JP2015022622A - Automotive electronic controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the safety of automotive control by improving the reliability of important arithmetic processing such as diagnostic processing in an automotive electronic controller.SOLUTION: The memory areas of ROM and RAM are separated into a normal control area for a control program (i.e., a normal arithmetic area) and a high safety area for a diagnostic program (i.e., an important arithmetic area). Then, a high safety area diagnostic program for performing memory diagnosis of the high safety area and a normal diagnostic program for performing memory diagnosis of the entire area are installed in the high safety area, thus the high safety area being subjected to double memory diagnosis.

Description

  The present invention relates to a technique for ensuring functional safety in an electronic control device for an automobile.

  In Patent Document 1, as a method for improving the reliability of an automobile computer system, when reading a flash memory by a microprocessor, a parity bit is stored for each data row in the same memory unit or a separate memory unit, and the memory access is performed. There is also disclosed an electronic vehicle control device that similarly protects data row by row in a data memory by generating parity bits and comparing it with test data stored for error checking.

JP 2005-503624 A

  By the way, even when performing a memory diagnosis using an error detection code such as a parity bit, there is a possibility that the program (software component) for performing the diagnosis may fail, so that the diagnosis program is functioning normally. Further, the area on the memory where the program for diagnosing the diagnostic program is mounted must be sufficiently protected and highly reliable.

  The present invention has been made in view of the above circumstances, and an object thereof is to improve the reliability of important arithmetic processing such as diagnostic processing in an electronic control device for automobiles.

  Therefore, in the present invention, the memory area is divided into two areas, a normal calculation area and an important calculation area, and the important calculation area is diagnosed by a memory diagnosis process implemented in the important calculation area.

  According to the above-described invention, the reliability of important arithmetic processing such as diagnostic processing is improved, so that the security of control in the electronic control device can be increased.

It is a block diagram which shows the hardware system of the electronic controller for motor vehicles in embodiment of this invention. It is a block diagram which shows the software component (processing function) in embodiment of this invention. It is a block diagram which shows the program arrangement | positioning on ROM in embodiment of this invention. It is a block diagram which shows the program arrangement | positioning on ROM in embodiment of this invention. It is a figure which shows the memory structure in the multi-core (dual core) in embodiment of this invention. It is a block diagram which shows the program arrangement | positioning on ROM in multi-core (dual core) in embodiment of this invention. It is a block diagram which shows the flow of a process, the delivery of data, and the multiplexing of data in embodiment of this invention. It is a block diagram which shows the flow of a process in multi-core (dual core) in embodiment of this invention, delivery of data, and multiplexing of data. It is a block diagram which shows the flow of a process in multi-core (dual core) in embodiment of this invention, delivery of data, and multiplexing of data.

Embodiments of the present invention will be described below.
FIG. 1 is a block diagram showing a hardware system of an automobile electronic control device according to this embodiment.
In FIG. 1, an automobile 100 includes an engine (internal combustion engine) 200 as a power source and an electronic control device 300 that controls the engine 200.

  Engine 200 includes an electric throttle 210 that adjusts an intake air amount (torque) of engine 200. The electric throttle 210 includes a throttle valve 211 and a throttle motor 212 that changes the opening of the throttle valve 211, and the throttle motor 212 is driven by a drive circuit 213.

The electronic control device 300 controls the output torque of the engine 200 by controlling the opening degree of the throttle motor 212 via the drive circuit 213.
The electronic control device 300 includes a main MPU (Micro-Processing Unit) 301, a sub MPU 302 as a monitoring IC for monitoring the operation of the main MPU 301, a RAM (Random Access Memory) 303, a ROM (Read Only Memory) 304, and the like. 310 is provided.

A ROM 304 (nonvolatile memory) is used as a memory for storing a control program for the electric throttle 210, various diagnostic programs, and control data used to implement these programs, and a RAM 303 (volatile memory). Is used as a work memory for operating the aforementioned program.
The electronic control device 300 (microcomputer 310) then detects an accelerator opening sensor 401 that detects the opening ACC of an accelerator pedal (not shown) operated by the driver, and a throttle that detects the throttle opening TVO of the electric throttle 210. Output signals of various sensors such as the opening sensor 402 are input, and an operation signal set based on these sensor signals is output to the drive circuit 213 to control the opening of the electric throttle 210.

FIG. 2 is a software block diagram illustrating control functions and diagnostic functions of the electronic control device 300.
The accelerator opening information from the accelerator opening sensor 401 and the throttle opening information from the throttle opening sensor 402 are processed by the redundant operation units 1001 and 1002, respectively. Is set.

For example, the sensors 401 and 402 are provided in duplicate, and the redundant system calculation units 1001 and 1002 determine the consistency of the outputs of the sensors provided in duplicate and determine the accelerator opening data and throttle opening used for control. Determine the data.
The redundant system computing unit 1001 outputs accelerator opening data to the target torque computing unit 1003, and the target torque computing unit 1003 computes a target value (target torque) of the output torque of the engine 200 based on the accelerator opening data.

