JP3908020B2 - Electronic control device for vehicle - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an electronic control device for a vehicle.
[0002]
[Prior art]
For example, a configuration shown in FIG. 7 is known as a vehicle electronic control device (engine ECU) that controls an in-vehicle engine. In FIG. 7, the engine ECU 20 has two main and sub CPUs, the main CPU 21 performs injection control and ignition control, and the sub CPU 22 performs electronic throttle control. The WD circuit 23 monitors the operation of the main CPU 21, receives a watchdog pulse (WD pulse) output from the main CPU 21, and resets the main CPU 21 when the periodicity of the WD pulse is lost.
[0003]
The main CPU 21 monitors the operation of the sub CPU 22 (that is, the throttle control state). That is, the main CPU 21 inputs the WD pulse output from the sub CPU 22, and resets the sub CPU 22 when the periodicity of the WD pulse is lost. When the sub CPU 22 is reset, the main CPU 21 performs a predetermined fail safe process. Specifically, as the fail-safe process, in order to realize retreat travel (limp home) of the vehicle, reduction cylinder control for stopping fuel injection of some cylinders, ignition delay angle control for delaying ignition timing, and the like are performed.
[0004]
In short, the main CPU 21 is reset by the WD circuit 23 and the sub CPU 22 is reset by the main CPU 21. Further, when the WD circuit 23 resets the main CPU 21, the main CPU 21 resets the sub CPU 22 subsequently. However, when the main CPU 21 returns to normal after resetting by the WD circuit 23, normal control is performed regardless of whether resetting has occurred in the past (that is, abnormality has occurred). Therefore, when it is desired to continue the predetermined failsafe process even after resetting, the inconvenience that the failsafe process that should be performed is not performed is caused.
[0005]
By the way, in recent years, with the increase in CPU functionality and capacity, engine control (injection / ignition control) and electronic throttle control, which have been realized using two CPUs in the past, have been integrated into a single control CPU. It is conceivable to reduce costs. In such an engine ECU of 1 CPU configuration, the control CPU is also reset by the WD circuit. However, if the control CPU returns to normal after resetting by the WD circuit as described above, there is a disadvantage that fail-safe processing that should be performed is not performed.
[0006]
[Problems to be solved by the invention]
The present invention has been made paying attention to the above problems, and an object of the present invention is to provide a vehicular electronic control device capable of appropriately storing and holding past abnormal information related to a CPU. .
[0007]
[Means for Solving the Problems]
The vehicle electronic control device of the present invention is premised on including a main CPU and a sub CPU that are communicably connected to each other, and a monitoring circuit that monitors the operation of the main CPU. That is, the monitoring circuit inputs a watchdog pulse that is inverted at a predetermined cycle from the main CPU, and outputs a reset signal to the main CPU when the periodicity is lost. In particular, in the first aspect of the invention, the sub CPU monitors the watchdog pulse output from the main CPU to the monitoring circuit, and when the periodicity is lost, the reset signal is output from the monitoring circuit at the latest. Until then, the reset history of the main CPU is stored in the memory.
[0008]
According to the configuration of the first aspect of the present invention, the sub CPU can reliably determine that the main CPU has been reset, that is, that an abnormality has occurred in the main CPU. In the present invention, the sub CPU is continuously reset when the main CPU is reset. However, since the sub CPU stores the reset history simultaneously with or earlier than the reset of the main CPU by the monitoring circuit, the reset history Can be reliably retained. As a result, it is possible to properly store and hold past abnormality information related to the CPU.
[0009]
According to the second aspect of the present invention, the sub CPU confirms the presence or absence of a predetermined edge of the watchdog pulse, predicts that the main CPU will be reset if there is no predetermined edge of the watchdog pulse, and stores the reset history in the memory. Thereafter, when the predetermined edge of the watchdog pulse is confirmed before the reset signal is output by the monitoring circuit, the stored reset history is erased.
