JP5561329B2 - In-vehicle electronic control unit - Google Patents

Description

  The present invention relates to an in-vehicle electronic control device having a function of monitoring failure / abnormality of a microcomputer.

As a vehicle-mounted electronic control apparatus having a conventional CPU monitoring function, for example, there are technologies described in Patent Documents 1 and 2. This technique employs a lockstep method as the monitoring function, and includes a collation circuit that collates processing results in the two information processing units A and B having the same configuration. And when the collation result by a collation circuit is inconsistent, it determines with A system or B system having failed.
In addition, as the monitoring function, there is a function that employs a so-called 2CPU system in which the control CPU is monitored by the monitoring CPU (see, for example, Patent Document 3).

JP 2010-262432 A JP 2010-160649 A JP 2006-344086 A

However, in the monitoring function employing the lock step method as described above, if the control unit and the monitoring unit use the same core, there is a problem that causes a calculation error in the arithmetic unit of the core, It cannot be detected as an abnormality. In addition, the monitoring function employing the 2CPU method as described above cannot make a detailed diagnosis of the calculation of the control CPU.
As described above, since the details of the abnormality cannot be diagnosed, the control is uniformly stopped regardless of the details of the abnormality when the abnormality occurs. However, depending on the details of the abnormality, it is desirable to continue the control even when an abnormality occurs, from the viewpoint of driver burden at the time of stopping the control due to an increase in the size of the vehicle and standardization of vehicle safety control.
Therefore, an object of the present invention is to provide an in-vehicle electronic control device that can appropriately diagnose details of abnormality of a microcomputer.

  In order to solve the above-described problem, an aspect of an on-vehicle electronic control device according to the present invention includes a microcomputer that generates a drive signal for an actuator based on a detection signal from a sensor mounted on a vehicle, and the microcomputer. An on-vehicle electronic control device including a clock, wherein the microcomputer includes a hardware part and a software part, and is provided inside the microcomputer, and each element of the hardware part is abnormal. Hardware element monitoring means having a watchdog timer for monitoring the software, software element monitoring means provided in the microcomputer and having a watchdog timer for monitoring an abnormality of each element of the software section, and the microcomputer Provided outside, the microcomputer External monitoring means for monitoring abnormalities of the data, the external monitoring means comprising: a clock monitoring processing means for monitoring the clock of the microcomputer; and a watchdog timer of the hardware element monitoring means and the software element monitoring means. And pulse monitoring processing means for monitoring each output pulse.

  As described above, since the microcomputer is comprehensively monitored by hardware monitoring, software monitoring, and external monitoring, the details of the abnormality of the microcomputer can be diagnosed. Therefore, when an abnormality occurs in the microcomputer, it is possible to take appropriate measures according to the details of the abnormality. Further, since external monitoring is performed by the clock monitoring process and the pulse monitoring process, it is possible to appropriately detect malfunction of the microcomputer outside the microcomputer.

In the above, the external monitoring means has a monitoring clock independent of the clock of the microcomputer, and the clock monitoring processing means monitors the clock of the microcomputer using the monitoring clock.
As a result, when a clock abnormality that affects each monitoring function in the microcomputer in common occurs and failure / abnormality diagnosis cannot be performed in the microcomputer, it can be detected as an abnormality.
In the above, the pulse monitoring processing means detects an abnormality of at least one of the hardware element monitoring means and the software element monitoring means when at least one of the output pulses is stopped for a predetermined time.
Thereby, when each monitoring function in the microcomputer is not operating, this can be detected as an abnormality.

Further, in the above, the clock monitoring processing means may detect an abnormality in the clock of the microcomputer by comparing a clock pulse of the microcomputer clock with a clock pulse of the monitoring clock. Good.
Thereby, the abnormality of the clock of the microcomputer can be detected appropriately .

Et al. In the above of the external monitoring means detects an abnormality of the microcomputer at least one of the clock monitoring processing means and said pulse monitoring processing unit, to perform a stop action to stop the actuator It may be.

