JP2018020678A - Electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control device including a plurality of control microcomputers connected to a plurality of CAN communication buses communicated for the same data, the electronic control device being able to detect malfunction in the control microcomputer efficiently.SOLUTION: The microcomputers 11, 21 of an ECU 101 comprises: CPU 12, 22 connected to a plurality of CAN communication buses 61, 62 communicated for the same data and configured to perform control calculation using the same data; transmission and reception CAN controllers 13, 23; and reception-only CAN controllers 14, 24. An AND gate 15 calculates a logic product of an own transmission signal transmitted by the transmission terminal Tx of the reception-only CAN controller 14, and other reception signal transmitted to the transmission and reception CAN controller 23 from a CAN transceiver 26 corresponding to the other microcomputer 21, and outputs it to the reception terminal Rx of the reception-only CAN controller 14. Based on data input to the reception-only CAN controller 14, the microcomputer 11 detects a malfunction in the microcomputer 21.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an electronic control device capable of transmitting and receiving control data via a CAN communication bus.

  2. Description of the Related Art Conventionally, an electronic control device that performs CAN communication is known which includes a plurality of microcomputers having a CPU and a CAN controller. For example, the electronic control device disclosed in Patent Document 1 includes a main control microcomputer that performs normal control using a transmission / reception CAN controller and a sub-control microcomputer that performs monitoring processing using a reception-only CAN controller. The ACK slot output by the sub control microcomputer when the control data can be normally received in the monitoring process is input to the CAN controller itself of the sub control microcomputer and is not input to the main control microcomputer. This prevents the confirmation response that the microcomputer has successfully received the data from being communicated between the plurality of microcomputers.

  Also, in a system that drives a load such as a motor under the control of a microcomputer, a plurality of microcomputers having equivalent control functions are redundantly provided, and when some microcomputers fail, the drive continues with another normal microcomputer Technology is known. In particular, in a motor drive system or the like mounted on a vehicle, it is required to improve reliability against a microcomputer failure by such a redundant configuration.

JP 2011-131713 A

The technique of Patent Document 1 assumes a configuration in which a plurality of microcomputers having different functions are incorporated in one electronic control device, and does not assume a configuration in which a plurality of microcomputers having the same function are redundantly provided. Therefore, there is no mention of a configuration for detecting a failure of a microcomputer or a configuration in which control computation is continued by another normal microcomputer when some of the microcomputers fail.
The present invention was created in view of the above points, and an object of the present invention is to provide control in an electronic control device including a plurality of control microcomputers connected to a plurality of CAN communication buses through which the same data is communicated. An object of the present invention is to provide an electronic control device capable of efficiently detecting a failure of a microcomputer.

The electronic control device of the present invention includes a plurality of control microcomputers (11, 21) connected to a plurality of CAN communication buses (61, 62) through which the same data is communicated, and a plurality of CAN transceivers (16, 26). Prepare.
The plurality of control microcomputers include a CPU (12, 22) that performs control calculation using the same data received from a plurality of CAN communication buses, a transmission / reception CAN controller (13, 23), and one or more reception-only CAN controllers. (14, 145, 24, 245).
The plurality of CAN transceivers relay communication between the transmission / reception CAN controllers of the plurality of control microcomputers and the plurality of CAN communication buses.

Here, among the plurality of control microcomputers, one control microcomputer to be noted is referred to as “own microcomputer”, and one or more control microcomputers other than the own microcomputer are referred to as “other microcomputer”.
The AND gates (15, 25) communicate with the “own transmission signal” transmitted from the transmission terminal (Tx) of the reception dedicated CAN controller of the microcomputer and from the CAN transceiver corresponding to the other microcomputer to the transmission / reception CAN controller of the other microcomputer. The logical product with the “other received signal” is calculated.

Here, an AND gate that outputs a calculation value to the reception terminal (Rx) of the reception dedicated CAN controller (14, 24) of the microcomputer may be provided outside the plurality of microcomputers. Alternatively, the reception-only CAN controller (145, 245) has an AND gate function.
And a plurality of microcomputers can mutually detect a failure of at least another microcomputer based on the data inputted to the reception-only CAN controller. Specifically, the self microcomputer determines whether or not data that should be output from other microcomputers is normally communicated.