Further, the target torque calculation unit 1003 outputs the target torque to the throttle target opening calculation unit 1004, and the throttle target opening calculation unit 1004 calculates the throttle target opening based on the target torque, and electrically controls it as a throttle control motor command. Output to the drive circuit 213 of the throttle 210.
On the other hand, the redundant system calculation unit 1002 outputs the throttle opening data to the target value / actual value diagnosis unit 1005, and the target value / actual value diagnosis unit 1005 outputs the throttle target opening that is the output of the throttle target opening calculation unit 1004. And the actual throttle opening, which is the output of the redundant system calculation unit 1002, is compared.

The target value / actual value diagnosis unit 1005 determines whether there is an abnormality in which the actual throttle opening does not follow the target throttle opening based on the deviation between the target throttle opening and the actual throttle opening, in other words, the throttle control function. Detect the presence or absence of abnormalities.
For example, the target value / actual value diagnosis unit 1005 detects the occurrence of an abnormality in the throttle control function when the duration of the state where the deviation between the throttle target opening and the actual throttle opening is larger than a threshold value reaches a set time. To do.

An abnormality in which the actual throttle opening does not follow the target throttle opening occurs due to a failure of the drive circuit 213 and the throttle motor 212 or the like.
Here, when the target value / actual value diagnosis unit 1005 detects an abnormality in the actual throttle opening, it cuts the output of the throttle target opening (motor command) from the throttle target opening calculation unit 1004 to the drive circuit 213. A cut command is output to the cut unit 1010 to be performed.

With this cut command, the drive of the throttle motor 212 is stopped, and a fail-safe process is performed in which the opening degree of the electric control throttle 210 is fixed at the default opening degree (fully closed position or predetermined low opening degree).
Therefore, due to a failure of the drive circuit 213 and the throttle motor 212, the throttle actual opening is controlled to a high opening exceeding the throttle target opening, in other words, the actual output torque is controlled to a high output torque state exceeding the target torque. Thus, the output torque of the engine 200 can be suppressed and the vehicle can be guided to the safe side.

On the other hand, the example calculation unit 1006 performs a calculation process for diagnosing whether or not the diagnosis function (abnormality detection function) of the target value / actual value diagnosis unit 1005 is normal.
The example calculation unit 1006 has an example output unit 1006a that gives an example to the target value / actual value diagnosis unit 1005 (actual operation unit or copy), and an answer reception unit 1006b that receives the answer of the example in the target value / actual value diagnosis unit 1005. The answer determination unit 1006c for comparing the response from the target value / actual value diagnosis unit 1005 with the expected value, and the example output to the target value / actual value diagnosis unit 1005 and the expected value of the answer of the example as a pair And a question / answer table 1006d to be stored.

If the target value / actual value diagnosis unit 1005 does not output an answer that matches the expected value, the target value / actual value diagnosis unit 1005 may not function normally.
Therefore, the answer determination unit 1006c outputs a cut command to the cut unit 1010 when the target value / actual value diagnosis unit 1005 does not output an answer that matches the expected value. Output of the target opening (motor command) to the drive circuit 213 is cut, and fail-safe processing is performed to set the opening of the electric throttle 210 to the default opening.

The cut unit 1010 drives the throttle target opening (motor command) from the throttle target opening calculation unit 1004 when at least one of the target value / actual value diagnosis unit 1005 and the answer determination unit 1006c commands output cut. The output to the circuit 213 is cut.
In other words, if the target value / actual value diagnosis unit 1005 is not functioning normally, the target value / actual value diagnosis unit 1005 may not perform the fail-safe process even though the actual throttle opening is abnormal. Therefore, the answer determination unit 1006c performs fail-safe processing that cuts the output to the drive circuit 213.

As a result, when an abnormality occurs in the program data functioning as the target value / actual value diagnosis unit 1005, it is possible to prevent the actual output torque from being controlled to be higher than the target, leading the vehicle to the safe side. it can.
Further, an ALU diagnosis unit 1007 for diagnosing an arithmetic function of an ALU (Arithmetic Logic Unit) of the main MPU 301 is provided.

  The ALU diagnosis unit 1007 includes an example reception unit 1007a that receives questions from the sub MPU 302 (monitoring IC), an ALU diagnosis unit 1007b that causes the ALU of the main MPU 301 to calculate an example received by the example reception unit 1007a, and an ALU diagnosis unit 1007b. An answer receiving unit 1007c that receives the calculation result (answer) in, and an answer sending unit 1007d that outputs the answer data received by the answer receiving unit 1007c to the sub MPU 302 side.

The answer reception unit 1007c receives the calculation result (answer) in the ALU diagnosis unit 1007b and the normal / abnormal determination result in the answer determination unit 1006c.
If the answer determination unit 1006c determines that there is an abnormality, the answer reception unit 1007c outputs an incorrect answer to the answer transmission unit 1007d regardless of the calculation result (answer) in the ALU diagnosis unit 1007b. If the normal determination is made in 1006c, the calculation result (answer) in the ALU diagnosis unit 1007b is output as it is to the answer transmission unit 1007d.
The software block described above is a program processed by the main MPU 301.

On the other hand, the sub MPU 302 has a calculation function as an example calculation unit 1008 that issues a question to the ALU diagnosis unit 1007 and receives an answer from the ALU diagnosis unit 1007.
The example calculation unit 1008 outputs an example to the example receiving unit 1007a of the ALU diagnosing unit 1007, an example to be output to the example receiving unit 1007a of the ALU diagnosing unit 1007, and an expected value of the answer of the example Questions / answers table 1008b that stores them as a pair, an answer receiving unit 1008c that receives an answer from the answer sending unit 1007d of the ALU diagnosis unit 1007, an answer received by the answer receiving unit 1008c, and an expectation that the question / answer table 1008b outputs And an answer determination unit 1008d for comparing the values.

