JP2016189118A - Electronic control apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To evaluate whether the order of executing modules is proper or not, while reducing processing load.SOLUTION: A control apparatus 1 (ECU), which is a vehicle electronic control apparatus that executes a control program including a plurality of modules to be executed in a predetermined order, includes: a CRC calculation unit 15 which applies arithmetic operation of a predetermined rule to input data, and outputs a result thereof; and a processor 11 which substitutes identification data of the first module in the control program and an initial value into the CRC calculation unit 15 when the module is executed, sequentially substitutes identification data of the second and subsequent modules and output data of the CRC calculation unit 15 relating to a module executed immediately before, into the CRC calculation unit 15, when the modules are executed, and evaluates the order of executing the modules, on the basis of a comparison between reference data and output data output finally from the CRC calculation unit 15.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an electronic control device mounted on an automobile.

  As a concept of functional safety software design in an electronic control device for automobiles, for example, in functional safety standards for automobiles (ISO 26262) regarding the application of functional safety of a plurality of modules constituting a program, ASIL ( Automotive Safety Integrity Level) has been proposed. In ASIL, it is required to classify according to severity, probability of exposure, controllability, etc., and develop at a design level corresponding to that.

  On the other hand, there is a module (QM: Quality Management) that is classified into a class that does not require application of functional safety in current software. Therefore, in a software system, when safety-related parts (ASIL) and non-safety-related parts (QM) are mixed due to differences in design levels, they are mutually non-existent based on FFI (Freedom from Interference) of automotive functional safety standards. Guarantees of interference are required and must be substantially independent.

  Here, as one of the methods for realizing independence based on FFI, for example, in a safety-related part (ASIL) module (also referred to as a safety module (SM)), a predetermined number is obtained by executing a plurality of modules. In order to demonstrate functional safety, it is desirable to monitor the execution order between modules.

  Therefore, conventionally, there has been proposed a diagnostic method for detecting whether or not an error has occurred when an error occurs in the module execution order.

JP 2001-175497 A

  However, in the conventional example, regarding whether the execution order is correct or not, it is necessary to determine whether or not the modules are executed in the correct order each time the modules are executed, which may increase the processing load on the processor.

  In view of the above problems, an object of the present invention is to provide a technique for evaluating the correctness of the execution order between modules while suppressing the processing load.

  The present invention is an electronic control device for an automobile that executes a control program in which the execution order of a plurality of modules is determined in advance, performs a predetermined rule operation on input data, and outputs the operation result When the calculator and the first module of the control program are executed, the module identification data and the initial value are substituted into the calculator, and when the second and subsequent modules of the control program are executed, the module identification data and immediately before An evaluation unit that sequentially evaluates the execution order of the modules based on a comparison between the output data finally output from the arithmetic unit and the reference data, by sequentially substituting the output data of the arithmetic unit related to the executed module into the arithmetic unit. Is provided.

  According to the present invention, it is possible to evaluate the correctness of the execution order between modules while suppressing the processing load.

It is a figure which shows the structural example of ECU (Electronic Control Unit) in this embodiment. It is explanatory drawing which shows an example of the control program in this embodiment. It is explanatory drawing which shows the outline | summary of the operation processing of this embodiment. It is a flowchart which shows an example of operation | movement of the arithmetic processing method in this embodiment. It is explanatory drawing which showed the flow of the flowchart shown in FIG. 4 typically. It is a flowchart which shows an example of operation | movement of the arithmetic processing method in this embodiment. It is explanatory drawing which showed the flow of the flowchart shown in FIG. 6 typically.

Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings.
[ECU configuration example]
FIG. 1 is a block diagram illustrating a configuration example of an ECU in the present embodiment. The ECU 1 shown in FIG. 1 includes various electronic devices 20 mounted on an automobile, such as an electronically controlled throttle valve, a fuel injection valve, a transmission, an electric brake system, an ABS (Antilock Brake System), a variable valve timing mechanism, and the like. (Not shown) is controlled. In this embodiment, for convenience of explanation, various electronic devices 20 are represented by one block diagram.

  As shown in FIG. 1, the ECU 1 includes a processor 11, a communication circuit 12, a ROM (Read Only Memory) 13, a RAM (Random Access Memory) 14, a CRC (Cyclic Redundancy Check) calculator 15, and a bus 16. . The processor 11, the communication circuit 12, the ROM 13, the RAM 14, and the CRC calculator 15 are connected to each other via a bus 16. The ECU 1 is connected to various electronic devices 20 that control the engine of the automobile via the communication circuit 12. The CRC calculator 15 is an example of a calculator.

