JP5459370B2 - In-vehicle electronic control unit - Google Patents

Description

  The present invention relates to an in-vehicle electronic control device having a function of monitoring failure / abnormality of a microcomputer.

As a vehicle-mounted electronic control apparatus having a conventional CPU monitoring function, for example, there are technologies described in Patent Documents 1 and 2. This technique employs a lockstep method as the monitoring function, and includes a collation circuit that collates processing results in the two information processing units A and B having the same configuration. And when the collation result by a collation circuit is inconsistent, it determines with A system or B system having failed.
In addition, as the monitoring function, there is a function that employs a so-called 2CPU system in which the control CPU is monitored by the monitoring CPU (see, for example, Patent Document 3).

JP 2010-262432 A JP 2010-160649 A JP 2006-344086 A

However, in the monitoring function employing the lock step method as described above, if the control unit and the monitoring unit use the same core, there is a problem that causes a calculation error in the arithmetic unit of the core, It cannot be detected as an abnormality. In addition, the monitoring function employing the 2CPU method as described above cannot make a detailed diagnosis of the calculation of the control CPU.
As described above, since the details of the abnormality cannot be diagnosed, the control is uniformly stopped regardless of the details of the abnormality when the abnormality occurs. However, depending on the details of the abnormality, it is desirable to continue the control even when an abnormality occurs, from the viewpoint of driver burden at the time of stopping the control due to an increase in the size of the vehicle and standardization of vehicle safety control.
Therefore, an object of the present invention is to provide an in-vehicle electronic control device that can appropriately diagnose details of abnormality of a microcomputer.

  In order to solve the above problems, a first embodiment of an on-vehicle electronic control device according to the present invention is an on-vehicle electronic control including a microcomputer that generates a drive signal for an actuator based on a detection signal from a sensor mounted on a vehicle. An apparatus, wherein the microcomputer includes a hardware part and a software part, and is provided inside the microcomputer, and each element of the hardware part has the same processing characteristics, In addition, hardware element monitoring means for monitoring an abnormality of each element of the hardware unit, which is implemented differently from the arithmetic processing circuit of each element of the hardware unit, and provided inside the microcomputer, the software unit Each element has the same processing characteristics and is different from the arithmetic processing section of each element of the software section. In, it is characterized by and a software element monitoring means for monitoring the abnormality of each element of the software section.

  Thus, since the microcomputer is comprehensively monitored by hardware monitoring and software monitoring, the details of the abnormality of the microcomputer can be diagnosed. Therefore, when an abnormality occurs in the microcomputer, it is possible to take appropriate measures according to the details of the abnormality. In addition, the monitoring hardware elements are implemented with the same processing characteristics as the monitored hardware elements and different implementations from the monitored hardware elements, so the input and output of the monitored hardware elements are monitored. By doing so, a failure can be detected. Furthermore, for example, the delay time until the completion of processing can be made different between the two, so that a failure factor that is influenced by both can be detected as a failure appropriately. The same applies to the monitoring software element.

In the above, the hardware element monitoring means includes a monitoring arithmetic processing circuit and a comparison circuit, and the monitoring arithmetic processing circuit receives the same signal as the arithmetic processing circuit of the hardware element to be monitored. At this time, the same signal as that of the arithmetic processing circuit of the hardware element to be monitored is output, and arithmetic processing that is simpler than the arithmetic processing in the arithmetic processing circuit of the hardware element to be monitored is performed .

Thereby, the failure of the hardware element to be monitored can be detected appropriately.
Further, in the above, the monitoring arithmetic processing circuit may be mounted with a different number of transistors from the arithmetic processing circuit of the hardware element to be monitored.
Thereby, the monitoring arithmetic processing circuit can have a simplified structure with respect to the arithmetic processing circuit of the hardware element to be monitored.

In addition, in the above, the software element monitoring unit includes a monitoring arithmetic processing unit and a comparison processing unit, and the monitoring arithmetic processing unit is mathematically the same as the arithmetic processing unit of the monitoring target software element. It is also possible to perform arithmetic processing that is simpler than the arithmetic processing in the arithmetic processing unit of the monitored software element.
Thereby, the failure of the software element to be monitored can be appropriately detected.
Furthermore, in the above, the monitoring arithmetic processing unit may perform arithmetic processing with a different number of instructions from the arithmetic processing unit of the monitoring target software element.