When the answer received by the answer receiving unit 1008c is different from the expected value, the answer determining unit 1008d (the connection circuit between the power supply and the drive circuit 213) supplies power to the drive circuit 213 of the throttle motor 212 of the electronic throttle 210. ) Is turned off, and power supply to the throttle motor 212 is cut off.
That is, the answer determination unit 1008d of the sub MPU 302 determines that the answer is different from the expected value when an abnormality occurs in the arithmetic function in the ALU of the main MPU 301, and the target value / actual value diagnosis unit 1005 Even when an abnormality occurs in the diagnostic function (diagnostic program), it is determined that the answer and the expected value are different. In either case, the sub MPU 302 performs a fail-safe process for turning off the motor relay 214.

  As a result, an abnormality occurs in the program data that functions as the target value / actual value diagnosis unit 1005 on the main MPU 301 side, and an abnormality occurs in the program data that functions as the answer determination unit 1006c on the main MPU 301 side. Even if the fail-safe process for cutting the motor output cannot be performed when the control abnormality 210 occurs, if the answer determination unit 1008d on the sub MPU 302 functions normally, the actual output of the engine 200 The torque can be prevented from being controlled to be higher than the target, and the vehicle can be guided to the safe side.

  As will be described in detail later, the ROM 304 in which a program for executing each software function shown in FIG. 2 is placed is usually placed together with a program (control program) for performing control processing of an external device such as the electric throttle 210. It is divided into two areas: a control area (normal calculation area and control area) and a high safety area (important calculation area and diagnosis area) that mainly stores important programs related to functional safety such as diagnostic programs. .

  The programs that function as the redundant system calculation units 1001 and 1002, the target torque calculation unit 1003, the throttle target opening calculation unit 1004, the target value / actual value diagnosis unit 1005, and the cut unit 1010 are the normal control area of the ROM 304. The programs that function as the example operation units 1006 and 1008, the ALU diagnosis unit 1007, and the microcomputer system diagnosis unit 1100 described later are placed in the high safety area of the ROM 304.

  In other words, since the safety of the control system cannot be guaranteed unless the diagnostic program is executed normally, the diagnostic program is generally more important than the control program, and the importance is higher in the high safety area than the control program. A high-level diagnostic program is placed (in other words, a process with high importance is implemented), and the data security level is normally controlled in the high safety area by multiple executions of memory defect diagnostic processing as described later. It is designed to be higher than the area.

The RAM 303 is also divided into a normal control area (normal calculation area) and a high safety area (important calculation area), and a program placed in the normal control area of the ROM 304 uses the normal control area of the RAM 303 as a work memory. The program placed in the high safety area of the ROM 304 is set to use the high safety area of the RAM 303 as a work memory.
As described above, the diagnostic program is mounted in the high safety area of the memory (ROM 304 and RAM 303), and the control program is mounted in the normal control area of the memory (ROM 304 and RAM 303).

  In the example of FIG. 2, the program that functions as the target value / actual value diagnosis unit 1005 is placed in the normal control area of the ROM 304, and the normal control area of the RAM 303 is used as a work memory. A program that functions as 1005 can be placed in the high safety area of the ROM 304, and the target value / actual value diagnosis unit 1005 can be set to use the high safety area of the RAM 303 as a work memory.

  In other words, the process of diagnosing the diagnosis unit is more important than the diagnosis target unit, and it is necessary to increase the security level. As the diagnosis process is overlaid, the requirement for the security level becomes higher. On the other hand, the high safety area is an area where the security level is higher than the normal control area, as will be described in detail later. Will be mounted in the high safety area.

  However, the minimum line of the security level (importance) of the processing implemented in the high safety area can be changed as appropriate according to the design concept, calculation load, memory usage, etc. Process (for example, target value / actual value diagnosis unit 1005) can be implemented in the normal control area, and all diagnosis processes including the target value / actual value diagnosis unit 1005 are implemented in the high safety area. can do.

  Here, the microcomputer system diagnosis unit 1100 includes a normal ROM diagnosis unit 1101 that performs diagnosis for the entire area of the ROM 304, a normal RAM diagnosis unit 1102 that performs diagnosis for the entire area of the RAM 303, and a high safety area of the ROM 304 (part of the ROM 304). A high safety area ROM diagnosis unit 1103 that diagnoses the high safety area, and a high safety area RAM diagnosis unit 1104 that diagnoses the high safety area of the RAM 303 (part of the RAM 303).

A program functioning as each diagnosis unit included in the microcomputer diagnosis unit 1100 is placed in the high safety area of the ROM 304, and a work area is allocated on the high safety area of the RAM 303.
That is, the entire areas of the ROM 304 and the RAM 303 are diagnosed by the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102, and the high safety area ROM diagnosis unit assigned to the high safety area is assigned to the high safety area of the ROM 304 and RAM 303. 1103, diagnosis by the high safety area RAM diagnosis unit 1104 is further performed, and memory diagnosis is performed twice for the high safety areas of the ROM 304 and the RAM 303.

  The normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 are diagnosed by the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104, and the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104 Mutual monitoring diagnosed by the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 is performed.