  The processor 11 is, for example, a CPU (Central Processing Unit) that performs central processing of the system, and performs overall control of the ECU 1. The processor 11 also functions as an example of an evaluation unit and a reference data setting unit. The communication circuit 12 provides a communication interface for connecting to various electronic devices 20. The communication circuit 12 includes, for example, a bus controller (CAN controller) that realizes a CAN (Controller Area Network) communication protocol.

  The ROM 13 is a nonvolatile semiconductor memory such as a flash ROM that retains data even when power supply from a power source (not shown) is cut off. The RAM 14 is, for example, a memory serving as a temporary work area for data used for arithmetic processing and the like, and is a volatile memory whose stored contents disappear when power supply is interrupted. Note that the RAM 14 may be, for example, a dynamic RAM or a static RAM.

  The CRC calculator 15 is an example of a calculator that performs a predetermined rule calculation on input data and outputs the calculation result. For example, the CRC calculator 15 includes an electronic circuit for cyclic redundancy check. However, in this embodiment, the CRC calculator 15 is used as a means for evaluating the execution order of modules. Details will be described using a flowchart and the like. The bus 16 can be used, for example, for data transfer of CAN communication.

  Further, the ECU 1 realizes various functions by cooperation of hardware such as the processor 11, the ROM 13, the RAM 14, and the CRC calculator 15 and software such as a control program and a CRC calculation program stored in the ROM 13. . This control program includes a plurality of modules of the present embodiment. Therefore, the processor 11 implements the CRC calculation process of the present embodiment when executing the control program.

  FIG. 2 is an explanatory diagram showing an example of a control program in the present embodiment. The control program P1 shown in FIG. 2 is used for controlling an electronically controlled throttle valve (not shown), for example. The control program P1 includes a plurality of modules M (1 to n) in order to realize control of the throttle valve. In addition, in order to make the explanation easy to understand, a case in which n = 4 is simplified is illustrated. Specifically, the control program P1 is executed by the processor 11, and includes a module M1 for processing an accelerator position sensor (APS), a module M2 for processing a throttle position sensor (TPS), target opening. Module M3 for calculating the degree of operation, and module M4 for processing the duty output.

  The APS processing module M1 executes processing for detecting the accelerator opening (the amount of depression of the accelerator pedal). The module M2 for TPS processing executes processing for detecting the actual opening of the throttle valve. The target opening calculation module M3 calculates the target opening based on, for example, the accelerator opening and the amount of change. The module M4 for duty output processing compares the actual opening of the throttle valve with the target opening, and adjusts the driving duty of the motor that adjusts the opening of the throttle valve so that the actual opening and the target opening coincide with each other. The throttle valve opening is adjusted by feedback control.

Here, in this embodiment, identification data is assigned to each module in various control programs including a plurality of modules classified as safety-related parts (ASIL). In this embodiment, as an example, identification data is assigned to a sequence according to the execution order of modules. For example, the identification data is written in a module program. Here, as identification data ID (n) of each module of the control program P1, for example, ID (1) = 1, ID (2) = 2, ID (3) = 3, and ID (4) = 4. . In this embodiment, the module M1 is assigned ID (1), the module M2 is assigned ID (2), the module M3 is assigned ID (3), and the module M4 is assigned ID (4).
[Operation processing of this embodiment]

  FIG. 3 is an explanatory diagram showing an outline of the operation processing of the present embodiment. In the following description, the control program is applied to the control program P1 that adjusts the opening of the throttle valve, but is not limited to this.

  When the ignition switch (IGNSW) is turned on, the processor 11 of the ECU 1 starts an initialization process necessary for starting various electronic devices 20. When the initialization process is completed, the processor 11 executes only the CRC calculation process based on the software without performing the actual drive control as the execution order confirmation process for the control program P1 subject to the flow check for monitoring the program flow. Then recheck the execution order of each module. However, in view of the software load, the processor 11 executes the CRC calculation process based on the software only once after the initialization process, and thereafter executes the CRC calculation process based on the hardware in the CRC calculator 15. Thereby, the load of software is reduced.

