JP2020194425A - Control device and monitoring method - Google Patents

Abstract

To provide a control device and a monitoring method, which allow for checking a reset line at low cost.SOLUTION: A control device according to an embodiment comprises multiple microcomputers. One microcomputer is configured to check for abnormalities of a reset line for resetting another microcomputer if information input by the another microcomputer at the startup thereof satisfies a given condition.SELECTED DRAWING: Figure 1

Description

The present invention relates to a control device and a monitoring method.

Conventionally, for example, there is a control system including a control microcomputer mounted on a vehicle and a monitoring microcomputer that resets (restarts) the control microcomputer when an abnormality of the control microcomputer is detected (see, for example, Patent Document 1). .. In this type of control system, when the control microcomputer is started, the reset line for resetting the control microcomputer is checked from the monitoring microcomputer.

JP-A-2018-78682

However, in the prior art, since dedicated hardware for checking the reset line is required, there is a risk of increasing the cost. In particular, in recent years, since the number of microcomputers mounted on each control device has increased, the cost increases in proportion to the number of microcomputers.

The present invention has been made in view of the above, and an object of the present invention is to provide a control device and a monitoring method capable of checking a reset line at low cost.

In order to solve the above-mentioned problems and achieve the object, the control device according to the embodiment includes a plurality of microcomputers, and one microcomputer is input from the other microcomputer when the other microcomputer is started. When the information satisfies a predetermined condition, an abnormality check of the reset line for resetting the other microcomputer is performed.

According to the present invention, the reset line can be checked at low cost.

FIG. 1 is a block diagram of a control device. FIG. 2 is a diagram showing a specific example of information stored in the first storage unit and the second storage unit. FIG. 3 is a timing chart showing a processing procedure by the main microcomputer and the sub microcomputer.

Hereinafter, the control device and the monitoring method according to the embodiment will be described with reference to the accompanying drawings. The present invention is not limited to the embodiments shown below. Further, in the following, a case where the control device is mounted on a vehicle (not shown) will be described as an example.

First, a configuration example of the control device will be described with reference to FIG. FIG. 1 is a block diagram of a control device. In the present embodiment, the control device 1 is various electronic control devices (ECU: Electronic Control Unit) mounted on the vehicle.

By the way, conventionally, there is a monitoring device (or a monitoring microcomputer) that monitors the operating state of a control microcomputer mounted on an ECU. When such a monitoring device detects that an abnormality has occurred in the control microcomputer, it outputs a reset signal to the reset line of the control microcomputer to restart the control microcomputer.

In addition, such a monitoring device may check whether the reset line of the control microcomputer functions normally at a predetermined timing. This type of monitoring device is dedicated hardware, and the cost increases by the amount of such hardware provided. Hereinafter, the check for whether or not the reset line functions normally may be described as an abnormality check.

On the other hand, in recent years, as in the control device 1 shown in FIG. 1, there is a device in which a plurality of control microcomputers (corresponding to the main microcomputer 10 and the sub microcomputer 20) that control different controls are mounted in one control device. Each such control microcontroller executes different control applications that control the state of the vehicle.

In such a control device 1, a reset line is provided for each microcomputer, and it is necessary to check the abnormality of the reset line for each reset line. Therefore, if a monitoring device is mounted on each microcomputer as in the above-mentioned conventional technique, the number of reset lines increases in proportion to the number of microcomputers, and a number of monitoring devices corresponding to the number of reset lines is required.

Therefore, in the control device 1 according to the embodiment, it is decided that a plurality of microcomputers each perform an abnormality check of the reset line of another microcomputer. That is, in the control device 1 according to the embodiment, it is possible to omit the monitoring device by having a plurality of microcomputers mutually check for an abnormality in the reset line.

Specifically, as shown in FIG. 1, the control device 1 according to the embodiment includes a main microcomputer 10 and a sub microcomputer 20. The main microcomputer 10 and the sub-microcomputer 20 are, for example, microcomputers that perform different controls on the battery.

