JP2019093839A - Electronic control apparatus - Google Patents

Abstract

To provide an electronic control apparatus capable of cutting off communication when an abnormality occurs in a CPU by minimizing an increase in costs.SOLUTION: An SCU 2 constituting a shift-by-wire system includes, as an internal function of a CPU 5, a CAN communication section 13 to perform communication with an external apparatus, a CPU abnormality diagnostic logic section 16 for performing a diagnostic program that diagnoses whether the CPU 5 is abnormal or not, and a transmission processing function address generation section 17. These are intended to cut off communication by the CAN communication section 13 when a diagnostic result identifies the presence of abnormality.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an electronic control unit including a CAN communication unit which is realized as an internal function of a CPU and communicates with an external device by CAN.

  Conventionally, in an ECU (Electronic Control Unit) that communicates with an external device by CAN, as a technology for stopping communication when an abnormality occurs in the CPU of a microcomputer that constitutes the ECU, CPU external to the microcomputer is used. There is a system in which a monitoring unit for monitoring an abnormality is provided and communication is stopped by the monitoring unit (see Patent Document 1).

  This is because the monitoring unit receives information necessary for abnormality diagnosis of the CPU from the microcomputer as an input and performs diagnosis, and when abnormality in the CPU is detected, the operation of the CAN driver used by the microcomputer is stopped or the communication line is cut off. It is a thing. By stopping the communication, the external ECU that is the communication destination can detect that the ECU that is the communication source is in an abnormal state.

Patent No. 4533270

  In Patent Document 1, since the monitoring unit that has detected an abnormality in the CPU stops communication, a configuration for connecting the monitoring unit and a CAN driver having a function of stopping communication by an external input, or a CAN driver is forced. It is necessary to have an external mechanism to stop the communication or shut off the communication line, and to control it by the monitoring unit. Adding a CAN driver with this function or an external mechanism for shutdown will increase the overall cost of the system.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide an electronic control unit capable of stopping communication when an abnormality occurs in a CPU without raising the cost as much as possible.

  According to the electronic control unit of the first aspect, the internal function of the CPU includes a communication unit that communicates with an external device, and an abnormality diagnosis unit that executes a diagnostic program that diagnoses whether the CPU is abnormal or not. The diagnosis unit stops communication by the communication unit if the diagnosis result is abnormal. According to this structure, the self-diagnosis is performed by the internal function without adding an external mechanism to the CPU, and if the result of the diagnosis is abnormal, the communication is stopped, so that the cost increase can be suppressed.

  According to the electronic control unit of the second aspect, the abnormality diagnosis unit stops only specific data transmission by the communication unit if the diagnosis result is abnormal. With this configuration, it is possible to continue reception of data, transmission of data with low risk in the case of an abnormal value, and the like.

  According to the electronic control device of the third aspect, the diagnostic program uses a plurality of instructions executed by the CPU, and generates an address of a function that performs transmission processing by executing independent computation for each instruction. If the generated address does not indicate the desired value, processing for diagnosing an abnormality is used as a main program. According to this configuration, if there is an abnormality in the CPU, the value of the generated address is different from the expected value, the function for performing the transmission process is not called, and the transmission is not performed. Therefore, transmission can be reliably stopped when an abnormality occurs.

  According to the electronic control device of the fourth aspect, the main program uses a plurality of instructions executed by the CPU when the specific data transmission is performed by the communication unit, and performs an independent operation for each instruction. Generates the address of the function that performs transmission processing. Then, if the generated address does not indicate the desired value, it is diagnosed as abnormal. According to this structure, the abnormality diagnosis can be efficiently performed depending on whether or not the instruction used for the transmission process is properly executed.

  According to the electronic control unit according to claim 5, the main program causes the values of the execution results of the independent calculation to be sequentially accumulated for each instruction, and whether the final accumulated value matches the value of the address or not to decide. With this configuration, abnormality diagnosis can be easily performed, and the accumulated value can be made an immediate value of the address that calls the function.