FIG. 3A illustrates the separation of the normal control area and the high safety area in the ROM 304 and the program arrangement in each area.
In the high safety area of the ROM 304, there are programs that function as a high safety area RAM diagnostic unit 1104, a high safety area ROM diagnostic unit 1103, a normal RAM diagnostic unit 1102, a normal ROM diagnostic unit 1101, an ALU diagnostic unit 1007, and an example calculation unit 1006. Placed.

In the normal control area of the ROM 304, programs that function as the target torque calculation unit 1003, the throttle target opening calculation unit 1004, the redundant system calculation units 1001, 1002, and the like are placed.
On the other hand, FIG. 3B illustrates a program that separates the normal control area and the high safety area in the RAM 303 and uses each area as a work memory.

In the high safety area of the RAM 303, control programs of a high safety area RAM diagnostic unit 1104, a high safety area ROM diagnostic unit 1103, a normal RAM diagnostic unit 1102, a normal ROM diagnostic unit 1101, an ALU diagnostic unit 1007, and an example calculation unit 1006 are stored. An area to be used as work memory is set.
In the normal control area of the RAM 303, areas used by each control program such as the target torque calculation unit 1003, the throttle target opening calculation unit 1004, the redundant system calculation units 1001 and 1002 as work memory are set.

  Then, the high safety area ROM diagnosis unit 1103 diagnoses the high safety area of the ROM 304, thereby diagnosing a program placed in the high safety area of the ROM 304. The high safety area RAM diagnosis unit 1104 is a high safety area of the RAM 303. By diagnosing the area, the data used by the program placed in the high safety area of the ROM 304 is diagnosed.

Further, the normal ROM diagnosis unit 1101 performs diagnosis for all areas including the high safety area and the normal control area of the ROM 304, and the normal RAM diagnosis unit 1102 performs diagnosis for all areas including the high safety area and the normal control area of the RAM 303. Do.
In FIG. 3, the high safety area and the normal control area in the RAM 303 and the ROM 304 are continuous areas, but the normal control area is set so as to be sandwiched between the high safety areas separated into two areas. Conversely, the high safety area can be set so as to be sandwiched between the normal control areas separated into two areas, and the high safety area and the normal control area are not limited to one continuous area. Absent.

  The normal control program implemented in the normal control area of the ROM 304 and performing the engine control (drive control of the electric throttle 210) using the normal control area of the RAM 303 as a work memory frequently accesses the memory. Therefore, the normal control area of the ROM 304 and the RAM 303 If the diagnosis is frequently performed, the engine control may be affected by an increase in calculation load.

  Therefore, the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 perform the diagnosis of the ROM 303 and the RAM 304 by using the free time of the normal control program so as not to affect the engine control. For this reason, the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 require a long time for the diagnosis of the ROM 303 and the RAM 304, and the diagnosis execution cycle becomes long.

On the other hand, the high safety area of the ROM 304 and the RAM 303 is not accessed by a normal control program (engine control program), and is a partial area of the ROM 303 and the RAM 304, and the diagnosis area is narrower than the entire area.
Therefore, the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104 have a shorter time required for diagnosis than the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 without affecting engine control. High safety area can be diagnosed in a shorter cycle.

In other words, the high safety area is diagnosed by the normal ROM diagnostic unit 1101 and the normal RAM diagnostic unit 1102, and further diagnosed in a shorter cycle by the high safety area ROM diagnostic unit 1103 and the high safety area RAM diagnostic unit 1104. It has come to be.
With this configuration, the data security level (data protection level) in the high safety area is higher than that in the normal control area. Therefore, by assigning diagnostic processing, which is an important program, to the high safety area, the reliability of the diagnostic processing is increased and the safety of the vehicle can be improved.

Further, a high safety area ROM diagnosis unit 1103, a high safety area RAM diagnosis unit 1104, a normal ROM diagnosis unit 1101, and a normal RAM diagnosis unit 1102 are allocated to the high safety areas of the ROM 303 and the RAM 304.
Thus, the reliability of the normal ROM diagnostic unit 1101 and the normal RAM diagnostic unit 1102 is ensured by the diagnosis by the high safety region ROM diagnostic unit 1103 and the high safety region RAM diagnostic unit 1104, while the high safety region ROM diagnostic unit 1103 and the high safety Mutual monitoring of the diagnosis units can be realized in which the reliability of the area RAM diagnosis unit 1104 is ensured by diagnosis by the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102.

Since the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 are diagnosed in a short cycle by the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104, the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 are diagnosed. Therefore, the validity of the whole area diagnosis according to the above is guaranteed, and the data of all areas of the ROM 304 and the RAM 33 can be ensured at a high level.
The normal ROM diagnosis unit 1101 and the high safety area ROM diagnosis unit 1103 calculate error detection codes such as a sum and parity for the data in the diagnosis area of the ROM 304, and embed the calculated error detection code and the ROM 304 in advance. The presence or absence of data error (memory failure) is detected by performing a comparison test with the measured value.

Further, the normal RAM diagnosis unit 1102 and the high safety area RAM diagnosis unit 1104, for example, perform a read / write test on the diagnosis area of the RAM 303 to detect the presence or absence of a failure (memory defect) in the RAM 303.
By the way, the allocation of each process in the ROM 304 and the RAM 303 is not limited to the example shown in FIG. 3, and for example, the allocation as in the example shown in FIG. 4 may be performed.