In the present embodiment, the main microcomputer 10 and the sub-microcomputer 20 can mutually check the reset line. Specifically, the main microcomputer 10 performs a control abnormality of the sub-microcomputer 20 and the above-mentioned abnormality check, and the sub-microcomputer 20 performs a control abnormality of the main microcomputer 10 and the above-mentioned abnormality check.

Therefore, in the following, among the main microcomputer 10 and the sub-microcomputer 20, the microcomputer to be monitored on the reset line may be referred to as the monitored microcomputer, and the monitored microcomputer may be referred to as the monitored microcomputer.

That is, when the main microcomputer 10 is the monitoring target microcomputer, the sub-microcomputer 20 is the monitoring microcomputer, and when the sub-microcomputer 20 is the monitoring target microcomputer, the main microcomputer 10 is the monitoring microcomputer.

For example, the main microcomputer 10 operates by the electric power supplied from the main battery (not shown) of the vehicle when the ignition switch (hereinafter referred to as IG switch) of the vehicle is turned on.

Further, the sub-microcomputer 20 operates by the electric power constantly supplied from the auxiliary battery (not shown) of the vehicle, and repeats sleep (hibernation) and wake-up activation at a predetermined cycle during the period when the IG switch is off.

The main microcomputer 10 and the sub-microcomputer 20 are each composed of separate CPUs (Central Processing Units), and transmit and receive information in both directions by inter-CPU communication via the communication bus B. Further, the main microcomputer 10 and the sub-microcomputer 20 are connected by the first reset line Lr1, the second reset line Lr2, the first WDC line Lw1 and the second WDC line Lw2 in addition to the communication bus B.

The first reset line Lr1 is a signal line that outputs a reset signal from the sub-microcomputer 20 to the main microcomputer 10, and the sub-microcomputer 20 can restart the main microcomputer 10 via the first reset line Lr1.

The second reset line Lr2 is a signal line that outputs a reset signal from the main microcomputer 10 to the sub-microcomputer 20, and the main microcomputer 10 can restart the sub-microcomputer 20 via the second reset line Lr2.

The first WDC line Lw1 is a signal line for transmitting a WDC (Watch Dog Counter) signal from the sub-microcomputer 20 to the main microcomputer 10, and the sub-microcomputer 20 can detect an abnormality in the main microcomputer 10 based on the WDC signal. ..

The second WDC line Lw2 is a signal line for transmitting a WDC signal from the main microcomputer 10 to the sub-microcomputer 20, and the main microcomputer 10 can detect an abnormality of the sub-microcomputer 20 based on the WDC signal.

The main microcomputer 10 includes a first control application execution unit 11, a first monitoring application execution unit 12, a first reset circuit 13, and a first storage unit 14. The main microcomputer 10 is a microcomputer provided with a CPU and the like.

The first control application execution unit 11 executes, for example, a power control application that controls the power of the vehicle. The application executed by the first control application execution unit 11 is not limited to this.

The first monitoring application execution unit 12 executes a monitoring application that monitors the operating state of the sub-microcomputer 20. For example, the first monitoring application execution unit 12 receives a WDC signal input from the sub-microcomputer 20 at a constant cycle via the second WDC line Lw2 in a normal state of the sub-microcomputer 20. The first monitoring application execution unit 12 determines that the sub-microcomputer 20 is abnormal when the WDC signal input from the sub-microcomputer 20 is interrupted.

The first monitoring application execution unit 12 detects an abnormality in the sub-microcomputer 20 when there is no response from the sub-microcomputer 20 within a predetermined time or when there is an error in the response to the output WDC signal. You may decide. Then, when the first monitoring application execution unit 12 detects an abnormality in the sub-microcomputer 20, it outputs a reset signal to the sub-microcomputer 20 via the second reset line Lr2.

As a result, when the sub-microcomputer 20 operates abnormally, the sub-microcomputer 20 is restarted, and it is possible to suppress the runaway of the sub-microcomputer 20. In this embodiment, the above-mentioned processing performed by the first monitoring application execution unit 12 may be performed by another microcomputer, or the first monitoring application execution unit 12 and the other microcomputer may perform the above-mentioned processing, respectively. You may.

