JP5683191B2 - Monitoring device and electronic control system - Google Patents

Description

  The present invention relates to a monitoring device that monitors the state of a control processing device that controls a load, and an electronic control system that includes the monitoring device and the control processing device.

  Conventionally, an electronic control provided with a control processing device that controls a load (for example, a motor) and a monitoring device that prohibits the operation of the control processing device if an abnormality occurs as a result of monitoring the state of the control processing device. A system is known (see, for example, Patent Document 1). In this type of electronic control system, the state of the control processing device, that is, the presence or absence of an abnormality in the control processing device, is monitored based on information communication performed between the monitoring device and the control processing device.

  Specifically, each time the homework number is acquired from the monitoring device, the control processing device executes an operation corresponding to the acquired homework number and outputs an answer number that is information indicating the result of executing the operation. To do.

  On the other hand, if the response number from the control processing device is a correct answer corresponding to the homework number from the monitoring device (that is, a correct answer), the monitoring device updates the new homework number according to a predetermined order. If the answer number is an incorrect answer, the homework number is maintained and the same homework number is output again to the control processor. Then, if the answer number from the control processing device is an incorrect answer for the specified number of times, it is determined that there is a possibility that the control processing device has an abnormality (hereinafter referred to as an estimated abnormal state), A reset signal is output and the electronic control system is restarted. As a result of repeatedly executing such processing, if the estimated abnormal state is detected for the same homework number continuously for the set number of times, it is determined that an abnormality has occurred in the control processing device (hereinafter referred to as “abnormal determination”). Thus, holding the output of the reset signal to the control processing device prohibits the operation of the control processing device.

JP 2004-259137 A

  By the way, in the control processing device, when the part that performs the operation of a specific homework number (hereinafter referred to as the cause homework number) is out of order, the answer number corresponding to the cause homework number is erroneously repeated the specified number of times. As a result, the monitoring device described in Patent Document 1 outputs the reset signal described above. At this time, since the monitoring device after restarting re-outputs the homework number from the initial value, the answer number from the control processing device is the correct answer until it is determined again as the estimated abnormal state, and thus until it is determined as abnormal. There is a problem that the homework number and the answer number corresponding to the homework number are repeatedly transmitted and received.

Specifically, when the homework number between the monitoring device described in Patent Document 1 and the control processing device, the transmission / reception of the response number, and the state of the correctness of the response number are illustrated in FIG. In the monitoring apparatus, the answer number A _i for each homework number Q _i from the homework number Q ₁ to the homework number Q ₃ which is an initial value is determined to be a correct answer. However, since the answer number A _# for the cause homework number Q _M (here, M = 4) is an erroneous answer continuously for a specified number of times (in the figure, the specified number of times = 3), it is assumed that it is an estimated abnormal state. Determine and output a reset signal. Thereafter, the restart electronic control system, after determining the response number A _i for each assignment number Q _i from assignment number Q ₁ is the initial value to the assignment number Q ₃ and correct answers to assignment number Q _M The number A _# is erroneously answered continuously for the specified number of times, and the set number of times (in the figure, set number of times = 2) is continuously in the estimated abnormal state, so it is determined that the abnormality is confirmed.

  Therefore, in the monitoring apparatus described in Patent Document 1, since the homework number Q is re-output in order from the initial value after being restarted, a large amount of processing is required until it is determined again as the estimated abnormal state. There is a problem that the time length required to determine again becomes longer.

  Therefore, an object of the present invention is to reduce the amount of processing required for re-determining an estimated abnormal state in an electronic control system and a monitoring device.

  The present invention made to achieve the above object relates to a monitoring device that monitors the state of a control processing device based on a homework number and an answer number transmitted to and received from the control processing device. However, when the control processing device acquires the homework number in which the operation contents are associated in advance, the control execution procedure for executing the operation corresponding to the acquired homework number and the answer number indicating the operation result in the operation execution procedure are displayed. An answer output procedure that is generated and output is executed.

  In the monitoring device of the present invention, when the homework output means outputs the set homework number and obtains the answer number from the control processing device for the homework number, the correctness determination means outputs the homework output by the homework output means. Whether the answer number is correct or not is determined based on the answer prepared for the number. As a result of the determination, if the answer number is a correct answer, the homework updating means changes the homework number to a different homework number from the one output earlier according to a predetermined order and sets the answer number. If it is an incorrect answer, the homework number is maintained and set to the homework number output earlier.

