watchdog pulse WDP signal in synchronism with the calculation by a calculation program. This monitoring circuit is a watchdog monitoring circuit for measuring the pulse period and pulse width of the WDP signal, and a control signal time monitoring circuit for monitoring a predetermined control operation state by a control signal to the actuator based on the calculation of the microcomputer. And the control signal time monitoring circuit detects that the control operation state by the microcomputer continues for a predetermined time or more, which should not be maintained, regardless of the normal reception of the WDP signal by the watchdog monitoring circuit. The control abnormality of A microcomputer monitoring circuit of an on-vehicle control electronic control device characterized by the above. 2. The actuator is a solenoid valve of a hydraulic circuit for controlling a wheel brake of an automobile and a motor for a hydraulic pump, and a control operation state for pressurizing the wheel brake during vehicle traveling stability control continues for a predetermined time or longer. Then, the control signal time monitoring circuit is configured to output an abnormal signal as the control abnormality, and the microcomputer monitoring circuit of the on-vehicle control electronic control device according to claim 1, characterized in that. 3. A control for driving an electromagnetic valve for controlling a wheel brake of an automobile and a motor for a hydraulic pump, wherein the actuator drives a solenoid valve for pressurizing and controlling the wheel brake during vehicle traveling stability control. The control signal time monitoring circuit is configured to output an abnormal signal as a control abnormality when a control operation state in which a signal cannot be switched on / off within a predetermined short time continues for a predetermined time or longer. 7. A microcomputer monitoring circuit of the electronic control device for vehicle control according to claim 1. 4. A control for driving an electromagnetic valve for controlling a wheel brake of an automobile and a motor for a hydraulic pump of the hydraulic circuit, wherein the actuator drives an electromagnetic valve for pressurizing and controlling the wheel brake during vehicle running stability control. The control signal time monitoring circuit is configured to output an abnormal signal as a control abnormality when a control operation state in which a signal continues to be switched on / off in an extremely short cycle continues for a predetermined time or longer. 3. The microcomputer monitoring circuit of the on-vehicle control electronic control device according to any one of 3 above.