JP2014096042A - Electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To minimize a processing load of an electronic control device which monitors control processing on a control target mounted on a vehicle.SOLUTION: A monitoring processing unit 34 of a monitoring unit 30 monitors whether control processing by a control unit 22 properly functions on the basis of a result of the control processing by the control unit 22 and a result of control processing by an execution processing unit 32. When the monitoring unit 30 executes monitoring processing which is an inspection target of an inspection unit 40, the monitoring unit 30 outputs a monitoring result of the monitoring processing to the inspection unit 40. An inspection processing unit 42 of the inspection unit 40 inspects whether the monitoring processing by the monitoring unit 30 properly functions on the basis of the monitoring result of the inspection target monitoring processing executed by the monitoring unit 30, or a test result of test processing executed by the monitoring unit 30 in response to an execution request by the inspection unit 40. When the monitoring unit 30 executes the inspection target monitoring processing, the inspection unit 40 does not request the monitoring unit 30 to execute the test processing for inspecting the monitoring processing.

Description

  The present invention relates to an electronic control device that monitors a control process for a control target mounted on a vehicle.

  2. Description of the Related Art Conventionally, an electronic control device that monitors a control process for a control target such as an actuator mounted on a vehicle is known (see, for example, Patent Document 1). In Patent Document 1, the monitoring unit monitors whether the control process by the control unit for the control target is functioning normally, and the inspection unit checks whether the monitoring process by the monitoring unit for the control process is functioning normally. Technology is adopted.

  In addition to monitoring the control process by the control unit, the monitoring unit executes a test process for inspecting whether the monitoring process by the monitoring unit is functioning normally in response to a request from the inspection unit.

Japanese National Patent Publication No. 11-505588

  When the inspection unit requests the monitoring unit to execute all test processes for each of the plurality of monitoring processes executed by the monitoring unit, the monitoring unit adds all the monitoring processes to be inspected in addition to the monitoring process. Since the test process is executed, the processing load on the entire electronic control unit increases.

  The present invention has been made to solve the above problems, and an object thereof is to reduce the processing load of an electronic control device that monitors a control process for a control target mounted on a vehicle as much as possible.

  According to the electronic control device of the present invention, the monitoring unit monitors the control process performed by the control unit for the control target mounted on the vehicle, and the monitoring process that is the inspection target among the plurality of monitoring processes performed by the monitoring unit that monitors the control process. The inspection unit requests the monitoring unit to execute a test process for inspecting whether or not the device is functioning normally.

  The monitoring means outputs a monitoring result when the monitoring process to be inspected by the inspection means is performed to the inspection means, and the inspection means outputs a monitoring result corresponding to the output monitoring result when the monitoring means outputs the monitoring result. The monitoring means is not requested to execute the test process for the inspection target.

  According to this configuration, when the monitoring unit executes the monitoring process that is the inspection target by the inspection unit, the monitoring unit does not execute the test process that targets the executed monitoring process. As a result, it is possible to prevent the monitoring process and the test process with the monitoring process as an inspection target from being duplicated as much as possible, and to reduce the processing load on the electronic control device.

  The inspection unit stores the number of executions of the monitoring process executed by the monitoring unit in the test unit for each test process in the storage unit, and sequentially starts the test process with the monitoring process having the lower number of executions as the inspection target. It is desirable to request the monitoring means to execute.

  Since it is unlikely that the monitoring means will execute a monitoring process with a small number of executions, the monitoring process and the test process will not be executed even if the test process for which the stored monitoring process with a small number of executions is preferentially executed. Duplicate execution can be prevented as much as possible.

  The inspection unit stores, in the storage unit, whether or not the monitoring unit has executed at least one of the test process and the monitoring process to be inspected by the test process for each test process for each predetermined period. Among the test processes stored as not being executed during the period, neither the test process nor the monitoring process that is the test target of the test process is monitored. It is desirable to request execution.

  Thereby, it is possible to prevent as much as possible that both the test process and the monitoring process to be inspected by the test process are not executed in each of the predetermined periods.

The figure which shows the electronic control apparatus by this embodiment. A table showing test process ID, number of executions, and execution status. The time chart which shows execution of a monitoring process and a test process. The flowchart which shows the monitoring process by a monitoring part. The flowchart which shows the test control process by a test | inspection part. The flowchart which shows the test request process 1 by a test | inspection part. The flowchart which shows the test process by the monitoring part. The flowchart which shows the test request process 2 by a test | inspection part.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
An electronic control unit (ECU) 10 shown in FIG. 1 controls a control target mounted on a vehicle that uses, for example, a multi-cylinder gasoline engine (hereinafter also simply referred to as “engine”) as a power source. Is. The control target is, for example, a throttle device, an injector, a spark plug, or the like.