As a result, appropriate measures can be taken according to the details of the abnormality of the microcomputer.
In the above, the hardware element monitoring means is implemented with a structure different from the hardware element to be monitored, and the software element monitoring means is implemented with a structure different from the software element to be monitored. Also good.

As described above, since the monitoring hardware element is mounted with a structure different from that of the monitoring target hardware element, it is possible to appropriately detect an abnormality factor that is commonly affected by both as an abnormality. The same applies to the monitoring software element.
Furthermore, in the above, the software element monitoring means may monitor the calculation result of the monitoring target software element by a monitoring software element having a structure different from that of the monitoring target software element.
Thereby, the abnormality of the software element to be monitored can be appropriately detected.

  In the in-vehicle electronic control device according to the present invention, it is possible to comprehensively monitor the internal monitoring of the hardware and software of the microcomputer and the external monitoring of the microcomputer, so that the details of the abnormality of the microcomputer can be appropriately diagnosed. Can do. Further, since external monitoring is performed by the clock monitoring process and the pulse monitoring process, it is possible to appropriately detect malfunction of the microcomputer outside the microcomputer. As a result, an appropriate treatment according to the details of the abnormality is possible.

It is a figure which shows the function of the vehicle-mounted electronic control apparatus in this embodiment. It is a block diagram which shows the monitoring function of a hardware part. It is a block diagram which shows the example of a diagnosis of MCU internal element. It is a block diagram which shows the example of a diagnosis of S / W element. It is a figure which shows the example of an abnormality diagnosis area | region. It is a figure which shows the example of an abnormality diagnosis area | region. It is a block diagram which shows the structure of a failure processing circuit.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating functions of the in-vehicle electronic control device according to the present embodiment.
In the figure, reference numeral 1 denotes an on-vehicle electronic control device that controls a vehicle. The on-vehicle electronic control device includes a microcomputer (MCU) 2. The MCU 2 includes a hardware unit 21 and a software unit 22.

  The hardware unit 21 includes a plurality of MCU internal elements and a monitoring function 23 that monitors a failure of the main function 22 among these MCU internal elements. Here, the MCU internal elements are a central processing circuit (CPU), a bus, a ROM, a RAM, peripheral circuits (timer, serial communication, CAN communication, external output port) and the like. Further, the software unit 24 includes a software element (S / W element) and a monitoring function 26 that monitors an abnormality in arithmetic processing executed by the main function 25 of the S / W elements.

That is, hardware elements and software elements are monitored in the MCU 2.
Detection signals detected by various sensors 11 mounted on the vehicle are input to the MCU 2 via the input I / F circuit 3. Then, the MCU 2 calculates a command signal for driving and controlling an actuator (brake actuator, active suspension, etc.) 12 mounted on the vehicle based on the input detection signal, and outputs this to the actuator drive circuit 4. .

The actuator drive circuit 4 includes a bridge circuit (FET), an FET drive circuit, a relay, a relay drive circuit, and the like, and drives and controls the actuator 12 based on a command signal calculated by the MCU 2.
The on-vehicle electronic control device 1 includes a failure processing circuit 5 that monitors a failure of the MCU 2 outside the MCU 2.
In FIG. 1, the monitoring function 23 corresponds to hardware element monitoring means, the monitoring function 26 corresponds to software element monitoring means, and the failure processing circuit 5 corresponds to external monitoring means.

Next, the monitoring function 23 of the hardware unit 21 of the MCU 2 will be described in detail.
FIG. 2 is a block diagram for explaining the monitoring function 23 of the hardware unit 21. As shown in FIG. 2, a failure processing element 32 is arranged as a monitoring function 23 in each of a plurality of MCU internal elements (main functions) 31. Here, the MCU internal element 31 and the failure processing element 32 are mounted with different structures.