  Specifically, the processor 11 uses a CRC calculation program P2 that replaces the calculation processing of the CRC calculator 15 as an example of the reference data setting unit. As a result, the processor 11 performs a predetermined rule operation in the cyclic redundancy check on the identification data of the first module and the initial value of the CRC operation processing (hereinafter referred to as “CRC initial value”) in the control program P1. Find the operation result.

  Subsequently, for each of the second and subsequent modules of the control program P1, the processor 11 sequentially performs the calculation according to the predetermined rule on the identification data of the current module and the calculation result relating to the module executed immediately before. More specifically, the processor 11 determines the predetermined rule for the identification data of the nth module and the calculation result related to the n−1th module executed immediately before, from n = 2 to the total number of modules (n). Are sequentially performed. Then, the processor 11 uses the finally obtained calculation result as reference data for evaluating the execution order. That is, the processor 11 acquires reference data by this CRC calculation process. The reference data may be stored in the ROM 13 in advance.

  Then, when shifting to the normal control, the processor 11 executes a CRC calculation process in the CRC calculator 15 every time each module of the control program P1 is executed. This speeds up the CRC calculation process. Then, the processor 11 monitors the execution order of each module through a flow check until the ignition switch (IGNSW) is turned off by key-off and before the process proceeds to a termination process for shutdown. Then, when a CRC error occurs based on the CRC value output from the CRC calculator 15, the processor 11 executes fail-safe control at the time of occurrence of an abnormality defined in advance, for example. The CRC value is an example of output data. Hereinafter, the details of the operation processing of this embodiment will be described.

  FIG. 4 is a flowchart showing an example of the operation of the arithmetic processing method in the present embodiment. The processor 11 executes this flowchart when the initialization process is completed. Specifically, the processor 11 executes a CRC calculation process based on software, and obtains the CRC value of the finally obtained calculation result as reference data. In order to make the explanation easy to understand, the control program P1 shown in FIG.

Step S101: The processor 11 assigns 0 (zero) to a variable n for loop processing of the program.
Step S102: The processor 11 executes a process of incrementing n by 1.

  Step S103: The processor 11 executes the CRC calculation program P2 for the nth module. Specifically, for example, when n = 1, the processor 11 executes the CRC calculation program P2 using the identification data (ID (1)) of the first module and the CRC initial value as input data. Note that the algorithm of the CRC calculation program P2 is an example of an error detection method, and is an arithmetic method in which data for inspection is regarded as a value and an error is detected using a remainder (remainder) divided by a predetermined constant. is there. The CRC initial value may be, for example, an arbitrary data string value.

  Here, for the CRC calculation, for example, various types are known according to the generator polynomial used for the CRC calculation, but the CRC value is obtained every time based on two input parameters as in the present embodiment. If possible, it is not particularly limited. The CRC calculation program P2 obtains, for example, CRC (n) for the nth module as the CRC value of the calculation result by executing the CRC calculation.

Step S104: The processor 11 determines whether or not the value of n has reached the total number of modules of the control program P1. When the total number has been reached (step S104: Yes), the process proceeds to step S105. When the total number has not been reached (step S104: No), the process returns to step S102, and the value of n is incremented (n = n + 1). To do.
Step S105: The processor 11 obtains CRC (n) as reference data for evaluating the execution order of modules of the control program P1. Then, the processor 11 stores the reference data in the RAM 14.

  FIG. 5 is an explanatory diagram schematically showing the flow of the flowchart shown in FIG. As shown in FIG. 5A, the processor 11 executes the CRC calculation program P2 using the identification data (ID (1)) corresponding to the module M1 for APS processing and the CRC initial value of the CRC calculation as input data. To do. The CRC calculation program P2 obtains CRC (1) as the calculation result of the first calculation process.

  Next, as illustrated in FIG. 5B, the processor 11 includes identification data (ID (2)) corresponding to the module M2 for TPS processing, and CRC (1) which is the immediately preceding CRC (n−1). Is used as input data to execute the CRC calculation program P2. The CRC calculation program P2 obtains CRC (2) as the calculation result of the second calculation process.

  Here, CRC (1) includes a result of CRC calculation using identification data (ID (1)) corresponding to the APS process. Further, CRC (2) includes a result of CRC calculation using identification data (ID (2)) corresponding to the TPS process. If the CRC calculation order is reversed, CRC (1) and CRC (2) have different values.

