JP6839212B2 - Electronic control device - Google Patents

Description

The present invention relates to an electronic control device.

As a background technique, for example, there is Patent Document 1. In Patent Document 1, the monitoring function of the monitoring circuit is diagnosed by using two methods. In the first method, by stopping the pulse signal output from the microcomputer to the monitoring circuit, a process of confirming whether or not the reset signal is output after a lapse of a certain period of time is performed. In the second method, the microcomputer intentionally gives an erroneous answer to the example given to the microcomputer from the monitoring circuit, so that a confirmation process is performed to confirm whether or not a reset signal is output. The two methods cannot be performed at the same time, and only one of them is diagnosed alternately. In addition, these diagnoses are performed only during the self-shut-off period immediately after the engine stop operation by the driver.

Japanese Unexamined Patent Publication No. 2002-099321

In the technique disclosed in Patent Document 1, since the microcomputer is reset, it is not possible to confirm the time from when the microcomputer goes into an abnormal state until the reset signal is output. Further, if the microcomputer is reset, the control target stops functioning, so that the monitoring function can be diagnosed only during the self-shut-off period immediately after the engine stop operation by the driver.

Therefore, in view of such circumstances, the present specification discloses an electronic control device capable of diagnosing whether or not the monitoring function of the monitoring IC is operating normally even when the controlled object is in normal operation.

For example, in order to solve the above problems, the configuration described in the claims is adopted. The present application includes a plurality of means for solving the above problems. For example, an MPU for controlling an external device, a monitoring IC for monitoring the MPU, and a reset unit for resetting the MPU. The monitoring IC includes an NG counter that changes when there is an abnormality in communication with the MPU, and the MPU monitors the value of the NG counter. An electronic control device is provided that diagnoses the time from when the MPU becomes abnormal to when it is reset.

According to the present invention, it is possible to diagnose whether the monitoring function of the monitoring IC is operating normally even when the controlled object is in normal operation. Further features relating to the present invention will become apparent from the description herein and the accompanying drawings. In addition, problems, configurations, and effects other than those described above will be clarified by the following description of the embodiments.

It is a block diagram of the electronic control device in 1st Embodiment. It is a timing chart of the electronic control device in 1st Embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. The accompanying drawings show specific embodiments in accordance with the principles of the present invention, but these are for the purpose of understanding the present invention and are by no means used for a limited interpretation of the present invention. ..

The following discloses an embodiment in which the MPU monitors the value of the NG counter of the monitoring IC and measures the time until immediately before the MPU is reset. According to this configuration, it is also possible to diagnose that the MPU is reset within a predetermined time after the abnormal state is established, without resetting the MPU during the normal operation of the controlled object. ..

[First Embodiment]
FIG. 1 shows a configuration diagram of an electronic control device according to the first embodiment. The electronic control device 10 is, for example, an electronic control device for a vehicle. The electronic control device 10 includes an MPU 20 that controls an external device (controlled object), a monitoring IC 30 that monitors the MPU 20, and a reset output unit 40 that resets the MPU 20.

The MPU 20 includes a monitoring function diagnostic circuit 21 and a clock circuit 24. The monitoring function diagnostic circuit 21 includes a reset time diagnostic circuit 22 and an example answer function 23. The reset time diagnostic circuit 22 includes a diagnostic flag. The diagnostic flag is a flag for transitioning the MPU 20 to an abnormal state. Hereinafter, it is assumed that the first value of the diagnostic flag corresponds to the normal state and the second value of the diagnostic flag corresponds to the abnormal state.

The monitoring IC 30 includes an MPU monitoring circuit 31. The MPU monitoring circuit 31 includes an example calculation monitoring function 32 and an NG counter 33. Example The calculation monitoring function 32 includes a window watchdog timer (window WDT). The window WDT has a function of outputting a reset when the output from the MPU 20 is too long or too short than a normal cycle. With this function, the example calculation monitoring function 32 can transmit a reset signal to the MPU 20 via the reset output unit 40.

Next, the flow of the process of diagnosing the monitoring function of the monitoring IC 30 will be described. The monitoring function diagnostic circuit 21 of the MPU 20 transmits an example seed request to the monitoring IC 30. When the MPU monitoring circuit 31 receives the seed request, the example calculation monitoring function 32 processes the seed request.