4 allocates the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 to the normal control areas of the ROM 304 and the RAM 303 in consideration of the resources (time and memory areas allocated for calculation) allocated to the high safety area of the ROM 304 and the RAM 303. An example is shown.
That is, in the example shown in FIG. 3, the area on the ROM 304 where the normal ROM diagnostic unit 1101 and the normal RAM diagnostic unit 1102 are placed, and the RAM 303 used as the work memory by the normal ROM diagnostic unit 1101 and the normal RAM diagnostic unit 1102 These areas were both designated as high safety areas.

On the other hand, the example shown in FIG. 4 is different in that both the area on the ROM 304 where the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 are placed and the area on the RAM 303 used as a work memory are set as normal control areas.
As described above, the resources allocated to the program placed in the high safety area can be reduced by reducing the process assigned to the high safety area, while the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 free up the normal control program. Since the entire region is diagnosed by using it, processing with resources allocated to the normal control region is possible.

Here, the diagnosis of the ROM 304 and the RAM 303 by the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 is performed for the entire area of the ROM 304 and the RAM 303 in both cases of FIGS.
On the other hand, the diagnosis of the ROM 304 and the RAM 303 by the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104 is performed for the high safety area in the example of FIG. 3, but in the example of FIG. Of the normal control area, the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 are placed, and the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 use the work area.

In other words, the target area to be diagnosed by the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104 is the area in which the diagnosis control program is placed on the ROM 304 and the diagnosis in common with FIGS. This is an area used by the control program as a work area on the RAM 303.
Therefore, even when the allocation shown in FIG. 4 is performed, the reliability of the normal ROM diagnostic unit 1101 and the normal RAM diagnostic unit 1102 is guaranteed by the diagnosis by the high safety region ROM diagnostic unit 1103 and the high safety region RAM diagnostic unit 1104. On the other hand, it is possible to realize mutual monitoring of the diagnosis units that guarantees the reliability of the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104 by the diagnosis by the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102.

Since the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 are diagnosed in a short cycle by the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104, the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102 are diagnosed. Therefore, the validity of the whole area diagnosis according to the above is guaranteed, and the data of all areas of the ROM 304 and the RAM 33 can be ensured at a high level.
In the allocation shown in FIG. 4, the normal ROM diagnostic unit 1101 and the normal RAM diagnostic unit 1102, which have a large calculation load, are allocated to the normal control areas of the ROM 304 and RAM 303, so that resources allocated to the high safety area are limited. However, diagnostic processing such as the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104 assigned to the high safety area can be performed in a short cycle.

FIG. 5 shows a configuration example of the memory and each processor core when the main MPU 301 is multi-core (dual core).
The main MPU 301 is configured by enclosing two processor cores, a first processor core 301a and a second processor core 301b, in one processor package.

One ROM 304 shared by the two processor cores 301a and 301b is provided, and the ROM 304 is divided into a high safety area and a normal control area.
The first processor core 301 a executes a program placed in the normal control area of the ROM 304, and the second processor core 301 b executes a program placed in the high safety area of the ROM 304.

On the other hand, as the RAM 303, the first processor core 301a uses the entire area as the normal control area and the first processor core 301a uses it as a work area, and the entire area as the high safety area uses the second processor core 301b as the work area. Second RAM 303b (second local RAM), and a third RAM 303c (global RAM) that is divided into a normal control area and a high safety area and is shared by the first processor core 301a and the second processor core 301b.
The hatched area in FIG. 5 indicates the high safety area, and the areas other than the hatched areas in the RAM 303 and ROM 304 indicate the normal control area.

FIG. 6 shows the settings of the normal control area and high safety area in the ROM 304, the first to third RAMs 303a to 303c, the area where the program is placed, and the area used by the program as a work area in the memory configuration shown in FIG.
In FIG. 6, in the normal use area of the shared ROM 304, a redundant system calculation unit 1001, 1002, a target torque calculation unit 1003, a throttle target opening calculation unit 1004, etc. are placed, and a normal use for the first processor core 301a is performed. A RAM diagnostic unit 1102a is placed.

On the other hand, in the high safety area of the shared ROM 304, in addition to the example operation unit 1006 and the ALU diagnosis unit 1007, the normal RAM diagnosis unit 1102b, the normal ROM diagnosis unit 1101, and the high safety area ROM diagnosis unit for the second processor core 301b are used. 1103, a high safety area RAM diagnostic unit 1104 is placed.
Further, the normal control area of the shared third RAM 303c is a work area of a program placed in the normal control area of the ROM 304. The redundant system calculation units 1001, 1002, the target torque calculation unit 1003, the throttle target opening calculation unit 1004, the normal RAM Used as a work area for the diagnosis unit 1102a.

On the other hand, the high safety area of the shared third RAM 303c is allocated as a work area for the normal RAM diagnostic unit 1102b, the normal ROM diagnostic unit 1101, the high safety area ROM diagnostic unit 1103, and the high safety area RAM diagnostic unit 1104.
The second RAM 303b used as the work area by the second processor core 301b is allocated as a work area for the example calculation unit 1006 and the ALU diagnosis unit 1007.