  The ECU 10 includes a main CPU 20, an inspection CPU 60, an input / output interface (not shown), and the like. The main CPU 20 mainly includes a control unit 22, a monitoring unit 30, an inspection unit 40, and a storage unit 50.

  The control unit 22 is a throttle device based on various signals such as an accelerator opening sensor, a water temperature sensor, a rotation speed (NE) sensor, a vehicle speed sensor (not shown), a sensor signal input from a vehicle speed sensor, and a control signal input from another ECU. The control process for the control target such as the injector and the spark plug is executed, and the control signal for the control target is output to the output stage 70. The control process for the control target includes an abnormal process when the control target is abnormal.

  The monitoring unit 30 includes an execution processing unit 32 and a monitoring processing unit 34. The execution processing unit 32 inputs the same various signals as the control unit 22 and executes the same control processing as the control unit 22 at the same timing as the control unit 22.

  The monitoring processing unit 34 compares the result of the control processing by the control unit 22 with the result of the control processing by the execution processing unit 32, and the result of the control processing by the control unit 22 becomes the result of the control processing by the execution processing unit 32. Whether or not the control process by the control unit 22 is functioning properly is determined by determining whether or not it is within an appropriate range set based on the above.

  Here, the execution processing unit 32 of the monitoring unit 30 inputs various signals to execute the control processing for the control target, and the monitoring processing unit 34 of the monitoring unit 30 performs the control processing result by the control unit 22 and the execution processing unit 32. The process of comparing the result of the control process and monitoring whether the control process by the control unit 22 is functioning normally corresponds to the monitoring process executed by the monitoring unit 30.

  If the result of the control processing by the control unit 22 is within an appropriate range and the control processing by the control unit 22 is normal, the monitoring processing unit 34 turns on an enable signal that is a signal representing the monitoring result and outputs the output stage 70. The control signal generated by the control unit 22 is allowed to be output from the output stage 70. If the result of the control processing by the control unit 22 is out of the proper range and the control processing by the control unit 22 is abnormal, the monitoring processing unit 34 turns off the enable signal, and the control signal generated by the control unit 22 is output to the output stage. The output from 70 is prohibited.

  When the monitoring unit 30 executes the monitoring process to be inspected by the inspection unit 40, the monitoring unit 30 identifies the result of the control process executed by the execution processing unit 32, the values of various signals input at that time, and the control process. Is output to the inspection unit 40 as a monitoring result of the monitoring process. When the monitoring process that is not the inspection target by the inspection unit 40 is executed, the monitoring unit 30 does not output the monitoring result to the inspection unit 40.

  The monitoring unit 30 not only executes the same control process as the control unit 22 as part of the monitoring process at the same timing as the control unit 22, but also receives an execution request from the inspection unit 40, the monitoring process to be inspected is performed. A test process for inspecting whether or not it is functioning normally is executed.

  The execution processing unit 32 of the monitoring unit 30 executes the same control process as the control process executed in the monitoring process that is the inspection target of the test process, in response to the test process execution request from the inspection unit 40. When executing the control process in response to the test process execution request, the execution processing unit 32 acquires values of various signals from the map or the like according to the ID of the control process corresponding to the test process received from the inspection unit 40, for example. Input signal.

  A common ID is assigned to the control process, the monitoring process, and the test process. That is, the monitoring process performed by the monitoring unit 30 that monitors whether the control process of the control unit 22 is functioning normally and the control process to be monitored have the same ID, and the monitoring process executed by the monitoring unit 30; The ID is the same as the test process for checking whether the monitoring process functions normally.

  When the execution processing unit 32 executes the control process according to the test process execution request, the monitoring processing unit 34 executes the result of the control process executed by the execution processing unit 32, the input signal acquired from the map, and the like. The control process ID is output to the inspection unit 40.

  The inspection unit 40 includes an inspection processing unit 42 and a test control processing unit 44. In the inspection processing unit 42, in the monitoring processing to be inspected or the test processing executed in response to the execution request from the inspection unit 40, the result of the control processing executed by the execution processing unit 32 and the execution processing unit 32 at that time The values of various signals as input signals and the ID of the control process are input from the monitoring unit 30, and the result of the control process executed by the execution processing unit 32 is obtained from the various signals input by the execution processing unit 32 at that time. It is determined whether or not it is within an appropriate range.

