JP2017065421A - On-vehicle electronic control device and deterioration diagnostic method for element of on-vehicle electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an on-vehicle electronic control device and a deterioration diagnostic method for an element of the on-vehicle electronic control device that predict a failure due to the deterioration of an element of the on-vehicle electronic control device in advance and enhance safety of the vehicle.SOLUTION: An on-vehicle electronic control device 200 is composed of a microcomputer mounted with on-vehicle control software and a peripheral circuit for generating an electric signal for driving a device to be controlled. The on-vehicle control software includes an element state check program 204 for diagnosing the deterioration of an element of the on-vehicle electronic control device, and reference data for diagnosing the deterioration of the element.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a support technology for predicting the occurrence of a failure in an electronic circuit of an electronic control device for an automobile.

  The digitization of control technology related to the operation and movement of automobiles tends to increase year by year.

  The number of microcomputer circuits called ECUs (Electronic Control Units) mounted on one vehicle is several tens. The size of the software installed in these ECUs (hereinafter referred to as control software) is one hundred. It has reached 10,000 lines (mainly C language source code).

  Although the development scale of the control software increases as described above, it is required to shorten the development period. Therefore, improving the quality of the control software is a major issue for automobile manufacturers and suppliers.

  In particular, the design related to safety is required to comply with the ISO 26262 standard.

  For products defined by ASIL-C or D at an automotive safety integrity level (ASIL) defined by ISO 26262, verification of fault injection is strongly recommended at the time of product shipment.

  This is intended to provide evidence that verifies that the ECU product does not infringe on the failure mode assumed in the use case when the ECU product is released to the market.

  Thus, the demand for safety design for the in-vehicle control device is high.

JP 2006-53016 A JP 2007-2758 A

  The software installed in the conventional ECU incorporates a diagnostic function, and performs self-diagnosis as to whether functions such as sensors and communication are operating normally when the automobile is started.

  Many in-vehicle control software executes a program for initializing the microcomputer when the ignition of the automobile is activated.

  A diagnostic program is executed in this series of initialization operations.

  The diagnostic program transmits a test signal to a communication device such as a sensor or a CAN (Controller Area Network), and checks whether the signal returned from the device is normal data. Detects abnormalities of hardware devices.

  In this way, it is possible to detect hardware abnormalities such as sensor failure and disconnection of communication devices by the diagnostic program, but the element characteristics due to deterioration over time in elements such as resistors and capacitors It is difficult to detect a failure caused by the change in

  In particular, recent ECUs have increased circuit density as functions have become more complex, making it difficult to identify the location where a failure has occurred.

  In such a situation, in order to maintain the safety of the ECU at a high level for more than 10 years, it is important to prevent these faults by prediction rather than detecting them at that time. .

  Accordingly, an object of the present invention is to provide an in-vehicle electronic control device that predicts a failure due to deterioration of an element in an in-vehicle electronic control device in advance and increases the safety of the vehicle, and a method for diagnosing element deterioration in the in-vehicle electronic control device. To do.

  In order to solve the above problems, for example, the configuration described in the claims is adopted.

  The present application includes a plurality of means for solving the above-mentioned problems. To give an example, an in-vehicle configuration composed of a microcomputer mounted with in-vehicle control software and a peripheral circuit for generating an electric signal for driving the control target device. An electronic control device, wherein the in-vehicle control software includes an element state check program for diagnosing deterioration of an element of the in-vehicle electronic control device, and reference data for diagnosing deterioration of the element. To do.

  According to the present invention, the range of ECU failure prevention can be expanded, so that the reliability of the in-vehicle control software and the ECU can be improved.

  Problems, configurations, and effects other than those described above will be clarified by the following description of examples.

The flowchart of the program which checks the element state in connection with the Example of this invention. The figure which shows the structure of the software mounted in ECU in connection with the Example of this invention. The figure which shows the degradation criteria regarding the Example of this invention. The figure which shows the structure of the fault injection | pouring simulation for derivation | leading-out the deterioration criteria.

  Embodiments relating to the present invention will be specifically described below.

  FIG. 1 is a flowchart of a program (hereinafter referred to as an element state check program 204) for checking the state of an element on a circuit of an ECU according to an embodiment of the present invention. As an example, a case will be described in which the state of a shunt resistance element used in a phase current detection circuit in an ECU circuit that controls a motor is checked.

  FIG. 2 is a diagram illustrating a configuration of software installed in the ECU 200 according to the embodiment of the present invention. An initialization program 201, a motor current control program 202, a CAN communication control program 203, an element state check program 204, and the like are configured on the base software 205. The base software 205 also provides access to the microcomputer hardware 206.

