JP5094777B2 - In-vehicle electronic control unit - Google Patents

Description

  The present invention relates to an on-vehicle electronic control device, and more particularly to a fail-safe control method.

  In recent years, in-vehicle electronic control devices are required to have high performance and downsizing, various functions, safety and reliability. Therefore, from the viewpoints of the number of parts, cost reduction, and downsizing, electronic components in the on-vehicle electronic control device, for example, a driver control circuit for controlling various functions, a diagnostic circuit for diagnosing the state of the driver, and various sensors Is being studied and put into practical use and used in an in-vehicle electronic control device.

  In-vehicle electronic control devices are equipped with a main microcomputer to process information from many equipped sensors and drivers, other electronic control devices, etc., and are processed according to programs written in nonvolatile raw memory. Based on the results, various function controls are performed.

  Therefore, for the safety and reliability of the in-vehicle electronic device, a system for monitoring that the microcomputer mounted in the in-vehicle electronic device is always operating normally is required. When it is determined that the device is in operation, the setting and output control signals controlled by the microcomputer can be quickly released, the settings can be canceled, control signals can be restricted, and erroneous information can be prevented from being communicated to other electronic control units. Need to be restarted.

  As a conventional example of the fail-safe system used in the on-vehicle electronic control device described above, for example, a description shown in Patent Document 1 is given.

  In the prior art disclosed in Patent Document 1, a main microcomputer that calculates and controls information from an external sensor and a sub-microcomputer that monitors the main microcomputer are used, and the microcomputer operates normally by communication between the two microcomputers. Judging.

  When the microcomputer determines that there is an abnormality, if a signal indicating an abnormality determined on the actuator side is input, or if a signal indicating an abnormality determined on the external sensor side is input, the operation of the connected actuator is prohibited. The means to make is used.

  In the monitoring function by the sub-microcomputer in the conventional example shown above, the main microcomputer continues to recover, initialize, and control the abnormal state of the main microcomputer and the controlled data even though it is determined to be abnormal. I can't. Furthermore, in recent years, the program of the main microcomputer, which performs a large number of sensors and drivers, a large number of function controls and arithmetic processes, has become complicated, and a special processing routine has been adopted that normally performs communication functions between the two microcomputers. If this happens, the fail-safe relay cannot be controlled, and the initialization control method is not used, so it cannot be avoided from a special routine. There is a possibility of causing an abnormal state, causing a functional breakdown due to abnormal control, and informing other electronic control devices of abnormal information to other electronic control devices, causing abnormal processing.

  In an electronic control unit equipped with a microcomputer, the main microcomputer monitors the ignition switch information to prevent a sudden power supply circuit stop by an ignition switch-off operation, and terminates the software when the switch is turned off. After that, if there is a means for stopping the power supply circuit under the control of the main microcomputer, the stop process cannot be performed, resulting in battery consumption.

JP-A-9-305223

  The problem to be solved by the present invention is to improve the reliability of the on-vehicle electronic control device.

  An in-vehicle electronic control device according to the present invention includes a nonvolatile memory for storing a control arithmetic program, and controls for controlling an actuator by the control arithmetic program based on information input from the outside. A first microcomputer that calculates a signal, a control register that stores information related to the control signal and generates a drive signal for driving the actuator based on the information, and a drive register based on the drive signal, Based on a drive circuit unit for driving the actuator, a first signal output from the first microcomputer, a second microcomputer for detecting a failure of the first microcomputer, and an output from the first microcomputer And the first microcontroller based on a second signal different from the first signal. A watchdog circuit unit for determining a failure state of the computer and outputting an initialization signal to the first microcomputer according to the determination result, wherein the second microcomputer detects a failure of the first microcomputer. When detected, an initialization signal is output to the control register.

  Accordingly, even if there is some abnormality between the first microcomputer and the watchdog circuit unit and the initialization signal cannot be output, the initialization can be executed by the second microcomputer. Reliability can be improved.

  According to the present invention, the reliability of the on-vehicle electronic control device can be improved.

