JPH0571963B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Application of the Invention] The present invention relates to a control system using a microcomputer, and particularly to a multi-microcomputer type automobile control system suitable for controlling an automobile engine.

[Background of the invention]

In recent years, control systems using microcomputers have come to be widely used for control when there are many control items and the control contents are complex and multifaceted.

For example, an automobile engine has significant load fluctuations and rotational speed fluctuations during operation, and must also comply with strict exhaust gas regulations, requiring multifaceted control over many control items.

Therefore, control systems using microcomputers (hereinafter referred to as microcomputers) have been widely used in such automobile engines since a very early stage, as is known from, for example, Japanese Patent Laid-Open No. 56-92330. It is starting to be adopted.

However, in recent years, the control required for automobiles is
Not only does it control the operation of the engine,
Detects abnormalities in the power system including the engine,
Various types of control have become necessary, including control for a diagnosis function that facilitates maintenance work by self-diagnosing and storing the results, and control for drive systems and travel systems.

On the other hand, the microcomputers used in such control systems naturally have their own limits to their capabilities, and when the number of control objects that are required to control increases, as in the case of controlling automobiles mentioned above, Accordingly, a microcontroller with large capacity is required,
Furthermore, special equipment may be required, which inevitably increases costs considerably.

Therefore, a so-called multi-microcomputer type control system has come into use, which uses a relatively low-cost general-purpose microcomputer and compensates for the lack of capacity by using a plurality of microcomputers.

[Purpose of the invention]

The present invention was made in view of the above circumstances, and
The purpose is to provide a highly reliable automobile control system that utilizes multi-microcomputer materials.

[Summary of the invention]

In order to achieve this object, the present invention allows microcomputers in a control system to have a mutual backup function for some of their control items and a reset function by mutual monitoring, and at this time, mutual backup The feature is that the reset function is given priority over other functions.

[Embodiments of the invention]

Embodiments of the vehicle control system according to the present invention will be described below with reference to the drawings.

FIG. 1 shows an embodiment of the present invention, in which 1 is a control unit, 2 and 3 are microcomputers, 4 is a power-on reset circuit, 5 and 6 are transistors, and 7 to 12 are OR gates.

The control unit 1 is of a multi-microcomputer type and has two microcomputers 2 and 3, and performs, for example, control of an automobile engine and diagnosis control.

Microcomputer 2 (hereinafter referred to as microcomputer A) is for engine control, and inputs a large amount of data representing the engine operating status from various sensors AI ₁ , AI ₂
...is taken in from AI _o , and various control signals are supplied accordingly to the outputs AO ₁ , AO ₂ ...from AO _o to the respective controlled devices and actuators, and the engine is controlled to an appropriate operating state.

Microcomputer 3 (hereinafter referred to as microcomputer B) detects abnormalities in the engine, performs self-diagnosis, and performs diagnostic control. BI ₁ , BI ₂ ... BI _o input data for this purpose, BO ₁ , BO ₂ ... …BO _o is the data or signal output.

The power reset circuit 4 generates a power reset signal having a predetermined pulse width when, for example, the engine key of a car is turned on and the power supply voltage V _cc is applied to the control unit 1, and the power reset signal is output to the A microcomputer 2 and the B microcomputer. 3 together, and performs initialization when the power is turned on.

The transistors 5 and 6 are turned on when signals are input to their bases from the OR gates 7 and 8, and serve to reset the A microcomputers 2 and B microcomputers 2 and 3 by setting their reset inputs RES to the ground potential.

Next, the operation of this embodiment will be explained.

First, the A microcomputer 2 is provided with a program that performs processing according to the flowchart shown in FIG.
A program is provided that performs processing according to the flowchart shown in Figure B.

When the power is turned on and the voltage _Vcc is applied to the control system 1, the power-on reset circuit 4 is first activated.
generates a reset pulse, the A microcomputer 2 and the B microcomputer 3 are initialized, each starts a control operation, and enters the processing shown in the flowchart of FIG.

When this process begins, the program operation signal generated from the other party's microcontroller is first entered in step .
Examine the PR and determine whether it was detected or not.
In other words, the A microcomputer 2 checks the program operation signal PR _b generated from the B microcomputer 3, and
examines the program operation signal PR _a generated from the A microcomputer 2.

When the result in step , is YES, the counter is cleared in step , and then each control routine is executed in step . In other words, the A microcomputer 2 takes in the data necessary for engine operation control, such as engine speed, cooling water temperature, intake air flow rate, etc., and receives the ignition signal,
The B microcomputer 3 performs calculations such as fuel supply signals and outputs them, while the B microcomputer 3 performs abnormality detection and self-diagnosis of various sensors and actuators.