  Please refer to FIG. 1 again. When the element state check program 204 is called, pre-defined characteristic check test data is read from the ROM (step S101). In this embodiment, in order to check the state of the shunt resistance element for detecting the phase current in the current control of the motor, data for driving the motor is used as the characteristic check test data.

  The element state check program 204 causes the circuit of the ECU 200 to output a signal based on the characteristic check test data (step S102). In this embodiment, a signal based on the characteristic check test data is output to the PWM controller in the microcomputer hardware 206.

  Data is output from the microcomputer to the ECU circuit (step S103), and a command value is output from the ECU circuit to the device to be controlled (step S104). In this embodiment, the pulse signal output from the PWM controller is transmitted to the motor driver through the microcomputer terminal. In the inverter circuit in the motor driver, in order to generate a current for driving the motor, a current corresponding to the PWM pulse width is generated and output to the stator of the motor. As a result, the motor rotates at a rotation speed corresponding to the magnitude of the current flowing through the motor.

  The element state check program 204 detects a current or voltage in a specific element on the ECU circuit (step S105), and reads the current value or voltage value into the microcomputer side (step S106).

  In controlling the motor, in order to control the current flowing through the motor (in this embodiment, three-phase current), it is detected by a shunt resistor and fed back to the microcomputer side. If the state of the shunt resistor is deteriorated and an accurate current value is not fed back, the motor control does not operate normally. Therefore, it is necessary to accurately grasp the state of the resistor. Therefore, the element state check program 204 detects the current flowing through the shunt resistor or the voltage at both ends of the resistor and captures it as data in the microcomputer.

  Next, the element state check program 204 compares a reference value (current value or voltage value as reference data) for determining the state of the element prepared in advance with the read value. In this embodiment, the difference between the read value and the reference value is calculated (step S107), and it is determined whether or not the difference exceeds a threshold value (S108).

  If the difference between the read data and the reference data is within an allowable range, it is determined that there is no problem with the deterioration of the element.

  If the allowable range is exceeded, it is determined that the deterioration state of the element is remarkable, and a warning signal is generated (step S109). In this embodiment, the driver is notified that there is a high possibility of failure due to deterioration of the element.

  When the determination process is completed, the element state check program 204 writes all signals to a storage element such as an EEPROM (step S110), and ends the execution of the program. In this embodiment, the value read to the microcomputer side is written in the EEPROM as a history, and the program execution is terminated.

  The element state check program 204 is set to be executed at regular intervals such as one month.

  In the embodiment described above, the reference data for determining the state of the element is data prepared in advance.

  As a specific example of the reference data, there is data as shown in FIG. An upper limit side allowable degradation value 302 and a lower limit side allowable deterioration value 303 are set for the reference value 301, and a range between the upper limit side allowable deterioration value 302 and the lower limit side allowable deterioration value 303 is an allowable deterioration range. All of the reference value 301, the upper limit side allowable deterioration value 302, and the lower limit side allowable deterioration value 303 change with time (FIG. 3 shows an example of decreasing with time). This is because the progress of deterioration with time progresses with time. Since deterioration becomes significant as time elapses from the start of use of the ECU, the prediction of a failure associated with the deterioration can be made more accurate by changing the reference value serving as a determination criterion.

  As a method for deriving such reference data, generally, it can be created based on experimental data accumulated in the past. However, collecting experimental data has the disadvantage that it takes time and effort.

  Therefore, in this embodiment, as shown in FIG. 4, a technique for modeling the entire ECU system as a target and predicting characteristics at the time of failure by a simulation technique is adopted. As this simulation technique, there is one disclosed in Japanese Patent Application Laid-Open No. 2014-203314.

  The ECU simulation apparatus shown in FIG. 4 is realized by a computer 1 and includes a fault injection simulation environment 11 for performing a fault injection simulation in the ECU and a user interface tool 12 for operating the fault injection simulation environment 11.

  The designer 2 operates the fault injection simulation environment 11 via the user interface tool 12. The substance of the user interface tool 12 is a program executed on the computer 1.

  The failure injection simulation environment 11 is roughly divided into the following five elements.

  The microcomputer model tool 401 is a tool for creating a model (microcomputer model 4011) in which the logical operation of the microcomputer used in the ECU is described on a C language basis and simulating this model. Since the microcomputer model tool 401 can operate the control software in an object format, the operation of the ECU actual machine can be reproduced on the computer 1.

  The circuit model tool 402 is described as a model (circuit model 4021) for a driver circuit for transmitting a control command signal from the microcomputer to the actuator, a sensor circuit for detecting the actuator signal, and the like on the computer 1. It is a tool for simulation.

