JP2014019416A - Vehicle control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a vehicle control device that can appropriately ensure a safe state against potential troubles.SOLUTION: In the present invention, a micro controller to control an actuator resets the micro controller for restart upon detection of abnormality by a self-diagnostic function, and has a restart invalidation function to invalidate the restart if the number of times of resetting reaches a predetermined number of times.

Description

  The present invention relates to a reset function of a microcontroller provided in a vehicle control device.

In recent years, the safety mechanism of a vehicle control device has been highly functionalized, and a microcontroller that is a component of the vehicle control device has various self-diagnosis functions inside. For example, a memory monitoring device using ECC (Error Correcting Code) and a mutual monitoring device for calculation results by a plurality of cores are known.
Normally, when any failure is detected by these self-diagnosis functions, the microcontroller is reset to an initial state and restarted. By resetting the microcontroller to the initial state, the vehicle control device is in a safe state, and it is possible to prevent malfunction of the vehicle control device due to failure of the microcontroller. For example, there is an apparatus described in Patent Document 1.

Japanese Patent No. 440275

  Here, assuming a state in which bit corruption occurs in the RAM, the microcontroller restarts from the initial state after the memory monitoring device using the ECC detects the bit corruption in the RAM. If the cause of bit corruption is electromagnetic noise or cosmic rays, initialization will clear the RAM data once, so if electromagnetic noise or cosmic rays are temporary, make the RAM normal. It is possible to return.

On the other hand, if the cause of bit corruption is physical damage, even if initialization is performed, the cause of bit corruption will remain and will be detected again when an area where bit corruption has occurred is accessed. That is, with the conventional safety function alone, due to a failure mode of the microcontroller (for example, garbled RAM), there is a state that falls into an infinite loop that alternately repeats failure detection and restart by resetting the microcontroller. This is not a desirable state as a transition state of the vehicle control device, and it is desirable to maintain a safe state when a failure is present.
The objective of this invention is providing the vehicle control apparatus which can ensure a safe state appropriately, when a failure exists.

  In order to achieve the above object, in the present invention, the microcontroller that controls the actuator resets itself and restarts when an abnormality is detected by the self-diagnosis function, while the number of resets reaches a predetermined number. When equipped with a restart disable function to disable restart.

  Therefore, it is possible to avoid an infinite loop in which the failure detection and the restart by resetting the microcontroller are alternately repeated. As a result, the vehicle control device can be maintained in a safe state even when there is a failure in the microcontroller.

It is a system diagram showing the structure of the brake control apparatus of Example 1. FIG. 3 is a block diagram illustrating a configuration in an electronic control unit according to the first embodiment. It is a flowchart showing the software processing performed in the brake control apparatus of Example 1. 3 is a flowchart illustrating initial processing according to the first exemplary embodiment.

[Example 1]
FIG. 1 is a system diagram illustrating the configuration of the brake control device according to the first embodiment. The brake control device includes an electronic control unit 2 that performs wheel lock prevention control and skid prevention control based on signals detected from sensors 1 such as a wheel speed sensor and a yaw rate sensor, and control commands calculated in the electronic control unit 2. And an actuator 3 for operating a plurality of solenoid valves and the like. The electronic control unit 2 includes a microcontroller 21 that performs various control calculation processes and a microcontroller monitoring IC 22 that monitors the microcontroller 21.
A master cylinder M / C that generates a brake fluid pressure is connected to the brake pedal BP operated by the driver, and the fluid pressure output from the master cylinder M / C is introduced into the actuator 3. The actuator 3 is connected to a wheel cylinder W / C that generates braking force on each of the four wheels. The actuator 3 controls the hydraulic pressure supplied from the master cylinder M / C based on various control commands, or generates the actuator hydraulic pressure by pumping up to control the hydraulic pressure supplied to the wheel cylinder W / C.

  FIG. 2 is a block diagram illustrating the configuration of the electronic control unit according to the first embodiment. The microcontroller 21 includes a self-diagnosis function unit 213, a reset function unit 212, and a reset count counting function unit 211. The microcontroller monitoring IC 22 has an external monitoring function unit 221. In the first embodiment, a restart invalidation function that avoids a state where an infinite loop in which failure detection and restart by resetting the microcontroller are alternately repeated is avoided by each of these functional units. Details of each functional unit will be described below.