  That is, the calculation result using the identification data (ID (1)) corresponding to the APS process is reflected in CRC (1), and the identification data (ID (1)) corresponding to the APS process is reflected in CRC (2). In addition, the calculation result using the identification data (ID (2)) corresponding to the TPS process which is the next execution order is reflected.

  Next, as shown in FIG. 5C, the processor 11 uses the identification data (ID (3)) and CRC (2) corresponding to the calculation processing of the target opening as input data. The calculation program P2 is executed. The CRC calculation program P2 obtains CRC (3) as the calculation result of the third calculation process. Compared with CRC (2), CRC (3) further reflects the calculation result using identification data (ID (3)) corresponding to the calculation processing of the target opening degree which is the next execution order. .

  Next, as shown in FIG. 5 (d), the processor 11 executes the CRC calculation program P2 using the identification data (ID (4)) corresponding to the duty output process and the CRC (3) data as input data. To do. The CRC calculation program P2 obtains CRC (4) as the calculation result of the fourth calculation process. Compared with CRC (3), CRC (4) further reflects a calculation result using identification data (ID (4)) corresponding to the duty output process which is the next execution order.

  Subsequently, when the processor 11 ends the CRC calculation program P2, the processor 11 stores the CRC (4) in the RAM 14. CRC (4) can be used as reference data for evaluating a preset execution order such as APS processing, TPS processing, target opening calculation processing, and duty output processing. That is, in the present embodiment, CRC (n) as a final result of the CRC calculation executed in the flowchart shown in FIG. 4 is used as reference data.

Next, the operation of the arithmetic processing method during normal control will be described.
FIG. 6 is a flowchart showing an example of the operation of the arithmetic processing method in the present embodiment. The processor 11 executes the flowchart shown in FIG. 6 every time the check flow target control program P1 is executed until the ignition switch (IGNSW) is turned off by the key-off operation after the processing of the flowchart shown in FIG. .

  The outline of this flowchart will be described. When the processor 11 executes the first module of the control program P1, the processor 11 substitutes the identification data of the module and the CRC initial value into the CRC calculator 15 to obtain the CRC value. When executing the second and subsequent modules of the control program P1, the processor 11 sends the module identification data and the CRC value output from the CRC calculator 15 related to the module executed immediately before to the CRC calculator 15. Assign sequentially. Furthermore, the processor 11 evaluates the execution order of the modules based on the comparison between the CRC value output from the CRC calculator 15 related to the module executed last and the reference data.

Step S201: The processor 11 assigns 0 (zero) to a variable n for the loop counter of the program.
Step S202: The processor 11 executes a process of incrementing n by 1.

  Step S203: The processor 11 executes the process of the nth module based on the identification data of the module in which the event has occurred. As an example, the processor 11 executes the APS process as the first (n = 1).

  Step S204: The processor 11 executes the n-th CRC calculation using the CRC calculator 15 as a check point of the execution order. The CRC calculation is executed using the identification data of the module in which the event has occurred and the CRC value output in the (n-1) th CRC calculation as input data. However, in the case of n = 1, the CRC initial value is input because the n-1st CRC value does not exist. The CRC calculator 15 outputs CRC (n) as the calculation result.

  Step S205: The processor 11 determines whether or not the value of n has reached the total number of modules of the control program P1. When the total number has been reached (step S205: Yes), the process proceeds to step S206. When the total number has not been reached (step S205: No), the process returns to step S202.

  Step S206: The processor 11 determines whether or not the CRC calculation result is an error. Specifically, the processor 11 compares the reference data with the CRC (n) obtained in the process of step S204 after the last module is executed. If it matches with the reference data and it is determined that there is no error (step S206: No), the process of the flowchart shown in FIG. 6 is terminated. On the other hand, if it is determined that the data does not match the reference data and an error has occurred (step S206: Yes), the process proceeds to step S207. For example, when the order of the target opening calculation process M3 and the duty output process M4 is reversed, the CRC (n) and the reference data do not coincide with each other, and the process shifts to an abnormal process.

  Step S207: The processor 11 executes processing at the time of abnormality. For example, the processor 11 executes fail-safe control at the time of occurrence of an abnormality defined in advance. Then, the processor 11 ends the process of the flowchart shown in FIG.