[0010]
In other words, when the output of the watchdog pulse is stopped, when the abnormality determination of the main CPU by the sub CPU is performed first and the abnormality determination (reset output) of the main CPU by the monitoring circuit is performed later, when the abnormality occurs in the sub CPU first Even if it is determined, the abnormal state is resolved immediately after that, and the monitoring circuit may not be determined to be abnormal. In this case, the watchdog pulse output is temporarily stopped and then returned to the reset output by the monitoring circuit. In such a case, according to the invention of claim 2, since the reset history once stored is erased, the inconvenience that the reset history is erroneously stored can be avoided.
[0012]
In the first or second aspect , as described in the third aspect , the sub CPU may determine that the main CPU is abnormal when the reset history is stored n times. In this case, the reliability of CPU abnormality determination is improved.
[0013]
In the invention according to claim 4 , the main CPU performs a predetermined fail-safe process based on the reset history stored in the sub CPU at the time of restart after reset. In this case, the fail safe process after CPU abnormality can be implemented appropriately.
[0014]
When the main CPU subsequently resets the sub CPU when the main CPU is reset, it may be considered that there is not enough time to store the reset history in the sub CPU. Therefore, as described in claim 5 , after the reset signal is output from the monitoring circuit to the main CPU, the reset signal may be output from the main CPU to the sub CPU with a delay of a predetermined time. As a result, the reset history can be stored and held more reliably in the sub CPU.
[0015]
According to the sixth aspect of the present invention, the main CPU integrates the engine control function and the electronic throttle control function in the vehicle, and the sub CPU monitors at least the electronic throttle control state of the main CPU. In this case, the above-described excellent effect can be achieved in the vehicle electronic control device in which the control functions are integrated in order to reduce the cost.
[0016]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the present embodiment, the present invention is embodied in an engine ECU as a vehicle electronic control device, and FIG. 1 shows a configuration of the engine ECU.
[0017]
In FIG. 1, an engine ECU 10 includes a control CPU (main CPU) 11 for executing engine injection control, ignition control, and electronic throttle control, and a monitoring CPU (sub CPU) for executing monitoring control related to electronic throttle control. 12 and a WD circuit 13 for monitoring the operation of the control CPU 11. The control CPU 11 inputs engine operation information such as engine speed, intake pipe pressure, throttle opening, etc. from various sensors as needed, and controls driving of an injector, an igniter, a throttle actuator, etc. (not shown) based on the operation information. Further, the control CPU 11 performs monitoring control for monitoring the operation of the monitoring CPU 12. That is, the monitoring CPU 12 outputs a WD pulse that is inverted at a predetermined cycle to the control CPU 11, and the control CPU 11 outputs a reset signal to the monitoring CPU 12 when the WD pulse from the monitoring CPU 12 is not inverted for a predetermined time or more. .
[0018]
The control CPU 11 and the monitoring CPU 12 are connected so as to be able to communicate with each other, and the control CPU 11 transmits data related to throttle control, such as a throttle opening, an accelerator opening, and a fail safe execution flag, to the monitoring CPU 12. At this time, the monitoring CPU 12 performs the throttle control monitoring process, for example, the throttle opening and accelerator opening data input through an A / D converter (not shown) and the throttle opening and accelerator opening received from the control CPU 11. Is compared with the degree data, and an abnormality in the throttle control state is detected depending on whether or not they match. Then, the monitoring result is returned to the control CPU 11.
[0019]
The control CPU 11 performs a predetermined fail-safe process when an abnormality occurs in the electronic throttle control according to the monitoring result of the monitoring CPU 12. Specifically, as the fail-safe process, in order to realize retreat travel (limp home) of the vehicle, reduction cylinder control for stopping fuel injection of some cylinders, ignition delay control for delaying ignition timing, and the like are performed. .
[0020]
Further, the control CPU 11 outputs a WD pulse that is inverted at a predetermined cycle to the WD circuit 13. The WD circuit 13 constitutes a “monitoring circuit”, and outputs a reset signal to the control CPU 11 when the WD pulse from the control CPU 11 is not inverted for a predetermined time or more.