The example calculation monitoring function 32 determines whether the reception timing is within the predetermined time T1 (see FIG. 2). Example The calculation monitoring function 32 changes the value of the NG counter 33 when the reception timing is not within the predetermined time T1. On the other hand, when the reception timing is within the predetermined time T1, the example calculation monitoring function 32 gives an example to the MPU 20 without changing the value of the NG counter 33. At this time, the example calculation monitoring function 32 transmits the value of the NG counter 33 to the MPU 20 together with the example.

The reset time diagnostic circuit 22 receives the value of the NG counter 33. The reset time diagnostic circuit 22 monitors the value of the NG counter 33. The reset time diagnostic circuit 22 changes the value of the diagnostic flag based on the value of the NG counter 33 and the elapsed time. The example answer function 23 receives an example. The example answer function 23 performs an example calculation and transmits an example answer to the monitoring IC 30. The example answer function 23 normally communicates with the monitoring IC 30 when the value of the diagnostic flag is the first value, and communicates normally with the monitoring IC 30 when the value of the diagnostic flag is the second value. Performs abnormal communication.

The example calculation monitoring function 32 determines whether the reception timing of the answer of the example is within the predetermined time T1 and whether the answer of the example is correct, as in the case of the seed request. The example calculation monitoring function 32 changes the value of the NG counter 33 when the reception timing is not within the predetermined time T1 or when the answer of the example is incorrect.

As described above, when receiving the communication from the MPU 20, the monitoring IC 30 always determines whether the reception timing is within the predetermined time T1 and determines whether or not the value of the NG counter 33 is changed. Further, when the communication from the MPU 20 is the answer of the example, the monitoring IC 30 determines whether the reception timing is within T1 for a predetermined time and whether the answer of the example is correct, and sets the value of the NG counter 33. Decide whether to fluctuate.

When the example calculation monitoring function 32 receives the answer of the example, it inquires whether the answer of the example is correct. The example calculation monitoring function 32 does not fluctuate the value of the NG counter 33 (maintains a normal value) when the answer of the example is correct, or is a normal value when the value of the NG counter 33 is different from the normal value. Get closer to. On the other hand, the example calculation monitoring function 32 keeps the value of the NG counter 33 away from the normal value (variates in a direction out of the predetermined range) when the answer of the example is incorrect.

As described above, the seed request of the example, the question and the answer of the example are repeatedly executed. During the iterative process, the reset time diagnostic circuit 22 changes the value of the diagnostic flag based on the value of the NG counter 33 and the elapsed time. Further, when the value of the NG counter 33 fluctuates outside the predetermined range during the iterative processing, the example calculation monitoring function 32 notifies the reset output unit 40, and the reset output unit 40 resets the MPU 20. Send a signal. When the MPU 20 receives the reset signal, the MPU 20 determines that it is abnormal, and the electronic control device 10 shifts the controlled object to a safe state.

FIG. 2 is a timing chart of the electronic control device 10 according to the first embodiment. In FIG. 2, the solid line shows the communication from the monitoring IC 30 to the MPU 20, and the broken line shows the communication from the MPU 20 to the monitoring IC 30. The characters on the left side of the broken line indicate the result of diagnosing the answer of the example by the example calculation monitoring function 32 of the monitoring IC 30.

The value of the NG counter 33 is updated at the timing of communication from the MPU 20 to the monitoring IC 30. In this example, the value of the NG counter 33 is "0" for the normal value and "5" for the abnormal value. The value of the abnormal value is preferably 2 or more in consideration of the case where a communication abnormality occurs due to noise or the like. This example is only one embodiment, and the setting of the normal value and the abnormal value of the NG counter 33 can be changed. In addition, the amount of fluctuation per count and the direction of fluctuation of the up or down count can be changed.

Before T2, the electronic control device 10 is operating normally, and the value of the NG counter 33 is maintained at the normal value "0". When the specified time has passed while the NG counter 33 is maintained at the normal value "0", the reset time diagnostic circuit 22 raises the diagnostic flag (change from the first value to the second value) to diagnose the reset time. The circuit 22 sends a command to the example answer function 23 to intentionally perform an abnormal operation. In the example of FIG. 2, at the time of T2, the reset time diagnostic circuit 22 raises the diagnostic flag.

