JP5741550B2 - Control device and vehicle control system - Google Patents

Description

  The present invention relates to a control device and a vehicle control system.

  As a microcomputer (hereinafter referred to as “microcomputer”), two execution units (cores) perform the same processing at the same time, and the outputs of both execution units are compared by a comparator. One of these is output to the outside as an output signal, but if the two outputs do not match, the output signal is cut off (see, for example, Patent Document 1). This microcomputer is a microcomputer in which two cores operate in the lockstep mode.

Special table 2009-505182

  When the above microcomputer is used to carry out some control, the two cores perform the same control processing, and if an abnormality occurs in the processing result of either core, the output signal from the microcomputer Is interrupted, and the control itself is stopped. For this reason, although it is possible to prevent indefinite control from being performed, it is not possible to prohibit, for example, some functions as fail safe. That is, even if the safety by implementing fail-safe can be realized, the availability of enabling the control system to continue operating in the event of a failure cannot be realized.

  Therefore, an object of the present invention is to achieve both safety and availability when an abnormality occurs in a control function in a control device.

The control device of the present invention includes at least two processing devices that perform different processing independently according to a program.
One processing device of the two processing devices includes a first control function for performing a first control as a function realized by the first program.

  In addition, the other processing device of the two processing devices monitors whether the first control function by one processing device is normal or not as a function realized by the second program. Is determined to be abnormal, a first monitor function is provided that performs fail-safe that prohibits part of the first control from being performed.

  According to this control apparatus, when the first control function of one processing apparatus becomes abnormal, the other processing apparatus detects the abnormality and performs safety to ensure safety. Can do. Furthermore, the fail safe performed by the other processing device using the first monitoring function is a fail safe that prohibits a part of the control in the first control from being performed, and thus the control is continued while ensuring safety. be able to. Therefore, availability at the time of failure can also be realized.

Moreover, you may further provide the following additional structure.
That is, the other processing device, as a function realized by the third program, checks whether or not the first monitor function is normal and outputs inspection result information representing the inspection result to the outside of the processing device. If the control device determines that the first monitoring function is abnormal based on the inspection result information output by the first inspection function from the other processing device, the first inspection function is provided. It is the structure of providing the monitoring apparatus which performs the fail safe which prohibits that control of this is performed.

  According to this configuration, when an abnormality occurs in the first monitoring function of the other processing device and the first control function of the one processing device cannot be monitored correctly, this is monitored. Detected by the device, the monitoring device performs fail-safe prohibiting that the first control is performed. In addition, even if the first processing function by the other processing device or the other processing device itself is abnormal and the inspection result information is not correctly output from the other processing device to the monitoring device, the monitoring device It is determined that the monitor function 1 is abnormal, and the fail safe is performed.

  In other words, if an abnormality occurs in the processing device that monitors the control function, there is a possibility that abnormality monitoring and fail-safety by the processing device may not be possible, so control is performed by a monitoring device that is separate from the processing device. It prohibits itself.

  Therefore, when an abnormality occurs in the first control function, it is prohibited to perform a part of the control. When an abnormality occurs in the processing device that monitors the first control function, the first control function It becomes possible to perform step-by-step fail-safe according to the malfunctioning function or part, such as prohibiting the execution of control itself (that is, performing final fail-safe). For this reason, the safety and reliability of control can be improved while realizing availability.

In addition to the above-described additional configuration, the following configuration may be further provided.
In other words, the other processing device has a second control function for performing the second control as a function realized by the fourth program. When one processing apparatus monitors whether the second control function by the other processing apparatus is normal as a function realized by the fifth program, and determines that the second control function is abnormal. The second monitor function for performing fail-safe prohibiting the execution of a part of the control in the second control is provided, and the second monitor function is normal as a function realized by the sixth program. And a second inspection function for outputting inspection result information representing the inspection result to the outside of the processing apparatus. Further, when the monitoring device determines that the second monitor function is abnormal based on the inspection result information output from the one processing device by the second inspection function, the second control is performed. Prohibit fail-safe.

  According to this configuration, also in the second control, as in the effect described for the additional configuration, when an abnormality occurs in the second control function, it is prohibited to perform a part of the control, If an abnormality occurs in the processing device that monitors the second control function, step-by-step fail-safe corresponding to the function or part that has failed may be performed, such as prohibiting the execution of the second control itself. it can. Moreover, fail safe according to each of 1st control and 2nd control can be performed. Furthermore, since the first control function and the second control function are shared by different processing devices, the processing load on each processing device can be reduced.