[0021]
Here, the WD pulse output from the control CPU 11 to the WD circuit 13 is also input to the monitoring CPU 12. The monitoring CPU 12 determines the presence or absence of a predetermined edge (for example, a falling edge) of the WD pulse, and stores the reset history of the control CPU 11 when the predetermined edge is not detected for a predetermined time or more, that is, when the WD pulse is not reversed for a predetermined time or more Store in 12a. The memory 12a is a memory such as an EEPROM or a standby RAM that can store and retain the contents even when the power is turned off, and stores and holds various counter values in addition to the reset history.
[0022]
Next, the procedure for monitoring the control CPU 11 with the WD pulse will be described in detail. FIG. 2 is a flowchart showing processing performed by the monitoring CPU 12 every 2 msec.
[0023]
In FIG. 2, first, at step 101, the presence or absence of a falling edge of the WD pulse is detected. Specifically, it is determined whether or not the current signal level of the WD pulse is LO (low) and the previous signal level is HI (high). It is determined that a falling edge has been detected. If YES, the WD monitoring counter is cleared to 0 in step 102 and the reset history is cleared in step 103. If NO, in step 104, the WD monitoring counter is incremented by one.
[0024]
Thereafter, in step 105, it is determined whether or not the value of the WD monitoring counter is equal to or greater than a predetermined value. Here, the time corresponding to the predetermined value is shorter than the time when the output stop of the WD pulse is determined by the WD circuit 13, and when the abnormality determination time by the WD circuit 13 is, for example, 24 msec, the monitoring CPU 12 The abnormality determination time is 16 msec, and a predetermined value = 8. If step 105 is YES, the process proceeds to step 106, and a reset history indicating that the control CPU 11 has been reset is stored in the memory 12a.
[0025]
FIG. 3 is a flowchart showing an initial process performed when the monitoring CPU 12 is initialized (at the time of activation).
In FIG. 3, first, in step 201, it is determined whether or not there is a reset history in the memory 12a. If there is a reset history, the process proceeds to step 202, and the abnormality counter is incremented by one. In step 203, the reset history in the memory 12a is cleared.
[0026]
Thereafter, in step 204, it is determined whether or not the abnormality counter is greater than or equal to a predetermined value (2 in the present embodiment). If YES, the process proceeds to step 205 and the control CPU 11 stores in the memory 12a that the control CPU 11 is abnormal. At this time, abnormality information is notified to the control CPU 11 in order to perform a predetermined fail-safe process.
[0027]
Although illustration of the processing flow is omitted, the abnormality counter is cleared when the ignition switch is turned off when the engine is stopped. Thus, the CPU abnormality is determined when the reset occurs twice during one trip of the vehicle travel.
[0028]
FIG. 4 is a time chart for more specifically explaining the processing of FIG. 2 and FIG. In FIG. 4, the control CPU 11 is operating normally before the timing t1, and the control CPU 11 is abnormal after the timing t1.
[0029]
Before timing t1, the WD pulse is output at a predetermined constant cycle (8 msec cycle). In this case, the WD monitoring counter is incremented every 2 msec and cleared to 0 each time a falling edge of the WD pulse is detected.
[0030]
After the timing t1, when the output of the WD pulse is stopped, the WD monitoring counter is not cleared to 0, so that the counter reaches a predetermined value (= 8) at the timing t2. At this time, the reset history is stored in the memory 12a of the monitoring CPU 12. Thereafter, at a timing t3 when 24 msec has elapsed from the output stop of the WD pulse, a reset signal is output from the WD circuit 13 to the control CPU 11. At this time, a reset signal is output from the control CPU 11 to the monitoring CPU 12.