A functional block diagram showing the configuration of a shift-by-wire system, which is an embodiment Flow chart showing contents of processing by SCU Flow chart showing contents of CPU diagnosis Flow chart showing contents of INST diagnosis Flow chart showing contents of transmission function address generation processing Figure showing an example of a diagnostic program Flow chart showing the processing contents when a service request is generated by the diagnosis service tool Sequence diagram showing processing between each component (normal) Sequence diagram showing processing between each component (when an error occurs) Sequence diagram showing processing when a service request is generated by the diagnostic service tool

  Hereinafter, an embodiment will be described with reference to the drawings. In the shift-by-wire (SBW) system shown in FIG. 1, it is assumed that the shifter 1 of the vehicle is operated by the driver and the shifter position is switched from, for example, "P" to "D". The SCU (Sift Control Unit) 2 determines the position of the shifter and transmits it to the TCU (Transmission Control Unit) 3 by CAN communication. When the TCU 3 transmits the required range to the SCU 2 according to the received position "D", the SCU 2 controls the ACT (Actuator) 4 to switch the vehicle between the lock state "P" and the unlock state "not P". The drive current is output as a signal. TCU 3 corresponds to an external device. Further, ACT 4 corresponds to a control target device.

  When the ACT 4 switches from "P" to "not P", information on the status "not P" is transmitted to the TCU 3 via a position sensor and a signal line (not shown). After confirming the status, the TCU 3 changes the transmission of the vehicle to the “D” mode according to the shifter position, and transmits to the SCU 2 that the current range of the shifter 1 is “D”.

  The SCU 2 includes a CPU 5, a CAN driver 6, and a monitoring unit 7. When the operation of the shifter 1 is performed, the CPU 5 determines the shifter position in the shifter position transmission determination unit 11. The shifter position is output to the CAN communication unit 13 via the shifter position transmission determination unit 12. The shifter position transmission determination unit 12 includes a normalcy determination unit 14 and a function call unit 15. Those represented by switch symbols are serially arranged in a path for outputting the shifter position to the CAN communication unit 13, and when an abnormality is detected as a result of the self-diagnosis performed by the CPU 5, transmission of the shifter position is performed. Have a function to stop the

  The CPU 5 includes a CPU abnormality diagnosis logic unit 16 and a transmission processing function address generation unit 17 as functional units that perform self-diagnosis. The CPU abnormality diagnosis logic unit 16 includes a RAM diagnosis unit 18, a ROM diagnosis unit 19, an FLOW diagnosis unit 20, an INST diagnosis unit 21, and an input / output unit 22. The RAM diagnosis unit 18 diagnoses whether writing and reading of data to and from the RAM are normally performed. For example, the ROM diagnostic unit 19 diagnoses the ROM based on whether or not the SUM value obtained by reading and accumulating the control program and data stored in the ROM matches the expected value.

  The FLOW diagnosis unit 20 diagnoses whether the programs to be executed by the CPU 5 are executed in a predetermined order. As described later in detail, the INST diagnosis unit 21 diagnoses an abnormality by performing predetermined operations using a plurality of instructions prepared as an instruction set of the CPU 5. The diagnosis results of each of the diagnosis units 17 to 20 are input to the input / output unit 22. If any one of the results is "abnormal", the normality determination unit 14 cuts off the transmission path of the shifter position. .

  The transmission processing function address generation unit 17 performs, for example, the same operation as the INST diagnosis unit 21 to generate an address for calling a function that executes a process of transmitting the shifter position to the TCU 3. When the above address is correctly generated by the normal execution of the operation, the above function is called in the function call unit 15, and the shifter position is transferred to the CAN communication unit 13. If the address is not correctly generated, the function is not called and the shifter position is not transferred.

  The CAN communication unit 13 includes a transmission processing unit 13S and a reception processing unit 13R. The transmission processing unit 13S inputs the shifter position data received via the determination unit 11 to the CAN driver 6. The CAN driver 6 transmits the shifter position data to the TCU 3 via the CAN bus 8. Further, the CAN driver 6 outputs the required range corresponding to the shifter position data to the P / not P switching unit 23 via the reception processing unit 13R. The P / not P switching unit 23 outputs a drive current for switching the lock and unlock of the vehicle to the ACT 4 through the normally closed relay 24. The relay 24 corresponds to a switch.

  In addition, a diagnostic service tool 9 is connected to the CAN bus 8. The diagnostic service tool 9 transmits a service request for reading out the fault information to the SCU 2. The service request is input to the diagnosis service unit 25 of the SCU 2 via the reception processing unit 13R of the CAN communication unit 13. The diagnosis service unit 25 transmits failure information corresponding to the service request as service response data to the diagnosis service tool 9 through the transmission processing unit 13S.