  In addition, as a fail safe performed by the first monitor function (fail safe for prohibiting a part of the control in the first control from being performed), for example, a part of a plurality of control contents in the first control This includes not only prohibiting the execution of the operation but also limiting the movable range of the controlled object. This is because in the latter case, the control of moving the control target beyond a predetermined limit range (this corresponds to a part of the control) is prohibited. This also applies to fail safe performed by the second monitor function (fail safe that prohibits partial control in the second control).

It is a block diagram showing the structure of the electronic controller (ECU) of embodiment. It is a flowchart showing the process of an idle stop control monitor function and a torque control monitor function. It is a flowchart showing the process of an inspection function. It is a flowchart showing the process which the failure function discrimination | determination part of monitoring IC performs.

  Hereinafter, a control device according to an embodiment to which the present invention is applied will be described. The control device according to the present embodiment is an electronic control device (hereinafter referred to as an ECU) including a microcomputer. For example, a control of torque that is mounted on a vehicle and is output to the engine of the vehicle, and an idle stop control. I do.

  As shown in FIG. 1, the ECU 1 of the present embodiment includes a microcomputer 3, an input circuit 5 that inputs various information signals input from outside the ECU 1 to the microcomputer 3, and the microcomputer 3 via a serial communication line 6. Connected to the monitoring IC 7, a drive circuit (starter relay drive circuit) 11 for turning on the starter relay 9 in accordance with a control signal output from the microcomputer 3, and a drive for driving the throttle motor 13 in accordance with the control signal output from the microcomputer 3. A circuit (throttle motor drive circuit) 15.

  The starter relay 9 is a relay that, when turned on, energizes the starter 19 for starting the engine 17 and operates the starter 19. The throttle motor 13 is a motor that adjusts the opening of the throttle 21 that adjusts the amount of intake air to the engine 17. Then, the drive circuit 15 outputs a voltage commanded by a control signal (in this embodiment, for example, a PWM (pulse width modulation) signal, hereinafter also referred to as a throttle control signal) given from the microcomputer 3 to the drive circuit 15. By supplying to the throttle motor 13, the opening degree of the throttle 21 is set to an opening degree corresponding to the commanded voltage.

  The microcomputer 3 includes two processors 31 and 32 that perform different processes independently according to a program, a ROM 33 that stores a program executed by the processors 31 and 32, and a RAM 35 that stores a calculation result by the processors 31 and 32. And a communication circuit 37 for the processors 31 and 32 to communicate with the monitoring IC 7 via the serial communication line 6.

The ROM 33 as a storage medium stores at least first to sixth programs 41, 42, 43, 44, 45, and 46.
The processor 31 includes an idle stop control function 51 that performs idle stop control as a function realized by the first program 41. The function realized by the program is specifically a function realized by executing the program.

  Here, in the idle stop control, when it is determined that an automatic stop condition for automatically stopping the engine 17 is satisfied while the engine 17 is in operation, for example, an engine stop command is transmitted to another ECU that controls the engine 17. When it is determined that the automatic start condition for automatically restarting the engine 17 is satisfied, the starter relay 9 is turned on by outputting a control signal to the drive circuit 11 to turn on the starter 19. In addition to the basic control of starting the engine 17 by operating it, the control of starting the starter 19 according to the start operation by the driver (that is, control of the starter 19) is also included.

  As the automatic stop condition, for example, the brake pedal is depressed by the driver of the vehicle, the accelerator pedal is not depressed by the driver, and the vehicle speed is a predetermined value or less. There are other conditions. The automatic start condition is, for example, a condition that the driver releases the brake pedal or the driver performs another operation to drive the vehicle while the brake pedal is depressed. However, other conditions may be used.

  For this reason, from the input circuit 5 to the microcomputer 3, as input information signals used for idle stop control, for example, a brake signal indicating whether or not the brake pedal is operated, an accelerator signal indicating the amount of operation of the accelerator pedal, and the vehicle speed are input. A vehicle speed signal, a signal indicating the presence or absence of a start operation by the driver, and the like are input.

  On the other hand, the processor 32 includes an idle stop control monitor function 52 as a function realized by the second program 42, and an idle stop control monitor inspection function 53 as a function realized by the third program 43. Yes.