[0031]
Thereafter, at timing t4, the control CPU 11 and the monitoring CPU 12 are restarted, and in the initial process of the monitoring CPU 12, the abnormality counter is incremented by 1 due to the reset history stored in the memory 12a. At this time, if the abnormality counter is 2 or more, the control CPU 11 is determined to be abnormal, and a predetermined fail-safe process is performed.
[0032]
Incidentally, when the output of the WD pulse is resumed between the timings t2 and t3, that is, after the output of the WD pulse is temporarily stopped, the output of the WD pulse returns to the normal state before the reset output by the WD circuit 13. In this case, the reset history in the memory 12a is cleared (erased) when the falling edge of the WD pulse comes. Therefore, inconvenience that only the reset history remains even though the reset by the WD circuit 13 is not actually performed can be avoided.
[0033]
According to the embodiment described in detail above, the following effects can be obtained.
Since the WD pulse output from the control CPU 11 to the WD circuit 13 is monitored by the monitoring CPU 12, and the reset history is stored according to the monitoring result, the reset of the control CPU 11 can be reliably determined. Therefore, fail-safe processing after CPU abnormality can be properly implemented.
[0034]
Further, since the monitoring CPU 12 stores the reset history earlier than the reset output by the WD circuit 13, the reset history can be reliably stored and held. As a result, it is possible to properly store and hold past abnormality information related to the CPU.
[0035]
When the monitoring CPU 12 stores the reset history and the output of the WD pulse returns to normal, the reset history is erased, so that the inconvenience of erroneously storing the reset history can be avoided.
[0036]
In the engine ECU 10 in which the engine control function and the electronic throttle control function are integrated in the control CPU 11, the above-described excellent effects can be achieved while reducing costs.
[0037]
(Second Embodiment)
Next, a second embodiment of the present invention will be described focusing on the differences from the first embodiment described above. FIG. 5 shows the configuration of engine ECU 10 in the present embodiment.
[0038]
In FIG. 5, as a difference from FIG. 1, a reset signal output from the WD circuit 13 to the control CPU 11 is also input to the monitoring CPU 12. That is, the monitoring CPU 12 monitors the reset line from the WD circuit 13 to the control CPU 11. The monitoring CPU 12 stores the reset history of the control CPU 11 in the memory 12a every time the reset signal is input.
[0039]
FIG. 6 is a flowchart showing various processes performed by the monitoring CPU 12, where (a) shows reset edge interrupt processing and (b) shows initial processing.
That is, the monitoring CPU 12 starts the interrupt process of FIG. 6A every time the reset signal is input, and increments the abnormality counter by 1 each time (step 301). In this embodiment, the count value of the abnormality counter corresponds to “reset history”.
[0040]
The monitoring CPU 12 activates the process of FIG. 6B at the time of initializing the CPU activation, and first determines whether or not the abnormality counter is greater than or equal to a predetermined value (2 in the present embodiment) (step 401). . If the abnormality counter ≧ 2, the control CPU 11 stores an abnormality in the memory 12a (step 402). At this time, abnormality information is notified to the control CPU 11 in order to perform a predetermined fail-safe process.
[0041]
As described above, according to the second embodiment, it is possible to reliably determine that the control CPU 11 is reset, as in the first embodiment described above. Therefore, fail-safe processing after CPU abnormality can be properly implemented.
[0042]
In the present embodiment, when the control CPU 11 subsequently resets the monitoring CPU 12 when the control CPU 11 is reset, it is conceivable that the monitoring CPU 12 does not have much time to store the reset history. Therefore, it is preferable to provide a delay circuit composed of a capacitor or the like on the reset line from the control CPU 11 to the monitoring CPU 12. As a result, after the reset signal is output from the WD circuit 13 to the control CPU 11, the reset signal is output from the control CPU 11 to the monitoring CPU 12 after a certain delay. Therefore, the monitoring CPU 12 can more reliably store and hold the reset history.
[0043]
In addition to the above, the present invention can be embodied in the following forms.