2. Description of the Related Art Conventionally, as a configuration for detecting that a part of control microcomputers among a plurality of control microcomputers has failed, a technique is known in which each control microcomputer mutually monitors another microcomputer by communication between the microcomputers. In this configuration, it is necessary to provide a communication line and a monitoring circuit for mutual monitoring.
On the other hand, in the present invention, paying attention to the fact that each of the plurality of control microcomputers receives the same data from the CAN communication bus, by monitoring whether the communication data output from the other microcomputers to the CAN communication bus is normal, Faults in other microcomputers can be detected efficiently.

The block diagram of ECU (electronic control apparatus) by 1st Embodiment. The lineblock diagram of the electric power steering device to which ECU of each embodiment is applied. The table | surface which shows the effect | action at the time of communication abnormality by an AND gate. The main flowchart of an abnormality detection process. The sub-flowchart of a communication check. The block diagram of ECU (electronic control apparatus) by 2nd Embodiment. The block diagram of ECU (electronic control apparatus) by 3rd Embodiment. The block diagram of ECU (electronic control apparatus) by 4th Embodiment.

  Hereinafter, a plurality of embodiments of an electronic control device will be described based on the drawings. In each embodiment, an ECU as an “electronic control device” is applied to an electric power steering device of a vehicle, for example, and controls driving of a motor that outputs a steering assist torque. In the plurality of embodiments, substantially the same components are denoted by the same reference numerals and description thereof is omitted. The following first to fourth embodiments are collectively referred to as “this embodiment”.

[Configuration of electric power steering device]
FIG. 2 shows the overall configuration of the steering system 100 including the electric power steering device 90. The electric power steering apparatus 90 shown in FIG. 2 is a column assist type, but can be similarly applied to a rack assist type electric power steering apparatus.
The steering system 100 includes a handle 91, a steering shaft 92, a pinion gear 96, a rack shaft 97, wheels 98, an electric power steering device 90, and the like.

  A steering shaft 92 is connected to the handle 91. A pinion gear 96 provided at the tip of the steering shaft 92 is engaged with the rack shaft 97. A pair of wheels 98 are provided at both ends of the rack shaft 97 via tie rods or the like. When the driver rotates the handle 91, the steering shaft 92 connected to the handle 91 rotates. The rotational motion of the steering shaft 92 is converted into a linear motion of the rack shaft 97 by the pinion gear 96, and the pair of wheels 98 are steered at an angle corresponding to the amount of displacement of the rack shaft 97.

The electric power steering device 90 includes a torque sensor 93 that detects steering torque, an ECU 101, a motor 80, a reduction gear 94 that transmits assist torque output from the motor 80 to a steering shaft 92, and the like. In description of ECU common to each embodiment, the code | symbol "101" of ECU of 1st Embodiment is described as a representative.
The ECU 101 acquires information such as the vehicle speed and the engine speed via the CAN communication bus from other ECUs mounted on the vehicle, in addition to the steering torque, the rotation angle of the motor 80, and the feedback current. Based on the information, the drive of the motor 80 is controlled.
Here, in a vehicle to which the ECU of the present embodiment is applied, the same data is redundantly communicated via a plurality of CAN communication buses for data such as vehicle speed and engine speed.

[Configuration of ECU]
In the following, the configuration and operational effects relating particularly to communication will be described for each embodiment of the ECU. In the description of the ECU, for example, a driving target such as a motor of an electric power steering apparatus is generally referred to as an “actuator”.
The ECU of each embodiment includes a plurality of microcomputers that perform control calculations redundantly based on data received from the CAN communication bus and output command signals to corresponding drive circuits. For example, an inverter that converts DC power into AC power corresponds to the drive circuit. The plurality of drive circuits that have received the command signals from the plurality of microcomputers cooperate to drive the actuator. In addition, when some microcomputers fail, the actuator can be driven only by normal microcomputers.