  The idle stop control monitor function 52 monitors whether the idle stop control function 51 by the processor 31 is normal, and determines that the idle stop control function 51 is abnormal. It is.

  The inspection function 53 of the idle stop control monitor is a function of inspecting whether the idle stop control monitor function 52 is normal and outputting inspection result information representing the inspection result to the communication circuit 37. The inspection result information output by the inspection function 53 of the idle stop control monitor includes identification information indicating that the inspection result information is output by the inspection function 53 (in this embodiment, idle stop control). And identification information indicating the idle stop control of the torque control).

Further, the processor 32 includes a torque control function 54 that performs torque control of the engine 17 as a function realized by the fourth program 44.
Here, in the torque control, for example, the target torque to be output to the engine 17 is calculated based on the engine speed (the speed of the engine 17), the operation amount of the accelerator pedal by the driver, and the target. In this control, a target opening of the throttle 21 for causing the engine 17 to output torque is calculated, and a control signal for realizing the target opening is output to the drive circuit 15.

  For this reason, from the input circuit 5 to the microcomputer 3, for example, a rotation signal indicating the engine speed, the aforementioned accelerator signal, or the like is input as a signal of input information used for torque control.

  Furthermore, the processor 31 includes a torque control monitor function 55 as a function realized by the fifth program 45, and a torque control monitor inspection function 56 as a function realized by the sixth program 46. .

  The torque control monitor function 55 is a function for monitoring whether the torque control function 54 by the processor 32 is normal and determining that the torque control function 54 is abnormal, and performing a predetermined fail-safe for torque control.

  The inspection function 56 of the torque control monitor is a function of inspecting whether or not the torque control monitor function 55 is normal and outputting inspection result information representing the inspection result to the communication circuit 37. Further, the inspection result information output by the inspection function 56 of the torque control monitor includes identification information indicating that the inspection result information is output by the inspection function 56 (in this embodiment, idle stop control and Of the torque control, identification information indicating the torque control) is added.

  The communication circuit 37 is, for example, a parallel / serial interface that converts parallel data into serial data and outputs the serial data to the serial communication line 6. The communication circuit 37 then outputs the inspection result information output from the processor 32 (that is, inspection result information output by the inspection function 53 of the idle stop control monitor) and the inspection result information output from the processor 31 (that is, torque). The inspection result information output by the inspection function 56 of the control monitor is transmitted to the monitoring IC 7 through the serial communication line 6 in the form of serial data.

The monitoring IC 7 includes a communication circuit 61 for serial communication with the microcomputer 3 (specifically, two processors 31 and 32), and a failure function determination unit 63.
The communication circuit 61 is data transmitted from the microcomputer 3, and outputs the above-described inspection result information with identification information to the failure function determination unit 63.

  Then, the failure function determination unit 63 uses the inspection function 53 or 56 to output the inspection result information input from the microcomputer 3 via the serial communication line 6 and the communication circuit 61 as the inspection result information. The identification is performed based on the added identification information.

  That is, the failure function determination unit 63 is the inspection result information output by the inspection function 53 as long as the identification result information indicating the idle stop control is added. Judge as information. Further, the failure function determination unit 63 is the inspection result information output by the inspection function 56 and the inspection result information related to the torque control monitor function 55 if it is inspection result information to which identification information indicating torque control is added. Judge that there is.

  Further, the failure function determination unit 63 determines that the idle stop control monitor function 52 is abnormal based on the inspection result information output by the inspection function 53 (that is, inspection result information to which identification information indicating idle stop control is added). If it is determined whether or not the idle stop control monitor function 52 is abnormal, a predetermined fail safe related to the idle stop control is performed.

  Further, the failure function determination unit 63 determines whether the torque control monitor function 55 is abnormal based on the inspection result information output by the inspection function 56 (that is, inspection result information to which identification information indicating torque control is added). If it is determined whether or not the torque control monitor function 55 is abnormal, a predetermined fail safe for torque control is performed.

Next, processing of the idle stop control monitor function 52 and the torque control monitor function 55 will be described using the flowchart of FIG.
In the following description, when the idle stop control monitor function 52 and the torque control monitor function 55 are not distinguished, they are referred to as “control monitor function”. Further, the “monitoring target control function” is a control function to be monitored by the control monitor function, and if it is the idle stop control monitoring function 52, the monitoring target control function is the idle stop control function 51, and the torque In the case of the control monitor function 55, the monitoring target control function is the torque control function 54.