  FIG. 7 is an explanatory diagram schematically showing the flow of the flowchart shown in FIG. As shown in FIG. 7A, when the processor 11 executes the APS process (module M1), the CRC calculator uses the identification data (ID (1)) corresponding to the APS process and the CRC initial value as input data. Substitute into 15. Then, the CRC calculator 15 executes the CRC calculation and outputs CRC (1) as the first calculation result.

  Next, as shown in FIG. 7B, when the processor 11 executes the TPS process (module M2), the identification data (ID (2)) corresponding to the TPS process and CRC (1) are input as input data. , And substitute for CRC calculator 15. Then, the CRC calculator 15 executes the CRC calculation and outputs CRC (2) as the second calculation result.

  Next, as shown in FIG. 7C, when the processor 11 executes the target opening calculation process (module M3), the identification data (ID (3)) corresponding to the target opening calculation process, the CRC, The data of (2) is substituted into the CRC calculator 15 as input data. Then, the CRC calculator 15 outputs CRC (3) as the third calculation result.

  Next, as shown in FIG. 7D, when the processor 11 executes the duty output process (module M4), it inputs identification data (ID (4)) and CRC (3) corresponding to the duty output process. The data is substituted into the CRC calculator 15. Then, the CRC calculator 15 outputs CRC (4) as the fourth calculation result.

  When the above processing is completed, the processor 11 compares the CRC (4) with the reference data stored in the RAM 14 as described above in step S206 of FIG.

  As described above, according to the present embodiment, whether the execution order is correct or not can be compared with the CRC value of the final result of the CRC calculation process and the reference data. There is no need to determine whether or not. Thereby, the processing load of the processor 11 can be suppressed, and even if the number of modules to be checked increases, the usage rate of the RAM 14 to be used can be suppressed.

  In addition, according to the present embodiment, when the initialization process is completed, as a reconfirmation of the execution order of each module, the CRC calculation program P2 is used to obtain reference data, and during operation, the CRC calculator 15 is used. The CRC value after execution of the last module was obtained, and the execution order was evaluated. Here, in the present embodiment, it is preferable to use the CRC calculator 15 capable of high-speed arithmetic processing as compared with the processing speed of the CRC arithmetic program P2, thereby speeding up the CRC arithmetic processing. In this embodiment, the processing load of the processor 11 can be further suppressed by executing the CRC calculation process by the CRC calculator 15. In the present embodiment, the reference data may be obtained by the CRC calculator 15 when the initialization process is completed.

[Supplementary items of the above embodiment]
In the embodiment described above, the number of modules is limited to 4 for easy understanding, but in the embodiment, the number of modules can be applied to an arbitrary number of 2 or more. That is, as described above, as the number of control programs and the number of modules increase, the processing load of the processor 11 can be suppressed, and the usage rate of the RAM 14 to be used can be suppressed. Further, in the above embodiment, in the flowchart shown in FIG. 6, if a module corresponding to the total number of modules is not executed even after a predetermined time has elapsed, it is determined that the total number has not been reached due to module execution omission, and step S207 You may make it transfer to the process at the time of abnormality.

  The embodiment disclosed in the present invention has been described above with reference to the specification and drawings. However, the technology disclosed herein is not limited to the above-described embodiment, and various modifications can be made without departing from the spirit of the present invention. Is possible.

1 ... ECU
11 ... Processor 12 ... Communication circuit 13 ... ROM
14 ... RAM
15 ... CRC calculator 16 ... Bus

Claims (3)

An electronic control device for an automobile that executes a control program in which the execution order of a plurality of modules is predetermined,
An arithmetic unit that performs a predetermined rule operation on the input data and outputs the operation result;
When executing the first module of the control program, the identification data and initial value of the module are substituted into the computing unit, and when executing the second and subsequent modules of the control program, the identification data of the module and the immediately preceding module are executed. The output data of the arithmetic unit related to the module executed in the step is sequentially substituted into the arithmetic unit, and the execution order of the modules is determined based on the comparison between the output data finally output from the arithmetic unit and the reference data. An evaluation unit to evaluate;
An electronic control device comprising:   The identification data and the initial value of the first module of the control program are subjected to the calculation of the predetermined rule, the calculation result is obtained, and the identification data of the module for each of the second and subsequent modules of the control program. And a reference data setting unit that sequentially performs the operation of the predetermined rule on the operation result related to the module executed immediately before, and uses the finally obtained operation result as the reference data. The electronic control device according to 1.   The electronic control device according to claim 1, wherein the arithmetic unit is a CRC arithmetic unit.