By the way, conventionally, as a configuration for detecting that a part of a plurality of microcomputers has failed, a technique is known in which each microcomputer monitors another microcomputer by communication between the microcomputers. In this configuration, it is necessary to provide a communication line and a monitoring circuit for mutual monitoring.
On the other hand, in this embodiment, attention is paid to the fact that each of the plurality of microcomputers receives the same data from the CAN communication bus, and communication between microcomputers for mutual monitoring is not provided, and communication data from the CAN communication bus to the microcomputer is used. Efficiently detect microcomputer failures.
It should be noted that, for reasons other than failure detection, for example, communication between microcomputers such as for synchronizing drive command signals is not mentioned in this specification.

(First embodiment)
A first embodiment will be described with reference to FIGS. 1 and 3 to 5.
As shown in FIG. 1, the ECU 101 according to the first embodiment includes two microcomputers 11 and 21, AND gates 15 and 25, CAN transceivers 16 and 26, and drive circuits 18 and 28, respectively. The first embodiment is different from the second embodiment described later in that AND gates 15 and 25 are provided outside the microcomputers 11 and 21 independently.

Here, the unit of the corresponding group of components is represented as “system”. The ECU 101 has a two-system redundant configuration. The sign of the first system component is “1” in the first digit, and the sign of the second system component is “2” in the first digit.
In FIG. 1, the first system microcomputer 11, the CAN transceiver 16, and the drive circuit 18 are prefixed with “first”, and the second system microcomputer 21, the CAN transceiver 26, and the drive circuit 28 are prefixed with “first”. 2 ”is attached. In the specification, “first and second” are omitted as appropriate.

  As CAN communication buses connected to the ECU 101, two CAN communication buses 61 and 62 through which the same data is communicated are provided. The ECU 101 exchanges data by performing data communication with other in-vehicle ECUs and the like via the CAN communication buses 61 and 62 using the CAN protocol. The CAN communication buses 61 and 62 are configured by a two-wire communication line including a CAN-H line and a CAN-L line used in the CAN protocol.

The first microcomputer 11 is connected to the first CAN communication bus 61 via the first CAN transceiver 16, and the second microcomputer 21 is connected to the second CAN communication bus 62 via the second CAN transceiver 26.
The first microcomputer 11 and the second microcomputer 21 perform the same kind of control calculation using the same data received from the CAN communication buses 61 and 62, and generate command signals to the drive circuits 18 and 28. The first drive circuit 18 that receives a command from the first microcomputer 11 and the second drive circuit 28 that receives a command from the second microcomputer 21 cooperate to drive the actuator 80.

Each of the first microcomputer 11 and the second microcomputer 21 has a drive control of the actuator 80 as a main function, and corresponds to a “control microcomputer” recited in the claims.
The first microcomputer 11 includes a CPU 12 and two CAN controllers 13 and 14. The second microcomputer 21 includes a CPU 22 and two CAN controllers 23 and 24.
AND gates 15 and 25 are provided for each system corresponding to the microcomputers 11 and 21.

Since the configurations of the two systems of the microcomputers 11 and 21 and the AND gates 15 and 25 are substantially the same, the description of one system is appropriately incorporated into the description of the other system. In the following description, one microcomputer of interest is referred to as “own microcomputer”, and one or more microcomputers other than the own microcomputer are referred to as “other microcomputer”. In the configuration of two systems, one “other microcomputer” may be rephrased as “the other microcomputer”.
The CPU 12 of the first microcomputer 11 can exchange information with the two CAN controllers 13 and 14. Further, the CPU 12 performs control calculation using data received from the CAN communication bus 61. The CAN controllers 13 and 14 each have a transmission terminal Tx and a reception terminal Rx. The same applies to the second microcomputer 21.

In the CAN controller 13 of the first microcomputer 11, the transmission terminal Tx and the reception terminal Rx are connected to the CAN transceiver 16 via the main transmission line 136 and the main reception line 137, respectively, and the first CAN communication is performed via the first CAN transceiver 16. Sends and receives to / from the bus 61.
The CAN controller 23 of the second microcomputer 21 has a transmission terminal Tx and a reception terminal Rx connected to the CAN transceiver 26 via the main transmission line 236 and the main reception line 237, respectively, and the second CAN communication via the second CAN transceiver 26. It transmits and receives to / from the bus 62.
In other words, the CAN transceivers 16 and 26 relay communication between the transmission / reception CAN controllers 13 and 23 and the CAN communication buses 61 and 62.
With this configuration, the CAN controllers 13 and 23 function as “transmission / reception CAN controllers”.