Thereby, the arithmetic processing of the monitoring arithmetic processing unit can be simplified with respect to the arithmetic processing of the arithmetic processing unit of the monitoring target software element.
Further, in the above, the external monitoring unit is provided outside the microcomputer and monitors an abnormality of the microcomputer, and the hardware element monitoring unit and the software element monitoring unit are operating in the external monitoring unit. If not, this may be detected as an abnormality of the microcomputer.
Thereby, the microcomputer can be comprehensively monitored by hardware monitoring, software monitoring, and external monitoring, and the abnormality of the microcomputer can be diagnosed in more detail.

  In the on-vehicle electronic control device of the present invention, the hardware part and the software part of the microcomputer can be internally monitored by the monitoring hardware element and the monitoring software element that are mounted differently from those of the microcomputer. The details of the abnormality can be properly diagnosed. As a result, an appropriate treatment according to the details of the abnormality is possible.

It is a figure which shows the function of the vehicle-mounted electronic control apparatus in this embodiment. It is a block diagram which shows the monitoring function of a hardware part. It is a block diagram which shows the example of a diagnosis of MCU internal element. It is a block diagram which shows the example of a diagnosis of S / W element. It is a figure which shows the example of an abnormality diagnosis area | region. It is a figure which shows the example of an abnormality diagnosis area | region. It is a block diagram which shows the structure of a failure processing circuit.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating functions of the in-vehicle electronic control device according to the present embodiment.
In the figure, reference numeral 1 denotes an on-vehicle electronic control device that controls a vehicle. The on-vehicle electronic control device includes a microcomputer (MCU) 2. The MCU 2 includes a hardware unit 21 and a software unit 22.

  The hardware unit 21 includes a plurality of MCU internal elements and a monitoring function 23 that monitors a failure of the main function 22 among these MCU internal elements. Here, the MCU internal elements are a central processing circuit (CPU), a bus, a ROM, a RAM, peripheral circuits (timer, serial communication, CAN communication, external output port) and the like. Further, the software unit 24 includes a software element (S / W element) and a monitoring function 26 that monitors an abnormality in arithmetic processing executed by the main function 25 of the S / W elements.

That is, hardware elements and software elements are monitored in the MCU 2.
Detection signals detected by various sensors 11 mounted on the vehicle are input to the MCU 2 via the input I / F circuit 3. Then, the MCU 2 calculates a command signal for driving and controlling an actuator (brake actuator, active suspension, etc.) 12 mounted on the vehicle based on the input detection signal, and outputs this to the actuator drive circuit 4. .

The actuator drive circuit 4 includes a bridge circuit (FET), an FET drive circuit, a relay, a relay drive circuit, and the like, and drives and controls the actuator 12 based on a command signal calculated by the MCU 2.
The on-vehicle electronic control device 1 includes a failure processing circuit 5 that monitors a failure of the MCU 2 outside the MCU 2.
In FIG. 1, the monitoring function 23 corresponds to hardware element monitoring means, the monitoring function 26 corresponds to software element monitoring means, and the failure processing circuit 5 corresponds to external monitoring means.

Next, the monitoring function 23 of the hardware unit 21 of the MCU 2 will be described in detail.
FIG. 2 is a block diagram for explaining the monitoring function 23 of the hardware unit 21. As shown in FIG. 2, a failure processing element 32 is arranged as a monitoring function 23 in each of a plurality of MCU internal elements (main functions) 31. Here, the MCU internal element 31 and the failure processing element 32 are mounted with different structures.

  The failure processing element 32 monitors the input / output of the MCU internal element 31 to be monitored, and diagnoses whether or not the MCU internal element 31 has failed. Here, as shown in FIG. 3, the failure processing element 32 includes an arithmetic processing circuit (monitoring arithmetic processing circuit) 32a and a comparison circuit 32b. The arithmetic processing circuit 32a is mounted differently from the arithmetic processing circuit 31a constituting the MCU internal element 31 to be monitored, and has the same input / output characteristics as the arithmetic processing circuit 31a.

