JP3508614B2 - Automotive electronic control unit with self-monitoring function - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a vehicle-mounted electronic control device, and more particularly to a vehicle-mounted electronic control device with a self-monitoring function for enhancing the certainty of its function as a fail-safe enhancement.

[0002]

2. Description of the Related Art Conventionally, some electronic control devices for vehicles have been
Some have rigorously monitored the malfunction of the control system to enhance the fail-safe function. For example, a four-wheel steering system and an anti-skid brake system (hereinafter referred to as ABS) ensure the maneuverability and stability of the vehicle independently of the driver's operation, and therefore a control unit (which determines the control amount). (Hereinafter, referred to as ECU) has a fail-safe function for the purpose of ensuring its reliability. In ABS, when performing the control amount calculation based on the wheel speed information, two CPUs are arranged, the same input and the same calculation result are collated, and when the same result is output, the actuator for controlling the brake fluid pressure is driven. It was In other words, the reliability was ensured by the redundancy of the full duplex system. The device configured as described above is described, for example, in Japanese Examined Patent Publication No. 7-38162.

Further, a concrete description will be given based on the block diagram of the conventional system shown in FIG. Reference numeral 20 is a sensor for detecting the state of the vehicle, which is a wheel speed sensor in ABS. Reference numeral 2 denotes a main control means which is composed of a CPU and includes a control amount calculation means 10a for calculating a signal for controlling the actuator 3 (hereinafter referred to as H / U) based on the information of the wheel speed sensor 20. It is output to the drive means 4. Reference numeral 21 is a sub-control unit which is composed of the same CPU as the CPU 2. 10
Reference numeral b is a control amount calculation means equivalent to 10a, and calculates a so-called anti-skid brake control amount from the information of the wheel speed sensor 20. The difference from 10a is the output of the calculated control amount, 10a is output to the driving means 4, while 10b is output.
Has no output function. Reference numeral 22 compares this control amount result with the information of the monitor means 5 for monitoring the drive state of the H / U, and when the monitor information is not the same as the control amount, that is, there is a difference between the output state and the monitor state. In this case, the comparison means outputs a prohibition signal to the prohibition means 7 that prohibits the driving of the driving means 4. The result of this comparing means is also sent to the CPU 2 (23). Furthermore, the CPU 2 is configured so as to perform its own failure detection and output a prohibition signal to the prohibition means 7 when an abnormality occurs.

Such a conventional ECU has a drawback that the cost is increased by equipping two CPUs having the same function. Therefore, for the purpose of compensating for the disadvantage of high cost, for example, a system having a configuration as shown in FIG. 5 has been proposed. In the figure, the same reference numerals as those in FIG. 4 indicate the same or corresponding portions. The sub control means 21 is compared with the main control means 2,
It is composed of a low-level CPU. The information of the wheel speed sensor 20 is mainly input to the CPU 2, calculates the antiskid brake control amount, and outputs the control amount to the drive means 4.
At the same time, the state of the drive signal is transmitted to the sub CPU 21 (24). The sub CPU 21 inputs this drive signal, inputs the H / U drive state from the monitor means 5, compares the two, and outputs a prohibition signal 25 when there is a difference, the comparison means 2
Have six.

[0005]

The conventional device as described above is designed and manufactured because it uses two identical CPUs or two high and low CPUs. There is a problem in that the cost becomes high and the area occupied by two CPUs is an obstacle to miniaturization.

The present invention has been made in order to solve the above-mentioned problems, and the reliability of the fail-safe function is achieved by exchanging information between the main control means and the monitoring means for monitoring the abnormality of the main control means. The present invention provides a vehicle-mounted electronic control device with a self-monitoring function, which is improved in cost, further reduced in cost, and reduced in size.

[0007]

In a vehicle-mounted electronic control device with a self-monitoring function according to the present invention, a state detection sensor for detecting the state of the vehicle, an actuator for controlling a predetermined portion of the vehicle, and this actuator are driven. Main control means including drive means and control amount calculation means including a CPU which inputs information from the state detection sensor, calculates a control amount based on this information, and outputs a signal corresponding to the control amount to the drive means A monitoring means for monitoring the status of the actuator, a monitoring means connected to the status detection sensor and not including a CPU for monitoring the function of the main control means, and a first prohibition signal output from the monitoring means. A device having a prohibition unit that prevents the actuator from operating when a prohibition signal is output,
The monitoring means includes a test signal output means for outputting to the driving means a short-time control signal that does not actually drive the actuator according to a predetermined sequence, and the monitoring means synchronizes so as to be in a predetermined sequence. When the driving state of the actuator is input from the monitor means, a monitor signal is input in response to the synchronization information, and this is compared with the sequence. If they are different, an inhibit signal is output to the inhibit means. And a comparison means for doing so.

Further, in the vehicle-mounted electronic control device with the self-monitoring function according to the present invention, the main control means and the monitoring means each perform a predetermined sequence triggered by the state detection sensor being in a predetermined state. It was designed to work together.