The processing of the control monitor function shown in FIG. 2 is executed by the processors 31 and 32, for example, at regular intervals.
As shown in FIG. 2, in the control monitor function, each of the processors 31 and 32 first reads part or all of the input information used by the monitoring target control function (S110).

Next, the calculation result by the monitoring target control function is read from the RAM 35 (S120).
Next, a determination value for determining the validity of the calculation result read in S120 is calculated based on the input information read in S110 (S130).

Next, it is determined whether or not the monitoring target control function is normal by comparing the calculation result read in S120 with the determination value calculated in S130 (S140).
When it is determined that the monitoring target control function is normal (S140: YES), the process of the control monitor function is terminated as it is, but when it is determined that the monitoring target control function is not normal (S140: NO), the monitoring target It is determined that the control function is abnormal, and fail-safe is performed to prohibit the partial control of the monitoring target control function from being performed (S150). Thereafter, the process of the control monitor function ends. If it is determined in S140 that it is not normal two or more times, it may be determined that the monitoring target control function is abnormal, and failsafe may be performed in S150. Further, as fail-safe in S150, an abnormality notification process for notifying the vehicle user of the occurrence of abnormality (for example, turning on a warning lamp indicating the occurrence of abnormality or displaying a message) Processing).

  Here, for example, in the case of the idle stop control monitor function 52, in S110, as input information, information for determining whether or not the aforementioned automatic stop condition is satisfied (vehicle speed, brake pedal state, accelerator pedal state, etc.) In step S120, a determination result as to whether or not to automatically stop the engine 17 (hereinafter also referred to as idle stop) is read as a calculation result by the idle stop control function 51. In S130, a process for determining whether or not the automatic stop condition is satisfied is performed from the input information read in S110, and the determination result is set as a determination value. In S140, the determination value and the read in S120. It is determined whether or not the determination result of idle stop is theoretically consistent.

  That is, although the determination value is “the automatic stop condition is not satisfied”, the calculation result by the idle stop control function 51 is “execution of the idle stop”, or conversely, the determination value is “the automatic stop condition is satisfied”. However, if the calculation result by the idle stop control function 51 is “Idle stop is not performed”, it is determined that the idle stop control function 51 is not normal, and the process proceeds to S150.

  In S150, for example, a process for prohibiting idle stop by the idle stop control function 51 is performed as fail-safe. Specifically, for example, a process of cutting off a signal path for transmitting an engine stop command from the microcomputer 3 to another ECU that controls the engine 17 is performed. Even if the fail safe of S150 is performed, the control of the starter 19 in the idle stop control is not prohibited.

  As another example, for example, at S110, at least the vehicle speed is read as input information, and at S130, it is determined from the vehicle speed whether the idle stop should not be performed, and the determination result is In S140, if the calculation value by the idle stop control function 51 is "Idle stop execution" even though the determination value is "the situation where the idle stop should not be executed" in S140, the idle stop It may be determined that the control function 51 is not normal.

  On the other hand, for example, in the case of the torque control monitor function 55, in S110, information for calculating the torque to be output to the engine 17 (such as the engine speed and the amount of operation of the accelerator pedal) is read as input information. Thus, the target torque is read as a calculation result by the torque control function 54. In S130, the maximum value of the target torque that can be calculated when the torque control function 54 is normal from the input information read in S110 (or a value that is larger than the maximum value by a predetermined value) corresponds to the determination value. It is calculated as the allowable torque. In S140, the allowable torque is compared with the target torque read in S120. If the target torque is larger than the allowable torque, it is determined that the torque control function 54 is not normal, and the process proceeds to S150.

  In S150, for example, the maximum opening of the throttle 21 controlled by the torque control function 54 is set to a predetermined allowable opening (for example, the opening for the engine 17 to generate the allowable torque, or the allowable (A degree of opening for producing torque smaller than torque) is performed. Specifically, for example, in the microcomputer 3, the output duty ratio of the throttle control signal set in the internal register by the torque control function 54 (that is, the set value of the duty ratio of the throttle control signal output from the microcomputer 3 to the drive circuit 15) ) Is equal to or greater than the duty ratio corresponding to the allowable opening, the output duty ratio set in the internal register is rewritten to the duty ratio corresponding to the allowable opening. Further, instead of rewriting the output duty ratio set in the internal register, for example, the signal path of the throttle control signal from the microcomputer 3 to the drive circuit 15 is switched, and the duty corresponding to the allowable opening is given to the drive circuit 15. Another throttle control signal with a ratio may be provided. Even if the fail-safe operation of S150 is performed, the opening degree of the throttle 21 is controlled by the torque control function 54 as long as it is within the allowable opening degree. That is, control of the throttle 21 below the allowable opening is permitted.