When this diagnostic flag is raised, the example answer function 23 always sends an incorrect example answer to the monitoring IC 30, or sends an example answer to the monitoring IC 30 at a timing outside the predetermined time T1. Send. The example calculation monitoring function 32 counts up the value of the NG counter 33 at the timing of receiving the answer from the example answer function 23. In the example of FIG. 2, from T2 to T3, the example calculation monitoring function 32 counts up the value of the NG counter 33.

The state in which the diagnostic flag of the reset time diagnostic circuit 22 is raised continues until the value of the NG counter 33 becomes “4”. The value "4" of the NG counter 33 is a value immediately before the value "4" becomes an abnormal value "5" when the NG counter 33 is counted up once more and is out of the predetermined range. The reset time diagnosis circuit 22 keeps the state in which the diagnosis flag is raised until the time T3 when the value of the NG counter 33 becomes "4". Then, the reset time diagnostic circuit 22 lowers the diagnostic flag at the time of T3 (that is, when the value "4" of the NG counter 33 is received from the monitoring IC 30) (change from the second value to the first value). ). At this time, the reset time diagnosis circuit 22 cancels the instruction of the abnormal operation to the example answer function 23. As a result, the example answer function 23 transmits the correct answer of the example to the monitoring IC 30 at a timing within the predetermined time T1.

Here, the monitoring function diagnostic circuit 21 measures the time from the rising point T2 of the diagnostic flag of the reset time diagnostic circuit 22 to the falling point T3 by the clock from the clock circuit 24. As a result, the monitoring function diagnosis circuit 21 diagnoses whether the time from when the MPU 20 becomes abnormal to when it is reset is within a predetermined time. That is, in the present embodiment, the time until the MPU 20 intentionally puts the communication with the monitoring IC 30 into an abnormal state and the value of the NG counter 33 deviates from the predetermined range is measured by the internal clock circuit 24 of the MPU 20. The time immediately before the value of the NG counter 33 deviates from the predetermined range can be regarded as the time from when the MPU 20 becomes abnormal to when it is reset. The reset time diagnostic circuit 22 determines whether the time from the abnormal state to the reset is within a predetermined time (for example, 200 ms), and the monitoring function of the monitoring IC 30 operates normally. Diagnose. According to this configuration, it can be guaranteed that the MPU 20 is reset within, for example, 200 ms after it becomes abnormal.

In FIG. 2, T3 to T4 indicate the time during which the electronic control device 10 is operating normally again. From T3 to T4, the example answer function 23 transmits the correct answer of the example to the MPU 30 at a timing within the predetermined time T1. The example calculation monitoring function 32 counts down the value of the NG counter 33 in the direction approaching the normal value “0” at the timing of receiving the answer.

In the present embodiment, the value of the NG counter 33 is not changed to the normal value "0" immediately after the diagnostic flag is lowered, and the countdown is performed in the direction approaching the normal value "0". This configuration has the following advantages: For example, when the MPU 30 is in a true abnormal state between T2 and T3 instead of a temporary abnormal state due to the diagnostic flag, the value of the NG counter 33 is set to the normal value "0" immediately after the diagnostic flag is lowered. When changed to, it takes time for the NG counter 33 to reach the abnormal value “5”. On the other hand, in the case of the configuration of the present embodiment, the value of the NG counter 33 becomes an abnormal value "5" immediately after passing T3, and the MPU 20 can be reset. Further, even if the MPU 30 goes into an abnormal state while the value of the NG counter 33 is approaching the normal value "0", the value of the NG counter 33 immediately becomes the abnormal value "5" and the MPU 20 can be reset. it can. Therefore, the abnormal state of the MPU 20 can be detected earlier and the MPU 20 can be reset.

In FIG. 2, T4 indicates the time when the MPU 20 is in an abnormal state. If the MPU 20 becomes abnormal, the example answer function 23 may not be able to send the answer of the example at a timing within the predetermined time T1, or may not be able to send the correct answer of the example to the MPU 30. Therefore, the example calculation monitoring function 32 counts up the value of the NG counter 33.

In FIG. 2, at the time of T5, the value of the NG counter 33 becomes an abnormal value “5” due to the count-up of the example calculation monitoring function 32. When the value of the NG counter 33 becomes an abnormal value "5", the example calculation monitoring function 32 notifies the reset output unit 40, and the reset output unit 40 transmits a reset signal to the MPU 20. When the MPU 20 receives the reset signal, the MPU 20 determines that it is abnormal, and the electronic control device 10 shifts the controlled object to a safe state.