(About the self-diagnosis function section)
The self-diagnosis function unit 213 is provided inside the microcontroller 21 and constantly monitors whether or not a failure has occurred. This function has, for example, a memory monitoring function using ECC (Error Correcting Code), and a mutual monitoring function of calculation results by a plurality of cores. If a failure that requires resetting the microcontroller 21 to an initial state occurs, the failure is detected by the self-diagnosis function, and then a reset function unit 212 (to be described later) is requested to reset and restart (SIG2 in FIG. 2). Reference: first reset function).

(About external monitoring function)
The external monitoring function unit 221 is provided outside the microcontroller 21 and monitors a program operation signal (see SIG1 in FIG. 2) that is regularly and periodically output from the microcontroller 21. This function is achieved by, for example, a watchdog timer. When the regularity or periodicity of the program operation signal (SIG1) is lost, the reset function unit 212 (to be described later) is requested to reset and restart (SIG3 in FIG. 2). Reference: second reset function).
Further, when the program operation signal (SIG1) is stopped for a predetermined time, only a reset is requested to the reset function unit 212 described later. The reset request signal (SIG3) is kept at a high level while the microcontroller 21 is activated, and is switched to a low level when the microcontroller 21 is requested to be reset. Subsequently, the microcontroller 21 is requested to restart by switching from the low level to the high level again.
That is, when the program operation signal (SIG1) is stopped for a certain period of time, the subsequent restart can be invalidated by holding the reset request signal (SIG3) at a low level. The state in which the reset request signal (SIG3) is held at the low level is not released until the ignition switch is turned off.

(Reset function part)
The reset function unit 212 is provided inside the microcontroller 21 and controls reset and activation of the microcontroller 21 according to the state of the reset request signal (SIG2, SIG3).
(Reset count function part)
The reset count counting function unit 211 is provided inside the microcontroller 21 and counts the reset count of the microcontroller 21. This function is preferably realized by software, and the reason will be described later.

[Control processing in brake control device]
FIG. 3 is a flowchart illustrating software processing executed in the brake control device according to the first embodiment. The software processing of the brake control device mainly includes two processes, that is, an initial process S1 and a brake control process S2. The initial process S1 is executed immediately after the activation of the microcontroller 21 (including a case where the microcontroller 21 is restarted after a failure is detected).
(About initial processing)
FIG. 4 is a flowchart illustrating the initial process according to the first embodiment. When the initial process S1 is started, first, in step S11, in order to determine whether or not the initial diagnosis 1 (step S12) needs to be executed, it is determined whether it is the first start immediately after the ignition is turned on or restart. In the case of the first activation, the process proceeds to step S12 and the initial diagnosis 1 is performed. Otherwise, the process proceeds to step S14.

The initial diagnosis 1 performed in step S12 corresponds to a diagnosis that needs to be executed at least once during the same ignition ON, for example, a logic BIST or a memory BIST. Therefore, in the case of restart, it is not always necessary to execute the initial diagnosis 1, and it is preferable not to execute it because the time required for the initial process S1 can be shortened.
In step S13, the initial diagnosis 1 is determined. If the diagnosis result is normal, the process proceeds to initial diagnosis 2 (step S14), and if abnormal, the process proceeds to step S18 to execute fail-safe processing.
In step S14, initial diagnosis 2 is executed. Specifically, a SUM check is executed for the ROM area where the reset count processing is implemented.
In step S15, the initial diagnosis 2 is determined. If the diagnosis result is normal, the process proceeds to step S16 to perform the reset count process, and if abnormal, the process proceeds to step S18 to execute the fail safe process.

In step S16, reset count counting processing is executed. Specifically, the counter is incremented every time reset is performed.
In step S17, it is determined whether or not the number of resets is less than a predetermined value. If the number of resets is less than the predetermined value, the initial process S1 is terminated. If the number of resets is greater than or equal to the predetermined value, the process proceeds to step S18 and the failsafe process is executed. .
In step S18, fail-safe processing is executed. In this fail-safe process, settings are made to shift the brake control device to a safe state. For example, a part of a later-described brake control function (a wheel lock prevention function or a skid prevention function) is limited, or a predetermined code corresponding to a failure part is stored in a rewritable nonvolatile memory. Further, if it is determined that the number of resets is equal to or greater than a predetermined value, a setting is made to prohibit the output of the program operation signal (SIG1) in the brake control device described above.

(About brake control processing)
As shown in the flowchart of FIG. 3, when the initial process is finished in step S1, a brake control process, that is, a brake control function (wheel lock prevention function or skid prevention function) is executed in step S2. Further, immediately after the start of this process, the output of the program operation signal (SIG1) is started. However, when the output of the program operation signal (SIG1) is prohibited in the fail-safe process in step S18 described above, the program operation signal (SIG1) is not output.