  If the result of the control processing by the execution processing unit 32 of the monitoring unit 30 is not within the proper range, the inspection processing unit 42 determines that the monitoring unit 30 is in an abnormal state that cannot properly monitor the control processing of the control unit 22. In addition to performing a process of forcibly resetting the main CPU 20 which is its own CPU, the inspection CPU 60 is notified that the monitoring unit 30 is in an abnormal state.

  In the monitoring process that is the inspection target of the test process among the plurality of monitoring processes executed by the monitoring unit 30, when the result of the control process executed by the execution processing unit 32 is within an appropriate range, the test control processing unit 44 The number of executions of the monitoring process is counted for each test process, and stored in the storage unit 50 in the format of the table 200 shown in FIG. The storage unit 50 is configured by a RAM, for example.

  Examples of test processing include torque control processing such as injection control processing, intake control processing, and ignition control processing, memory check processing for ROM and RAM, AD conversion processing, and processing at the time of abnormality when each processing abnormality is detected. Is set. In the present embodiment, some of the plurality of monitoring processes executed by the monitoring unit 30 are set as test process inspection targets, but all of the plurality of monitoring processes may be set as test process inspection targets.

  In the table 200 of FIG. 2, for each test process, the ID unique to each test process, the content of the test process corresponding to the ID, and the monitoring process that is the inspection target of the test process have been executed by the monitoring unit 30 so far. And an execution status flag indicating whether or not the monitoring unit 30 has executed at least one of the test process and the monitoring process that is the inspection target of the test process in a predetermined period.

  The execution status flag is set to “done” when at least one of the test process and the monitoring process that is the inspection target of the test process is executed once by the monitoring unit 30 during the predetermined period. If none of the monitoring processes are executed at all, the initial value “un” remains.

  As shown in FIG. 3, in this embodiment, the length of the predetermined period is set to 500 ms. It is defined that at least one of the test process and the monitoring process that is the inspection target of the test process is executed at least once in a predetermined period. The execution status flag is set to “not yet” and initialized every 500 ms which is a predetermined period. The predetermined period is not limited to 500 ms, but is set as appropriate according to the required specifications.

  The number of executions of the monitoring process to be inspected is not initialized every predetermined period but continues to be counted. In the present embodiment, the predetermined period (500 ms) is divided into a normal processing period in which the processes of the monitoring unit 30 and the inspection unit 40 are repeated in a processing period of 32 ms, and a final processing period (50 ms) until the predetermined period 500 ms ends. It is divided. The processing period of 32 ms and the final processing period of 50 ms are appropriately set according to the required specifications.

  In the predetermined period of 500 ms, the inspection unit 40 does not execute any of the test process and the monitoring process that is the inspection target of the test process until now, and executes the test process in which the execution status flag is “not yet”. The monitoring unit 30 requests the monitoring unit 30 once every 32 ms in order of the number of executions in 200 in ascending order. In the present embodiment, the number of test processes that the inspection unit 40 requests the monitoring unit 30 every 32 ms is set to 1% of the maximum number of test processes.

  Then, at the start of the final processing period (50 ms), the inspection unit 40 requests the monitoring unit 30 to execute all test processes for which the execution status flag is “not yet”. The processing period immediately before the start of the final processing period may be increased by 2 ms to 34 ms, or may be executed for 2 ms and the process may proceed to the final processing period.

  If the inspection CPU 62 does not reset the main CPU 20 even though the inspection processor 62 of the inspection CPU 40 is notified by the inspection processor 42 of the inspection unit 40 that the monitoring processing of the monitoring unit 30 is abnormal, the main CPU 20 is not reset. A signal for forcibly resetting the CPU 20 is output.

Next, each process performed by the monitoring unit 30 and the inspection unit 40 will be described.
(Monitoring process)
The monitoring unit 30 executes the monitoring process of FIG. 4 in synchronization with the timing at which the control unit 22 executes the control process. The execution processing unit 32 of the monitoring unit 30 executes the same control processing as that of the control unit 22 based on various input signals (S400), and the monitoring processing unit 34 confirms the ID of the control processing executed by the execution processing unit 32. (S402).

  In this embodiment, since all of the monitoring processes are not inspection targets of the test process, some IDs assigned to the control process and the monitoring process are different from the IDs assigned to the test process.

  When the ID of the control process is the same as the ID of the test process (S404: Yes), the monitoring processing unit 34 determines the values of the various signals input, the result of the control process executed by the execution processing unit 32, and the ID of the control process. The monitoring result is output to the inspection unit 40 (S406).