[0009]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiment 1. Embodiment 1 of the present invention will be described below with reference to the drawings. 1 is a block diagram showing a vehicle-mounted electronic control device with a self-monitoring function according to a first embodiment of the present invention. In FIG. 1, 1 is a state detection sensor for detecting the state of the vehicle. An actuator 3 controls the vehicle. Reference numeral 4 is a drive means for driving the actuator 3. A main control unit 2 includes a control amount calculation unit 10 that calculates a control amount based on the sensor 1 information and outputs a control amount signal to the drive unit 4. 6
Is a monitoring means for monitoring the main control means 4, 7 is a prohibiting means for operating to stop the operation of the actuator 3, and is operated by the main control means 2 or the monitoring means 6. Reference numeral 5 is a monitor means for monitoring the drive state of the actuator 3, and this information is inputted to the monitor means 6.

When the main control means 2 detects that the information of the sensor 1 has reached a predetermined state, the main control means 2 outputs a short-time drive signal to the drive means 4 to such an extent that the actuator 3 is not driven according to a predetermined sequence. The signal output means 11 is provided. When the monitoring means 6 also detects that the sensor 1 is in the predetermined state, the synchronizing means 12 for synchronizing the signals to operate in a predetermined sequence operates, and the actuator state signal from the monitoring means is input in accordance with this synchronizing signal. However, the comparison means 13 is provided for comparing whether or not it is in the same state as a predetermined sequence and outputting a prohibition signal to the prohibition means 7 when a difference between the two is detected. The monitoring means checks the test signal from the main control means 2 and the monitor signal from the monitoring means 6. If there is a difference between them, it means that any one of the main control means 2, the driving means 4, the actuator 3, or the monitoring means 6 is abnormal, and the monitoring means outputs a prohibition signal to turn on the actuator 3. It will be stopped to ensure safety.

In such a structure, the sensor 1 acts as a trigger signal for activating the fail safe function of the main control means 2 and the monitoring means 6. This trigger signal causes the main control means 2 and the monitoring means 6 to operate their functions independently of each other, the main control means 2 outputs an actuator drive signal, and the monitoring means 6 monitors this to detect an abnormality. is there. Further, the main control means 2 can check the abnormality of this system, for example, the malfunction of the sensor, the suitability of the control amount, etc., and when the abnormality occurs, the prohibiting means 7 can be operated.

Next, the invention will be specifically described with reference to FIG. This vehicle electronic control unit is applied to ABS. Reference numeral 1 denotes sensors such as a vehicle speed sensor and a brake switch. The main control means 2 is a CPU, the actuator 3 is H / U, and only two valves are shown for simplicity. Reference numeral 4 is a means for driving the H / U 3 valve, which is a drive circuit using a transistor. Reference numeral 5 is a monitor means, which is a monitor circuit for detecting the driving or non-driving state of the H / U 3 by a transistor. Reference numeral 7 is a prohibiting means, and in this case, it is configured to stop the H / U 3 by cutting off the relay 8 which is a power supply source of the H / U. Reference numeral 9 is an abnormality notifying means, which notifies the driver by a lamp.

The CPU 2 calculates a so-called anti-skid brake control amount on the basis of the information of the sensors 1, particularly the wheel speed by the wheel speed sensor, and outputs a control signal for driving the H / U 3. The relay 8 is normally closed as long as there is no abnormality, and power is supplied to the H / U 3. Further, the lamp 9 is also turned off as long as there is no abnormality. The monitoring means 6 is configured such that at least one signal of the sensors 1 is input, the signal of the monitor circuit 5 is input, and as outputs, a prohibition signal for shutting off the relay 8 and a notification signal for the lamp 9 are output. Has been done.

Next, the functions of the CPU 2 and the monitoring means 6 will be described in time series with reference to FIG. First, at least one sensor signal 1a is input to the CPU 2 and the monitoring means 6. This sensor signal is selected from the sensors mounted on the ABS, and no special sensor needs to be mounted. For example, a wheel speed sensor can be used as a trigger signal by detecting that the speed has reached 10 km / h. When the sensor 1 is a brake switch, it can be used by detecting that the brake is turned on or off. Further, there is a type of a vehicle equipped with a deceleration sensor, and this sensor utilizes that a predetermined level is reached. When the sensor reaches a predetermined state in this way,
PU2 and the monitoring means 6 detect each independently (t0.
Time point). The CPU 2 creates a stored sequence or a sequence by a predetermined calculation and outputs the drive signals 4a and 4b. A signal for driving the valve of H / U3 for a short period of time is output from time t1, the drive is not performed thereafter, and a drive signal is similarly output from t5. Also, from t3 and t7, a short-time drive signal is output to the other valve. If this drive signal is a short-time signal of, for example, about 1 msec, it will not drive the H / U and will not affect the vehicle.