It is explanatory drawing which showed the implementation method of the vehicle-mounted electronic control apparatus. (Example 1) It is a timing chart which showed operation of an in-vehicle electronic control unit. (Example 1) It is explanatory drawing which showed the implementation method of the vehicle-mounted electronic control apparatus. (Example 2) It is a timing chart which showed operation of an in-vehicle electronic control unit. (Example 2) It is explanatory drawing which showed the implementation method of the vehicle-mounted electronic control apparatus. Example 3 It is a timing chart which showed operation of an in-vehicle electronic control unit. Example 3

  According to the present invention, as a means for monitoring the operation of the main microcomputer of the on-vehicle electronic control device, monitoring is performed by means of monitoring from the sub microcomputer and redundancy monitoring by the watchdog function used in the semiconductor integrated circuit. . Means for initializing the control registers and control signals controlled by the main microcomputer and further restarting them when controlled by the monitoring means from the semiconductor integrated circuit or from the sub-microcomputer. It becomes possible to provide a vehicle-mounted electronic control device having a higher fail-safe function.

  A mode for carrying out the present invention will be described below.

  FIG. 1 shows a first embodiment of the present invention.

  In the electronic control device mounted on the vehicle, the ignition switch 3 is turned on. From the ignition switch information 4, the drive circuit 5 outputs the drive signal 6 to drive the main relay 7 in order to drive the main relay 7. Then, the relay contact is turned on, the battery voltage 2 is supplied to the voltage generator 8, and the voltage is supplied to each device.

  In the semiconductor integrated circuit 9, the power is detected by the voltage monitoring unit 17, and power-on reset control is performed on the sub microcomputer 11 and the semiconductor integrated circuit 9. The reset generation unit 15 performs power-on reset control on the main microcomputer 10 based on information from the voltage monitoring unit 17.

  The activated main microcomputer 10 performs arithmetic processing on information input from the outside by an internal arithmetic processing unit 19 (CPU) in accordance with a program written in the nonvolatile memory, and the serial communication signal line 26a based on the arithmetic processing result. , 26b and serial communication with the semiconductor integrated circuit 9.

  Further, the main microcomputer 10 can grasp the state of the ignition switch 3 from the ignition switch information 4, and the main microcomputer 10 prevents the abnormal termination due to the voltage generation stop by operating the ignition switch 3 during the software processing. 10 makes it possible to output the regulator control signal 31 to the high level and to control and control the main relay 7, and when the operation of the ignition switch 3 is turned off, the software performs the termination process and outputs the regulator control signal 31 to the low level. The drive circuit 5 outputs the drive signal 6 low, releases the drive of the main relay 7, turns off the relay contact, stops the supply of the battery voltage 2, and stops the voltage generator 8.

  The main microcomputer 10 and the sub-microcomputer 11 include fail-safe monitoring units 21 and 24 that monitor mutual fail-safe, and mutually monitor the fail-safe by communicating with each other. When one of the microcomputers determines that an abnormality has occurred in the other microcomputer, the fail-safe relay is cut off via the fail-safe relay control signal lines 22 and 25, so that the in-vehicle electronic control device has a specific function. Mask output operation.

  The sub microcomputer 11 outputs a control register initialization signal 29 to the semiconductor integrated circuit 9 when it is determined that the main microcomputer 10 is abnormal by mutual monitoring.

  The semiconductor integrated circuit 9 serially communicates with the main microcomputer 10 to latch information from the main microcomputer 10 in the control register 13 and to control the corresponding drive units 12a, 12b,... Based on the latched information. To control the output of the on-vehicle electronic control unit. In addition, a watchdog timer 16 is provided for measuring a time interval at which a watchdog timer clear pulse 28 whose output is controlled from the main microcomputer 10 is input. The watchdog timer clear pulse 28 is input to the watchdog timer 16 for a certain period of time. If the set time is reached, the main microcomputer 10 is initialized by outputting the main microcomputer initialization signal 27 to the main microcomputer 10 and restarted.

  Further, the semiconductor integrated circuit 9 determines that the sub-microcomputer 11 is abnormal in the main microcomputer 10 by mutual monitoring, and initializes the control register 13 controlled by the main microcomputer 10. The control register 13 is initialized by the control register initialization signal 29 output from the control register 13. In addition, the reset generation unit 15 uses a technique for initializing the main microcomputer 10 and returning it to normal operation in order to return the main microcomputer 10 that has entered an abnormal state to normal. It is possible to prevent routine status, continuation of unknown control status, abnormal status of various functional circuits, functional destruction due to abnormal control, and further cause abnormal processing by notifying other electronic control devices of abnormal information, It is possible to provide an in-vehicle electronic control device having a higher fail-safe function.

  FIG. 2 shows a timing chart in the first embodiment.