  However, as a result of determining whether the answer number is correct or not, if the answer number corresponding to the same homework number is an estimated abnormal state in which the answer number is continuously incorrect for a predetermined number of times, the reset means responds to the error answer. The homework number is stored in a storage unit that retains the stored contents even if it is restarted, and a reset signal for restarting the control processing device and the monitoring device is output. When the control processing device and the monitoring device are restarted by the output of the reset signal, the number resetting means sets the homework number stored in the storage unit and causes the homework output means to output it.

  Note that “restarted” as used herein may mean that the monitoring device is returned to the initial state except for the information stored in the storage unit, or the monitoring device is again connected. It may be activated. On the other hand, “restart” for the control processing device preferably restarts the control processing device again.

For example, FIG. 7B illustrates how homework numbers, transmission / reception of response numbers, and correctness of the response numbers change between the monitoring device and the control processing device of the present invention. As shown in FIG. 7B, the monitoring apparatus of the present invention determines that the answer numbers A ₁ to ₃ up to homework number Q ₃ are correct answers. However, due the answer number A _# assignment is a number for assignment number Q _4, the specified number of times (in the figure, the specified number of times = 3) for a wrong answer continuously, stored in the storage unit the assignment number Q ₄ (i.e. The control processing device and the monitoring device are restarted. Thereafter, the monitoring device of the present invention is restarted, the transmission of the assignment number Q, and the judgment about the correctness of the answer number A corresponding to the transmitted assignment number Q, resumes from due assignment number Q _4.

  Therefore, according to the monitoring device of the present invention, after the monitoring device and the control processing device of the present invention are restarted, the homework numbers from the initial value to the previous homework number can be prevented from being output again. As a result, according to the monitoring apparatus of the present invention, it is possible to reduce the amount of processing required to re-determine the estimated abnormal state, and in turn reduce the length of time required to re-determine the estimated abnormal state. it can.

  Further, the reset means in the present invention is the estimated abnormal state if the answer number corresponding to the homework number output by the homework output means is not acquired for a predetermined time or more after outputting the homework number. (Claim 2).

  According to such a monitoring device, even if the answer number is not output from the control output device for the homework number output from the monitoring device, the output of the homework number after the restart is resumed from the homework number. it can.

  Furthermore, in the monitoring device of the present invention, when the result of determination by the correctness determination means for each answer number to the same homework number results in an estimated abnormal state continuously for a preset number of times, the operation prohibiting means is reset. The output of the reset signal by the means may be continued (Claim 3).

  With such a monitoring device of the present invention, it is possible to determine whether or not an abnormality has been established, and if the abnormality has been established, the operation of the control processing device can be disabled. Moreover, according to the monitoring device of the present invention, when the control processing device and the monitoring device are restarted, the homework number is re-output from the cause homework number. It is possible to reduce the time required to determine that it is confirmed.

By the way, this invention may be made | formed as an electronic control system provided with the control processing apparatus in addition to the monitoring apparatus as described in any one of Claims 1-3.
Even if the present invention is configured as such an electronic control system, the same effects as the monitoring device according to claims 1 to 3 can be obtained.

  Furthermore, the control processing device and the monitoring device according to the present invention may be a computer that executes processing according to a processing procedure defined in a program, that is, a general-purpose computer (microcomputer).

In this way, the configuration of the monitoring device can be easily changed by adding a processing procedure to the program or changing the processing procedure defined in the program.
The monitoring device in the electronic control system of the present invention is configured by combining at least one or more circuit elements each of homework output means, correctness determination means, homework update means, reset means, and number resetting means. Alternatively, it may be realized by a dedicated electronic device.

Thus, if the monitoring device is configured as a dedicated circuit specialized for realizing one function, the manufacturing cost of the monitoring device can be reduced as compared with a general-purpose computer.
The control processing device and the monitoring device according to the present invention are different processor cores provided in one central processing unit, i.e., each processor core in a so-called multi-core processor as a control processing device and a monitoring device. You may make it function (Claim 6).

In this way, the state of the processor core can be monitored.
Furthermore, each of the control processing device and the monitoring device in the present invention may be an electronic control unit (a so-called ECU (Electronic Control Unit)) that is mounted on a vehicle and controls equipment provided in the vehicle. ).

  In this way, the state of the electronic control unit can be monitored.

1 is a block diagram showing a schematic configuration of an electronic control system to which the present invention is applied. It is a block diagram which shows schematic structure of the monitoring apparatus in 1st embodiment. It is a block diagram which shows schematic structure of the monitoring apparatus in 2nd embodiment. It is a flowchart which shows the process sequence of the monitoring process which the monitoring apparatus of 2nd embodiment performs. It is a block diagram which shows the modification of the electronic control system in 2nd embodiment. It is a block diagram which shows the modification of the electronic control system in 2nd embodiment. It is explanatory drawing for demonstrating the subject of a prior art and the effect of this invention.