Further, the first monitoring application execution unit 12 performs an abnormality check of the second reset line Lr2 based on the request of the sub-microcomputer 20 as a part of the primary check (operation check at startup) by the sub-microcomputer 20. The primary check corresponds to an example of initialization processing at startup.

The abnormality check of the second reset line Lr2 is performed by actually outputting the reset signal to the sub-microcomputer 20 side via the second reset line Lr2. That is, if the second reset line Lr2 functions normally, the sub-microcomputer 20 will be restarted, and if the sub-microcomputer 20 does not restart, it means that the second reset line Lr2 does not function normally. To do.

The first reset circuit 13 is a circuit for restarting the main microcomputer 10. For example, when a reset signal is input from the sub-microcomputer 20, the main microcomputer 10 is restarted.

The first storage unit 14 is, for example, a volatile memory such as an SRAM, and stores various information written by the first control application execution unit 11 and the first monitoring application execution unit 12. Further, the first storage unit 14 stores various information related to the check of the reset line received from the sub-microcomputer 20 via the communication bus B. It is assumed that the first storage unit 14 also includes a non-volatile memory (for example, ROM).

Subsequently, the sub-microcomputer 20 will be described. As shown in FIG. 1, the sub-microcomputer 20 includes a second control application execution unit 21, a second monitoring application execution unit 22, a second reset circuit 23, and a second storage unit 24.

The second control application execution unit 21 starts, for example, in a predetermined cycle during the period when the IG switch is off, and performs an equalization process for equalizing each cell voltage of the Li (lithium ion) storage battery which is a backup power source of the vehicle. Do.

In the present embodiment, a Li storage battery is provided as a backup power source in addition to the 12V auxiliary battery of the lead storage battery which is the main battery. The cell voltage is equalized by discharging the cell having a high voltage and adjusting the voltage of the cell having a high voltage to the cell having a low voltage. Further, the sub-microcomputer monitors the battery cell status of the Li storage battery even while the IG switch is on, and equalizes only when the IG switch is off.

Further, the second control application execution unit 21 sets a timer and sleeps when the equalization process for the Li storage battery is completed. When the timer reaches a predetermined time, the second control application execution unit 21 wakes up from sleep and starts wake-up again. The function executed by the second control application execution unit 21 is not limited to the above example, and can be arbitrarily changed. For example, the second control application execution unit 21 charges the auxiliary battery by supplying power from the main battery to the auxiliary battery when the charge state of the auxiliary battery drops during the period when the IG switch is off. The process may be performed.

The second monitoring application execution unit 22 performs the processing performed on the sub-microcomputer 20 by the first monitoring application execution unit 12 on the main microcomputer 10. The second reset circuit 23 is a circuit that restarts the sub-microcomputer 20 based on the reset signal input from the main microcomputer 10.

The second storage unit 24 is a volatile memory like the first storage unit 14, and is transmitted from the main microcomputer 10 and various information written by the second control application execution unit 21 and the second monitoring application execution unit 22. Store various information.

Next, a specific example of the information stored in the first storage unit 14 and the second storage unit 24 will be described with reference to FIG. FIG. 2 is a diagram showing a specific example of information stored in the first storage unit 14 and the second storage unit 24.

As shown in FIG. 2, for example, the first storage unit 14 and the second storage unit 24 store information regarding a "primary check state", an "execution request flag", a "reset history", and the like, respectively.

Here, the information stored in the first storage unit 14 is information related to the state of the sub-microcomputer 20, and the information stored in the second storage unit 24 is information related to the state of the main microcomputer 10. That is, in the present embodiment, the main microcomputer 10 and the sub-microcomputer 20 each have information about each other.

The primary check state shown in FIG. 2 is information indicating the primary check state of the other microcomputer. For example, when the other microcomputer is performing the primary check, the primary check state is being executed, and is completed after the primary check is completed.

The execution request flag is a flag indicating whether or not the other microcomputer requests the execution of the abnormality check. For example, when the execution request flag is "1", it means that the other microcomputer is requesting the execution of the abnormality check.