  When the control process ID is different from the test process ID and the monitoring process executed by the monitoring unit 30 is not the target of the test process requested by the inspection unit 40 to the monitoring unit 30 (S404: No), the monitoring processing unit 34 The monitoring result by the monitoring process is not output to the inspection unit 40.

  Although not shown in the flowchart of FIG. 4, as described above, the monitoring processing unit 34 compares the control processing result by the control unit 22 with the control processing result by the execution processing unit 32, and A monitoring process is also performed to determine whether the result of the control process by 22 is within an appropriate range generated from various signals. Based on the determination by the monitoring process, the monitoring processing unit 34 determines whether the enable signal for the output stage 70 is turned on or off.

(Test control processing)
In the test control process of FIG. 5, as shown in FIG. 3, the inspection unit 40 receives a monitoring result or a test result from the monitoring unit 30 in each processing period (32 ms) as a processing result, or a final processing period (50 ms). ) Is activated when a test result is received from the monitoring unit 30.

When the processing result received by the monitoring unit 30 is a test result (S410: No), the monitoring unit 30 shifts the processing to S414.
When the processing result received by the monitoring unit 30 is a monitoring result (S410: Yes), the test control processing unit 44 increments the number of times of execution of the monitoring process corresponding to the received ID in the table 200 (S412), and proceeds to S414. Migrate processing.

  In S414, the test control processing unit 44 sets the execution status flag corresponding to the received ID to “completed” (S414), and sorts the table 200 in ascending order of execution (S416).

  For example, if the ID of the processing result received from the monitoring unit 30 is “1”, the test control processing unit 44 executes the ignition abnormality processing that is the test processing corresponding to ID = 1 from the state shown in FIG. The number of times is changed from “0” to “1”, and the execution status flag is changed from “not yet” to “done”. Even when the number of executions of the abnormal ignition process is changed from “0” to “1”, the order of the number of executions is not changed.

  Although not shown in the flowchart of FIG. 5, when the inspection unit 40 receives the monitoring result or the test result from the monitoring unit 30, as described above, the inspection processing unit 42 executes the execution processing unit 32 of the monitoring unit 30. The inspection process for determining whether or not the result of the control process executed by is within an appropriate range is performed.

  If the result of the control processing by the execution processing unit 32 is not within an appropriate range, the inspection processing unit 42 performs processing for forcibly resetting the main CPU 20 that is its own CPU, and the monitoring CPU 30 is in an abnormal state in the inspection CPU 60. Notify that.

(Test request processing 1)
The test request process 1 in FIG. 6 is executed every 32 ms excluding the final processing period (50 ms) as shown in FIG. The test control processing unit 44 searches the table 200 stored in the storage unit 50 for a test process with an execution status flag of “not yet”, which has a low number of executions (S420), and the total number of test processes at the maximum. The monitoring unit 30 is requested to execute a number of test processes corresponding to 1% of (S422).

  The test control processing unit 44 requests execution of the test process by transmitting the ID of the test process that requests execution. Further, the test control processing unit 44 may request the monitoring unit 30 to call a function for executing the corresponding test processing.

(Test processing)
The test process of FIG. 7 is activated when the monitoring unit 30 receives a test process execution request from the inspection unit 40. The monitoring unit 30 determines the priority of the execution request for the test process corresponding to the received ID and the monitoring process for monitoring the control process of the control unit 22, the ID of the test process for which the execution request has been made, and the ID of the monitoring process. A comparison is made (S430).

  When the priority of the test process requested to be executed is higher than the monitoring process (S430: Yes), the execution processing unit 32 of the monitoring unit 30 executes the test process corresponding to the ID (S432), and the monitoring processing unit 34 Transmits the test result of the test process to the inspection unit 40 (S434).

  When the priority of the test process requested to be executed is equal to or lower than the priority of the monitoring process (S430: No), the execution processing unit 32 waits until the priority of the monitoring process becomes lower than the priority of the test process.

(Test request processing 2)
As shown in FIG. 3, the test request process 2 in FIG. 8 starts when the final processing period (50 ms) starts. The inspection unit 40 searches the table 200 stored in the storage unit 50 for a test process whose execution status flag is “not yet” (S440), and executes all the corresponding test processes with a small number of executions. To the monitoring unit 30 by transmitting the test process IDs in order (S442). The amount of test processing executed in the 32 ms processing period and the length of the final processing period are set so that all the test processing whose execution status flag is “not yet” can be executed in the final processing period (50 ms). .