  That is, the arithmetic processing circuit 32a outputs the same signal as the arithmetic processing circuit 31a when the same signal as the arithmetic processing circuit 31a is input when its function is normal. Mount with different number of transistors. The arithmetic processing for failure processing can be simplified as compared with the arithmetic processing of the main function because it is only necessary to obtain an arithmetic value for diagnosis. Therefore, here, the number of transistors is different, and the arithmetic processing circuit 32a is simplified with respect to the arithmetic processing circuit 31a.

Then, the input signal of the arithmetic processing circuit 31a is input to the arithmetic processing circuit 32a, and the output signal is input to the comparison circuit 32b. Then, the comparison circuit 32b compares the output signal of the arithmetic processing circuit 31a with the output of the arithmetic processing circuit 32a. At this time, when the same result is not obtained, it is determined that the MCU internal element 31 has failed, and the failure processing element 32 includes the MCU internal element (external output function) 33 and the post-failure treatment element shown in FIG. A diagnosis result indicating that a failure has been detected is notified to 34.
The MCU internal element 33 receives the diagnosis result of the failure processing element 32 and outputs a failure post-treatment execution command to the actuator drive circuit 4.

  As an example of the execution instruction for the post-failure treatment, for example, there is a stop signal to the FET drive circuit of the bridge circuit constituting the actuator drive circuit 4. In this case, by outputting the stop signal, all the FETs are turned OFF, and the actuator 12 can be stopped. In addition, another example of the execution instruction for the post-failure treatment is a stop signal to the relay drive circuit of the actuator drive circuit 4, for example. In this case, when the stop signal is output, the relay is turned OFF, and the power supply to the actuator 12 can be stopped. As described above, in the present embodiment, the stop treatment of the actuator 12 is applied as post-failure treatment.

The failure post-treatment element 34 receives the diagnosis result of the failure processing element 32 and notifies the failure processing circuit 5 of the failure of the MCU internal element 31. When the failure processing circuit 5 receives the failure notification from the failure post-treatment element 34, the failure processing circuit 5 outputs a failure post-treatment execution command to the actuator drive circuit 4.
As described above, by making the notification means redundant, even if the notification function of either the MCU internal element 33 or the post-failure treatment element 34 is lost, the actuator drive circuit 4 can be reliably instructed to execute the post-failure treatment. Can be output.

Next, the monitoring function 26 of the software unit 24 of the MCU 2 will be described in detail.
FIG. 4 is a block diagram illustrating a diagnosis example of the S / W element. As shown in FIG. 4, the S / W element (main function) 41 is provided with an abnormal process S / W 42 as the monitoring function 26. Here, the S / W element 41 and the abnormality processing S / W 42 are mounted with different structures.
The abnormality process S / W 42 monitors the calculation result of the S / W element 41 to be monitored and diagnoses whether or not an abnormality has occurred in the S / W element. Here, the abnormality process S / W 42 includes a calculation process (monitoring calculation processing unit) 42a, a comparison process (comparison processing unit) 42b, and a restriction process 42c. The calculation process 42a is implemented differently from the calculation process 41a of the monitoring target S / W element 41 and performs the same calculation as the calculation process 41a.

  That is, the arithmetic processing 42a performs arithmetic operations that are mathematically the same as the arithmetic processing 41a with a different number of instructions than the arithmetic processing 41a. The arithmetic processing for failure processing can be simplified as compared with the arithmetic processing of the main function because it is only necessary to obtain an arithmetic value for diagnosis. Therefore, here, it is assumed that the number of instructions is different and the calculation process 42a is simplified with respect to the calculation process 41a.