The reset history is information related to the history of whether or not an abnormality check has been performed on the other microcomputer. For example, the reset history becomes "1" when an abnormality check is performed on the other microcomputer.

The other microcomputer can determine whether or not the previous stop was due to an abnormality check based on the reset history after the startup. Specifically, if the reset history stored in the monitoring microcomputer is "1" when the monitored microcomputer is started, it can be recognized that the previous stop was a stop due to an abnormality check.

In this case, since it is not necessary to check the reset line of the monitored microcomputer for an abnormality, the monitored microcomputer does not request the monitored microcomputer to check for an abnormality. On the other hand, when the monitored microcomputer terminates normally or is stopped (restarted) due to an actual abnormality of the monitored microcomputer, the reset history stored in the monitored microcomputer becomes "0".

In this case, it is preferable to check the reset line of the monitored microcomputer for abnormality, and the monitored microcomputer requests the monitored microcomputer to perform the abnormality check.

After that, the monitored microcomputer notifies the monitoring microcomputer of the reset history deletion request. As a result, the reset history stored in the monitoring microcomputer is updated from "1" to "0".

In this way, by storing the history of the abnormality check performed on the monitored microcomputer, the monitoring microcomputer can prevent the abnormality check on the monitored microcomputer from being performed again.

Further, when the monitored microcomputer confirms the reset history stored in the monitoring microcomputer, it makes a request to delete the reset history. As a result, it is possible to prevent the monitoring microcomputer from performing an abnormality check again on the monitored microcomputer in the next periodic processing.

That is, by updating the reset history based on the abnormality check, it is possible to suppress the execution of unnecessary abnormality check.

Next, the processing procedure by the main microcomputer 10 and the sub-microcomputer 20 will be described with reference to FIG. FIG. 3 is a timing chart showing a processing procedure by the main microcomputer 10 and the sub microcomputer 20.

In FIG. 3, it is assumed that the main microcomputer 10 is started while the sub-microcomputer 20 is operating normally. That is, in FIG. 3, a case where the main microcomputer 10 corresponds to the monitored microcomputer and the sub-microcomputer 20 is the monitoring microcomputer will be described as an example.

First, as shown in FIG. 3, when the main microcomputer 10 is started (step S1), a start check is performed (step S2). For example, when the period during which the IG switch is turned off is sufficiently short, that is, when the time until restart is less than or equal to a predetermined value, the main microcomputer 10 continues normal control without performing shutdown processing. In some cases, it may be performed, or only the initialization task that initializes only the required area of RAM may be performed to restore normal control.

In such a case, it is not necessary to perform the primary check, and the activation check in step S2 is a process of determining whether or not the primary check is necessary. That is, if the period during which the IG switch is turned off is sufficiently short, it is determined that the primary check is unnecessary, and if the period during which the IG switch is turned off is sufficiently long, it is determined that the primary check is necessary.

In the determination in step S2, for example, the time from when the IG switch is turned off to when it is turned on again may be measured and the determination may be made based on the time taken, or the main microcomputer 10 may be used. The determination may be made based on the operating state of.

In this way, by preventing the abnormality check from being performed and suppressing unnecessary abnormality checks, it is possible to quickly restore the main microcomputer 10. Then, when it is determined in step S2 that the primary check is required, the main microcomputer 10 starts the primary process (step S3). The conditions for starting the main microcomputer 10 in step S1 include a case where the IG switch is turned on, a case where the main microcomputer 10 is reset by the sub microcomputer 20 while the IG switch is on, and the like. ..

Subsequently, the main microcomputer 10 starts a communication connection with the sub-microcomputer 20 via the communication bus B (step S4), and acquires information on the reset history from the sub-microcomputer 20 (step S5). Subsequently, the main microcomputer 10 determines whether or not to perform an abnormality check based on the reset history (step S6).

In the determination in step S6, the main microcomputer 10 determines that the abnormality check is performed if the reset history is "1", and determines that the abnormality check is not performed if the reset history is "0".