  As another example, for example, in S130, instead of the allowable torque, a target torque is calculated by the same program as the torque control function 54 as a determination value. In S140, the calculated target torque and the target read in S120 are calculated. If the difference between the target torques is not zero or the difference is outside the predetermined range, it is determined that the torque control function 54 is not normal and the process proceeds to S150. it can.

  As another example, for example, in S110, input information for calculating the actual output torque of the engine 17 (for example, the engine speed, the amount of intake air to the engine 17, etc.) is also read as input information. In step S130, the actual output torque of the engine 17 is calculated based on the input information read in step S110, and in step S140, the calculated output torque and the allowable torque as the determination value are calculated. If the output torque is larger than the allowable torque by comparing with the allowable torque, it is possible to determine that the torque control function 54 is not normal and to proceed to S150.

Next, processing of the inspection function 53 of the idle stop control monitor and the inspection function 56 of the torque control monitor will be described using the flowchart of FIG.
In the following description, when the inspection function 53 of the idle stop control monitor and the inspection function 56 of the torque control monitor are not particularly distinguished, they are referred to as “inspection function”. Further, the “inspection target function” is a control monitor function to be inspected by the inspection function. If the inspection function 53 of the idle stop control monitor is used, the inspection target function is the idle stop control monitor function 52. In the case of the inspection function 56 of the torque control monitor, the inspection target function is the torque control monitor function 55.

The processing of the inspection function shown in FIG. 3 is executed by the processors 31 and 32, for example, at regular intervals.
As shown in FIG. 3, in the inspection function, each of the processors 31 and 32 first performs processing of a program that realizes the inspection target function using dummy input information that is not real input information (S210).

  In the present embodiment, for example, among the processing of FIG. 2 which is the processing of the program realizing the inspection target function, the processing of S120 to S140 is stored in the ROM 33 in advance instead of the input information read in S110 of FIG. Execute using dummy input information. As will be described later, a plurality of types of dummy input information are prepared, and different dummy input information is used each time the inspection function is processed.

  Next, in S220, whether or not the determination result in S140 is “normal” when the process in S210 to S140 in FIG. 2 is performed using dummy input information (ie, S140). Whether or not “YES” is determined in step).

  If it is determined in S220 that the determination result is “normal”, information indicating “normal” is output to the communication circuit 37 as the inspection result information of the inspection target function (S230). When it is determined that the determination result is not “normal”, information indicating “abnormal” is output to the communication circuit 37 as the inspection result information of the inspection target function (S240). Thereafter, the processing of the inspection function is terminated.

  In each of S230 and S240, as described above, if the inspection function 53 of the idle stop control monitor is used, identification information indicating idle stop control is added to the “normal” or “abnormal” inspection result information to be output. If the inspection function 56 of the torque control monitor is used, identification information indicating torque control is added to the “normal” or “abnormal” inspection result information to be output.

  Further, as the dummy input information, if the program and the processor (31 or 32) are normal, it is determined to be “YES” in S220 (in other words, “YES” is determined in S140 of FIG. 2). If the dummy input information expected to be normal and the program and the processor (31 or 32) are normal, it is determined as “NO” in S220 (in other words, “NO” is determined in S140 of FIG. 2). The expected dummy input information for abnormality determination is prepared in the ROM 33 in advance.

  In the present embodiment, the pattern of the inspection result information output by the inspection function is, for example, ““ normal ”→“ normal ”→“ abnormal ”→ normal” → “normal” → “abnormal” ” Dummy input information used in the inspection function is selected so as to obtain a predetermined specific pattern.

  Therefore, if the pattern of the inspection result information output by the inspection function is a specific pattern, the inspection target function of the inspection function is normal, and conversely, the pattern of the inspection result information output by the inspection function is If it is not a specific pattern, it means that the inspection target function of the inspection function is not normal. In addition, what is necessary is just to select suitably the process made into a test object in test | inspecting a test object function from the process of a test object function.

Next, processing performed by the failure function determination unit 63 of the monitoring IC 7 will be described with reference to FIG.
First, as described above, the failure function determination unit 63 determines whether the inspection result information input via the serial communication line 6 and the communication circuit 61 is output by the inspection function 53 or 56 in the microcomputer 3. The identification is performed based on the identification information added to the inspection result information.