[Operation by the restart invalidation function]
Next, the operation of the restart invalidation function achieved by the control process will be described. First, as a situation where an infinite loop in which the failure detection and the restart by resetting the microcontroller are alternately repeated, a situation in which bit corruption due to physical damage to the RAM occurs is described.
(i) When the bit corruption of the RAM occurs, the self-diagnostic function unit 213 detects the failure and outputs a reset request signal (SIG2) to the reset function unit 212.
(ii) Next, the reset function unit 212 that has received the reset request signal (SIG2) resets the microcontroller 21 to the initial state and restarts it.
(iii) After restarting, the reset count counter is incremented by the reset count function unit 211.
(iv) The above (i) to (iii) are repeated, and the program operation signal (SIG1) is stopped when the reset number counter reaches a predetermined value.
(v) The external monitoring function 221 detects that the program operation signal (SIG1) has stopped, and holds the reset request signal (SIG3) at a low level. Thereby, the microcontroller 21 is held in the reset state until the ignition switch is turned off.

As described above, the effects listed below can be obtained in the embodiment.
(1) A vehicle control apparatus including a microcontroller 21 that controls the actuator 3, and the microcontroller 21 resets itself when an abnormality is detected by the self-diagnosis function unit 213 and the self-diagnosis function unit 213. The first reset function for restarting, the counter for counting up the number of times reset by the first reset function (step S16), and invalidating the restart when the number of resets counted up reaches a predetermined number A restart invalidation function (step S18) is provided.
Therefore, it is possible to avoid an infinite loop in which failure detection and restart by resetting the microcontroller 21 are repeated alternately. Thereby, when a failure is latent in the microcontroller 21, the vehicle control device can be maintained in a safe state.

(2) The counter is implemented by software stored in the microcontroller 21.
Therefore, the vehicle control device can be maintained in a safe state without newly adding hardware.

(3) A second monitoring function unit 221 (external monitoring device) for monitoring the microcontroller 21 is provided. When an abnormality is detected by the external monitoring function unit 221, the microcontroller 21 is reset to stop the restart. Perform the reset function.
Therefore, when an abnormality occurs in the program operation signal of the microcontroller 21, the restart can be invalidated while requesting a reset from the outside, and the vehicle control device can be maintained in a safe state.

(4) The microcontroller 21 performs a brake control process (control program) after the first initial diagnosis executed when the ignition of the vehicle is turned on and the second initial diagnosis executed following the first initial diagnosis. ) And the second initial diagnosis is performed without performing the first initial diagnosis when the system is restarted by the first reset function.
That is, the first initial diagnosis only needs to be executed at least once while the ignition is on and does not necessarily need to be executed at the time of restart. Therefore, the time required for initial processing can be reduced by avoiding the execution of the first initial diagnosis. It can be shortened.

  Each embodiment has been described above, but the present invention is not limited to this, and other configurations may be used within the scope of the invention. For example, although the example applied to the brake control device is shown in the embodiments, the present invention may be applied to other control devices such as an airbag system, a variable steering angle control system, a damping force variable control system, and the like.

1 Sensor 2 Electronic Control Unit 3 Actuator 21 Microcontroller
211 Reset count function
212 Reset function section
213 Self-diagnosis function
221 External monitoring function unit 22 Microcontroller monitoring IC

Claims (4)

A vehicle control device including a microcontroller for controlling an actuator,
The microcontroller counts up the self-diagnosis function, a first reset function that resets itself and restarts when an abnormality is detected by the self-diagnosis function, and the number of times reset by the first reset function. And a restart invalidating function for invalidating the restart when the counted number of resets reaches a predetermined number. The vehicle control device according to claim 1,
The vehicle control apparatus, wherein the counter is implemented by software stored in the microcontroller. The vehicle control device according to claim 1 or 2,
An external monitoring device for monitoring the microcontroller;
A vehicle control device that executes a second reset function that resets the microcontroller and stops restart when an abnormality is detected by the external monitoring device. In the vehicle control device according to any one of claims 1 to 3,
The microcontroller is configured to execute a control program after a first initial diagnosis executed when the ignition of a vehicle is turned on and a second initial diagnosis executed following the first initial diagnosis,
The vehicle control apparatus according to claim 1, wherein, when restarted by the first reset function, the second initial diagnosis is performed without performing the first initial diagnosis.

Images