Embodiments of the present invention will be described below with reference to the drawings.
[First embodiment]
<Configuration of electronic control system>
FIG. 1 is a block diagram showing a schematic configuration of an electronic control system to which the present invention is applied.

  The electronic control system 1 executes various processes in accordance with a processing program, and monitors the state of the control processing apparatus 10 based on signals transmitted and received between the control processing apparatus 10 that controls the load and the control processing apparatus 10. Monitoring device 20. The control processing device 10 and the monitoring device 20 are connected by a dedicated serial bus that transmits and receives signals, and the electronic control system 1 (the control processing device 10 and the monitoring device 20) is used by being mounted on an automobile. .

  In the present embodiment, the load is an actuator that functions as a power source for driving various devices mounted on the automobile. For example, in a pre-crash safety system, a motor that winds a seat belt or an electric power steering system Corresponds to a motor or the like for assisting the turning of the steering wheel.

  Among them, the control processing device 10 stores a ROM 11 for storing data and programs that need to retain contents even when the power is turned off, a RAM 12 for storing data temporarily generated during processing, and a ROM 11 and a RAM 12. A known microcomputer including at least a CPU 15 for executing a stored processing program and a bus (not shown) for connecting them is mainly configured.

  Further, the CPU 15 includes a control unit 16 that reads and decodes a processing program from the ROM 11 or the RAM 12, and a calculation unit 17 that performs various calculations according to the processing program decoded by the control unit 16.

The ROM 11 stores a processing program for controlling the load and a processing program for executing a calculation based on a signal from the monitoring device 20.
That is, in the electronic control system 1, the homework signal including the homework number Q _i that is a character string (for example, a number) representing the operation content to be executed is output from the monitoring device 20 to the control processing device 10. Then, the control processing apparatus 10 that has acquired the homework signal executes a calculation (corresponding to the calculation execution procedure in the present invention) corresponding to the acquired homework number Q _i and a character string (for example, a number) ) and it is to generate a reply signal including an answer number a _i output (corresponding to the reply output procedure in the present invention). As a result, the monitoring device 20 that has acquired the answer signal sets the answer number A _i included in the answer signal based on the homework number Q _i output by the monitoring device 20 itself. by matching the referred to _i), judges correctness of answers number a _i. Then, if the monitoring device 20 determines that the control processing device 10 is in an estimated abnormal state where there is a possibility that a failure has occurred based on the result of the correctness / incorrectness determination, the monitoring device 20 restarts the electronic control system 1 and performs control. If it is determined that a failure has occurred in the processing apparatus 10 is a definite abnormality confirmation state, the operation of the control processing apparatus 10 is prohibited.

In addition to the homework number Q _i , the homework signal in the present embodiment includes a header portion for the control processing device 10 to identify the homework signal itself. Its header section, the current assignment number Q _i, homework update information indicating whether to update the assignment number Q _i outputted earlier contain at least. On the other hand, in addition to the answer number A _i , the answer signal includes a header part for the monitoring device 20 to identify the answer signal itself. The header portion includes at least answer update information indicating whether or not the answer number A _{i of} this time has been updated from the answer number A _i output previously.
<About the configuration of the monitoring device>
Next, the configuration of the monitoring device 20 will be described with reference to FIG.

The monitoring device 20 includes a assignment number counter 34 generates a count value cn be updated with predefined conditions are satisfied as assignment number Q _i, homework including assignment number Q _i generated by the assignment number counter 34 A serial communication unit 31 that generates and outputs a signal and obtains an answer signal from the control processing apparatus 10 for the output homework signal.

Further, the monitoring device 20 analyzes the answer signal acquired by the serial communication unit 31 and separates the answer number A _i included in the answer signal into the count value cn of the homework number counter 34. the correct number generator 36 for generating a correct number an, _i corresponding to the assignment number Q _i based, its generated by the correct answer number generator 36 the correct number an, _i, and separated by the reply signal analyzer 32 based on the response number a _i, answer number a _i is a right or wrong decision unit 33 determines whether the wrong answer or a correct answer.

At the same time, the monitoring device 20, answer number A _i for the same assignment number Q _i is, if wrong answer continuously specified number of times defined in advance, erroneous answer counter 37 which determines that an estimated abnormal state And an update measurement timer 38 for confirming an elapsed time since the reply number A _i from the control processing device 10 is updated, and a reset generation unit 39 for restarting the electronic control system 1.

  Of the “restarting the electronic control system 1”, the “restart” for the control processing device 10 is preferably restarted after the power supply to the control processing device 10 is cut off. On the other hand, the “restart” for the monitoring device 20 may be to return the monitoring device 20 to the initial state, or may be started again after the power supply to the monitoring device 20 is cut off.