Then, an input signal of the calculation process 41a is input to the calculation process 42a, and the calculation result is input to the comparison process 42b. Then, the comparison process 42b compares the calculation result of the calculation process 41a with the calculation result of the calculation process 42a. At this time, if the error between the two is not within the predetermined allowable range, it is determined that an abnormality has occurred in the S / W element 41.
That is, as shown in FIG. 5, an area in which the value on the main function side (the calculation result of the calculation process 41a) is within a predetermined range with respect to the value on the monitoring side (the calculation result of the calculation process 42a) is set as the allowable area. An area indicated by diagonal lines other than is an abnormality diagnosis area. When the point determined by the value on the main function side and the value on the monitoring side is within the abnormality diagnosis area, it is determined that the error is not within the allowable range. In addition, the straight line shown with the broken line of FIG. 5 is an area | region where the value on the main function side and the value on the monitoring side are equal.

As described above, in order to set the predetermined allowable range, it is possible to perform abnormality determination in consideration of the calculation error caused by simplifying the calculation process 42a.
Also, the abnormality diagnosis area can be set as shown in FIG. 6, for example. In this example, the value on the main function side and the value on the monitoring side have the same sign, and the absolute value of the value on the main function side is smaller than the absolute value of the value on the monitoring side. It is. That is, when the point determined by the value on the main function side and the value on the monitoring side is within the abnormality diagnosis region indicated by the oblique lines in FIG. 6, it is determined that the error is not within the allowable range. As a result, it is possible to determine that an actual operation value is small and to allow it to be determined that there is a low possibility of causing a failure, so that it is possible to suppress an abnormal determination.

When the comparison process 42b detects that an abnormality has occurred in the S / W element 41, the comparison process 42b outputs the diagnosis result to the limit process (limit means) 42c in FIG.
The calculation result of the calculation process 41a is input to the restriction process 42c. When a diagnosis result indicating that an abnormality has been detected is input from the comparison process 42b, the limit process 42c limits and outputs the calculation result of the calculation process 41a to an allowable limit value. Here, it is desirable that the limit value be determined by experimentally verifying a range allowable in the vehicle. On the other hand, when the diagnosis result indicating that the abnormality is detected is not input from the comparison process 42b, the limit process 42c outputs the calculation result of the calculation process 41a as it is.

Next, the configuration of the failure processing circuit 5 will be specifically described.
FIG. 7 is a block diagram showing functions of the failure processing circuit 5. The failure processing circuit 5 monitors the failure of the MCU 2 from the outside of the MCU 2. As a method of monitoring the MCU 2, a method of monitoring the clock 27 of the MCU 2 and a method of monitoring that the monitoring functions 23 and 26 of the MCU 2 are operating are adopted.

  That is, the failure processing circuit 5 includes a clock 51 independent of the MCU 2 and a clock monitoring process 52 in order to monitor the clock 27 of the MCU 2. The clock monitoring process 52 detects a failure of the clock 27 by comparing the clock pulse of the clock 27 with the clock pulse of the clock 51. The clock 27 is a reference for a series of operations of the MCU 2, and includes, for example, an RC oscillation circuit, a ceramic resonator, a crystal resonator, an oscillator with a built-in crystal resonator, an oscillator with a built-in crystal resonator / frequency divider, and the like.

Although FIG. 7 shows a case where the clock monitoring process 52 is implemented by S / W inside the failure processing circuit 5, it can also be implemented by H / W or S / W inside the MCU 2.
In addition, the failure processing circuit 5 includes a pulse monitoring process 53 that monitors the output pulse of the watchdog timer of the failure processing element 32 in order to monitor the operation of the monitoring function 23 of the MCU 2. The pulse monitoring process 53 detects an abnormality in the monitoring function 23 when the output pulse has stopped for a predetermined time.

Although only the abnormality detection of the monitoring function 23 is shown in FIG. 7, it is assumed that the monitoring function 26 (abnormality processing S / W 42) also detects an abnormality by the same method.
That is, by outputting a pulse from the watchdog timer when the monitoring function 26 (abnormal processing S / W42) is correctly executed, a state in which the monitoring function 26 is not executed (a state in which the monitoring function 26 is not monitored) Diagnosis can be made by the processing circuit 5.