According to the above embodiment, as a means for diagnosing the time from when the MPU 20 becomes abnormal to when the MPU 20 is reset, the value of the NG counter 33 inside the monitoring IC 30 exceeds the specified time and is a normal value. In some cases, the MPU 20 deliberately puts the communication with the monitoring IC 30 into an abnormal state. Then, the MPU 20 measures the time immediately before the value of the NG counter 33 deviates from the predetermined range (that is, the time immediately before the MPU 20 becomes abnormal and is reset) by the clock circuit 24. Then, it is diagnosed whether the time from the abnormal state to the reset of the MPU 20 is within a predetermined time. According to this configuration, the diagnostic flag is lowered immediately before the MPU 20 is reset, and the MPU 30 is not reset. Therefore, it is possible to diagnose whether the monitoring function of the monitoring IC 30 is operating normally even when the control target is operating. ..

According to the above embodiment, it can be guaranteed that the time from when the MPU 20 becomes abnormal to when the MPU 20 is reset is within a predetermined time. In addition, since the monitoring function can always be diagnosed even while the engine is operating, an abnormality can be detected immediately, and it is possible to avoid a loss of vehicle function or an unfavorable behavior of the vehicle.

The present invention is not limited to the above-described embodiment, and includes various modifications. The above-described embodiment has been described in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to the one including all the described configurations. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment. It is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, other configurations can be added / deleted / replaced with respect to a part of the configurations of each embodiment.

The monitoring IC 30 may change the set value of the abnormal value of the NG counter 33 according to the device to be controlled. Further, the monitoring IC 30 may change the set value of the abnormal value of the NG counter 33 according to the state of the controlled object. For example, the monitoring IC 30 sets the abnormal value of the NG counter 33 as the first value until the traveling speed of the vehicle exceeds a certain threshold value, and when the traveling speed of the vehicle exceeds the above threshold value, the NG counter 33 The outlier may be changed to a second value that is smaller than the first value. As a result, when the traveling speed is faster, the abnormal state of the MPU 20 can be detected earlier, and the automobile can be moved to a safer state.

In the above-described embodiment, the control lines and information lines are shown as necessary for explanation, and not all the control lines and information lines are necessarily shown in the product. All configurations may be interconnected.

10 ... Electronic control device 20 ... MPU 21 ... Monitoring function diagnostic circuit 22 ... Reset time diagnostic circuit 23 ... Example answer function 24 ... Clock circuit 30 ... MPU 31 ... MPU monitoring circuit 32 ... Example Calculation monitoring function 33 ... NG counter 40 ... Reset output unit

Claims (5)

In an electronic control device including an MPU for controlling an external device, a monitoring IC for monitoring the MPU, and a reset unit for resetting the MPU.
The monitoring IC includes an NG counter that changes when there is an abnormality in communication with the MPU.
By monitoring the value of the NG counter, the MPU determines whether the time from when the MPU becomes abnormal to when it is reset is within a predetermined time, and diagnoses the monitoring IC. An electronic control device characterized by In the electronic control device according to claim 1,
The MPU causes communication with the monitoring IC to be in an abnormal state based on the value of the NG counter and the elapsed time.
The MPU is an electronic control device that measures the time from the abnormal state to immediately before the value of the NG counter deviates from a predetermined range. In the electronic control device according to claim 2.
The monitoring IC transmits the value of the NG counter and the example to the MPU, and the monitoring IC transmits the value and the example.
The MPU changes the diagnostic flag for transitioning to the abnormal state from the first value to the second value when the value of the NG counter exceeds the specified time and is a normal value.
The MPU either transmits an erroneous answer to the example to the monitoring IC while the diagnostic flag is at the second value, or provides the answer to the example so that it does not fit within a predetermined time. Send to the monitoring IC,
When the MPU receives the value of the NG counter immediately before it goes out of the predetermined range, the MPU returns the diagnostic flag from the second value to the first value.
The MPU is characterized in that it measures the time from the time when the diagnostic flag is changed from the first value to the second value to the time when the second value is returned to the first value. Electronic control device. In the electronic control device according to claim 2.
The monitoring IC is characterized in that, when communication with the MPU is normal, the value of the NG counter is maintained at a normal value, or the value of the NG counter is changed so as to approach the normal value. Electronic control device. In the electronic control device according to claim 2.
The monitoring IC is an electronic control device characterized in that the predetermined range of the value of the NG counter is changed according to the state of the controlled object.

Images