JPH03291731A - Controller using microcomputer - Google Patents

Abstract

PURPOSE:To enlarge a file safe function by monitoring a reset signal from an abnormality detecting means by a sub microcomputer when a driving output from a main microcomputer is abnormal. CONSTITUTION:A sub microcomputer 33 is newly provided in a controller 31 so as to decide the run-away of a main microcomputer 32, to decide the fault of a suction pressure sensor 34 and to control respective electromagnetic solenoids 40-42 of an automatic change gear 50. Namely, when a reset signal to be led from an abnormality detection circuit 43 to lines L4 and L2 is set at a high level and an abnormality detection signal to be led from a backup control circuit 44 to a line 8 is set at a high level as well, it is judged that both the computer 32 and the sensor 34 are normal. On the other hand, when the reset signal to be led to the lines L4 and L2 is set at the high level and the abnormality detection signal to be led to the line 8 is set at a low level, it is judged that only the sensor 34 breakd down and further, when this reset signal is a low active pulse, the run-away of the computer 32 is judged.

Description

DETAILED DESCRIPTION OF THE INVENTION Overview The main micro combinator is configured using a plurality of microcomputers. The computer is a control device that derives a drive output to a second load in response to information from the main microcomputer, and is realized by a so-called watchdog timer or the like, and in the event of an abnormality such as a runaway of the main microcomputer, Reset the main microcomputer 1~
A reset signal from the abnormality detection means is also input to the sub-microcomputer.

Accordingly, the sub microcomputer determines whether the arithmetic operation of the main microcomputer is abnormal or whether a specific input used only for the arithmetic operation of the main microcomputer is abnormal. Based on the judgment result, when the specific input is abnormal, a drive output corresponding to the information from the main microcomputer is output to the second load, and when the calculation operation of the main microcomputer is abnormal, the drive output corresponding to the information from the main microcomputer is output to the second load. A predetermined constant drive output is derived to the load.

Therefore, even if there is an abnormality in a specific input used only for arithmetic operations of the main microcomputer, if the necessary information is normally input to the main microcomputer, the sub microcomputer will respond to the second input according to that input.
drive and control the load. In this way, the fail-safe function is expanded.

INDUSTRIAL APPLICATION FIELD The present invention relates to an apparatus comprising a plurality of microcomputers, such as a microcomputer for controlling an internal combustion engine of an automobile or a microcomputer for controlling a gear shifting operation.Prior art FIG. , a typical prior art control device] is a block diagram showing the electrical configuration of a typical prior art control device. This control device 1 is used for controlling an automobile, and has two microcomputers 2.
, 3. The main microcomputer 2 calculates the fuel injection amount based on the outputs from the intake pressure sensor 4, the crank angle sensor 5, and the throttle valve opening sensor 6, and injects the fuel via the output circuit 22. It drives and controls the electromagnetic solenoids 1 to 7 of the valve 21, calculates the ignition timing, and drives and controls the equniter 8 via the output buffer 23.

The sub microcomputer 3 receives the opening degree information of the throwers 1 to 1 through the line l1 from the main microcomputer 2, and outputs the information according to this opening degree information and the vehicle speed detected by the vehicle speed sensor 9. The electromagnetic solenoids 1 to 10 to 12 of the automatic transmission 20 are selectively driven and controlled via circuits 24 to 26.

In connection with the main microcomputer 2, an abnormality detection circuit 3 and a backup control circuit 4 are provided. The abnormality detection circuit 13 is realized by a so-called watch 1, a timer, etc., and this abnormality detection circuit 13 monitors a pulse of a constant period derived from the main microcomputer 2 to the line 13, and detects that this pulse exceeds a predetermined time. When this happens, it is determined that the main microcomputer 2 has gone out of control, and a reset signal is output via line e4.

The sub microcomputer 3 is monitored by the main microcomputer 2, and the main microcomputer 2 is provided with an abnormality detection circuit i815 similar to the abnormality detection circuit 13.

This abnormality detection circuit 15 receives pulses of a certain period from the sub-microcomputer 3 inputted through the line 15, and when this pulse is not detected for a predetermined period of time or more, it is determined that the sub-microcomputer 3 has gone out of control. and outputs a reset signal via line l6.

An abnormality detection circuit is also provided in the backup control circuit 14]6
This abnormality detection circuit 16 is connected to line 1.
It receives an ignition signal from the main microcomputer 2 inputted via line 18, and outputs an abnormality detection signal to the sub microcomputer 3 via line 18 when the ignition signal is not detected for a certain period of time.

Further, when the ignition signal is not detected, the abnormality detection circuit 16 detects the changeover switch]. 7.19 as individual contacts].
Individual contacts 17b and 1.9b from 7a and 1.9a, respectively
Switch to The individual contacts 17a are supplied with an ignition signal via the line g7, and the individual contacts ]. 7b, a fixed ignition signal with a constant period is derived from the backup signal generation circuit T8.