  At time t1, an abnormality occurs in the main microcomputer 10 and the watchdog timer clear pulse 28 is processed normally, but it falls into a special routine, and mutual communication between the main microcomputer 10 and the sub microcomputer 11 At time t4 when the sub-microcomputer 11 determines that the main microcomputer 10 is abnormal, the sub-microcomputer 11 controls the output of the control register initialization signal 29. Since the main microcomputer initialization signal 27 is also controlled in synchronization with the control register initialization signal 29, the main microcomputer 10 and the control register 13 are initialized at the same time, so the main microcomputer 10 is in the initialization processing state. In the meantime, the control register 13 does not have to hold abnormality information.

  When the main microcomputer 10 returns to normal at time t3, the sub-microcomputer 11 determines that the main microcomputer 10 is in a normal state at time t5, and cancels the fail-safe relay control signal line 25, thereby fail-safe relay. After that, the on-vehicle electronic control device operates normally.

  FIG. 3 shows a second embodiment of the present invention. In the figure, the same elements as those in FIG. 1 are described in detail with the same numbers, and only the differences will be described here.

  In the second embodiment, a dedicated port for controlling the output of the main microcomputer initialization signal 32 is provided in the sub microcomputer 11.

  When the sub microcomputer 11 determines that the main microcomputer 10 is abnormal, the sub microcomputer 11 controls the fail safe relay control signal line 25 to cut off the fail safe relay, and the control register initialization signal 29 is sent to the semiconductor integrated circuit 9. Simultaneously with the output control of the main microcomputer initialization signal 32. As a result, the control register 13 and the main microcomputer 10 can be initialized at the same time, and the main microcomputer 10 is in a normal state although the sub-microcomputer 11 controls the output of the main microcomputer initialization signal 32. Even when the control register 13 does not return to the normal state, the control register 13 can prevent the abnormal information from being latched by the communication with the main microcomputer 10 in the abnormal state by the control register initialization signal 29. As in the first embodiment, It is possible to provide an in-vehicle electronic control device having a higher fail-safe function.

  FIG. 4 shows a timing chart in the second embodiment.

  At time t1, the watchdog timer clear pulse 28 is processed normally, but it falls into a special routine, and the sub microcomputer 11 causes the main microcomputer 10 to be connected by mutual communication between the main microcomputer 10 and the sub microcomputer 11. At the time t4 when it is determined as abnormal, the sub-microcomputer 11 controls the output of the control register initialization signal 29 to the semiconductor integrated circuit 9 and outputs the watchdog timer clear pulse 28 until the time t5 when the control register 13 returns to normal. Regardless of the presence or absence, the control microcomputer initialization signal 29 continues to be controlled, so that the main microcomputer 10 in which an abnormality has occurred can access the control register 13 and not latch the abnormality information.

  Further, the sub-microcomputer 11 controls the output of the main microcomputer initialization signal 32 to the main microcomputer 10, returns to normal operation, and repeats the initialization control until time t5 when it is determined that the operation has returned to normal.

  FIG. 5 shows a third embodiment of the present invention. In the figure, the same elements as those in FIG. 1 are described in detail with the same numbers, and only the differences will be described here.

  In the third embodiment, a watchdog timer clear pulse limiting signal 33 for masking a signal line for inputting a watchdog timer clear pulse 28 output-controlled from the main microcomputer 10 to the watchdog timer 16 of the semiconductor integrated circuit 9. Is included in the sub-microcomputer 11.

  When the sub-microcomputer 11 determines that the main microcomputer 10 is abnormal, the sub-microcomputer 11 controls the fail-safe relay control signal line 25, cuts off the fail-safe relay, and sends a control register initialization signal to the semiconductor integrated circuit 9. At the same time, the output control of the watchdog timer clear pulse limiting signal 33 is controlled to the mask circuit 34 to perform the mask control.

  The watchdog timer 16 in the semiconductor integrated circuit 9 counts up to a set time and controls the output of the main microcomputer initialization signal 27 from the reset generator 15. As a result, even if the main microcomputer 10 is abnormal, the main microcomputer is initialized from the semiconductor integrated circuit 9 even when it falls into a special routine for normally controlling the output of the watchdog timer clear pulse 28. It is possible to initialize the main microcomputer 10 by controlling the output of the signal 27, and even when the main microcomputer 10 does not return to the normal state despite the initialization control of the main microcomputer 10. The control register 13 can prevent abnormal information from being latched by communication with the main microcomputer 10 in an abnormal state by the main microcomputer initialization signal 27, and has a higher fail-safe function as in the first embodiment. In-vehicle with It is possible to provide an electronic control device.