In the CAN controller 14 of the first microcomputer 11, the transmission terminal Tx is connected to one input terminal of the AND gate 15, and the reception terminal Rx is connected to the output terminal of the AND gate 15. The other input terminal of the AND gate 15 is connected to the second main reception line 237.
In the CAN controller 24 of the second microcomputer 21, the transmission terminal Tx is connected to one input terminal of the AND gate 25, and the reception terminal Rx is connected to the output terminal of the AND gate 25. The other input terminal of the AND gate 25 is connected to the main reception line 137 of the first system.
With this configuration, the CAN controllers 14 and 24 function as “reception dedicated CAN controllers”.

The first microcomputer 11 and the second microcomputer 21 can determine a communication interruption abnormality of other microcomputers based on inputs from the AND gates 15 and 25 to the reception-only CAN controllers 14 and 24 of the own microcomputer, and can detect a failure.
For convenience of explanation, a normal microcomputer capable of detecting a failure of another microcomputer is referred to as a “detection-side microcomputer”, and a microcomputer whose failure is detected by the detection-side microcomputer is distinguished as a “detection-side microcomputer”.
Actually, both the first microcomputer 11 and the second microcomputer 21 function as a “detection-side microcomputer” and a “detection-side microcomputer”. However, hereinafter, the first microcomputer 11 will be referred to as a detection-side microcomputer, and the second microcomputer 21 will be described. Will be described as the detected microcomputer.

In the first microcomputer 11 on the detection side, a signal from the transmission terminal Tx of the reception-only CAN controller 14 is input to one input terminal of the AND gate 15. In this specification, this signal is referred to as “self-transmitting signal”. A transmission signal from the second CAN transceiver 26 on the detected side to the transmission / reception CAN controller 23 of the second microcomputer 21 is input to the other input terminal of the AND gate 15. In this specification, this signal is referred to as “another received signal”.
The AND gate 15 calculates the logical product of the own transmission signal and the other reception signal, and outputs the calculation result to the reception terminal Rx of the reception-only CAN controller 14. Based on the calculation result, the CPU 12 of the detection-side first microcomputer 11 determines a communication abnormality of the detected-side second microcomputer 21.

As disclosed in Patent Document 1 (Japanese Patent Application Laid-Open No. 2011-131713), in CAN communication, when another microcomputer receives data transmitted from one microcomputer in the same ECU, an ACK is returned as a confirmation response. Is done.
If the AND gate 15 is not provided in the CAN controller 14, the CAN controller 14 ACKs the transmission message of the transmission / reception CAN controller 23 even when the CAN transceiver 26 corresponding to another microcomputer or the CAN communication bus 62 is broken. Will be replied. As a result, the failure of the CAN transceiver 26 and the CAN communication bus 62 cannot be detected by the self loop in the ECU 101.

The operation when the CAN controller 14 is connected without the AND gate 15 will be described in detail with reference to the table of FIG. In the table of FIG. 3, the dominant output corresponds to L (that is, logical value 0), and the recessive output corresponds to H (that is, logical value 1).
When the first microcomputer 11 is a detection side microcomputer and the second microcomputer 21 is a detected side microcomputer, the transmission / reception CAN controller 23 of the second microcomputer 21 transmits a message, and the CAN controller 14 of the first microcomputer 11 receives the message. Serves as dedicated.

The CAN message is basically transmitted from the detected side in a combination of dominant and recessive. At the ACK timing, the reception-side CAN controller 14 on the detection side outputs a dominant. FIG. 3 shows the following six items in these three patterns.
“Transmission terminal Tx output of CAN controller 23 for transmission / reception of detected side”
“Transmission terminal Tx output of detection-side reception-only CAN controller 14”
“Output level of detected CAN transceiver 26”
“Detected CAN communication bus 62”
“Received terminal Rx recognition value of detected side transmission / reception CAN controller 23”
“Reception terminal Rx recognition value of reception-only CAN controller 14”

FIG. 3A shows the normal operation. During normal operation, the ECU 101 is connected to the CAN communication buses 61 and 62, and other ECUs are connected to the CAN communication buses 61 and 62. “Dominant (* 1)” of the detected CAN communication bus 62 at the ACK timing indicates that another ECU connected to the CAN communication bus 62 outputs a dominant level according to the CAN protocol.
When communication is normal, the transmission / reception CAN controller 23 recognizes “L” at the ACK timing. The reception-only CAN controller 14 recognizes “L” at the ACK timing.