When the failure processing circuit 5 detects a failure of the MCU 2 in at least one of the clock monitoring processing 52 and the pulse monitoring processing 53, the failure processing circuit 5 outputs an execution instruction for post-failure treatment to the actuator drive circuit 4 to stop the actuator 12. To do.
As described above, in the present embodiment, the MCU is comprehensively monitored by the hardware monitoring, the software monitoring, and the external monitoring, so that the abnormality of the MCU can be monitored in detail.

That is, in hardware monitoring, a failure processing element is arranged for each MCU internal element and an input / output signal of the MCU internal element is monitored, so that a failure of the MCU internal element can be diagnosed in detail.
At this time, since the failure processing element is mounted with a structure different from the MCU internal element to be monitored, for example, the delay time until the process is completed can be made different between the two. As a result, it is possible to appropriately detect a failure factor that is commonly affected by both as a failure. Further, since the failure processing element is mounted with a simplified structure as compared to the MCU internal element to be monitored by reducing the number of transistors, the failure processing element can be provided relatively easily and inexpensively.

Furthermore, in addition to the hardware monitoring described above, software monitoring is performed inside the MCU, so that it is possible to detect calculation failures that cannot be detected by the failure processing elements of hardware monitoring.
At this time, in software monitoring, the abnormality processing S / W is arranged in the S / W element and the calculation result of the S / W element is monitored, so that the abnormality of the S / W element can be appropriately diagnosed. Furthermore, since the abnormal processing S / W is implemented with a structure different from the S / W element to be monitored, for example, the instructions used for the calculation can be made different from each other. As a result, it is possible to appropriately detect an abnormality factor that is commonly affected by both as an abnormality.

  Further, since a predetermined allowable range is set when comparing the calculation results, abnormality diagnosis can be performed in consideration of calculation errors caused by the simplified structure of the abnormality processing S / W. For example, the calculation result of the monitoring target S / W element and the calculation result of the abnormality processing S / W have the same sign, and the absolute value of the calculation result of the monitoring target S / W element is the calculation of the abnormality processing S / W. A range smaller than the absolute value of the result is set as the allowable range. As a result, when the calculation result of the S / W element to be monitored is a value that is difficult to lead to an operation in which the actual control operation of the actuator is small and causes a problem, the calculation result of the S / W element to be monitored is Even if a relatively large error occurs in the calculation result of the abnormal processing S / W, it can be tolerated. For this reason, it is possible to suppress abnormal diagnosis.

If a failure of the MCU internal element is detected in hardware monitoring, the actuator is stopped. If an abnormality of the S / W element is detected in software monitoring, the calculation result of the S / W element is displayed. Correction is performed to limit the value within the allowable range, and a process for continuing the drive control of the actuator is performed.
In general, an MCU for electronic control mounted on a vehicle stops control when an abnormality occurs regardless of the details of the abnormality. However, from the viewpoint of driver burden at the time of control stop due to the increase in size of the vehicle and standardization of vehicle safety control, it is necessary to continue control depending on the details of the abnormality even when an abnormality occurs. In the present embodiment, the MCU abnormality can be diagnosed in detail, so that appropriate measures can be taken such as stopping the control or continuing the control according to the details of the abnormality.

Furthermore, since external monitoring for monitoring MCU failures is performed outside the MCU, it is possible to diagnose a factor that is commonly affected by hardware monitoring and software monitoring, which are monitoring functions inside the MCU.
For example, by arranging a clock independent of the MCU outside the MCU and monitoring the clock of the MCU, a clock abnormality that affects each monitoring function in the MCU in common occurs, and a failure / abnormality occurs in the MCU. If this cannot be diagnosed, this can be detected as an abnormality. Further, by monitoring the output pulse of the watchdog timer of each monitoring function inside the MCU, when each monitoring function inside the MCU is not operating, this can be detected as an abnormality. In this way, MCU malfunction can be detected and treated outside the MCU.

  And in this external monitoring, when the failure of the MCU is detected by its own monitoring function, or when information indicating that the failure of the MCU internal element is detected is obtained from the abnormality processing element, the action of stopping the actuator is taken. Do. That is, when a failure of an MCU internal element is detected by hardware monitoring, a means for directly stopping the actuator by hardware monitoring and a means for stopping the actuator via external monitoring are used in combination. be able to. As a result, the actuator can be surely stopped when a failure of the MCU internal element occurs.