After completing the processing of step,
Proceed to the respective program operation signals PR _a ,
Perform PR _b generation processing. As a result, these program operation signals PR _a and PR _b are generated only when the respective microcomputers 2 and 3 are operating normally and accurately performing the prescribed processing. By checking whether the signals PR _a and PR _b are generated at a predetermined cycle, it is possible to confirm whether the microcomputer is operating correctly or whether the program has entered a program runaway state. For this reason, the function that generates these signals is also called the watchdog timer function.
It is widely used.

On the other hand, if the result in step is NO, that is, the program operation signal of the other party's microcomputer is not detected, the process proceeds from step to step, where the generation processing of the respective reset signals R _a and R _b is first performed. Then, at step, the counter is incremented, that is, the count value is advanced by one count, and then it goes to step.

The reset signals R _a and R _b generated at this time are
As is clear from Fig. 1, since it is input to the bases of transistors 5 and 6 via OR gates 7 and 8, respectively, when the reset signal R _a is generated, the B microcomputer 3 is reset, and the opposite When the reset signal R _b is generated, the A microcomputer 2 is reset.

Now, returning to Fig. 2, after step, proceed to step, check the count value of the counter, judge whether it is greater than or equal to the predetermined value N, and if the result is NO, perform the processing here. However, when the result is YES, the process passes through step , and the A microcomputer 2 generates the backup signals AB ₁ and AB ₂ before completing the process, and the B microcomputer 3 generates the backup signals BA ₁ and BA ₂ and then finishes the process. Finish processing.

Now, suppose that an abnormality occurs in the A microcomputer 2 while the control system 1 is operating, and the control operation is stopped due to this.

Then, the A microcomputer 2 no longer generates the program operation signal PR _a , and the result of the step becomes NO, so the B microcomputer 3 outputs the reset signal R _b as a step process.

As a result, a reset is applied to the A microcomputer 2, and if the abnormality occurring in the A microcomputer 2 at this time is temporary, such as a runaway program due to noise, a reset is applied from the B microcomputer 3. As a result, the A microcomputer 2 is initialized and returns to normal operation from this point on.

On the other hand, while the control system 1 is operating, the B microcomputer 3
When an error occurs, the program operation signal
With the disappearance of PR _b , the reset signal R _a is generated from the A microcomputer 2. Therefore, if the abnormality in the B microcomputer 3 is temporary due to program runaway, etc., the above case will occur. Similarly, at this time as well, the B microcomputer 3 immediately returns to normal operation and can continue control.

Therefore, according to this embodiment, a retry function is obtained through mutual monitoring that takes advantage of the multi-microcomputer system, and even if one microcomputer goes out of control due to noise, etc., the other microcomputer immediately resets it and returns to normal operation. It is possible to prevent the control from becoming abnormal.

Next, assume that the abnormality that occurs in the A microcomputer 2 or the B microcomputer 3 is not a temporary one such as a runaway program caused by the above-mentioned noise, but is a semi-permanent failure due to a hardware abnormality.

In this case, the malfunctioning microcomputer will not return to normal operating state despite the reset by the other party's microcomputer, and as a result, each time the other party's microcomputer enters the process shown in The result is NO,
The counter is continuously incremented by step or without clearing the counter at step or. Eventually, the count value of the counter reaches N, and the result at step or is YES.

In this way, if the result at step or is YES, each time the signal shown in Fig. 2 is
The microcomputer 2 generates backup signals AB ₁ and AB ₂ , and the B microcomputer 3 generates a backup signal.
BA ₁ and BA ₂ will now be generated.

Therefore, A, who is currently in charge of engine control,
Assume that a semi-permanent failure as described above occurs in the microcomputer 2.

In this case, even if the B microcomputer 3 resets the A microcomputer 2, the A microcomputer 2 will not return to its normal operating state, so if this continues, the engine will no longer be controlled, the engine will stop, and the car will no longer be able to operate. Put it away.

In this embodiment, when a failure occurs in the A microcomputer 2 and the retry by the B microcomputer 3 is repeated N times, the B microcomputer 3 then outputs the backup signals BA ₁ and BA ₂ . These signals BA ₁ and BA ₂ are the OR gates 9 and 1
0 to the outputs AO ₁ and AO ₂ .

Therefore, among the output signals from the A microcomputer 2, the minimum necessary signals for engine operation, such as the ignition signal and fuel injection signal, are output to the outputs AO ₁ and AO ₂ . Assume that the backup signals BA ₁ and BA ₂ from the B microcomputer 3 are made similar to the ignition signal and the fuel injection signal. For example, backup signal BA ₁
The back-up signal BA ₂ is set to have the same pulse width at the same crank angle position as the ignition signal when the engine is in a certain standard operating state. Make sure the pulse is the same.