Subsequently, the main microcomputer 10 notifies the sub-microcomputer 20 of the determination result in step S6 (step S7). The determination result here includes information on the primary check status, the execution request, and the reset history deletion request.

In step S7, the main microcomputer 10 notifies the execution request as "1" when it is determined that the abnormality check is to be performed, and notifies the execution request as "0" when it is determined that the abnormality check is not performed. The information regarding the primary check state shall be notified to the sub-microcomputer 20 every time the primary state of the main microcomputer 10 is updated.

The sub-microcomputer 20 makes an execution determination as to whether or not to perform an abnormality check based on the determination result by the main microcomputer 10 acquired in step S7 (step S8). In the determination process of step S8, the sub-microcomputer 20 determines that the abnormality check is performed when the primary check state of the main microcomputer 10 is being executed and the execution request is "1".

That is, the sub-microcomputer 20 waits until both the determination conditions of the primary state and the execution request are satisfied. At this time, the sub-microcomputer 20 ends the standby, for example, when the standby time elapses for a predetermined time. That is, in such a case, the sub-microcomputer 20 does not check the main microcomputer 10 for an abnormality due to the timeout.

In the following, the description will be continued on the assumption that the abnormality check is to be performed in the determination in step S8. When the main microcomputer 10 acquires the determination result from the sub-microcomputer 20 (step S9), the main microcomputer 10 notifies the sub-microcomputer 20 of the reset request when the preparation for restart is complete (step S10).

In this way, by determining the timing for performing the abnormality check on the main microcomputer 10 side (monitoring target microcomputer side), it is possible to suppress in advance the malfunction of the main microcomputer 10 that accompanies the abnormality check.

When the sub-microcomputer 20 receives the reset request, it outputs a reset signal to the reset line (first reset line Lr1) to check for an abnormality in the reset line (step S11). At this time, the sub-microcomputer 20 updates the reset history from "0" to "1" (step S12).

Then, if the first reset line Lr1 is normal, the main microcomputer 10 restarts (step S13) and proceeds to the process of step S1. On the other hand, when the main microcomputer 10 does not restart, the sub-microcomputer 20 detects an abnormality in the first reset line Lr1 and outputs a diagnosis to a higher-level control device (not shown).

As described above, in the control device 1 according to the embodiment, the monitoring microcomputer performs an abnormality check of the reset line of the monitored microcomputer when the information input from the monitored microcomputer satisfies a predetermined condition.

As a result, since the control device 1 according to the embodiment does not require a separate microcomputer for checking the abnormality, it is possible to check the abnormality of the reset line at low cost.

When the main microcomputer 10 is the monitoring microcomputer and the sub-microcomputer 20 is the monitoring target microcomputer, basically the same processing as that shown in FIG. 3 is performed. However, in CPU communication, when the main microcomputer 10 is the master and the sub-microcomputer 20 is the slave, the communication connection start in step S3 cannot be started from the sub-microcomputer 20 side.

In this case, when the sub-microcomputer 20 is started, it waits until the main microcomputer 10 starts the communication connection. Then, when the sub-microcomputer 20 is connected to the main microcomputer 10 by communication, the processes after step S4 are started.

The activation conditions of the sub-microcomputer 20 corresponding to step S1 include turning on the IG switch during sleep and wake-up activation by a timer during the period when the IG switch is off. However, if the wakeup is started by the timer during the period when the IG switch is off, the main microcomputer 10 is stopped because the IG switch is off.

Therefore, in such a case, the sub-microcomputer 20 does not perform the primary check because the abnormality check of the reset line (second reset line Lr2) cannot be performed. Further, for example, when the main microcomputer 10 and the sub-microcomputer 20 are started at the same time, for example, an abnormality check is performed as the monitored microcomputer in the order of the main microcomputer 10 and the sub-microcomputer 20.

By the way, the IG switch may be turned off during the abnormality check. In this case, a problem such as interruption of abnormality check may occur. Therefore, as shown in FIG. 1, the main microcomputer 10 and the sub-microcomputer 20 are connected to the IG switch, respectively, and the monitoring microcomputer monitors the IG signal output in conjunction with the IG switch during the abnormality check. deep.