In the first embodiment, the monitoring CPU 12 determines the predetermined edge of the WD pulse in a time shorter than the abnormality determination time of the WD circuit 13, but the WD pulse determination time is made the same in the WD circuit 13 and the monitoring CPU 12. Also good. The point is that the monitoring CPU 12 may store the reset history of the control CPU 11 before the reset signal is output from the WD circuit 13 at the latest. However, when the WD pulse determination time is the same between the WD circuit 13 and the monitoring CPU 12, it is preferable to provide a delay circuit composed of a capacitor or the like on the reset line from the control CPU 11 to the monitoring CPU 12.
[0044]
In each of the above embodiments, the control CPU abnormality is determined based on the two reset histories during one trip, but it is also possible to immediately determine the control CPU abnormality based on the one reset history. Of course, it is also possible to make a determination based on the reset history three times or more.
[0045]
It is also possible to integrate the monitoring CPU 12 and the WD circuit 13 into one IC. In this case, cost reduction as the engine ECU 10 can be achieved.
[0046]
In each of the above-described embodiments, the control CPU 11 is a combination of the engine control function and the electronic throttle control function in the vehicle, but this configuration is changed. For example, an engine control CPU (main CPU) and an electronic throttle control CPU (sub CPU) may be provided separately (see FIG. 7). In this case, the sub CPU monitors the WD pulse output from the main CPU to the WD circuit, and when the periodicity is lost, the sub CPU resets the main CPU until the reset signal is output at the latest. Is stored in the memory. Alternatively, the sub CPU monitors the reset signal output from the WD circuit to the main CPU, and when the reset signal is output, the sub CPU stores the reset history in the memory.
[Brief description of the drawings]
FIG. 1 is a configuration diagram showing an outline of an engine ECU in a first embodiment.
FIG. 2 is a flowchart showing 2 msec processing by a monitoring CPU.
FIG. 3 is a flowchart showing initial processing by a monitoring CPU.
FIG. 4 is a time chart showing an abnormality detection operation.
FIG. 5 is a configuration diagram showing an engine ECU in a second embodiment.
FIG. 6 is a flowchart showing various processes performed by the monitoring CPU.
FIG. 7 is a block diagram showing a configuration of an engine ECU in the prior art.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 ... Engine ECU, 11 ... Control CPU, 12 ... Monitoring CPU, 12a ... Memory, 13 ... Monitoring circuit.

Claims (6)

A main CPU that performs vehicle control, a watchdog pulse that is inverted at a predetermined cycle from the main CPU, and a monitoring circuit that outputs a reset signal to the main CPU when the periodicity is lost. A vehicular electronic control device including a sub CPU connected so as to be communicable, and the main CPU resetting the sub CPU subsequently when the main CPU is reset,
The sub CPU monitors the watchdog pulse output from the main CPU to the monitoring circuit, and stores the reset history of the main CPU in the memory until the reset signal is output from the monitoring circuit at the latest when the periodicity is lost. An electronic control device for a vehicle. The sub CPU confirms the presence or absence of a predetermined edge of the watch dog pulse, predicts that the main CPU will be reset if there is no predetermined edge of the watch dog pulse, and stores the reset history in the memory. The vehicle electronic control device according to claim 1, wherein the stored reset history is erased when a predetermined edge of the watchdog pulse is confirmed before the output of. The vehicular electronic control device according to claim 1, wherein the sub CPU determines that the main CPU is abnormal when the reset history is stored n times . The vehicular electronic control device according to any one of claims 1 to 3, wherein the main CPU performs a predetermined fail-safe process based on a reset history stored in the sub CPU when restarting after reset . 5. The vehicular electronic control device according to claim 1 , wherein after the reset signal is output from the monitoring circuit to the main CPU, the reset signal is output from the main CPU to the sub CPU with a delay of a predetermined time . 6. The main CPU is a combination of an engine control function and an electronic throttle control function in a vehicle, and the sub CPU monitors at least an electronic throttle control state of the main CPU. Vehicle electronic control device.

Images