Then, a failure occurs in A microcomputer 2, and B
When the A microcomputer 2 does not return to the normal operating state despite N times of retries by the microcomputer 3, its outputs AO ₁ , AO ₂ ... After the control signal generated from AO _o disappears, the output AO ₁
Backup signals BA _{1 and} BA 2 from the B microcomputer 3 are output from and AO ₂ , and the signal _{BA 1 is} supplied to the ignition system of the engine, and the signal BA ₂ is supplied to the fuel injection control system.

Therefore, even if A microcomputer 2 fails, at least
Only the engine's ignition control and fuel injection control are continued, and the vehicle can be kept in a state where it is possible to run, and a backup function can be performed in case of a failure.

At this time, the backup signal is generated from the B microcomputer 3 after the A microcomputer 2 has been reset multiple times, so even if the B microcomputer 3 does not receive the program operation signal of the A microcomputer 2 during this time, Even if PR _a fails to be read once or so, a backup signal will not be generated immediately. Therefore, according to this embodiment,
Only when the A microcomputer 2 (or B microcomputer 3) semi-permanently breaks down can the backup signal be reliably output.

Furthermore, as a result, the backup signal is output from the B microcomputer 3 only after the A microcomputer 2 has been repeatedly reset and the subsequent control signals have definitely disappeared, so the control state of the engine is temporarily changed. Abnormalities are reliably suppressed and a smooth backup is obtained. In other words, when a microcomputer malfunctions, the output from it may become abnormal. Therefore, if a backup signal is output before a reliable reset is applied, a control signal that overlaps with this abnormal signal will be sent to the engine. However, according to this embodiment, since multiple resets are performed prior to generation of the backup signal, accurate backup can always be obtained. .

The same applies when a failure occurs in the B microcomputer 3. In this case, the backup signals AB ₁ and AB ₂ from the A microcomputer 2 appear at the outputs BO ₁ and BO ₂ via the OR gates 11 and 12, and In place of the output, the necessary control continues and the backup function is performed. Note that the outputs BO ₁ and BO ₂ of the B microcomputer 3 at this time may be, for example, alarm signals in diagnosis control.
Therefore, the backup signal from A microcomputer 2
AB ₁ and AB ₂ should also be made to provide signals commensurate with that.

Although omitted in the above explanation, the value of the predetermined value N in step 2 of FIG. , the above predetermined value N may be set to, for example, N=3.

Furthermore, in the above embodiment, there are two types of backup signals for each microcomputer, but these can also be determined arbitrarily, and it goes without saying that the signals to be backed up can also be determined arbitrarily. do not have.

Further, in the above embodiment, the system includes two microcomputers, but it goes without saying that the present invention can also be implemented as a system including three or more microcomputers, and mutual backup and mutual retry in this case can be implemented. may be performed between all microcomputers, or may be performed only between sequentially adjacent microcomputers.

〔Effect of the invention〕

As explained above, according to the present invention, it is possible to sufficiently improve the reliability of the multi-microcontroller system, thereby reducing costs by using a general-purpose microcontroller, and improving the degree of design freedom by dividing the microcontroller for each controlled object. It is possible to easily provide an automobile control system that can fully utilize the advantages of the multi-microcomputer method, such as improving the efficiency of development work.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing an embodiment of the vehicle control system according to the present invention, and FIGS. 2A and 2B are flowcharts for explaining the operation. 1... Control unit, 2, 3... Microcomputer, 4... Power reset circuit, 5, 6... Transistor, 7-12... OR gate.

Claims (1)

[Scope of Claims] 1. In an automobile control system that includes a plurality of microcomputers for controlling an automobile, and uses different microcomputers depending on the control items of the automobile, the control program operation of the other microcomputer Reset signal generation processing that generates a reset signal to the other microcomputer when no signal is detected; Reset count counting processing that counts the number of times a reset signal has been generated; and a program operation signal of the other microcomputer is detected. Initialization processing to return the counted number of resets to the initial value; and outputting a control signal for backing up a part of the control items by the other microcomputer when the count value from the reset number counting process reaches a predetermined value. A program for causing each of the microcomputers to sequentially and repeatedly execute backup processing is stored in the storage device of each of the microcomputers, and a retry when one of the microcomputers goes out of control is a mutual backup of the control function. A vehicle control system characterized in that the vehicle control system is configured to give priority to the following operations. 2. The automobile control system according to claim 1, wherein some of the control items to be backed up are a fuel supply control function and an ignition control function of an internal combustion engine.