FIG. 3B shows an operation at the time of abnormality assuming disconnection of the CAN transceiver 26 or the CAN communication bus 62 on the detected side. “Recessive (* 2)” of the detected-side CAN communication bus 62 indicates a state in which other ECUs connected to the CAN communication bus 62 are not transmitting.
When communication is abnormal, the transmission / reception CAN controller 23 recognizes “H” at the ACK timing, and detects communication failure. On the other hand, since the reception-only CAN controller 14 recognizes the same “L” as in the normal state at the ACK timing, it cannot detect communication failure.

Thus, if the CAN controllers 14 and 24 are connected without the AND gates 15 and 25, there is a problem that failure detection cannot be performed at the ACK timing. Therefore, in the present embodiment, by providing the AND gates 15 and 25, the CAN controllers 14 and 24 are dedicated to reception.
In other words, the essential meaning of “reception only” of the “reception-only CAN controller” in this embodiment is not the transmission itself from the transmission terminal Tx, but the self-loop of transmission and reception in the same ECU. This is to prevent the reply of the resulting ACK.

Next, the abnormality determination process executed by the detection side microcomputer will be described with reference to the flowcharts of FIGS. 4 is a main flowchart of the entire abnormality determination process, and FIG. 5 is a sub-flowchart describing in detail S20 of the communication check in FIG. In the following description of the flowchart, the symbol S indicates “step”.
Also in this description, it is assumed that the first microcomputer 11 is a detection side microcomputer and the second microcomputer 21 is a detection side microcomputer.

The main routine shown in FIG. 4 is repeatedly executed periodically.
In S <b> 1, the reception-only CAN controller 14 of the first microcomputer 11 receives communication data to the second microcomputer 21.
In S <b> 2, the CPU 12 of the first microcomputer 11 performs a communication check based on the reception data of the reception-only CAN controller 14.

In S21 of the communication check, it is determined whether “the message of the second microcomputer 21 is stored in the mail BOX”. That is, the detection side microcomputer confirms the presence or absence of data that the detected side microcomputer should output, and determines whether or not the data that should be output is normally communicated.
In the case of YES in S21, the CPU 12 determines “communication OK” in S22.

In the case of NO in S21, it is determined whether or not “another message is stored in the mail BOX”. In the case of YES in S23, the CPU 12 determines in S24 that “the communication of the second microcomputer 21 has been interrupted”.
In the case of NO in S23, the CPU 12 determines in S25 that "CAN transceiver 26 or CAN communication bus 62 is abnormal".

Returning to the main flowchart, in S3, it is determined whether or not it is determined that "communication interruption of the second microcomputer 21" as a result of the communication check. If YES in S3, that is, if the communication check corresponds to S24, the process proceeds to S4.
In S4, it is determined whether the count value of the abnormality counter has reached a specified value. If YES in S4, the CPU 12 determines an abnormality of the second microcomputer 21 in S5.

When the abnormality of the second microcomputer 21 is confirmed, the ECU 101 stops the output of the second drive circuit 28 by, for example, an output stop request, and switches the actuator 80 to be driven only by the first drive circuit 18. At this time, the normal first microcomputer 11 can continue the control using the data of all the CAN communication buses 61 and 62.
Furthermore, when the normal first microcomputer 11 transmits microcomputer failure information to the CAN communication bus 61, the failure part can be notified to the outside and used for troubleshooting.

If NO in S4, the CPU 12 increments the count value of the abnormality counter in S6. Note that “++” in FIG. 4 means increment.
On the other hand, if NO in S3, the process proceeds to S7. The CPU 12 resets the count value of the abnormality counter to 0 in S7, and determines the normality of the second microcomputer 21 in S8.