Then, the second processor core 301b follows the high safety area ROM diagnosis unit 1103 placed in the high safety area of the shared ROM 304, and the normal RAM diagnosis part of the high safety area of the shared ROM 304 and the normal control area of the shared ROM 304 Data diagnosis (presence / absence of data error) is performed on the area where 1102a is placed.
Further, the second processor core 301b performs data diagnosis (whether there is an error in data, whether there is data error, in accordance with the normal ROM diagnosis unit 1101 placed in the high safety area of the shared ROM 304, and all areas of the high safety area and the normal control area of the shared ROM 304). Diagnose memory defects).

On the other hand, the second processor core 301b follows the high safety area RAM diagnosis unit 1104 placed in the high safety area of the shared ROM 304, and the normal RAM of the high safety area of the shared third RAM 303c and the normal control area of the shared third RAM 303c. Diagnosis (diagnosis of data error, diagnosis of memory defect) is performed for the area used as a work area by the diagnosis unit 1102a and the entire area of the second RAM 303b.
The second processor core 301b performs diagnosis (data error diagnosis, memory defect diagnosis) on the entire area of the shared third RAM 303c and the entire area of the second RAM 303b in accordance with the normal RAM diagnosis unit 1102b placed in the high safety area of the shared ROM 304. Diagnosis).

The first processor core 301a performs all of the first RAM 303a according to the normal RAM diagnosis unit 1102a placed in the normal control area of the shared ROM 304 at the same time as or after completion of the diagnosis according to the normal RAM diagnosis unit 1102b by the second processor core 301b. Data diagnosis (data error diagnosis, memory defect diagnosis) is performed for the area.
Even in the above configuration, the reliability of the normal ROM diagnosis unit 1101 and the normal RAM diagnosis units 1102a and 1102b is guaranteed by the diagnosis by the high safety region ROM diagnosis unit 1103 and the high safety region RAM diagnosis unit 1104, while the high safety region ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104 can be mutually monitored by the diagnosis unit to ensure the reliability of the diagnosis by the normal ROM diagnosis unit 1101 and the normal RAM diagnosis unit 1102b.

  Since the normal ROM diagnosis unit 1101 and the normal RAM diagnosis units 1102a and 1102b are diagnosed in a short cycle by the high safety area ROM diagnosis unit 1103 and the high safety area RAM diagnosis unit 1104, the normal ROM diagnosis unit 1101 and the normal RAM diagnosis The validity of the entire area diagnosis by the units 1102a and 1102b is ensured, and the data in all areas of the ROM 304 and the RAMs 33a to 303c can be ensured at a high level.

FIG. 7 shows the processing flow of various programs and the configuration of the RAM 303 when the main MPU 301 is a single core.
The block on the left side of FIG. 7 schematically shows the flow of processing of the program placed in the normal control area of the ROM 304. The program placed in the normal control area of the ROM 304 accesses the normal control area of the RAM 303. Process.

A flowchart (A) shows an example of background processing.
The microcomputer 310 is reset in step S2101 so that the MPUs 301 and 302 are initialized in step S2102, and then the background process in step S2103 is performed.

The microcomputer 310 determines the end flag in step S2104, and continues the background processing until the end flag is set.
On the other hand, when the end flag is set, the microcomputer 310 performs various end processes in step S2105 and waits for reset (restart).

Further, the flowchart (B) shows an example of an interrupt process based on the timer module X.
The microcomputer 310 performs 1 ms task processing in step S2202 by performing an interrupt every 1 ms based on the timer module X in step S2201, performs 5 ms task processing in step S2203, and performs 10 ms task processing in step S2204. Processing is executed, and in step S2205, 100 ms task processing is executed.

Further, the flowchart (C) shows an example of processing based on an interrupt factor (for example, rising and falling of an input pulse signal).
The microcomputer 310 performs various interrupt processes in step S2302 when an interrupt is generated based on various interrupt factors in step S2301.

The block on the right side of FIG. 7 schematically shows the processing flow of the program placed in the high safety area of the ROM 304. The program placed in the high safety area of the ROM 304 accesses the high safety area of the RAM 303. Process.
In step S2401 of the flowchart (D), the microcomputer 310 is interrupted based on a timer module Y that is not used in the normal control area program (timer module Y separate from the timer module X). Perform scheduled task processing of safety area program.

Further, the central block in FIG. 7 shows the function of dividing the area in the RAM 303, multiplexing the RAM data, and the function of transferring data between the normal control area and the high safety area of the RAM 303.
The high safety area of the RAM 303 accessed by the program placed in the high safety area of the ROM 304 is updated in the data copied from the normal control area of the RAM 303, the data copied to the normal control area of the RAM 303, and the high safety area of the RAM 303. Data is saved.

Here, data copying (data transfer) between the normal control area and the high safety area is performed by a macro soft interface that is placed in the high safety area of the ROM 304 and has a data check function.
The above interface has an input interface for copying data stored in the normal control area of the RAM 303 to the high safety area of the RAM 303, and copies data stored in the high safety area of the RAM 303 to the normal control area of the RAM 303. Output interface for

Some data may correspond to all of data copied from the normal control area to the high safety area, data copied from the high safety area to the normal control area, and data updated in the high safety area.
The software interface can be placed in the normal control area instead of the high safety area of the ROM 304. In this case, an interface for copying data stored in the high safety area of the RAM 303 to the normal control area of the RAM 303 is an input interface. Thus, an interface for copying data stored in the normal control area of the RAM 303 to the high safety area of the RAM 303 is an output interface.