  In this case, the monitoring unit 30 executes all the requested test processes regardless of the priority of the test process requested to be executed by the inspection unit 40 and the execution request of the monitoring process in the monitoring unit 30.

  According to the embodiment described above, the monitoring unit 30 outputs the monitoring result of the monitoring process to the inspection unit 40 when executing the monitoring process that is the inspection target by the inspection unit 40. The test unit 40 becomes “done” for a predetermined period of 500 ms by setting the execution status flag of the table 200 to “done” for the test process in which the monitoring result output by the monitoring unit 30 is a test target. The monitoring unit 30 is not requested to execute the test process.

  Thereby, since it is possible to prevent the test process and the monitoring process to be inspected by the test process from being performed repeatedly in each predetermined period, the processing load on the ECU 10 can be reduced.

  The inspection unit 40 counts the number of times the monitoring unit 30 has executed the monitoring process to be inspected for each test process, stores the number of executions in the table 200, and stores the test process whose execution status flag is “not yet”. Among them, the monitoring unit 30 is requested to execute in order from the test process in which the stored monitoring process with a small number of executions is the inspection target.

  Since the monitoring unit 30 is unlikely to execute a monitoring process with a small number of executions, even if a test process for which the stored monitoring process with a small number of executions is preferentially executed, monitoring is performed in each predetermined period. It is possible to prevent the process and the test process from being executed as much as possible.

  In addition, in the final processing period until the predetermined period of 500 ms ends, neither the test process nor the monitoring process to be inspected by this test process is executed, that is, the execution status flag is “not yet”. The monitoring unit 30 is requested to execute the test process.

Thereby, in each predetermined period, the monitoring unit 30 can execute at least one of the test process and the monitoring process to be inspected by the test process.
Further, in the normal processing period excluding the final processing period, the number of executions is limited to 1% of the total number of test processes in each processing period of 32 ms for the test process whose execution status flag is “not yet”. It is possible to prevent the test process and the monitoring process to be inspected by this test process from being performed in duplicate during the normal process period excluding.

[Other Embodiments]
In the above embodiment, the ECU 10 has been described as the electronic control device of the present invention. However, the electronic control device of the present invention only needs to be composed of at least the monitoring unit 30 and the inspection unit 40 of the above embodiment.

  The electronic control device of the present invention is not limited to the gasoline engine vehicle exemplified in the above embodiment, and may be applied to any of a diesel engine vehicle, an electric vehicle, and a hybrid vehicle.

  As described above, the present invention is not limited to the above-described embodiment, and can be applied to various embodiments without departing from the gist thereof.

10: ECU (electronic control device, control means, monitoring means, inspection means), 22: control section (control means), 30: monitoring section (monitoring means), 40: inspection section (inspection means), 50: storage section, 60: Inspection CPU

Claims (4)

Monitoring means (30, S400 to S406, S430 to S434) for monitoring control processing by the control means (22) for the control target mounted on the vehicle;
An inspection requesting the monitoring means to execute a test process for inspecting whether or not the monitoring process to be inspected normally functions among a plurality of monitoring processes by the monitoring means for monitoring the control process Means (40, S410 to S416, S420, S422, S440, S442, S450);
With
The monitoring unit (S406) outputs a monitoring result when the monitoring process, which is an inspection target by the inspection unit, is performed to the inspection unit,
The inspection means (S420, S422, S440, S442), when the monitoring means outputs the monitoring result, monitors the execution of the test process with the monitoring process corresponding to the output monitoring result as the inspection target. Do not require means,
An electronic control device (10) characterized by the above.   The inspection unit (S412) stores, in the storage unit (50), the number of executions performed by the monitoring unit for the monitoring process that is the inspection target of the test process for each test process, and the monitoring with a small number of executions The electronic control apparatus according to claim 1, wherein execution is requested to the monitoring unit in order from the test process whose process is an inspection target.   The inspection unit (S414) determines whether or not the monitoring unit has executed at least one of the test process and the monitoring process to be inspected by the test process for each test process for each predetermined period. Out of the test processes stored in the storage unit and stored as not being executed in the predetermined period, the monitoring process is executed in order from the test process with the monitoring process having a small number of executions as an inspection target. The electronic control device according to claim 2, wherein the electronic control device is requested.   The inspection means (S440, S442) requests the monitoring means to execute all the test processes that are not executed in a predetermined final processing period until the predetermined period ends. 3. The electronic control device according to 3.

Images