  The failure processing element 32 monitors the input / output of the MCU internal element 31 to be monitored, and diagnoses whether or not the MCU internal element 31 has failed. Here, as shown in FIG. 3, the failure processing element 32 includes an arithmetic processing circuit 32a and a comparison circuit 32b. The arithmetic processing circuit 32a is mounted differently from the arithmetic processing circuit 31a constituting the MCU internal element 31 to be monitored, and has the same input / output characteristics as the arithmetic processing circuit 31a.

  That is, the arithmetic processing circuit 32a outputs the same signal as the arithmetic processing circuit 31a when the same signal as the arithmetic processing circuit 31a is input when its function is normal. Mount with different number of transistors. The arithmetic processing for failure processing can be simplified as compared with the arithmetic processing of the main function because it is only necessary to obtain an arithmetic value for diagnosis. Therefore, here, the number of transistors is different, and the arithmetic processing circuit 32a is simplified with respect to the arithmetic processing circuit 31a.

Then, the input signal of the arithmetic processing circuit 31a is input to the arithmetic processing circuit 32a, and the output signal is input to the comparison circuit 32b. Then, the comparison circuit 32b compares the output signal of the arithmetic processing circuit 31a with the output of the arithmetic processing circuit 32a. At this time, when the same result is not obtained, it is determined that the MCU internal element 31 has failed, and the failure processing element 32 includes the MCU internal element (external output function) 33 and the post-failure treatment element shown in FIG. A diagnosis result indicating that a failure has been detected is notified to 34.
The MCU internal element 33 receives the diagnosis result of the failure processing element 32 and outputs a failure post-treatment execution command to the actuator drive circuit 4.

  As an example of the execution instruction for the post-failure treatment, for example, there is a stop signal to the FET drive circuit of the bridge circuit constituting the actuator drive circuit 4. In this case, by outputting the stop signal, all the FETs are turned OFF, and the actuator 12 can be stopped. In addition, another example of the execution instruction for the post-failure treatment is a stop signal to the relay drive circuit of the actuator drive circuit 4, for example. In this case, when the stop signal is output, the relay is turned OFF, and the power supply to the actuator 12 can be stopped. As described above, in the present embodiment, the stop treatment of the actuator 12 is applied as post-failure treatment.

The failure post-treatment element 34 receives the diagnosis result of the failure processing element 32 and notifies the failure processing circuit 5 of the failure of the MCU internal element 31. When the failure processing circuit 5 receives the failure notification from the failure post-treatment element 34, the failure processing circuit 5 outputs a failure post-treatment execution command to the actuator drive circuit 4.
As described above, by making the notification means redundant, even if the notification function of either the MCU internal element 33 or the post-failure treatment element 34 is lost, the actuator drive circuit 4 can be reliably instructed to execute the post-failure treatment. Can be output.

Next, the monitoring function 26 of the software unit 24 of the MCU 2 will be described in detail.
FIG. 4 is a block diagram illustrating a diagnosis example of the S / W element. As shown in FIG. 4, the S / W element (main function) 41 is provided with an abnormal process S / W 42 as the monitoring function 26. Here, the S / W element 41 and the abnormality processing S / W 42 are mounted with different structures.
The abnormality process S / W 42 monitors the calculation result of the S / W element 41 to be monitored and diagnoses whether or not an abnormality has occurred in the S / W element. Here, the abnormality process S / W 42 includes a calculation process 42a, a comparison process 42b, and a restriction process 42c. The calculation process 42a is implemented differently from the calculation process 41a of the monitoring target S / W element 41 and performs the same calculation as the calculation process 41a.

  That is, the arithmetic processing 42a performs arithmetic operations that are mathematically the same as the arithmetic processing 41a with a different number of instructions than the arithmetic processing 41a. The arithmetic processing for failure processing can be simplified as compared with the arithmetic processing of the main function because it is only necessary to obtain an arithmetic value for diagnosis. Therefore, here, it is assumed that the number of instructions is different and the calculation process 42a is simplified with respect to the calculation process 41a.