On the other hand, the monitoring means 6 also checks the sensor information of 1a and detects t0. Then, t2, which is a delay of the circuit from t1, is t4 for t3 and t for t5.
For t6 and t7, a signal synchronized with each time t8 is created.
On the other hand, the monitor circuit 5 is 5a for the drive signals 4a and 4b,
5b is being monitored. Where t2, t4, t6, t8
Is a time aimed at the vicinity of the center of 5a and 5b. At this time, the states of the monitor signals 5a and 5b are checked.
5a is at H level at t2 and t6, and 5b at t4 and t8.
There is no abnormality at H level. t2, t
If each monitor is not at the H level at each time of 4, t6, and t8, it is determined to be abnormal, an inhibition signal is output to the inhibition means 7, and the relay 8 is cut off to stop the driving of the H / U3.

Further, at time t2, the monitor signal 5a = H,
It is also possible to check both 5b = L, which means that both drive and non-drive are checked, and the fail-safe function can be further enhanced. Further, for the purpose of improving the noise margin, it is possible to output the prohibition signal when an abnormality can be detected at both t2 and t6.

The main control means 2 can also call a stored sequence to output a drive signal, but if the main control means is a CPU in particular, ROM, RAM, registers,
In order to check the calculation function, the timer function, etc., it is possible to calculate by using the stored value and to configure the sequence by the method of using the timer function for time management. As a result, by outputting the same short-time drive signal, the monitoring means activates the respective functions similar to those described above, so that the check contents of the CPU 2 can be enhanced and the fail-safe function can be made more reliable.

[0018]

Since the vehicle-mounted electronic control device of the present invention is constructed as described above, it has the following effects.

According to the on-vehicle electronic control device with the self-monitoring function of the present invention, the main control means including the CPU outputs to the drive means a short-time control signal in which the actuator is not actually driven by a predetermined sequence. The monitoring means, which includes a test signal output means and does not include a CPU , responds to the synchronization information when inputting the driving state of the actuator from the synchronization means and the monitoring means that synchronizes in a predetermined sequence. Input the monitor signal,
This and the sequence are compared, and when the two are different, there is an effect that the abnormality detection of the main control means can be easily performed by the monitoring function provided with the comparison means for outputting the prohibition signal to the prohibition means.

Further, according to the on-vehicle electronic control device of the present invention, the main control means and the monitoring means each combine a predetermined sequence with the state detection sensor being in a predetermined state as a trigger. Since the operation start and the function can be performed independently, there is an effect that the abnormality of the main control means can be accurately detected.

[Brief description of drawings]

FIG. 1 is a block diagram showing an on-vehicle electronic control device according to a first embodiment of the present invention.

FIG. 2 is a circuit diagram showing a specific control device according to the first embodiment of the present invention.

FIG. 3 is a time chart showing a state of each signal according to the first embodiment.

FIG. 4 is a block diagram showing a conventional on-vehicle electronic control device.

FIG. 5 is a block diagram showing a conventional on-vehicle electronic control device.

[Explanation of symbols]

1 state detection sensor, 2 CPU (main control means), 3
Actuator, 4 driving means, 5 monitoring means, 6 monitoring means, 7 prohibiting means, 10 controlled variable means, 11 test signal output means, 12 synchronizing means, 13 comparing means.

─────────────────────────────────────────────────── ─── Continuation of front page (51) Int.Cl. ⁷ identification code FI G05B 23/02 G05B 23/02 E (58) Fields investigated (Int.Cl. ⁷ , DB name) B60R 16/02 650 B60R 16 / 02 660 G05B 9/02 G05B 15/02 G05B 23/02

Claims (2)

(57) [Claims] 1. A state detection sensor for detecting a state of a vehicle, an actuator for controlling a predetermined portion of the vehicle, a drive means for driving the actuator, and information from the state detection sensor are input, and based on the information. calculates the control amount, and the main control means including a control amount calculation means including a CPU for outputting a signal commensurate with the control amount to said drive unit,
Monitoring means for monitoring the state of the actuator,
A monitoring unit that is connected to the state detection sensor and does not include a CPU that monitors the function of the main control unit, and outputs a first inhibition signal from the monitoring unit so that the actuator does not operate when the inhibition signal is output. In the device having a prohibition means, the main control means comprises a test signal output means for outputting to the drive means a short time control signal in which the actuator is not actually driven by a predetermined sequence, the monitoring means, When inputting the driving state of the actuator from the synchronization means and the monitoring means for synchronizing so as to form a predetermined sequence, a monitor signal is input in response to the synchronization information, and this is compared with the sequence. A self-monitoring function, characterized in that it comprises a comparison means for outputting a prohibition signal to the prohibition means when the two differ. Vehicle electronic control unit. 2. The self-monitoring function according to claim 1, wherein the main control means and the monitoring means each form a predetermined sequence triggered by the state detection sensor being in a predetermined state. In-vehicle electronic control unit.