  However, the serial communication unit 31, the response signal analysis unit 32, the correct / incorrect determination unit 33, the homework number counter 34, the correct answer number generation unit 36, the incorrect answer number counter 37, the update measurement timer 38, and the reset generation unit 39 that constitute the monitoring device 20. Are each constituted by at least one circuit element.

  Among these, the response signal analysis unit 32 outputs the response update signal rn that changes the signal state to the active state if the response signal from the serial communication unit 31 is different from the previous signal. The change of the answer update signal rn to the active state means that the answer update signal rn changes in a pulse shape by one clock every time a new answer signal different from the previous signal is acquired.

When the signal state of the answer update signal rn changes to an active state, the correctness / incorrectness determination unit 33 compares the answer number A _i with the answer number an _i to determine whether the answer number A _i is a correct answer. It is determined whether it is. If the answer number A _i is a correct answer as a result of the determination, the correct / incorrect determination unit 33 sets the signal state of the correct answer signal rs to an active state. If the answer number A _i is an incorrect answer, the correct answer signal es The signal state is made active. That is, only one of the signal states of the correct answer signal rs or the incorrect answer signal es output from the correct / incorrect determination unit 33 is in an active state.

  When the signal state of the wrong answer signal es is switched to an active state, the wrong answer number counter 37 increments the count value Tc of the wrong answer number counter 37 and the signal state of the correct answer signal rs is switched to an active state. Then, the count value Tc is returned to the initial value (here, “0”). Then, when the count value Tc is equal to or greater than a specified value Thc that is defined in advance as a value corresponding to the specified number of times (in this embodiment, the specified value Thc is “3”), It is determined that the state is a state, and the signal state of the abnormal signal gs is set to the active state. However, the signal state of the abnormal signal gs from the erroneous answer counter 37 is a passive state if the count value Tc is less than the specified value Thc.

  The update measurement timer 38 measures a time length until the signal state of the answer update signal rn changes to an active state, that is, a time length in which the signal state is passive, and if the time length is equal to or longer than a predetermined time, The signal state of the non-update signal ur is set to the active state.

  If the signal state of the abnormal signal gs or the no-update signal ur is in the active state, the reset generation unit 39 sets the time length measured by the update measurement timer 38 and the count value Tc of the erroneous answer counter 37 to the initial value. (In other words, the initialization signal in is returned to a time length of “0 [sec]” and a count value Tc of “0”). At the same time, the reset generation unit 39 outputs a reset signal re for restarting the electronic control system 1 if the signal state of the abnormal signal gs or the no-update signal ur is active.

However, those reset generator 39, answer number A _i for the same assignment number Q _i is, if a preset number of times (set number> specified value Thc) wrong answer continuously, an abnormal commit state And the output of the reset signal re is maintained. Thereby, the control processing apparatus 10 will be in the state where operation was prohibited.

When the signal state of the correct answer signal rs becomes active, the homework number counter 34 increments the count value cn of the homework number counter 34 (that is, the homework number Q _{i to be} output next) by one, and the error answer signal es If the signal state is active, the current count value cn is maintained.

The homework number counter 34 further includes a storage area 35 for storing information.
When the signal state of the abnormal signal gs or the non-update signal ur is switched to the active state, the storage area 35 of the present embodiment stores the count value cn at the time of switching.

  The storage area 35 may be a volatile memory or a non-volatile memory. When the storage area 35 is configured as a volatile memory, the storage contents 35 in which the count value cn is stored are stored even if the monitoring device 20 is restarted (or returned to the initial state). Is held.

  Therefore, when the reset signal re is output from the reset generation unit 39 and the electronic control system 1 is restarted, the value stored in the storage area 35 is set as the count value cn of the homework number counter 34.

  Note that the homework number counter 34 may not include the storage area 35. In this case, when the monitoring apparatus 20 is restarted (or returned to the initial state), the homework number counter 34 needs to be held so that the count value cn is held.

As described above, the monitoring device 20 of the electronic control system 1, if the answer number A _i is the correct answer from the control processor 10 to the assignment number Q _i, incrementing the count value Tc of the wrong answer counter 37 If the answer is incorrect, the count value Tc is incremented. Then, it becomes incorrect answer answer number A _i for the same assignment number Q _i is continuously, the count value Tc is the predefined predetermined value Thc above, it is determined that what is estimated abnormal state, the electronic control system 1 is restarted.