The high safety area of the RAM 303 is set to store data multiplexed. As the data multiplexing, for example, a pair of original data and data obtained by inverting the original data (inverted value) is stored.
The software interface process when the original data and the inverted data are stored as a pair in the high safety area is as follows.

When the program placed in the normal control area of the ROM 304 uses the data stored in the normal control area of the RAM 303 by the program placed in the high safety area of the ROM 304, the input interface uses the data on the normal control area side as it is in the high safety area. And the inverted value of the data on the normal control area side is stored in the high safety area.
On the other hand, when the program stored in the high safety area of the RAM 304 uses the data stored in the high safety area of the RAM 303 by the program stored in the high safety area of the ROM 304, the output interface is stored in pairs in the high safety area. It is determined whether or not the original data and the inverted data are correct (whether they are in an inverted relationship).

The output interface then copies the original data to the normal control area when the data is correct (when it is in an inverted relationship), and the stored data is incorrect (when it is not in an inverted relationship). Is written to the normal control area.
Note that data multiplexing (multi-faceted, multi-stored) in the high safety area of the RAM 303 is not limited to duplexing of original data and inverted data, and the same data is stored twice. In addition, it can be stored in triplicate or more.

When the same data is stored in the high safety area of the RAM 303 and the data is copied to the normal control area, the output interface determines whether the data stored in the high safety area is correct. Judgment is made based on whether or not all the multiplexed data match.
When all the multiplexed data matches, the data is copied to the normal control area, and when all the multiplexed data does not match, information indicating that the data is not correct is written to the normal control area.

On the other hand, a program placed in the high safety area of the ROM 304 stores data in accordance with a predetermined multiplexing rule such as an inversion relationship or the same by comparing a group of data stored in the high safety area of the RAM 303 with each other. Check if it has been done.
The program placed in the high safety area uses the data when the data is stored in accordance with a predetermined multiplexing rule, and the data stored in a multiplexed manner does not satisfy the predetermined multiplexing storage rule and the RAM 303 is defective. If this occurs, a predetermined fail-safe process is performed.

In addition, when the same data is stored in the high safety area of the RAM 303 more than three times, data having a large number of identical data among a plurality of data is determined as correct data, and the data determined to be correct Can be copied to the normal control area or used as data adopted by the program in the high safety area.
For example, if the same data is stored in triplicate in the high safety area of the RAM 303, if all three are the same, it is determined that all of the data stored in triplicate is correctly stored and the data is used as is. If two of the three are identical, the two identical data are stored correctly, but the remaining one data is considered to be stored in the wrong value and is identical 2 Use two data.

FIG. 8 shows the processing flow of various programs and the configuration of the RAM 303 when the main MPU 301 of the microcomputer 310 is not a single core but a multi-core.
The block on the left side of FIG. 8 schematically shows the flow of processing by the first processor core 301a for the program placed in the normal control area of the ROM 304. The flow of processing (flow chart ( A), (B), and (C)) are the same as those described in FIG. 7, and detailed description thereof is omitted.

In the case of the multi-core system shown in FIG. 8, the first processor core 301a accesses the first RAM 303a (local RAM) dedicated to the first processor core 301a and the third RAM 303c (shared RAM) shared with the second processor core 301b. Then, processing is performed, and data shared with the second processor core 301b is stored in the third RAM 303c.
The block on the right side of FIG. 8 schematically shows the flow of processing by the second processor core 301b for the program placed in the high safety area of the ROM 304.

Here, the second processor core 301b performs the process for ensuring the reliability of the high safety area in the same manner as the flowchart (D) shown in FIG. In the case of a multi-core system, background processing is possible on the second processor core 301b side, and a flowchart (E) showing background processing is also described on the second processor core 301b side.
In the flowchart (E), when the second processor core 301b receives a start command in step S2501, the second processor core 301b performs initialization processing in step S2502, and then performs background processing in step S2503.

Then, the second processor core 301b determines the end flag in step S2504, and continues the background processing until the end flag is set.
On the other hand, when the end flag is set, the second processor core 301b notifies the first processor core 301a of the end of processing in the second processor core 301b in step S2505.

  The second processor core 301a accesses the second RAM 303b (local RAM) dedicated to the second processor core 301a and the third RAM 303c (shared RAM) shared with the first processor core 301a to perform processing. Data shared with the core 301a is stored in the third RAM 303c, and update data used only in the high safety area program is stored in the second RAM 303b.

The central block of FIG. 8 shows the area partitioning of the third RAM 303c, the multiplexing of RAM data, and the data transfer function between the normal control area and the high safety area in the multi-core system.
Update data that is used only by the program in the high safety area is stored in the second RAM 303b. In the high safety area of the third RAM 303c accessed by the program placed in the high safety area of the ROM 304, data copied from the normal control area of the third RAM 303c, Data to be copied is stored in the normal control area of the third RAM 303c.

When data in the normal control area of the third RAM 303c is copied to the high safety area, the data is multiplexed and copied by the input interface.
On the other hand, the data to be copied to the normal control area of the third RAM 303c is multiplexed and stored in the high safety area of the third RAM 303c, and the output interface is used to check the consistency of the data stored in the high safety area of the third RAM 303c. After the determination, it is copied to the normal control area of the third RAM 303c.