The effect by ECU101 of 1st Embodiment is demonstrated.
(1) The ECU 101 of the first embodiment pays attention to the plurality of microcomputers 11 and 21 receiving the same data from the CAN communication buses 61 and 62, respectively. A failure of the other microcomputer can be detected by monitoring whether the communication data output from the other microcomputer to the CAN communication bus is normal. Therefore, it is possible to efficiently detect a failure of another microcomputer as compared with a configuration in which mutual monitoring is performed by communication between the microcomputers 11 and 21.
Further, the microcomputers 11 and 21 can detect a failure in the CAN transceivers 16 and 26 or the CAN communication buses 61 and 62 corresponding to other microcomputers.

Furthermore, the ECU 101 can continue normal control by specifying a malfunctioning microcomputer and switching to control with only a normal microcomputer. In the case of the drive control device of the actuator 80, the drive of the actuator 80 can be continued appropriately. In addition, when a normal microcomputer notifies the failure information to the outside, a treatment in cooperation with an external device is possible.
For example, this is particularly effective in an apparatus that requires high reliability for maintaining the steering assist function, such as the electric power steering apparatus 90.

  (2) In the first embodiment, AND gates 15 and 25 are provided outside the microcomputers 11 and 21. Thus, practically, by adding an AND gate to an existing ECU, it is possible to modify the configuration of the first embodiment without changing the microcomputer itself.

(Second Embodiment)
A second embodiment will be described with reference to FIG.
The ECU 102 of the second embodiment is different from the first embodiment in that the functions of the AND gates 15 and 25 are included in the microcomputers 11 and 21. That is, the microcomputers 11 and 21 include reception-only CAN controllers 145 and 245 having an AND gate function.
Although the microcomputers of the first and second embodiments are strictly different in configuration, the same reference numerals “11, 21” are given to avoid complication.

The transmission terminals Tx of the reception-only CAN controllers 145 and 245 are connected to main transmission lines 236 and 136 of other microcomputers. The reception terminals Rx of the reception dedicated CAN controllers 145 and 245 are connected to main reception lines 237 and 137 of other microcomputers. Each of the microcomputers 11 and 21 determines whether or not the other microcomputers normally receive data from the CAN transceivers 26 and 16.
In addition, the code | symbol described side by side in each sentence below this paragraph respond | corresponds to the code | cord | chord of 1st and 2nd, respectively.

In this configuration, the AND gate function is constructed by software inside the CAN controllers 145 and 245, and the symbol of the AND gate does not appear on the drawing. Therefore, “(reception only)” is described in the CAN controllers 145 and 245 in the figure.
Note that the CAN controllers 145 and 245 are apparently capable of transmitting from the transmission terminal Tx to the main transmission lines 236 and 136 of other systems. However, as described above in the first embodiment, the essential meaning of “reception only” is to prevent an ACK reply, and does not exclude the configuration of the second embodiment in which transmission is possible.
The second embodiment has the same effects as the first embodiment.

(Third embodiment)
A third embodiment will be described with reference to FIG.
The ECU 103 of the third embodiment is connected to three CAN communication buses 61, 62, and 63 through which the same data is communicated, and includes three control microcomputers 11, 21, and 31 that perform control calculations redundantly using the same data. Prepare. That is, the ECU 103 is connected to the third CAN communication bus 63 with respect to the ECU 101 of the first embodiment, and includes a third microcomputer 31 including the CPU 32 and a third drive circuit 38 to which a command signal is output from the third microcomputer 31. In addition.
In the third embodiment, there are two other microcomputers for one own microcomputer.
The first and second microcomputers of the first embodiment and the third embodiment are strictly different in configuration, but are given the same reference numerals “11, 21” in order to avoid complexity.

  Each microcomputer 11, 21, 31 has one transmission / reception CAN controller 13, 23, 33, and two reception-only CAN controllers 141, 142, 241, 242, 341, 342. Further, outside each microcomputer 11, 21, 31 there are two AND gates 151, 152, 251, 252, 351, 352 corresponding to each reception dedicated CAN controller 141, 142, 241, 242, 341, 342, respectively. Is provided. The connection configuration between the reception-only CAN controller and the AND gate is the same as that in the first embodiment.