Thus, the monitoring device 20 after being determined to be in the estimated abnormal state and restarted (or returned to the initial state) outputs the output of the homework number Q _i before the restart. resume from homework number Q _i was. Then, if the wrong answer answer number A _i is the set number continuously to the same assignment number Q _i, and determines that an abnormal determined state, maintains the output of the reset signal re.
[Effect of the first embodiment]
As described above, according to the electronic control system 1 of the present embodiment, after the electronic control system 1 is restarted, the homework number Q _i to be re-output becomes a cause that is determined to be an estimated abnormal state last time. The homework number (ie, the assigned homework number).

In addition, according to the electronic control system 1, even if the answer number A _i from the control processing device 10 has not been answered for a predetermined time or more with respect to the homework number Q _i output from the monitoring device 20, It is determined that there is something. Therefore, according to the electronic control system 1, even when the electronic control system 1 is restarted due to such an estimated abnormal state, the output of the homework number Q _i is displayed as an unanswered homework number Q _You can resume from _i .

Thus, according to the electronic control system 1, it is possible to prevent the homework number Q _i from the initial value to the previous homework number from being output again after being restarted. Therefore, according to the electronic control system 1, it is possible to reduce the amount of processing required until the estimated abnormal state is determined again, and thus it is possible to reduce the length of time required to determine again the estimated abnormal state. Furthermore, it is possible to reduce the processing amount required to determine that the abnormality is confirmed.

In addition, since the monitoring apparatus 20 in this embodiment is comprised as a dedicated circuit specialized in monitoring the state of the control processing apparatus 10, compared with the case where the monitoring apparatus 20 is comprised using a general purpose computer. The manufacturing cost of the monitoring device 20 can be suppressed.
[Correspondence Relationship Between First Embodiment and Claims]
The correspondence between terms used in the present embodiment and terms used in the claims will be described.

The serial communication unit 31 in the monitoring device 20 of the present embodiment corresponds to homework output means of the present invention, and the answer signal analysis unit 32, the correct answer number generation unit 36, and the correctness / incorrectness determination unit 33 in the monitoring device 20 are included in the present invention. This corresponds to correctness determination means. Furthermore, the homework number counter 34 in the monitoring device 20 corresponds to the homework update means and number resetting means of the present invention, and the update measurement timer 38, the erroneous answer number counter 37, and the reset generation unit 39 in the monitoring device 20 It corresponds to the reset means of the invention. The reset generation unit 39 in the monitoring device 20 corresponds to the operation prohibiting unit of the present invention.
[Second Embodiment]
Next, a second embodiment of the present invention will be described with reference to FIG. 1 as in the first embodiment.

  The electronic control system 5 according to the present embodiment and the electronic control system 1 according to the first embodiment have the same configuration of the control processing device 10, but the configuration of the monitoring device 40 is different. For this reason, in this embodiment, each part which comprises the control processing apparatus 10 attaches | subjects the same code | symbol as 1st embodiment, abbreviate | omits description, and focuses on the structure of the monitoring apparatus 40 different from 1st embodiment. Explained.

  The electronic control system 5 of this embodiment includes a control processing device 10 and a monitoring device 40 that monitors the state of the control processing device 10 based on homework signals and answer signals transmitted and received between the control processing devices 10. ing.

  As shown in FIG. 3, the monitoring device 40 according to the present embodiment executes a processing program stored in the storage unit 42 and a storage unit 42 that stores processing programs and data, and occurs during the execution of the processing program. The control unit 45 having a register 46 for storing the information and a bus (not shown) for connecting them is mainly configured with a known microcomputer. The storage unit 42 in the present embodiment may be configured as a non-volatile storage device that can rewrite the storage content, or may be configured as a volatile storage device that can rewrite the storage content.

That is, the monitoring device 40 transmits a homework signal including the homework number Q _i , and based on the result of determining the correctness of the response number A _i included in the response signal from the control processing device 10 for the transmitted homework signal, A monitoring process for monitoring the state of the control processing device 10 is executed according to the processing program.
<About monitoring processing details>
Next, the processing procedure of the monitoring process executed by the monitoring device 40 will be described using the flowchart shown in FIG.

This monitoring process is started when electric power is supplied to the electronic control system 5, that is, the monitoring device 40 (in this embodiment, the ignition switch is turned on).
When the monitoring process is started, as shown in FIG. 4, first, it is confirmed whether or not each unit constituting the electronic control system 1 is normal. If there is an abnormality as a result of the confirmation, the electronic control is performed. An initial process for prohibiting the operation of the system 1 is executed (S110).

  Subsequently, it is determined whether or not the history information indicating the history of the result of monitoring the state of the control processing device 10 by the monitoring device 40 includes abnormal information indicating that the estimated abnormal state has been reached (S120). Note that the history information in the present embodiment includes at least the number of abnormal times Tc that represents the number of times that the estimated abnormal state has occurred continuously. In S120 of the present embodiment, if the number of abnormal times Tc is equal to or greater than a specified value Thc (in this embodiment, the specified value Thc is “3”), it is determined that abnormal information is included.