FIG. 9 shows another example of the processing flow of various programs and the data delivery function when the main MPU 301 is multi-core.
In FIG. 9, the processing on the first processor core 301a side and the processing on the second processor core 301a side are the same as those in the configuration example shown in FIG. 8, but data is transferred between the high safety area and the normal control area. Function is different.

In the example shown in FIG. 9, the second processor core 301a receives data copied from the normal control area of the third RAM 303c, data copied to the normal control area of the third RAM 303c, and update data used only on the high safety area side. The data is stored in the second RAM 303b dedicated to the two-processor core 301a.
The data copy from the normal control area of the third RAM 303c to the second RAM 303b is performed by an input interface placed on the high safety area side, and the input interface multiplexes and stores the data of the normal control area of the third RAM 303c in the second RAM 303b. To do.

In addition, data that is multiplexed and stored in the second RAM 303b and copied to the normal control area of the third RAM 303c is subjected to data check (judgment of consistency of multiplexed data) by an output interface placed on the high safety area side, Copied to the normal control area of the third RAM 303c.
That is, in the configuration example shown in FIG. 9, data can be transferred between the second RAM 303b dedicated to the second processor core 301a and the shared third RAM 303c without storing the multiplexed data in the shared third RAM 303c. become.

  In the configuration shown in FIG. 9, since the second RAM 303b dedicated to the two processor cores 301a is accessed in the data transfer, the second processor core 301a side needs to perform processing as a software interface. Therefore, the software interface is placed in the high safety area of the ROM 304 and executed by the second processor core 301a.

The technical ideas described in the above embodiments can be used in appropriate combination as long as no contradiction arises.
Although the contents of the present invention have been specifically described with reference to preferred embodiments, it is obvious that those skilled in the art can take various modifications based on the basic technical idea and teachings of the present invention. is there.

Although the electronic control device 300 controls the electric throttle 210, the control target is obviously not limited to the electric throttle 210. For example, a fuel injection device, an automatic transmission, a brake device, etc. Can be controlled.
The electronic control apparatus 300 includes a sub MPU 302 that monitors the main MPU 301 together with the main MPU 301, but the sub MPU 302 may be omitted.

Further, the main MPU 301 and the sub MPU 302 of the electronic control device 300 can be read as the main CPU and the sub CPU.
As a monitoring method of the main MPU 301 by the sub MPU 302, a watchdog timer (WDT) method in which the sub MPU 302 monitors a pulse signal having a predetermined period output from the main MPU 301 can be adopted in addition to the above-described example answer method.

Here, technical ideas other than the claims that can be grasped from the above embodiment will be described together with effects.
(I)
The whole area including the normal calculation area and the important calculation area is diagnosed by a normal memory diagnosis process implemented in the area diagnosed by the memory diagnosis. Electronic control device.
According to the above-described invention, the mutual diagnosis of the memory diagnosis of the important calculation area and the normal memory diagnosis of the entire area is realized, thereby ensuring the validity of the normal memory diagnosis of the entire area.

(B)
The automobile electronic control device according to claim 1, wherein the diagnosis by the memory diagnosis is performed in a shorter cycle than the diagnosis by the normal memory diagnosis process.
According to the above invention, the important calculation area is diagnosed twice by the memory diagnosis and the normal memory diagnosis process, and the memory diagnosis is diagnosed at a cycle shorter than that of the normal memory diagnosis process. Data security can be performed.

(C)
The control program for controlling an external device is mounted in the normal calculation area, and the diagnosis program is mounted in the important calculation area. 5. Electronic control unit for automobiles.
According to the above invention, the diagnostic program that affects the safety of the control is guaranteed, and the safety of the automobile can be improved.

(D)
A timer module for realizing a scheduled task process when executing the program of the important calculation area and a timer module for realizing the scheduled task process when executing the program of the normal calculation area are individually provided. The electronic control device for automobiles according to any one of claims 1 to 3 and (a) to (c).
According to the above invention, the use of separate timer modules for the normal calculation area and the important calculation area ensures independence between the scheduled task process in the normal calculation area and the scheduled task process in the important calculation area. .

(E)
From (1) to (3), comprising (a) a multi-core consisting of a first processor core that executes the program in the important calculation area and a second processor core that executes the program in the normal calculation area. The electronic control apparatus for motor vehicles as described in any one of d).
According to the above invention, when the CPU (MPU) is multi-core, the local RAM diagnosis can be executed in parallel as a configuration in which the core is used separately for the execution of the program in the important calculation area and the execution of the program in the normal calculation area. .

DESCRIPTION OF SYMBOLS 100 ... Automobile, 200 ... Engine, 210 ... Electronic control throttle, 300 ... Electronic control unit, 301 ... Main MPU, 302 ... Sub MPU, 303 ... RAM

Claims (3)

  An automotive electronic control device in which a memory area is divided into two areas, a normal calculation area and an important calculation area, and the important calculation area is diagnosed by a memory diagnosis process installed in the important calculation area.   The automobile electronic control device according to claim 1, wherein the important calculation area on the RAM as the memory stores data multiplexed.   The electronic control device for an automobile according to claim 1 or 2, wherein data is transferred between a normal calculation area and an important calculation area of a RAM as the memory by an interface having a data check function.