In addition, individual contacts 1. 9a is supplied with an injection signal via line l9, and the individual contacts]. 9b, a fixed injection signal for injecting a fixed amount of fuel is derived from the backup signal generation circuit 18.

7, 1.9 or individual contacts]
, 7b, 19b, the igniter 8 is supplied with a fixed ignition signal of a fixed period from the backup signal generation circuit 8, and the fuel injection valve 21 is supplied with a fixed ignition signal for injecting a fixed amount. An injection signal is given.

In the control device configured as described above, when the sub microcomputer 3 receives an abnormality detection signal from the line 18, it drives the electromagnetic solenoids 1O to ↓2,
The gear position of the automatic transmission 20 is maintained at the highest gear position, for example, the overdrive position. By setting the automatic transmission 20 to this overdrive position, the acceleration force is at its slowest, thus providing fail-safety.

Problems to be Solved by the Invention In the prior art described above, even if an abnormality detection signal is input from the backup control circuit 14, the sub microcomputer 3 detects whether the abnormal state is due to the abnormal state, a failure of the main microcomputer 2 itself, or whether the intake pressure is It is not possible to determine whether this is due to a failure of the sensor 4. Note that the ignition signal is not output to the line 27 in most of the following two cases: when the main microcomputer 2 itself fails, and when the intake pressure sensor 4 fails.

However, since the sub microcomputer 3 cannot identify the location where the failure has occurred, the gear position of the automatic transmission 20 cannot be changed from the overdrive position in order to ensure safety as described above. For this reason, it is not possible to smoothly drive the vehicle to a repair shop or the like.

On the other hand, compared to the intake pressure sensor 4, the failure rate of the throttle valve opening sensor 6 is very small. In many cases, the sensor 6 is functioning normally.

An object of the present invention is to determine whether, even if an abnormality occurs in a device computer composed of a plurality of microcomputers, the abnormality is due to an abnormality in the main microcomputer itself or an abnormality in the input to the main microcomputer. It is an object of the present invention to provide a control device using a microcomputer that can enhance the fail-safe function of a sub-microcomputer by making decisions.

Means for Solving the Problems The present invention provides a main microcomputer that performs an arithmetic operation based on one or more inputs and derives a drive output corresponding to the result of the arithmetic operation to a first load; a sub-microcomputer that performs arithmetic operation using the information of the arithmetic operation and derives a drive output corresponding to the result of the arithmetic operation to the second load; abnormality detection means for outputting a reset signal to the computer; and an abnormality detection means provided in connection with the main microcomputer, which monitors the drive output of the main microcomputer, and when an abnormality is detected, sends a predetermined constant signal to the first load. and hack-up control means for deriving a drive output and outputting an abnormality detection signal to the sub-microcomputer, the sub-microcomputer having a reset signal derived from the abnormality detection means to the second load. Sometimes, a predetermined constant drive output is derived, and when an abnormality detection signal is output from the backup control means without the reset signal being derived, a drive output corresponding to information from the main microcomputer is generated. There is a control device using a microcomputer, which is characterized by the following.

Operation The control device according to the present invention is composed of a plurality of microcomputers, where the main microcomputer is used to control an internal combustion engine of a car, and the sub microcomputer is used to control an automatic transmission. .

The main microcombination unit performs calculation operations based on outputs from various sensors, switches, etc., derives a drive output corresponding to the calculation results to the first load, and controls the internal combustion engine. In addition, the sub microcomputer performs calculation operations using information from the main microcomputer as well as outputs from the sensors and switches, outputs a drive output corresponding to the calculation results to the second load, and outputs a drive output corresponding to the calculation result to the second load. control the machine.

An abnormality detection means is provided in association with the main microcomputer, and this abnormality detection means monitors the operating state of the main microcomputer and outputs a reset signal to the main microcomputer when an abnormality is detected.

Further, a backup control means is provided in association with the main microcomputer, and this backup control means monitors the drive output derived from the main microcomputer to the first load, and when an abnormality is detected, the backup control means A predetermined constant drive output is derived for one load.

The backup control means outputs an abnormality detection signal to the sub microcomputer when an abnormality is detected in the drive output from the main microcomputer. The sub microcomputer responds to this abnormality detection signal and the reset signal from the abnormality detection means, and determines from these two signals whether the main microcomputer itself is abnormal or the input to the main microcomputer is abnormal. Determine whether

That is, when the reset signal is derived, it is determined that the main microcomputer itself is abnormal;
A predetermined constant drive output is derived to the second load. Manoko, the reset 1 ~ the state where the signal is not derived,
When the abnormality detection signal is output, it is determined that a specific input to the main microcomputer is abnormal;
A drive output corresponding to information other than the specific input from the main microcomputer is derived to the second load.