  The diagnosis result in the transmission processing function address generation unit 17 is also input to the input / output unit 22 of the CPU abnormality diagnosis logic unit 16. The input / output unit 22 transmits the diagnosis result of each of the diagnosis units 18 to 21 or the transmission processing function address generation unit 17 to the monitoring unit 7 via the serial communication unit 26. The monitoring unit 7 controls the opening and closing of the relay 24. If there is an "abnormality" in the received diagnosis result, the monitoring unit 7 opens the relay 24 and prohibits the drive of the ACT 4. The transmission processing function address generation unit 17 and the INST diagnosis unit 21 correspond to an abnormality diagnosis unit.

  Next, the operation of the present embodiment will be described. As shown in FIG. 2, when the shifter position determination unit 11 of the SCU 2 determines the shifter position (S1), the CPU abnormality diagnosis logic unit 16 performs CPU diagnosis (S2). That is, as shown in FIG. 3, each diagnosis unit 18 to 21 diagnoses each subject (S11 to S14), and if all the diagnosis results are normal (S15; YES), the result of CPU diagnosis is “normal If it is determined that any one diagnosis result is abnormal (S15; NO), the result of CPU diagnosis is determined as "abnormal" (S17).

  Refer again to FIG. Following step S2, the transmission processing function address generation unit 17 calculates an address for calling the transmission processing function (S3). Then, if the result of the CPU diagnosis in step S2 is "normal" (S4; YES), the transmission processing function is called by the address calculated in step S3 (S5). If the address is normally calculated (S6; YES), the transmission processing function is called and shifter position data is transmitted by CAN communication (S7). That is, in this case, both the normality determination unit 14 and the function call unit 15 in the shifter position transmission determination unit 12 pass shifter position data and input the data to the CAN communication unit 13.

  In this case, as shown in FIG. 8, the shifter position, for example, “D”, is transmitted from the SCU 2 to the TCU 3. Then, the TCU 3 transmits a required range “not P” to the SCU 2 in order to unlock the vehicle. In response to that, the SCU 2 transmits a control signal "notP" to the ACT 4. Then, the ACT 4 is driven to switch the range from "P" to "not P". The ACT 4 transmits to the TCU 4 that the vehicle is unlocked and the status is "not P". When the TCU 4 recognizes that the status is "not P", the TCU 4 changes the transmission of the vehicle to "D" mode, and informs the SCU 2 that the current range is "D".

  On the other hand, if the result of the CPU diagnosis is "abnormal" (S4; NO), or if the address is not properly calculated (S6; NO), step S7 is skipped and transmission is not performed. That is, either the normality determination unit 14 or the function call unit 1 blocks passage of shifter position data. Subsequently, the diagnosis result is transmitted to the monitoring unit 7 (S8). If the diagnosis result is "abnormal" (S9; NO), the monitoring unit 7 opens the relay 24 to shut off the current path to the ACT 4 (S10). In this case, as shown in FIG. 9, the shifter position is not transmitted to the TCU 4, and the TCU 4 detects an abnormality. Then, it is transmitted to the SCU 2 that the current range is "P".

  Next, the "INST diagnosis" executed in step S14 will be described. As shown in FIG. 4, here, all the instructions used for the transmission processing of the shifter position are used (S21 to S25). Then, when an operation using each instruction is performed (S22), the operation result is stored as a SUM value in an accumulator or the like and added (S23). Then, when the calculation is performed using all the instructions, if the final SUM value matches the desired value and is normal (S26; YES), the result of the INST diagnosis is determined to be “normal”. To do (S27). On the other hand, if the final SUM value does not match the expected value (S26; NO), it is determined that the result of the INST diagnosis is "abnormal" (S28). Programs for performing this INST diagnosis correspond to diagnostic programs and subprograms.

  Next, the calculation of the function address to be executed in step S3 will be described. As shown in FIG. 5, as in the case of "INST diagnosis", all the instructions used for the transmission process of the shifter position are used (S31 to S35), and the operation using each instruction is performed (S32) The result is accumulated and added as a SUM value (S33). Then, when the operation is completed using all the instructions, the final SUM value is stored as a transmission processing function address in a register or the like (S36). Programs for calculating this function address correspond to a diagnostic program and a main program.

Next, specific examples of operations performed in INST diagnosis and function address calculation processing will be described. For example, as shown in FIG. 6, the following calculation is performed using MOV (data transfer instruction), ADD (addition instruction), CMP (comparison instruction) or the like.
(1) Transfer 0x55 to register A.
(2) Compare the value of register A with 0x55.
(3) If the results match, (4) increment the value of register C; otherwise, skip the process without executing it.
(5) Transfer 0x55 to register A.
(6) Compare the value of register A with 0xAA.
(7) If the results match, (8) increment the value of the register C; otherwise, skip the process without executing it.
(9) Transfer 0x55 to the register A.
(10) Transfer 0x56 to register B.
(11) Compare the values of the registers A and B.
(12) If the results do not match (13) The value of register C is incremented, and if they match, the processing is skipped without being executed.