  FIG. 6 shows a timing chart in the third embodiment.

  At time t 1, the main microcomputer 10 enters an abnormal processing state, and at time t 4 when the sub microcomputer 11 determines that the main microcomputer 10 is abnormal due to mutual communication between the main microcomputer 10 and the sub microcomputer 11. The computer 11 controls the output of the control register initialization signal 29 and simultaneously controls the output of the watchdog timer clear pulse limit signal 33.

  While it is determined that the main microcomputer 10 is in an abnormal state, the watchdog timer clear pulse 28 is a semiconductor regardless of whether or not the main microcomputer 10 is in a state in which the output control of the watchdog timer clear pulse 28 is possible. Since it is not input to the integrated circuit 9, the watchdog timer 16 counts up to a set time tWD and controls the output of the main microcomputer initialization signal 27 at time t2.

  Further, by continuing to control the control register initialization signal 29 until the time t5 when the sub microcomputer 11 determines that the main microcomputer 10 is abnormal, the main microcomputer 10 in which the abnormality has occurred is transferred to the control register 13. It is possible to prevent access to latch information.

  The vehicle-mounted electronic control device of the present invention can initialize the control register without going through the microcomputer when the microcomputer that latches the control register in the semiconductor integrated circuit becomes abnormal by communication. It is used for an on-vehicle electronic control device that requires a high fail-safe function.

DESCRIPTION OF SYMBOLS 1 Battery 2 Battery voltage 3 Ignition switch 4 Ignition switch information 5 Drive circuit 6 Drive signal 7 Main relay 8 Voltage generation part 9 Semiconductor integrated circuit 10 Main microcomputer 11 Sub microcomputer 12a, 12b Drive part 13 Control register 14 Serial communication part ( Semiconductor integrated circuit)
15 Reset generator 16 Watchdog timer 17 Voltage monitor (power-on reset)
18 External information input unit 19 Arithmetic processing unit (main microcomputer)
20 Serial communication unit (main microcomputer)
21 Fail-safe monitoring unit (main microcomputer)
22 Fail-safe relay control signal line (main microcomputer)
23 Arithmetic processing part (sub microcomputer)
24 Fail-safe monitoring unit (sub-microcomputer)
25 Fail-safe relay control signal line (sub microcomputer)
26a Serial communication signal line (semiconductor integrated circuit to main microcomputer)
26b Serial communication signal line (from main microcomputer to semiconductor integrated circuit)
27 Main microcomputer initialization signal (semiconductor integrated circuit)
28 Watchdog timer clear pulse 29 Control register initialization signal 30 Sub microcomputer initialization signal 31 Regulator control signal 32 Main microcomputer initialization signal (sub microcomputer)
33 Watchdog timer clear pulse limit signal 34 Mask circuit 35 Fail safe relay logic circuit t1 Timing when main microcomputer becomes abnormal t2 Timing when main microcomputer initialization signal starts output control t3 Timing when main microcomputer becomes normal t4 Sub Timing at which the microcomputer determines that the main microcomputer is abnormal t5 Timing at which the sub microcomputer determines that the main microcomputer has returned to normal tWD Watchdog timer setting time

Claims (3)

A first microcomputer that includes a non-volatile memory for storing a control arithmetic program and calculates a control signal for controlling the actuator by the control arithmetic program based on information input from the outside;
A control register that stores information related to the control signal and generates a drive signal for driving the actuator based on the information;
A drive circuit unit for driving the actuator based on the drive signal;
A second microcomputer for detecting a failure of the first microcomputer based on a first signal output from the first microcomputer;
A failure state of the first microcomputer is determined based on a second signal output from the first microcomputer and different from the first signal, and an initialization signal is sent to the first microcomputer according to the determination result. And a watchdog circuit section that outputs
The on-vehicle electronic control device that outputs an initialization signal to the control register when the second microcomputer detects a failure of the first microcomputer. The in-vehicle electronic control device according to claim 1,
When the second microcomputer detects a failure of the first microcomputer, the vehicle-mounted electronic control device continues to output an initialization signal to the control register. The on-vehicle electronic control device according to claim 1 or 2,
A cutoff circuit for preventing the second signal from being input to the watchdog circuit unit based on a failure detection signal of the first microcomputer from the second microcomputer;
The watchdog circuit unit is an on-vehicle electronic control device that determines a failure of the first microcomputer when the second signal is not input for a predetermined period.

Images