A result of the determination in the S120, if contains abnormal information in the history information (S120: NO), then sets the assignment number Q _i to be output to the initial value Q ₁ (S130). On the other hand, if the history information includes abnormality information (S120: YES), the homework number Q _i to be output next is set to the homework number Qi previously output from the monitoring device 40 (hereinafter referred to as the previous value) Q _i . (S140).

Subsequently, the number of abnormal times Tc is cleared to an initial value (here, “0”) (S150). Then, a homework signal including the set homework number Q _i is generated, and the generated homework signal is output to the control processing device 10 (S160). It is determined whether or not an answer signal for the output homework signal has been acquired (S170). If the answer signal is not acquired as a result of the determination (S170: NO), the process waits until an answer signal is acquired. When the answer signal is acquired (S170: YES), the answer number A _i included in the acquired answer signal is checked against the correct answer number an _i prepared in advance to determine whether the answer number A _i is correct (S180). .

As a result of the determination in S180, if the answer number A _i is a correct answer (S190: YES), the homework number Q _i that is output next is incremented in accordance with a pre-defined order from the previous value. _i is set (S200). Moreover, clear the abnormality frequency Tc and the initial value (S210), then returns to S160, and generates and outputs an assignment signal including assignment number Q _i set in S200. That is, in the monitoring process, if there is no abnormality such as a failure in the control processing device 10, a homework signal in which the homework numbers Q _i are sequentially updated in accordance with the prescribed order is transmitted, and monitoring of the control processing device 10 is repeated.

On the other hand, if the answer number A _i is an incorrect answer as a result of the determination in S180 (S190: NO), the number of abnormal times Tc is incremented by one (S220). Subsequently, it is determined whether or not the number of abnormal times Tc is equal to or greater than a specified value Thc (S230). If the number of abnormal times Tc is less than the prescribed value Thc as a result of the determination (S230: NO), the homework number Q _i to be output next is maintained (set) at the homework number Q _i (that is, the output value) output this time. (S240). Thereafter, the process returns to S160, and a homework signal including the homework number Q _i set in S240 is generated and output.

  As a result of the determination in S230, if the number of abnormal times Tc is equal to or greater than the specified value Thc (S230: YES), it is determined that the estimated abnormal state is present, and preparations for restarting the electronic control system 5 are executed After that, an abnormal process for outputting the reset signal re and restarting the electronic control system 5 is executed (S250).

  Of the “reactivation of the electronic control system 5” referred to in the present embodiment, the “reactivation” for the control processing device 10 is to restart after the power supply to the control processing device 10 is cut off. On the other hand, the “restart” for the monitoring device 40 may be to return the monitoring device 40 to the initial state, or may be started again after the power supply to the monitoring device 40 is cut off.

In the abnormality processing of this embodiment, as a preparation for restarting, a monitoring device is used for the register 46 in which the homework number Q _i and the number of abnormal times Tc included in the homework signal output in S160 of the current cycle are stored. Even if 40 is restarted (or returned to the initial state), a memory holding process for holding the memory contents is executed. Thereby, even if the power supply to the electronic control system 5 is interrupted, the values of the homework number Q _i and the number of abnormal times Tc are maintained.

  Thereafter, when the electronic control system 5 is restarted, the monitoring device 40 starts the monitoring process and executes each step from S110 again. When the “restart” for the monitoring device 40 is to return the monitoring device 40 to the initial state, the timing of starting the monitoring process after the second time is every time the monitoring device 40 is returned to the initial state. May be.

In the abnormality processing of the present embodiment, the determination of what is estimated abnormal state due to the answer number A _i for the same assignment number Q _i, if the consecutive predetermined number of times set in advance, the abnormality confirmation The state is determined to be in a state, and the output of the reset signal re is continuously held (that is, continued). This prohibits the control processing device 10 from operating.

That is, in the monitoring process of the present embodiment, if the answer number A _i from the control processing device 10 is a correct answer, the abnormality number Tc is maintained without being incremented, and if the answer number A _i is an incorrect answer, the number of abnormalities is maintained. Increment Tc. If the wrong answer to the same homework number Q _i continues and the number of abnormal times Tc becomes equal to or greater than the specified value Thc, it is determined as an estimated abnormal state, and the electronic control system 1 including the monitoring device 40 and the control processing device 10 is restarted. To do.