Then, an input signal of the calculation process 41a is input to the calculation process 42a, and the calculation result is input to the comparison process 42b. Then, the comparison process 42b compares the calculation result of the calculation process 41a with the calculation result of the calculation process 42a. At this time, if the error between the two is not within the predetermined allowable range, it is determined that an abnormality has occurred in the S / W element 41.
That is, as shown in FIG. 5, an area in which the value on the main function side (the calculation result of the calculation process 41a) is within a predetermined range with respect to the value on the monitoring side (the calculation result of the calculation process 42a) is set as the allowable area. An area indicated by diagonal lines other than is an abnormality diagnosis area. When the point determined by the value on the main function side and the value on the monitoring side is within the abnormality diagnosis area, it is determined that the error is not within the allowable range. In addition, the straight line shown with the broken line of FIG. 5 is an area | region where the value on the main function side and the value on the monitoring side are equal.

As described above, in order to set the predetermined allowable range, it is possible to perform abnormality determination in consideration of the calculation error caused by simplifying the calculation process 42a.
Also, the abnormality diagnosis area can be set as shown in FIG. 6, for example. In this example, the value on the main function side and the value on the monitoring side have the same sign, and the absolute value of the value on the main function side is smaller than the absolute value of the value on the monitoring side. It is. That is, when the point determined by the value on the main function side and the value on the monitoring side is within the abnormality diagnosis region indicated by the oblique lines in FIG. 6, it is determined that the error is not within the allowable range. As a result, it is possible to determine that an actual operation value is small and to allow it to be determined that there is a low possibility of causing a failure, so that it is possible to suppress an abnormal determination.

When the comparison process 42b detects that an abnormality has occurred in the S / W element 41, the comparison process 42b outputs the diagnosis result to the limit process (limit means) 42c in FIG.
The calculation result of the calculation process 41a is input to the restriction process 42c. When a diagnosis result indicating that an abnormality has been detected is input from the comparison process 42b, the limit process 42c limits and outputs the calculation result of the calculation process 41a to an allowable limit value. Here, it is desirable that the limit value be determined by experimentally verifying a range allowable in the vehicle. On the other hand, when the diagnosis result indicating that the abnormality is detected is not input from the comparison process 42b, the limit process 42c outputs the calculation result of the calculation process 41a as it is.

Next, the configuration of the failure processing circuit 5 will be specifically described.
FIG. 7 is a block diagram showing functions of the failure processing circuit 5. The failure processing circuit 5 monitors the failure of the MCU 2 from the outside of the MCU 2. As a method of monitoring the MCU 2, a method of monitoring the clock 27 of the MCU 2 and a method of monitoring that the monitoring functions 23 and 26 of the MCU 2 are operating are adopted.

  That is, the failure processing circuit 5 includes a clock (monitoring clock) 51 independent of the MCU 2 and a clock monitoring process 52 in order to monitor the clock 27 of the MCU 2. The clock monitoring process 52 detects a failure of the clock 27 by comparing the clock pulse of the clock 27 with the clock pulse of the clock 51. The clock 27 is a reference for a series of operations of the MCU 2, and includes, for example, an RC oscillation circuit, a ceramic resonator, a crystal resonator, an oscillator with a built-in crystal resonator, an oscillator with a built-in crystal resonator / frequency divider, and the like.

Although FIG. 7 shows a case where the clock monitoring process 52 is implemented by S / W inside the failure processing circuit 5, it can also be implemented by H / W or S / W inside the MCU 2.
In addition, the failure processing circuit 5 includes a pulse monitoring process 53 that monitors the output pulse of the watchdog timer of the failure processing element 32 in order to monitor the operation of the monitoring function 23 of the MCU 2. The pulse monitoring process 53 detects an abnormality in the monitoring function 23 when the output pulse has stopped for a predetermined time.