Therefore, even if the drive output from the main microcomputer is abnormal, if the information required by the sub microcomputer is normally input to the main microcomputer, the sub microcomputer will respond to this information by Drive and control the load.

1 Embodiment FIG. 1 is a block diagram that does not show the electrical configuration of a control device 31- according to an embodiment of the present invention. This control device 31 is used for controlling the automobile and includes two microcomputers 32 and 33.

The main microcomputer 32 includes an intake pressure sensor 34, a crank angle sensor 35, and a throttle valve opening sensor 36.
The fuel injection amount is calculated based on the output from the output circuit 52, and the electromagnetic solenoid 37 of the fuel injection valve 51 is driven and controlled via the output circuit 52, and the ignition timing is calculated, and the igniter 38 is controlled via the output huffer 53. Drive control.

The sub microcomputer 33 receives throttle valve opening information from the main microcomputer 32 via the line L1, and outputs output circuits 54 to 56 according to this opening information and the vehicle speed detected by the vehicle speed sensor 39. The electromagnetic solenoids 1 to 40 to 42 of the automatic transmission 50 are selectively driven and controlled via.

In connection with the main microcomputer 32, two abnormality detection circuits 43 and a backup control circuit 44 are provided. The abnormality detection circuit 43 is realized as a so-called watchdog timer, and this abnormality detection circuit 43 monitors the pulse of a constant period derived from the main microcomputer 32 to the line L3, and detects that this pulse exceeds a predetermined time. When it no longer occurs, it is determined that the main microcomputer 32 has gone out of control, and the line L4
Outputs a reset signal via.

Further, the sub microcomputer 33 is monitored by the main microcomputer 32, and an abnormality detection circuit 45 similar to the abnormality detection circuit 43 is provided within the main microcomputer 32. This abnormality detection circuit 45
receives a constant cycle pulse from the sub-microcomputer 33 inputted via line L5, and when this pulse is not detected for a predetermined period of time or more, it determines that the sub-microcomputer 33 has gone out of control. The reset signal 1~ is output via 6.

Furthermore, the sub microcomputer 33 receives a reset signal derived from the abnormality detection circuit 43 to the line L4 via the line L2, and determines the runaway of the main microcomputer 32 and the intake pressure as described below. A failure determination of the sensor 34 is performed.

An abnormality detection circuit 46 is also provided in the backup control circuit 44.
This abnormality detection circuit 46 is connected to the line L
7, and when the ignition signal is not detected for a certain period of time or more, it outputs an abnormality detection signal to the sub microcomputer 33 via line L8.

Further, when the ignition signal is not detected, the abnormality detection circuit 46 switches the changeover switch 47.49 to the individual contact 47a.
, 49a to individual contacts 47b, 49b, respectively. The individual contact 47a is supplied with an ignition signal via line 1-7, and the individual contact 47b is supplied with a fixed periodic ignition signal from a backup signal generation circuit 48.

Further, an injection signal via line L9 is given to the individual contact 49a, and a fixed injection signal for injecting a certain amount of fuel is derived from the backup signal generation circuit 48 to the individual contact 491). .

Therefore, the changeover switch 4.7.49 is connected to the individual contact 47.
1:l, 4.91:), the igniter 38 is given a fixed ignition signal with a constant period from the backup signal generation circuit 48, and the fuel injection valve 5
1 is given a fixed injection signal for injecting a fixed amount.

In the control device 31 configured as described above, the sub microcomputer 33 determines runaway of the main microcomputer 32 and controls the intake pressure sensor 34 as follows.
The controller performs failure determination and controls each electromagnetic solenoid 40 to 42 of the automatic transmission 50.

That is, as shown in FIG. 2(1), the line L4. The reset signal derived to L2 is at a high level, and the backup control circuit 44
The abnormality detection signal derived from the line L8 is shown in Fig. 2 (2
), when the main microcomputer 3 is at a high level, the main microcomputer 3
2 and the intake pressure sensor 34 are both determined to be normal.

At this time, each electromagnetic solenoid 40 to 42 is connected to the line L
The drive is selectively controlled in response to the opening degree information of the throttles 1 to 1 inputted via the vehicle speed sensor 39 and the vehicle speed signal from the vehicle speed sensor 39.

In addition, the line L4. When the reset signal led out to line L2 is at a high level as shown in Figure 3 (1), and the abnormality detection signal led out to line L8 is at a low level as shown in Figure 3 (2), It is determined that only the intake pressure sensor 34 has failed.