And the failure function discrimination | determination part 63 performs the process shown in FIG. 4 for every fixed time for each of the test | inspection functions 53 and 56, for example.
As shown in FIG. 4, the failure function determination unit 63 determines whether or not the inspection result information output by the counterpart inspection function changes in the specific pattern (S310).

  If it is determined that the inspection result information changes in a specific pattern (S310: YES), it is determined that the control monitor function to be inspected by the inspection function of the other party is normal (S320), and the process ends. To do.

  If it is determined that the inspection result information does not change in a specific pattern (S310: NO), it is temporarily determined that the control monitor function that is the inspection target of the counterpart inspection function is abnormal (S330). If the provisional determination state of abnormality is not continued for a predetermined period (S340: NO), the process is terminated as it is.

  On the other hand, if the temporary determination state of abnormality continues for a predetermined period (S340: YES), it is determined that the control monitor function that is the inspection target of the counterpart inspection function is abnormal, and the idle stop control and torque Among the controls, fail-safe related to the control corresponding to the inspection function of the other party is performed (S350).

Here, the fail safe performed by the failure function determination unit 63 in S350 of FIG. 4 will be specifically described.
First, if the other party's inspection function is the inspection function 53, the failure function determination unit 63 determines that the idle stop control monitor function 52 is abnormal, and sets the drive circuit 11 from the microcomputer 3 as fail-safe related to idle stop control. A process for prohibiting the starter relay 9 from being turned on by the control signal is performed. For example, in the present embodiment, when the drive circuit 11 receives the drive prohibition signal, the drive circuit 11 keeps the starter relay 9 turned off regardless of the control signal from the microcomputer 3. By outputting the drive inhibition signal to the drive circuit 11, the starter relay 9 is inhibited from being turned on.

  If the starter relay 9 is prohibited from being turned on and the idling stop is performed, the engine 17 cannot be restarted after that, so the failure function determination unit 63 performs fail-safe related to the idling stop control. In addition, processing for prohibiting idle stop is also performed. As the prohibition process, for example, the idle stop control monitor function 52 performs the same process as the fail-safe process performed in S150 of FIG.

  That is, if the malfunction function determination unit 63 determines that the idle stop control monitor function 52 is abnormal based on the inspection result information from the inspection function 53, the idle stop control function by the idle stop control monitor function 52 is determined. Since there is no guarantee that the monitoring and fail safe of 51 are correctly performed, it is prohibited to perform all of the control (idle stop control including control of the starter 19) performed by the idle stop control function 51. And by such a measure, it is avoided that cranking of the engine 17 etc. which are not intended by the idle stop control function 51 will be implemented.

  When the failure function determination unit 63 determines that the idle stop control monitor function 52 is abnormal, it is possible that the inspection function 53 is abnormal or the processor 32 itself is abnormal. However, in any case, since the processor 32 cannot correctly monitor the idle stop control function 51 on the processor 31 side, safety is ensured by prohibiting the idle stop control from being performed.

  Further, if the other party's inspection function is the inspection function 56, the failure function determination unit 63 determines that the torque control monitor function 55 is abnormal, and sets the failure control related to torque control from the microcomputer 3 to the drive circuit 15. A process of prohibiting the opening degree of the throttle 21 from being controlled by the throttle control signal is performed. For example, in the present embodiment, when the drive circuit 15 receives the control prohibition signal, the drive circuit 15 stops the voltage supply to the throttle motor 13 regardless of the throttle control signal from the microcomputer 3. Outputs the control inhibition signal to the drive circuit 15 to inhibit electrical control of the opening degree of the throttle 21. When the electric control of the throttle 21 is prohibited, the opening degree of the throttle 21 is maintained at an opening degree at which the engine 17 can be in an idle operation state, or the driver's It can be adjusted within a predetermined range according to the accelerator pedal operation. For this reason, even if electrical control of the throttle 21 is prohibited, the vehicle can travel at a minimum.

  That is, if the failure function determination unit 63 determines that the torque control monitor function 55 is abnormal based on the inspection result information from the inspection function 56, the torque control monitor function 55 monitors the torque control function 54. In addition, since there is no guarantee that the fail safe is correctly performed, it is prohibited to perform all of the torque control performed by the torque control function 54. Such a measure prevents the torque control function 54 from unintentionally increasing the output torque of the engine 17.