Although only the abnormality detection of the monitoring function 23 is shown in FIG. 7, it is assumed that the monitoring function 26 (abnormality processing S / W 42) also detects an abnormality by the same method.
That is, by outputting a pulse from the watchdog timer when the monitoring function 26 (abnormal processing S / W42) is correctly executed, a state in which the monitoring function 26 is not executed (a state in which the monitoring function 26 is not monitored) Diagnosis can be made by the processing circuit 5.

When the failure processing circuit 5 detects a failure of the MCU 2 in at least one of the clock monitoring processing 52 and the pulse monitoring processing 53, the failure processing circuit 5 outputs an execution instruction for post-failure treatment to the actuator drive circuit 4 to stop the actuator 12. To do.
The clock monitoring processing 52 corresponds to the clock monitoring processing means, and the pulse monitoring processing 53 corresponds to the pulse monitoring processing means.

As described above, in the present embodiment, the MCU is comprehensively monitored by the hardware monitoring, the software monitoring, and the external monitoring, so that the abnormality of the MCU can be monitored in detail.
That is, in hardware monitoring, a failure processing element is arranged for each MCU internal element and an input / output signal of the MCU internal element is monitored, so that a failure of the MCU internal element can be diagnosed in detail.

  At this time, since the failure processing element is mounted with a structure different from the MCU internal element to be monitored, for example, the delay time until the process is completed can be made different between the two. As a result, it is possible to appropriately detect a failure factor that is commonly affected by both as a failure. Further, since the failure processing element is mounted with a simplified structure as compared to the MCU internal element to be monitored by reducing the number of transistors, the failure processing element can be provided relatively easily and inexpensively.

Furthermore, in addition to the hardware monitoring described above, software monitoring is performed inside the MCU, so that it is possible to detect calculation failures that cannot be detected by the failure processing elements of hardware monitoring.
At this time, in software monitoring, an abnormality processing S / W (monitoring software element) is arranged in the S / W element and the calculation result of the S / W element is monitored, so the abnormality of the S / W element is appropriately diagnosed. can do. Furthermore, since the abnormal processing S / W is implemented with a structure different from the S / W element to be monitored, for example, the instructions used for the calculation can be made different from each other. As a result, it is possible to appropriately detect an abnormality factor that is commonly affected by both as an abnormality.

  Further, since a predetermined allowable range is set when comparing the calculation results, abnormality diagnosis can be performed in consideration of calculation errors caused by the simplified structure of the abnormality processing S / W. For example, the calculation result of the monitoring target S / W element and the calculation result of the abnormality processing S / W have the same sign, and the absolute value of the calculation result of the monitoring target S / W element is the calculation of the abnormality processing S / W. A range smaller than the absolute value of the result is set as the allowable range. As a result, when the calculation result of the S / W element to be monitored is a value that is difficult to lead to an operation in which the actual control operation of the actuator is small and causes a problem, the calculation result of the S / W element to be monitored is Even if a relatively large error occurs in the calculation result of the abnormal processing S / W, it can be tolerated. For this reason, it is possible to suppress abnormal diagnosis.

If a failure of the MCU internal element is detected in hardware monitoring, the actuator is stopped. If an abnormality of the S / W element is detected in software monitoring, the calculation result of the S / W element is displayed. Correction is performed to limit the value within the allowable range, and a process for continuing the drive control of the actuator is performed.
In general, an MCU for electronic control mounted on a vehicle stops control when an abnormality occurs regardless of the details of the abnormality. However, from the viewpoint of driver burden at the time of control stop due to the increase in size of the vehicle and standardization of vehicle safety control, it is necessary to continue control depending on the details of the abnormality even when an abnormality occurs. In the present embodiment, the MCU abnormality can be diagnosed in detail, so that appropriate measures can be taken such as stopping the control or continuing the control according to the details of the abnormality.