  If each instruction is normally executed up to step (13), the value of register C, which is a SUM value, becomes “3” if the initial value is “0”, and one of MOV, ADD, and CMP is an instruction. If normal execution is not performed, the value of the register C becomes "2" or less. Therefore, the result of the INST diagnosis can be determined by comparing the SUM value with "3" in step S26.

Further, for calculation of the function address, assuming that the expected value of the calculation result of the function address is 0xFFFF, the initial value of the register C is 0xFFFF-0x0003 = 0xFFFC.
By setting it to the value obtained by subtracting "3" from the expected value like this, the expected value result: 0xFFFF is obtained when all the instructions used in the operation are normal, and the transmission processing function is called in the function call unit 15 Transmission processing is performed. On the other hand, when one of the instructions is abnormal, the other result: 0xFFFC to 0xFFFE is obtained, so the transmission processing function is not called and transmission processing is not performed.

  The above operation is an example for performing INST diagnosis or calculating function address. A process of finely dividing an operation into instructions and calculating a SUM value is not essential for achieving the purpose. The important point is that each instruction is used to perform an operation, and even one instruction is processed so that a correct result can not be obtained.

  Also, it is not necessary to use all the instructions in the operation. The process of stopping CAN transmission when the CPU 5 of the present embodiment is abnormal is necessary to prevent unintended vehicle operation by not transmitting an incorrect shifter position signal. Therefore, if the instruction used from the determination of the shifter position until the CAN transmission is performed is the target of the operation, the request is sufficiently satisfied.

  Next, the diagnosis service process will be described. As shown in FIGS. 7 and 10, when the diagnostic service tool 9 transmits a service request to the SCU 2 (S41), the reception processing unit 13R of the CAN communication unit 13 receives the supply and transfers it to the diagnostic service unit 25. (S42). The diagnostic service unit 25 generates a response message to the service request (S43). At this time, if "abnormal" is detected, failure information is included in the response message. Then, the diagnosis service unit 25 calls a function for performing transmission processing in the CAN communication unit 13 (S44), and transmits a response message to the diagnosis service tool 9 (S45). Then, the diagnostic service tool 9 receives the transmitted response message (S46).

  Here, in the prior art, when stopping CAN communication, all CAN transmissions are completely cut off in order to stop the CAN driver itself or to shut off the CAN bus. As a result, all functions using CAN communication, such as a function for acquiring failure information from outside the ECU such as a diagnostic service, can not be used. On the other hand, in the present embodiment, only the CAN transmission of the shifter position is limited when an abnormality occurs, and the CAN reception for the diagnostic service request by the external tool 9 and the CAN transmission for the response thereto are not limited.

  As described above, according to the present embodiment, the SCU 2 configuring the shift-by-wire system has, as an internal function of the CPU 5, a CAN communication unit 13 that communicates with an external device and a diagnostic program that diagnoses whether the CPU 5 is abnormal. The CPU abnormality diagnosis logic unit 16 to be executed and the transmission processing function address generation unit 17 are provided, and when the diagnosis result is abnormal, the communication by the CAN communication unit 13 is stopped. According to this configuration, the internal function DE self-diagnosis is performed without adding an external mechanism to the CPU 5, and if the result of the diagnosis is abnormal, the communication is stopped. Therefore, the cost increase is suppressed when configuring the SCU 2. it can.

  Then, since the CPU abnormality diagnosis logic unit 16 and the transmission processing function address generation unit 17 only stop the data transmission of the shifter position by the CAN communication unit 13 if the diagnosis result is abnormal, the diagnosis service request by the external tool 9 is requested. It is possible to continue CAN reception of the response to it and CAN reception.

  In addition, the transmission processing function address generation unit 17 uses a plurality of instructions executed by the CPU 5 to execute independent operations for each instruction, sequentially accumulate the values of the execution results, and transmit the final accumulated value, transmission Generate as the address of the function to be processed. If the generated address does not indicate the desired value, it is diagnosed as abnormal. According to this configuration, if there is an abnormality in the CPU 5, the value of the generated address is different from the expected value, so that the function that performs the transmission process is not called and the transmission is not performed. Therefore, transmission can be reliably stopped when an abnormality occurs. In this case, since the plurality of instructions executed by the CPU 5 when transmitting data at the shifter position by the CAN communication unit 13 are used as the plurality of instructions, whether or not the instruction used for the transmission process is properly executed An abnormality diagnosis can be performed efficiently.