Then, when the IG signal is turned off (the IG switch is turned off) during the abnormality check, the monitoring microcomputer determines that the abnormality check is invalid. For example, the monitoring microcomputer stores the history of the IG signal during the abnormality check of the monitored microcomputer.

Then, the monitoring microcomputer invalidates the abnormality check when it indicates that the history of the IG signal is off. As a result, it is possible to suppress erroneous determination of abnormality check due to the off of the IG switch.

Further, assuming that the IG signal is turned off during the abnormality check, the power supply holding signal may be output to the power supply circuit so that the power supply during the abnormality check is held. As a result, the power supply can be secured even when the IG switch is turned off.

As described above, the control device 1 according to the embodiment includes a plurality of microcomputers, and one microcomputer is used when the data input from the other microcomputers satisfies a predetermined condition when the other microcomputers are started. , Check for abnormalities in the reset line to reset other microcomputers. Therefore, according to the control device 1 according to the embodiment, the reset line can be checked at low cost.

By the way, in the above-described embodiment, the case where the control device 1 includes two microcomputers (main microcomputer 10 and sub-microcomputer 20) has been shown, but the present invention is not limited to this. That is, the control device 1 may be configured to include three or more microcomputers.

Further, in the above-described embodiment, the case where the main microcomputer 10 and the sub-microcomputer 20 are started under different conditions has been described, but the present invention is not limited to this, and the main microcomputer 10 and the sub-microcomputer 20 are under the same conditions. It may be the one that starts.

Further, in the above-described embodiment, the control device 1 has been described on the premise that it is mounted on a vehicle, but the present invention is not limited to this, and the present invention can be applied to various control devices. is there.

Further, in the above-described embodiment, the case where different microcomputers in the control device 1 perform abnormality checks with each other has been described, but it is also possible to perform abnormality checks with the microcomputers outside the control device 1 with each other. Good.

Further effects and variations can be easily derived by those skilled in the art. For this reason, the broader aspects of the invention are not limited to the particular details and representative embodiments described and described above. Therefore, various modifications can be made without departing from the spirit or scope of the overall concept of the invention as defined by the appended claims and their equivalents.

1 Control device 10 Main microcomputer 11 1st control application execution unit 12 1st monitoring application execution unit 13 1st reset circuit 14 1st storage unit 20 Sub-microcomputer 21 2nd control application execution unit 22 2nd monitoring application execution unit 23 2nd Reset circuit 24 2nd storage unit

Claims (7)

Equipped with multiple microcomputers
One microcomputer is
A control device characterized by performing an abnormality check of a reset line for resetting the other microcomputer when the information input from the other microcomputer satisfies a predetermined condition when the other microcomputer is started. .. The one microcomputer mentioned above
The control device according to claim 1, wherein the abnormality check is performed when a reset request is received from the other microcomputer during the initialization process at the time of starting the other microcomputer. The one microcomputer mentioned above
When the abnormality check is performed on the other microcomputer, the history indicating that the abnormality check has been performed is stored in the memory of the one microcomputer.
The other microcomputer
The control device according to claim 2, wherein it is determined whether or not to output the reset request based on the history stored in the memory during the initialization process. The other microcomputer
3. The third aspect of the present invention is to output an erasure request for the history to the one microcomputer when the history stored in the memory indicates that the abnormality check has been performed during the initialization process. The control device described. The one microcomputer mentioned above
The control device according to any one of claims 1 to 4, wherein when the one microcomputer stops during the abnormality check, the abnormality check is invalidated. The other microcomputer
The control device according to any one of claims 1 to 5, wherein the request for abnormality check is not performed when the time until the other microcomputer restarts is equal to or less than a predetermined value. It is a monitoring method performed by one of multiple microcomputers.
A transmission / reception process for transmitting / receiving data to / from the other microcomputer when another microcomputer is started.
A monitoring method comprising a check step of checking an abnormality of a reset line for resetting the other microcomputer when the data transmitted / received by the transmission / reception step satisfies a predetermined condition.

Images