At this time, each of the electromagnetic solenoids 40 to 42 operates according to the main microcomputer 32 and the intake pressure in response to the thrower opening degree information inputted via the line L1 and the vehicle speed signal from the vehicle speed sensor 39. The electromagnetic solenoids 40 to 42 are selectively driven and controlled so that the speed change operation is performed with a larger throttle valve opening than when the sensor 34 is normal.

6 In other words, this is because when the intake pressure sensor 34 is abnormal, the fuel injection valve 51 is driven and controlled so that the fuel injection amount becomes a predetermined low constant value, so the output of the internal combustion engine is small, and therefore the shift This is because it is necessary to switch to a control that is difficult to increase.

Furthermore, the line L4. When the reset signal derived from L2 is a low active pulse shown in FIG. 4, it is determined that the main microcomputer 32 is out of control, and the automatic transmission 50 sets its gear position to the overdrive position. so that each electromagnetic solenoid 40
-42 are driven and controlled.

FIG. 5 is a flowchart for explaining the operation of the sub microcomputer 33 described using FIGS. 2 to 4 above. In step n1, line L4. ．． L
2, it is determined whether the input signal is at a high level or not, and if so, step n2
Then, it is determined whether the abnormality detection signal input via line L8 is high level or not. If so, in step n3, normal gear shifting operation is performed based on the throttle opening information and the vehicle speed signal. or will be done.

Further, in step n2, when the abnormality detection signal via the line L8 is at a low level, the intake pressure sensor 3
4 is determined to be abnormal, and the speed change operation is controlled so that the thrower 1 hell valve opening is larger than normal, in accordance with the throttle opening information and the vehicle speed signal.

Furthermore, in step n1, if the reset signal is a low active pulse, step n5
The automatic transmission 150 is maintained at the overdrive position.

In the control device 31 according to the present invention, the sub microcomputer 33 monitors the reset signal derived from the abnormality detection circuit 43 to the main microcomputer 32 via the lines L4 and L2, and then Even when it is detected by the abnormality detection signal inputted through the main microcomputer 32 that there is an abnormality in the ignition signal from the main microcomputer 32, it is determined whether the abnormality is due to an abnormality in the intake pressure sensor 34. Alternatively, it is possible to accurately determine whether the main microcomputer 32 itself is out of control.

In the past, when only the intake pressure sensor 34 is abnormal, the automatic shift @ 50 can be driven and controlled according to the throttle opening information via the line L1 and the vehicle speed signal from the vehicle speed sensor 39. This makes it possible to perform evacuation driving smoothly, thereby expanding the fail-safe function.

Effects of the Invention As described above, according to the present invention, the sub microcomputer monitors the reset signal derived from the abnormality detection means when the drive output from the main microcomputer is abnormal. It can be determined whether the abnormality is due to an abnormality in the main microcomputer itself or an abnormality in the input to the main microcomputer, and whether the information required by the sub microcomputer is correctly input to the main microcomputer. When you are
The drive of the second load can be controlled based on this information, and the fail-safe function can be expanded.

[Brief explanation of the drawing]

FIG. 5 is a block diagram showing the electrical configuration of the control device 31 according to an embodiment of the present invention, FIGS. 2 to 4 are waveform diagrams for explaining the operation of the control device 31, and FIG. Figures 2 to 4
To flowchart 1 for explaining the operation shown in the figure,
FIG. 6 is a block diagram showing the electrical configuration of the conventional control device 1. As shown in FIG. 3■...control device, 32 main microcomputer,
33... Submicrocomputer, 34... Intake pressure sensor, 35 - Crank angle sensor, 36... Throttle valve opening sensor, 38... Igniter, 39... Vehicle speed sensor, 4B, 45.46...・Abnormality detection circuit, 44・
...Backup control circuit, 47...Selector switch, 4
8... Backup signal generation circuit, 50... Automatic transmission, 51 Fuel injection valve

Claims (1)

[Scope of Claims] A main microcomputer that performs an arithmetic operation based on one or more inputs and derives a drive output corresponding to the result of the arithmetic operation to a first load, using information from the main microcomputer. A sub-microcomputer that performs calculation operations and derives a drive output corresponding to the calculation results to the second load, and a sub-microcomputer that monitors the operating status of the main microcomputer and sends a reset signal to the main microcomputer when an abnormality is detected. An abnormality detection means for outputting an output, and provided in association with the main microcomputer, monitors the drive output of the main microcomputer, and when an abnormality is detected, derives a predetermined constant drive output to the first load. and a backup control means for outputting an abnormality detection signal to the sub-microcomputer, and the sub-microcomputer causes the second load to have a predetermined constant drive when a reset signal is derived from the abnormality detection means. An output is derived, and when an abnormality detection signal is output from the backup control means in a state where the reset signal is not derived, a drive output corresponding to information from the main microcomputer is derived. A control device using a microcomputer.