  Further, the INST diagnosis unit 21 diagnoses the abnormality of the CPU 5 using a diagnosis program similar to that of the transmission processing function address generation unit 17. Thus, whether or not the CPU 5 is normal can be double-checked, and the presence or absence of an abnormality can be diagnosed more reliably.

  Furthermore, a relay 24 disposed in a path for energizing the external ACT 4 and a monitoring unit 7 controlling on / off of the relay 24 are provided, and the CPU abnormality diagnosis logic unit 16 outputs a diagnosis result to the monitoring unit 7; The monitoring unit 7 opens and turns off the relay 24 if the diagnosis result is abnormal. As a result, it is possible to prevent the drive current from flowing to the ACT 4 and prevent the lock and unlock of the vehicle from being switched.

(Other embodiments)
The INST diagnosis may be performed as needed.
The diagnostic program does not necessarily have to calculate the cumulative value of the result of each operation.
The main program and the sub program in the diagnostic program do not necessarily have to be the same program.
The communication protocol is not limited to CAN, and any protocol may be used.
The present invention may be applied to systems other than shift-by-wire systems.
Although the present disclosure has been described based on the examples, it is understood that the present disclosure is not limited to the examples and structures. The present disclosure also includes various modifications and variations within the equivalent range. In addition, various combinations and forms, and further, other combinations and forms including only one element, or more or less than these elements are also within the scope and the scope of the present disclosure.

  In the figure, 1 is a shifter, 2 is an SCU, 3 is a TCU, 4 is an ACT, 5 is a CPU, 7 is a monitoring unit, 13 is a CAN communication unit, 16 is a CPU abnormality diagnosis logic unit, and 17 is a transmission processing function address generation unit , 21 indicates an INST diagnostic unit.

Claims (10)

It is realized as an internal function of CPU (5),
A communication unit (13) that communicates with an external device;
And an abnormality diagnosis unit (16, 17) that executes a diagnosis program that diagnoses whether the CPU is abnormal or not.
The electronic control unit according to claim 1, wherein the abnormality diagnosis unit stops communication by the communication unit if the diagnosis result is abnormal.   The electronic control unit according to claim 1, wherein the abnormality diagnosis unit stops only specific data transmission by the communication unit if the diagnosis result is abnormal.   The diagnostic program uses a plurality of instructions executed by the CPU, and executes an independent operation for each instruction to generate an address of a function that performs transmission processing. If the address does not indicate a desired value, an error occurs. The electronic control device according to claim 1 or 2, wherein the process of diagnosing the main body is a main program.   The main program uses a plurality of instructions executed by the CPU when performing specific data transmission by the communication unit, and generates an address of a function that performs transmission processing by executing an independent operation for each instruction. 4. The electronic control unit according to claim 3, wherein the electronic control unit diagnoses an abnormality if the address does not indicate a desired value.   5. The electronic control according to claim 3, wherein the main program sequentially accumulates values of execution results of independent operations for each instruction, and determines whether a final accumulated value matches the value of the address. apparatus.   The diagnostic program is a sub-program that uses a plurality of instructions executed by the CPU, and performs a process of diagnosing an abnormality if the value obtained by executing independent operations for each instruction does not match the expected value. The electronic control device according to any one of claims 3 to 5, wherein   The diagnostic program uses a plurality of instructions executed by the CPU when transmitting specific data by the communication unit, and a value obtained by executing independent calculation for each instruction is a desired value. 7. The electronic control device according to claim 6, wherein the processing for diagnosing an abnormality if they do not match is a subprogram.   8. The electronic control device according to claim 6, wherein the subprogram sequentially accumulates values of execution results of independent operations for each instruction, and determines whether or not the final accumulated value matches an expected value. . A switch (24) disposed in a path for energizing the external control target device;
A monitoring unit (7) for controlling the on / off of the switch;
The abnormality diagnosis unit outputs the diagnosis result to the monitoring unit.
The electronic control unit according to any one of claims 1 to 8, wherein the monitoring unit turns off the switch if the diagnosis result is abnormal.   The electronic control unit according to any one of claims 1 to 9, which is applied to a shift-by-wire system and transmits the position of a shifter (1) of a vehicle operated by a driver to the external device (3).

Images