In addition, in FIG. 7, illustration by the straddle line in the crossing point of the communication line connected to the receiving terminal Rx of each reception dedicated CAN controller 141, 142, 241, 242, 341, 342 and the other communication lines is shown. Omitted. Instead, communication lines connected to the main reception line 137 from the first CAN transceiver 16, the main reception line 237 from the second CAN transceiver 26, and the main reception line 337 from the third CAN transceiver 36 are respectively represented by one-dot chain line and two It is indicated by a dotted line and a thin broken line.
In addition, in the reference numerals in the claims and [Explanation of reference numerals], the description of reference numerals unique to the third embodiment is omitted to avoid complication.

For example, another reception signal output from the second CAN transceiver 26 to the second microcomputer 21 via the main reception line 237 is connected to one terminal of the AND gate 151 corresponding to one reception dedicated CAN controller 141 of the first microcomputer 11. Is entered.
The other reception signal output from the third CAN transceiver 36 to the third microcomputer 31 via the main reception line 337 is connected to one terminal of the AND gate 152 corresponding to the other reception-only CAN controller 142 of the first microcomputer 11. A signal is input.
Thereby, the 1st microcomputer 11 can detect a failure by the method similar to 1st Embodiment about the 2nd microcomputer 21 and the 3rd microcomputer 31 which are two other microcomputers.

  Similarly, the second microcomputer 21 can detect a failure in the first microcomputer 11 and the third microcomputer 31, and the third microcomputer 31 can detect a failure in the second microcomputer 21 and the third microcomputer 31. In this way, the three control microcomputers 11, 21, and 31 perform the control calculation using the same data at the normal time, and drive the actuator 80 by instructing the drive circuits 18, 28, and 38 to drive signals. Moreover, the three control microcomputers 11, 21, and 31 mutually detect the failure of the other microcomputers. The normal control microcomputer identifies the failed microcomputer and notifies the outside via the corresponding CAN communication bus 61, 62, 63.

  As described above, the third embodiment develops the characteristic technical idea of the two-system redundant ECU in the first embodiment to the three-system redundant ECU. The same technical idea can be similarly extended to four or more multi-system redundant ECUs. The configuration having an AND gate function in the microcomputer according to the second embodiment may be similarly applied to three or more ECUs.

(Fourth embodiment)
A fourth embodiment will be described with reference to FIG.
The ECU 104 of the fourth embodiment is connected to two CAN communication buses 61 and 62 through which the same data is communicated, and in addition to the two control microcomputers 11 and 21 that perform control calculations redundantly using the same data, A third microcomputer 41 is provided as a “monitoring microcomputer”. That is, the ECU 104 further includes a third microcomputer 41 in addition to the configuration of the ECU 101 of the first embodiment.
As indicated by the broken line, the drive circuit 48 that drives the actuator 80 in cooperation with the drive circuits 18 and 28 may or may not be provided. When the drive circuit 48 is provided, the third microcomputer 41 instructs the drive circuit 48 with a drive signal generated by the control calculation.

The third microcomputer 41 includes, in addition to the CPU 42, two reception-only CAN controllers 441 and 442, and does not include a transmission / reception CAN controller.
Outside the third microcomputer 41, AND gates 451 and 452 corresponding to the reception-only CAN controllers 441 and 442 are provided. The connection configuration between the receive-only CAN controllers 441 and 442 and the AND gates 451 and 452 is the same as the connection configuration between the receive-only CAN controllers 14 and 24 and the AND gates 15 and 25 in the first and second microcomputers 11 and 21. .

An output from the first CAN transceiver 16 to the first microcomputer 11 is input to one terminal of the AND gate 451 corresponding to the reception-only CAN controller 441 via the main reception line 137. Therefore, the failure of the first microcomputer 11 can be detected twice by the second microcomputer 21 and the third microcomputer 41.
An output from the second CAN transceiver 26 to the second microcomputer 21 is input to one terminal of the AND gate 452 corresponding to the reception-only CAN controller 442 via the main reception line 237. Therefore, the failure of the second microcomputer 21 can be detected twice by the first microcomputer 11 and the third microcomputer 41.