  When the failure function determination unit 63 determines that the torque control monitor function 55 is abnormal, it is possible that the inspection function 56 is abnormal or the processor 31 itself is abnormal. However, in any case, since the processor 31 cannot correctly monitor the torque control function 54 on the processor 32 side, safety is ensured by prohibiting the torque control from being performed.

Then, after performing the fail safe as described above, the failure function determination unit 63 ends the process.
In the ECU 1 as described above, each of the processors 31 and 32 of the microcomputer 3 has a control function, and also has a control monitor function for performing fail-safe by monitoring the control function of the processor different from itself.

  For this reason, when the control function of one of the processors 31 and 32 becomes abnormal, the other processor detects the abnormality by the control monitor function and performs fail-safe (S150). Safety can be ensured. The fail safe performed by the processors 21 and 32 using the control monitor function is a fail safe that prohibits a part of the control performed by the monitoring target control function from being performed, and thus ensures safety. Control can be continued. Therefore, availability at the time of failure can also be realized.

Further, each of the processors 31 and 32 has an inspection function for inspecting a control monitor function provided therein and outputting inspection result information representing the inspection result to the monitoring IC 7.
When the monitoring IC 7 determines that the idle stop control monitor function 52 of the processor 32 is abnormal based on the inspection result information output from the processor 32 by the inspection function 53, the monitoring IC 7 monitors the idle stop control monitor function 52. The idle stop control by the processor 31 being performed is prohibited (S350). Similarly, when the monitoring IC 7 determines that the torque control monitor function 55 of the processor 31 is abnormal based on the inspection result information output from the processor 31 by the inspection function 56, the monitoring IC 7 is monitored by the torque control monitor function 55. The torque control by the processor 32 is prohibited (S350).

  For this reason, when an abnormality occurs in one of the processors 31 and 32 and an abnormality cannot be monitored for the control function of the other processor, the monitoring IC 7 prohibits the execution of control by the other processor.

  Therefore, according to the ECU 1 of the present embodiment, when an abnormality occurs in the idle stop control function 51 in the processor 31, it is prohibited to perform a part of the control in the idle stop control, and the idle stop control function 51 When an abnormality occurs in the processor 32 that monitors the idle stop control, the step-by-step fail safe can be performed for the idle stop control, such as prohibiting the execution of the idle stop control itself. Similarly, when an abnormality occurs in the torque control function 54 in the processor 32, it is prohibited to perform a part of the control in the torque control, and an abnormality occurs in the processor 31 that monitors the torque control function 54. Thus, step-by-step fail-safe can be performed for torque control, such as prohibiting execution of torque control itself. Therefore, the safety and reliability of control can be improved while realizing availability.

  Further, fail-safe according to each of the idle stop control and the torque control can be performed. In addition, since the idle stop control function 51 and the torque control function 54 are shared by the separate processors 31 and 32, the processing load on each of the processors 31 and 32 can be reduced.

  Further, identification information indicating which inspection result information is output by the inspection function 53 or 56 is added to the inspection result information output from the microcomputer 3 to the monitoring IC 7 by each inspection function 53 or 56. Is done. The inspection result information output by the inspection functions 53 and 56 is input to the monitoring IC 7 by the communication circuit 37 via the common serial communication line 6, and the monitoring IC 7 is input via the serial communication line 6. Based on the identification information, the inspection result information output by the inspection function 53 or 56 is identified. For this reason, the number of wiring lines for communication between the microcomputer 3 and the monitoring IC 7 can be reduced.

  Further, the idle stop control and the torque control performed by the processors 31 and 32 are each of the two controls in the vehicle control system, so that a vehicle control system with high safety and reliability can be constructed. That is, if the ECU 1 of the present embodiment is used as a control device that performs control in the vehicle control system (in the example of the present embodiment, idle stop control and torque control), the vehicle control system is highly safe and reliable. Can be built.

  As mentioned above, although one Embodiment of this invention was described, this invention is not limited to such Embodiment at all, Of course, in the range which does not deviate from the summary of this invention, it can implement in a various aspect. .

An example of a modification will be described below. The following modifications can be combined as appropriate.
For example, the torque control function 54 may be deleted from the processor 32, and the torque control monitor function 55 and the torque control monitor inspection function 56 may be deleted from the processor 31. Conversely, the idle stop control function 51 may be deleted from the processor 31, and the idle stop control monitor function 52 and the idle stop control monitor inspection function 53 may be deleted from the processor 32.