  DESCRIPTION OF SYMBOLS 1 ... Car-mounted electronic control apparatus, 2 ... Microcomputer (MCU), 3 ... Input I / F circuit, 4 ... Actuator drive circuit, 5 ... Failure processing circuit, 11 ... Sensor, 12 ... Actuator, 21 ... Hardware part, 22 ... H / W main function, 23 ... H / W monitoring function, 24 ... software part, 25 ... S / W main function, 26 ... S / W monitoring function, 27 ... clock, 31 ... MCU internal element (main function), 31a ... arithmetic processing circuit, 32 ... failure processing element, 32a ... arithmetic processing circuit, 32b ... comparison circuit, 33 ... MCU internal element (external output function), 34 ... post-fault treatment element, 41 ... S / W element, 41a ... Arithmetic processing, 42... Abnormal processing S / W, 42 a .. arithmetic processing, 42 b... Comparison processing, 42 c .. limiting processing, 51... Clock, 52.

Claims (6)

An in-vehicle electronic control device including a microcomputer that generates a drive signal of an actuator based on a detection signal from a sensor mounted on a vehicle,
The microcomputer includes a hardware part and a software part,
Each element of the hardware unit is provided inside the microcomputer, and has the same processing characteristics as each element of the hardware unit, and is different from the arithmetic processing circuit of each element of the hardware unit. Hardware element monitoring means for monitoring abnormalities of
Provided inside the microcomputer, each element of the software part has the same processing characteristics and implementation different from that of the element of the software part. A software element monitoring means for monitoring ,
The hardware element monitoring means includes a monitoring arithmetic processing circuit and a comparison circuit,
The monitoring arithmetic processing circuit outputs the same signal as the monitoring target hardware element arithmetic processing circuit when the same signal as the monitoring target hardware element arithmetic processing circuit is input, An in-vehicle electronic control device that performs simplified arithmetic processing as compared with arithmetic processing in an arithmetic processing circuit of a hardware element to be monitored . The in-vehicle electronic control device according to claim 1 , wherein the monitoring arithmetic processing circuit is implemented with a different number of transistors from the arithmetic processing circuit of the hardware element to be monitored. The software element monitoring unit includes a monitoring arithmetic processing unit and a comparison processing unit,
The arithmetic processing unit for monitoring performs arithmetic processing that is mathematically identical to the arithmetic processing unit of the software element to be monitored, and is simplified than the arithmetic processing in the arithmetic processing unit of the software element to be monitored vehicle electronic control unit according to claim 1 or 2, characterized in that the arithmetic processing.   An in-vehicle electronic control device including a microcomputer that generates a drive signal of an actuator based on a detection signal from a sensor mounted on a vehicle,
  The microcomputer includes a hardware part and a software part,
  Each element of the hardware unit is provided inside the microcomputer, and has the same processing characteristics as each element of the hardware unit, and is different from the arithmetic processing circuit of each element of the hardware unit. Hardware element monitoring means for monitoring abnormalities of
  Provided inside the microcomputer, each element of the software part has the same processing characteristics and implementation different from that of the element of the software part. A software element monitoring means for monitoring,
  The software element monitoring unit includes a monitoring arithmetic processing unit and a comparison processing unit,
  The arithmetic processing unit for monitoring performs arithmetic processing that is mathematically identical to the arithmetic processing unit of the software element to be monitored, and is simplified than the arithmetic processing in the arithmetic processing unit of the software element to be monitored An on-vehicle electronic control device that performs arithmetic processing. The in-vehicle electronic control device according to claim 3 , wherein the monitoring arithmetic processing unit performs arithmetic processing with a different number of instructions from the arithmetic processing unit of the monitoring target software element. Provided outside the microcomputer, comprising external monitoring means for monitoring abnormalities of the microcomputer,
6. The external monitoring means, when the hardware element monitoring means and the software element monitoring means are not operating, detects this as an abnormality of the microcomputer. The vehicle-mounted electronic control apparatus of description.

Images