Therefore, even when an abnormality occurs in which the other microcomputer failure detection function of the first microcomputer 11 or the second microcomputer 21 is lost, the third microcomputer 41 can detect the failure of the first microcomputer 11 and the second microcomputer 21. . However, the third microcomputer 41 does not output its calculation result to the CAN communication buses 61 and 62.
Thus, unlike the first and second microcomputers 11 and 21 as the “control microcomputer”, the third microcomputer 41 of the fourth embodiment monitors the failure of the other two control microcomputers 11 and 21. This is the main purpose and is called “monitoring microcomputer”. The third microcomputer 41, which is a monitoring microcomputer, does not have a function of instructing a drive signal to the drive circuit 48, and may execute only monitoring of other microcomputers.

In the example of the fourth embodiment, for the two CAN communication buses 61 and 62, two control microcomputers 11 and 21 out of the three microcomputers included in the ECU 104 transmit and receive with the CAN communication buses 61 and 62, and the other third The microcomputer 41 functions as a “monitoring microcomputer” dedicated to reception.
In another example according to the fourth embodiment, the ECU includes more microcomputers than the corresponding number of CAN communication buses. For example, for two CAN communication buses, the ECU may include a total of four microcomputers including two control microcomputers and two monitoring microcomputers. Alternatively, for the three CAN communication buses, the ECU may include a total of four microcomputers including three control microcomputers and one monitoring microcomputer.

(Other embodiments)
The present invention is not limited to an ECU for an electric power steering device, and is applied to any electronic control device provided with a plurality of control microcomputers redundantly connected to a plurality of CAN communication buses through which the same data is communicated. Also good. In particular, this is effective for a vehicle-mounted electronic control device that requires high reliability.
As mentioned above, this invention is not limited to such embodiment, In the range which does not deviate from the meaning of invention, it can implement with a various form.

101, 102, 103, 104 ... ECU (electronic control unit),
11, 21 ... microcomputer (control microcomputer),
12, 22 ... CPU,
13, 23 ... (for transmission and reception) CAN controller,
14, 145, 24, 245 (reception only) CAN controller,
15, 25 ... AND gate 16, 26 ... CAN transceiver 41 ... microcomputer (monitoring microcomputer),
61, 62 ... CAN communication bus.

Claims (4)

A CPU (12, 22) that is connected to a plurality of CAN communication buses (61, 62) to which the same data is communicated and performs a control operation using the same data received from the plurality of CAN communication buses, a transmission / reception CAN controller ( 13, 23) and a plurality of control microcomputers (11, 21) including one or more receive-only CAN controllers (14, 145, 24, 245),
A plurality of CAN transceivers (16, 26) for relaying communication between the transmission / reception CAN controllers of the plurality of control microcomputers and the plurality of CAN communication buses;
With
Of the plurality of control microcomputers, if one of the control microcomputers of interest is the own microcomputer, and one or more control microcomputers other than the own microcomputer are other microcomputers,
The own transmission signal transmitted from the transmission terminal (Tx) of the reception dedicated CAN controller of the own microcomputer and the other reception signal communicated from the CAN transceiver corresponding to the other microcomputer to the transmission / reception CAN controller of the other microcomputer. AND gates (15, 25) are provided outside the plurality of microcomputers to calculate the logical product of them and output them to the reception terminals (Rx) of the reception-only CAN controllers (14, 24) of the microcomputer. Or the reception-only CAN controller (145, 245) has the function of the AND gate,
The plurality of microcomputers are electronic control devices capable of mutually detecting at least a failure of another microcomputer based on data input to the reception-only CAN controller.   The electronic control according to claim 1, wherein the plurality of microcomputers can further detect a failure of the CAN transceiver or the CAN communication bus corresponding to the other microcomputer based on data input to the reception-only CAN controller. apparatus.   The electronic control device according to claim 1, wherein the AND gate is provided outside the plurality of control microcomputers.   In addition to the plurality of control microcomputers capable of mutually detecting a failure of the other microcomputer, one or more monitoring microcomputers (41) including the reception-only CAN controller (441, 442) and capable of detecting a failure of the other microcomputer are provided. The electronic control device according to claim 1, further comprising:

Images