Moreover, the structure which is not equipped with the test | inspection functions 53 and 56 and monitoring IC7 can also be taken.
Further, both the idle stop control function 51 and the torque control function 54 are provided in one of the processors 31 and 32, and the other of the processors 31 and 32 has an idle stop control monitor function 52 and an idle stop control monitor. The inspection function 53, the torque control monitor function 55, and the torque control monitor inspection function 56 may be provided.

Further, the idle stop control and the torque control are merely examples of the control contents, and the control to be performed may be other controls.
Further, the processors 31 and 32 as processing devices are not limited to single core processors, and may be, for example, dual core processors performing a lockstep operation. In the latter case, the reliability can be further improved.

  Further, the number of processing devices (processors in the microcomputer 3 in the above embodiment) may be three or more. In addition, the plurality of processing devices may be separate microcomputers or separate units including the microcomputers.

Further, data communication between the processors 31 and 32 of the microcomputer 3 and the monitoring IC 7 is not limited to serial data communication, and may be parallel data communication, for example.
As the monitoring device, for example, a microcomputer or other unit that plays the same role as the monitoring IC 7 may be used instead of the monitoring IC 7.

  DESCRIPTION OF SYMBOLS 1 ... ECU (electronic control apparatus), 3 ... Microcomputer, 6 ... Serial communication line, 7 ... Monitoring IC, 31, 32 ... Processor, 33 ... ROM, 37 ... Communication circuit, 41-46 ... 1st-6th program 51 ... Idle stop control function, 52 ... Idle stop control monitor function, 53 ... Idle stop control monitor inspection function, 54 ... Torque control function, 55 ... Torque control monitor function, 56 ... Torque control monitor inspection function

Claims (5)

Comprising at least two processing devices (31, 32) for performing different processing independently according to a program;
One of the two processing devices (31) is
As a function realized by the first program (41), a first control function (51) for performing the first control is provided,
The other processing device (32) of the two processing devices is:
As a function realized by the second program (42), whether or not the first control function by the one processing device is normal is determined, and if it is determined that the first control function is abnormal, Rutotomoni comprising a first monitor function for fail-safe to prohibit that some control is performed (52) in the first control,
As a function realized by the third program (43), the first monitor function checks whether the first monitor function is normal and outputs test result information representing the test result to the outside of the processing apparatus. It has an inspection function (53),
Further, the other processing device is
As a function realized by the fourth program (44), a second control function (54) for performing the second control is provided,
The one processing apparatus is
As a function realized by the fifth program (45), whether or not the second control function by the other processing device is normal is determined, and if it is determined that the second control function is abnormal, A second monitor function (55) for performing fail-safe prohibiting that a part of the control in the second control is performed is provided.
As a function realized by the sixth program (46), the second monitor function checks whether or not the second monitor function is normal, and outputs test result information representing the test result to the outside of the processing apparatus. It has an inspection function (56),
The control device
If it is determined that the first monitor function is abnormal based on the inspection result information output from the other processing device by the first inspection function, the first control is prohibited. When fail-safe is performed and it is determined that the second monitor function is abnormal based on the inspection result information output from the one processing device by the second inspection function, the second control is performed. Equipped with a fail-safe monitoring device (7) that prohibits
Moreover, the first control and the second control are independent controls,
A control device (1) characterized by The control device according to claim 1 ,
Identification information indicating that the inspection result information is output by the first inspection function is added to the inspection result information output by the first inspection function,
Identification information indicating that the inspection result information is output by the second inspection function is added to the inspection result information output by the second inspection function,
A communication circuit for transmitting the inspection result information output by the first inspection function and the inspection result information output by the second inspection function to the monitoring device via a serial communication line (6). (37)
The monitoring device identifies, based on the identification information, whether the inspection result information input via the serial communication line is output by the first inspection function or the second inspection function. To do,
A control device characterized by. In the control device according to claim 1 or 2 ,
The first control and the second control are each of two controls in a vehicle control system;
A control device characterized by. The control device according to claim 3,
  The first control is idle stop control of the vehicle,
  The second control is torque control of the engine of the vehicle;
  A control device characterized by. The vehicle control system provided with the control apparatus of any one of Claim 1 thru | or 4 as a control apparatus which implements control in the control system of a vehicle.

Images