Note that the homework number Q _i from the monitoring device 40 of the present embodiment is normally output while changing from an initial value (i = 1) to a maximum value (i = max) in a predetermined order. However, when it is determined that the estimated abnormal state is detected and the system is restarted, the output is restarted from the previous value Q _i . Then, the monitoring device 40, if the wrong answer answer number A _i is the set number continuously to the same assignment number Q _i, and determines that an abnormal determined state, holds the output of the reset signal re.
[Effects of Second Embodiment]
As described above, according to the electronic control system 5 of the present embodiment, as in the electronic control system 1 of the first embodiment, the homework number Q _i from the initial value to the previous homework number is output again. Can be prevented. Thereby, according to the electronic control system 5, it is possible to reduce the amount of processing required to re-determine the estimated abnormal state, and to shorten the length of time required to re-determine the estimated abnormal state. . Furthermore, it is possible to reduce the processing amount required to determine that the abnormality is confirmed.

In particular, in the electronic control system 5 of the present embodiment, the monitoring device 40 is configured by a general-purpose macro computer, so that a processing procedure is added to the program or a processing procedure defined in the program is changed. Thus, the configuration of the monitoring device 40 can be easily changed.
[Correspondence between Second Embodiment and Claims]
The correspondence between terms used in the present embodiment and terms used in the claims will be described.

S160 in the monitoring process of the present embodiment corresponds to homework output means of the present invention, S180 in the monitoring process corresponds to correctness determination means of the present invention, and S190, S200, and S240 in the monitoring process correspond to the present invention. It corresponds to homework update means. Further, S230 and S250 in the monitoring process correspond to the reset unit of the present invention, and S140 in the monitoring process corresponds to the number resetting unit of the present invention. Note that S250 in the monitoring process also corresponds to the operation prohibiting means of the present invention.
[Other Embodiments]
As mentioned above, although embodiment of this invention was described, this invention is not limited to the said embodiment, In the range which does not deviate from the summary of this invention, it is possible to implement in various aspects.

  For example, the monitoring device 20 of the electronic control system 1 of the first embodiment is provided with a self-diagnosis unit that diagnoses the operating state of the monitoring device 20 itself before starting to output homework signals to the control processing device 10. It may be done. Such a self-diagnosis unit is preferably configured to output signals necessary for operation confirmation to each unit constituting the monitoring device 20.

  As a modification of the electronic control system 5 of the second embodiment, an electronic control system 50 shown in FIG. 5 can be considered. The electronic control system 50 is configured as, for example, a central processing unit including at least two processor cores 55A and 55B. One processor core 55A functions as the control processing device 10, and the other processor core 55B is a monitoring device. It is preferably configured to function as 40.

  However, the processor cores 55A and B in such an electronic control system 50 include storage units 56A and B that store processing programs, and control units 58A and B that read and decode the processing programs stored in the storage units 56A and 56B. In addition, it is necessary to include at least arithmetic units 59A and B that perform various arithmetic operations according to the processing program decoded by the control units 58A and B, and registers 57A and B that store information generated during the execution of the processing program.

Furthermore, the processor core 55B needs to execute the monitoring process described in the second embodiment. In this case, in the abnormal processing in the monitoring processing executed by the processor core 55B, even if the processor core 55B is restarted (or returned to the initial state) with respect to the register 57B in which the homework number Q _i and the number of abnormal times Tc are stored. A memory holding process for holding the memory contents needs to be executed.

  In the electronic control system 50, the storage units 56 </ b> A and B may not be provided in the processor cores 55 </ b> A and B, respectively, and one storage unit 56 may be provided in the electronic control system 50.

  Furthermore, as another modification example regarding the electronic control system 5 of the second embodiment, an electronic control system 80 shown in FIG. 6 can be considered. The electronic control system 80 includes, for example, at least two electronic control units (so-called ECUs (Electronic Control Units)) 60 and 70, and one electronic control unit 60 functions as the control processing device 10, and the other electronic control unit. 70 is preferably configured to function as the monitoring device 40.

  However, the electronic control units 60 and 70 in such an electronic control system 80 have storage units 62 and 72 that store processing programs and data, and processing that executes processing based on the processing programs stored in the storage units 62 and 72. It is necessary to include at least the parts 65 and 75 and a bus (not shown) for connecting them. And the process parts 65 and 75 are the control parts 63 and 73 which read and decode a process program, the calculation parts 64 and 74 which perform various calculations according to the process program decoded by the control parts 63 and 73, and the execution of a process program It is preferable to have registers 66 and 76 for holding information generated in the above. Note that the storage units 62 and 72 may be configured as a nonvolatile storage device capable of rewriting stored contents, or may be configured as a volatile storage device capable of rewriting stored contents.