Furthermore, since external monitoring for monitoring MCU failures is performed outside the MCU, it is possible to diagnose a factor that is commonly affected by hardware monitoring and software monitoring, which are monitoring functions inside the MCU.
For example, by arranging a clock independent of the MCU outside the MCU and monitoring the clock of the MCU, a clock abnormality that affects each monitoring function in the MCU in common occurs, and a failure / abnormality occurs in the MCU. If this cannot be diagnosed, this can be detected as an abnormality. Further, by monitoring the output pulse of the watchdog timer of each monitoring function inside the MCU, when each monitoring function inside the MCU is not operating, this can be detected as an abnormality. In this way, MCU malfunction can be detected and treated outside the MCU.

  And in this external monitoring, when the failure of the MCU is detected by its own monitoring function, or when information indicating that the failure of the MCU internal element is detected is obtained from the abnormality processing element, the action of stopping the actuator is taken. Do. That is, when a failure of an MCU internal element is detected by hardware monitoring, a means for directly stopping the actuator by hardware monitoring and a means for stopping the actuator via external monitoring are used in combination. be able to. As a result, the actuator can be surely stopped when a failure of the MCU internal element occurs.

  DESCRIPTION OF SYMBOLS 1 ... Car-mounted electronic control apparatus, 2 ... Microcomputer (MCU), 3 ... Input I / F circuit, 4 ... Actuator drive circuit, 5 ... Failure processing circuit, 11 ... Sensor, 12 ... Actuator, 21 ... Hardware part, 22 ... H / W main function, 23 ... H / W monitoring function, 24 ... software part, 25 ... S / W main function, 26 ... S / W monitoring function, 27 ... clock, 31 ... MCU internal element (main function), 31a ... arithmetic processing circuit, 32 ... failure processing element, 32a ... arithmetic processing circuit, 32b ... comparison circuit, 33 ... MCU internal element (external output function), 34 ... post-fault treatment element, 41 ... S / W element, 41a ... Arithmetic processing, 42... Abnormal processing S / W, 42 a .. arithmetic processing, 42 b... Comparison processing, 42 c .. limiting processing, 51... Clock, 52.

Claims (5)

An on-vehicle electronic control device comprising a microcomputer that generates a drive signal for an actuator based on a detection signal from a sensor mounted on a vehicle, and a clock of the microcomputer,
The microcomputer includes a hardware part and a software part,
Hardware element monitoring means having a watchdog timer, which is provided inside the microcomputer and monitors an abnormality of each element of the hardware unit;
Software element monitoring means having a watchdog timer, which is provided inside the microcomputer and monitors an abnormality of each element of the software section;
An external monitoring means provided outside the microcomputer for monitoring an abnormality of the microcomputer,
The external monitoring means includes a monitoring clock independent of the microcomputer clock, a clock monitoring processing means for monitoring the microcomputer clock using the monitoring clock, the hardware element monitoring means, and the software element. the Kaparusu out of watchdog timer monitoring means have a pulse monitoring processing means for monitoring respectively,
The on-vehicle electronic control device, wherein the pulse monitoring processing unit detects an abnormality of at least one of the hardware element monitoring unit and the software element monitoring unit when at least one of the output pulses is stopped for a predetermined time .   2. The clock monitoring processing means detects an abnormality in the clock of the microcomputer by comparing a clock pulse of the clock of the microcomputer with a clock pulse of the monitoring clock. The vehicle-mounted electronic control apparatus of description.   2. The external monitoring unit, when detecting an abnormality of the microcomputer in at least one of the clock monitoring processing unit and the pulse monitoring processing unit, performs a stopping process for stopping the actuator. The vehicle-mounted electronic control apparatus of 2.   2. The hardware element monitoring unit is implemented with a structure different from the hardware element to be monitored, and the software element monitoring unit is implemented with a structure different from the software element to be monitored. The vehicle-mounted electronic control apparatus of any one of -3.   The said software element monitoring means monitors the calculation result of the software element of the monitoring object by the software element for monitoring of the structure different from the software element of the monitoring object, The any one of Claims 1-4 characterized by the above-mentioned. The vehicle-mounted electronic control apparatus of description.

Images