  The plant model tool 403 is a tool for describing a model (plant model 4031) as a model (plant model 4031) for parts such as actuators, machines to be controlled, electricity, hydraulics, and the like, and performing simulation on the computer 1.

  The fault injection simulation environment 11 causes the computer 1 to simulate the entire control system including the ECU by linking the above-described three types of model tools and using the output of each model tool as an input of another model tool. Can do.

  The fault injection automation tool 404 is a tool for writing fault mode information into the circuit model for the circuit model used in the circuit model tool 402 in order to perform fault injection verification. The storage 405 stores a failure mode definition file 111 that defines a failure mode for each element constituting the circuit, such as a resistor and a capacitor, a failure injection test pattern 112, and failure injection test data 113 in a file format. The storage 405 can store the microcomputer model 4011, the circuit model 4021, and the plant model 4031 described above. A common fault injection simulation can be performed using each model prepared for different ECU products. In environment 11, fault injection verification can be performed.

  In the fault injection simulation environment 11 of FIG. 4, an element whose element value changes with time due to deterioration with time is added to the element whose state is to be checked (shunt resistor in this embodiment).

  By roughening the step of elapsed time in the simulation, an element deterioration model (reference data for deterioration determination) can be generated in a short time.

  The above-described embodiment is an implementation procedure for a case where attention is paid to one element. However, in a multi-function ECU, when there are a plurality of elements related to control safety, the same procedure is performed for each element. The element state check program 204 may be executed for these elements.

  When the creation of a plurality of reference data is executed in a fault injection simulation environment, it takes time to execute the reference data sequentially for each target element.

  Therefore, it is possible to reduce the time by using an environment in which the above-described failure injection simulation environment is executed in parallel for a plurality of virtual machines prepared in the virtual server environment.

1 ... Calculator
2 ... Designer 11 ... Failure injection simulation environment 12 ... User interface tool 111 ... Failure mode definition file 112 ... Failure injection test pattern 113 ... Failure injection test data 201 ... Initialization program 202 ... Motor current control program 203 ... Communication control program 204 ... Element state check program 205 ... Base software 206 ... Microcomputer hardware 301 ... Reference value 302 ... Upper limit side deterioration tolerance value 303 ... Lower limit side deterioration tolerance value 401 ... Microcomputer model tool 402 ... Circuit model tool 403 ... Plant model tool 404 ... Failure Injection automation tool 405 ... storage 4011 ... microcomputer model 4021 ... circuit model 4031 ... plant model

Claims (8)

A microcomputer with in-vehicle control software,
An in-vehicle electronic control device composed of a peripheral circuit for generating an electric signal for driving a control target device,
The in-vehicle control software is
An element state check program for diagnosing element deterioration of the in-vehicle electronic control device;
Reference data for diagnosing deterioration of the element,
In-vehicle electronic control device. The on-vehicle electronic control device according to claim 1,
The reference data has a deterioration tolerance range composed of an upper limit deterioration allowance value and a lower limit deterioration allowance value,
The element state check program compares the result of causing the check target element to execute a control operation and the reference data, and diagnoses the deterioration state of the element based on the allowable deterioration range. In-vehicle electronic control device. The on-vehicle electronic control device according to claim 2,
An on-vehicle electronic control device that notifies the driver of the risk of failure when the deterioration of the element exceeds the allowable deterioration range. The on-vehicle electronic control device according to any one of claims 1 to 3,
The on-vehicle electronic control device, wherein the deterioration diagnosis of the element is executed at predetermined intervals. The on-vehicle electronic control device according to any one of claims 1 to 4,
The reference data is an in-vehicle electronic control device created by a fault injection simulation using a model of the in-vehicle electronic control device. An in-vehicle electronic control device element deterioration diagnosis method comprising:
Reading the characteristic check test data of the element;
Outputting a signal based on the characteristic check test data;
Detecting a current value or a voltage value in the element while controlling a device to be controlled based on the signal; and
A method for diagnosing deterioration of an element of an in-vehicle electronic control device, comprising: comparing a current or voltage in the element with reference data. An element deterioration diagnosis method for an on-vehicle electronic control device according to claim 6,
The reference data has a deterioration tolerance range composed of an upper limit deterioration allowance value and a lower limit deterioration allowance value,
An element deterioration diagnosis method for an in-vehicle electronic control device, comprising: generating a warning signal when a current value or a voltage value in the element is outside the allowable deterioration range. An element deterioration diagnosis method for an on-vehicle electronic control device according to claim 7,
A method for diagnosing element deterioration in an in-vehicle electronic control device, using data created by a fault injection simulation using a model of the in-vehicle electronic control device as the reference data.

Images