Furthermore, the processing unit 75 needs to execute the monitoring process described in the second embodiment. In this case, in the abnormality process in the monitoring process executed by the processing unit 75, even if the electronic control unit 70 is restarted (or returned to the initial state) with respect to the register 76 in which the homework number Q _i and the abnormality number Tc are stored. It is necessary to execute a memory holding process for holding the memory contents.

  Thus, it is preferable that the electronic control units 60 and 70 that execute the monitoring process have a mode for monitoring the operation state, and the processing unit 75 executes the monitoring process after switching to the mode.

By the way, in the second embodiment, since the homework number Q re-outputted by the monitoring device 40 after the determination of the estimated abnormal state is set to the previous value Q _i , the homework number Q _i and the abnormal The storage holding process was executed for the register 46 in which the number of times Tc was stored. However, the method of setting the homework number Q re-outputted by the monitoring apparatus 40 after the determination of the estimated abnormal state as the previous value Q _i is not limited to this. For example, when the estimated abnormal state occurs, the homework number Q _i The abnormality count Tc may be stored in the storage unit 42.

In the monitoring process according to the second embodiment, it is determined that the answer number A _i from the control processing device 10 for the same homework number Q _i is an erroneous answer continuously over the specified value Thc (ie, S250). However, the condition for executing the abnormal process is not limited to this. For example, the condition that the answer number A _i from the control processing device 10 has not been answered for a predetermined time or more with respect to the homework number Q _i may be set as a condition for executing the abnormality process.

  DESCRIPTION OF SYMBOLS 1, 5, 50, 80 ... Electronic control system 10 ... Control processing apparatus 11 ... ROM 12 ... RAM 15 ... CPU 16 ... Control part 17 ... Calculation part 20 ... Monitoring apparatus 31 ... Serial communication part 32 ... Reply signal analysis part 33 ... Correct / incorrect determination unit 34 ... homework number counter 35 ... storage area 36 ... correct answer number generation unit 37 ... incorrect answer number counter 38 ... update measurement timer 39 ... reset generation unit 40 ... monitoring device 42 ... storage unit 45 ... control unit 46 ... register 55A , B ... processor core 56A, B ... storage unit 57A, B ... register 58A, B ... control unit 59A, B ... calculation unit 60, 70 ... electronic control unit 62, 72 ... storage unit 63, 73 ... control unit 64, 74 ... Calculation unit 65,75 ... Processing unit 66,76 ... Register

Claims (7)

When the homework number associated with the operation content is acquired in advance, the operation execution procedure for executing the operation corresponding to the acquired homework number, and the answer for generating and outputting the answer number indicating the operation result in the operation execution procedure A monitoring device that monitors the status of the control processing device based on the homework number and the answer number transmitted to and received from the control processing device that executes the output procedure,
Homework output means for outputting the set homework number;
Based on the answer prepared for the homework number output by the homework output means, correctness determination means for determining the correctness of the answer number from the control processing device,
As a result of the determination by the correctness determination means, if the answer number is a correct answer, the homework number is changed and set to a homework number different from that previously output according to a predetermined order, If the answer number is an incorrect answer, the homework update means for maintaining and setting the homework number to the homework number output earlier;
As a result of the determination by the correctness / incorrectness determination means, if the answer number for the same homework number is an estimated abnormal state that is an erroneous answer continuously for a predetermined number of times, the homework number corresponding to the incorrect answer is A reset unit that stores a stored content even when activated, and outputs a reset signal for restarting the control processing device and the monitoring device;
When the reset signal is output by the reset means and the control processing device and the monitoring device are restarted, the homework number stored in the storage unit is set, and the number is reset to be output to the homework output means And a monitoring device. The reset means includes
If the answer number corresponding to the homework number output by the homework output means is not acquired for a predetermined time or more after the homework number is output, the estimated abnormal state is assumed. The monitoring device according to claim 1, characterized in that: As a result of determination by the correct / incorrect determination means for each answer number to the same homework number, when the estimated abnormal state is continuously set a predetermined number of times, the operation of prohibiting the reset means from continuing to output the reset signal is prohibited. The monitoring apparatus according to claim 1, further comprising: means. The monitoring device according to any one of claims 1 to 3,
An electronic control system comprising the control processing device. The control processing device and the monitoring device are respectively
The electronic control system according to claim 4, wherein the electronic control system is a computer that executes processing according to a processing procedure defined in a program. The control processing device and the monitoring device are respectively
The electronic control system according to claim 4, wherein the processor cores are different from each other provided in one central processing unit. The control processing device and the monitoring device are respectively
The electronic control system according to claim 4, wherein the electronic control system is an electronic control unit that is mounted on an automobile and controls equipment provided in the automobile.

Images