JPH08104224A - Failure detecting device for electronic control unit - Google Patents

Abstract

PURPOSE: To provide a failure detecting device for an electronic control unit, simple and at a low cost, capable of detecting failure of a control microcomputer without providing a monitoring microcomputer. CONSTITUTION: A device comprises a phase difference setting circuit 12 making a watch dog pulse output from a controlling microcomputer 11 branch into two systems also to set a prescribed periodic difference output between these pulses relating to the two system watch dog pulses and a nonconformity detecting circuit 13 comparing both outputs from the phase difference setting circuit 12 to perform trouble decision by inconformity of both the outputs.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a failure detection device for an electronic control unit, which is suitable for application to, for example, a vehicle anti-skid brake control system (ABS).

[0002]

2. Description of the Related Art In recent years, in an automobile, an electronic control unit equipped with a microcomputer is used to precisely control various control objects such as an engine, an automatic transmission, an ABS, etc., and fuel consumption performance, running performance or braking performance is improved. It is often used to increase the.

However, a microcomputer (hereinafter, abbreviated as "microcomputer") as a control means included in such an electronic control unit sometimes causes a failure (failure), which causes an object to be controlled. Since it will not operate normally, it is necessary to detect such a failure early and notify the driver. For this reason, generally, the electronic control unit is provided with a fail detecting means for detecting a fail of the microcomputer.

In the conventional electronic control unit for automobiles, usually, two microcomputers having the same function are provided, the same control information is given to both microcomputers to perform the same control operation, and mutual communication is performed. When the calculation results of both microcomputers are compared with each other, and when the two calculation results are inconsistent, at least one of the microcomputers has failed, so this is notified to the driver, and in particular, the failure of the microcomputer is safe. In the case of ABS, which is a serious problem in running, a fail-safe function is activated to bring down the system (see, for example, JP-A-59-130768).

FIG. 7 is a block diagram showing an example of a conventional failure detection device for an electronic control unit that controls a vehicle ABS.

As shown in FIG. 7, the electronic control unit U, which controls the ABS for automobiles, has a main microcomputer 1 as a control means for performing control calculation of ABS control.
And a monitoring microcomputer 2 for monitoring the operation of the main microcomputer 1, and a watchdog pulse monitor (hereinafter referred to as "W / D
Called a monitor) 3. Then, the main microcomputer 1, based on the input signal from the sensor 4,
A control signal for driving an actuator (for example, a solenoid valve for reducing the braking pressure) 5 and a watchdog pulse for the W / D monitor 3 are output via a drive circuit (not shown).

On the other hand, the monitoring microcomputer 2 performs mutual operation monitoring with the main microcomputer 1 via the mutual communication line, outputs a watchdog pulse to the W / D monitor 3, and outputs from the main microcomputer 1. The permission signal given to the AND circuit 6 is outputted together with the outputted control signal (for example, the pressure reduction signal). By outputting this permission signal, the output of the control signal from the main microcomputer 1 to the actuator 5 is permitted.

The W / D monitor 3 is a circuit for monitoring the simultaneous runaway of both microcomputers 1 and 2 by the watchdog pulse output from both microcomputers 1 and 2. Here, the watchdog pulse is basically a rectangular wave signal that repeatedly turns on and off in a constant cycle, and the on-time and off-time in one cycle are set to constant values. When at least one of both watchdog pulses input to the W / D monitor 3 disappears due to the failure of at least one of the two microcomputers 1 and 2, the fail safe relay (hereinafter referred to as “F / S”) from the W / D monitor 3 A fail-safe signal is output to a drive circuit (referred to as a "relay") 7 (not shown) to turn off the F / S relay 7 to shut down the system.

[0009]

By the way, although the W / D monitor 3 can detect the non-pulse abnormality of the watchdog pulse, it cannot detect the cycle abnormality of the watchdog pulse. Therefore, the fault detection of the conventional electronic control unit is not possible. In the apparatus, the monitoring microcomputer 2 is provided as described above, and microcomputer runaway or oscillator abnormality in which a pulse in the main microcomputer 1 oscillates is detected.

However, in the conventional failure detection device for the electronic control unit, not only the electronic control unit must be provided with two microcomputers, but also the circuit around the microcomputer becomes complicated and large-scaled, and the cost of the electronic control unit increases. There was a problem that was very high.

In view of the above circumstances, the present invention provides a simple and inexpensive failure detecting apparatus for an electronic control unit capable of detecting a failure of a control microcomputer without providing a monitoring microcomputer. To aim.

[0012]

In order to achieve the above object, a first aspect of the present invention divides a watchdog pulse output from a control means into two systems, and for the watchdog pulse of the two systems, A phase difference setting means for setting and outputting a predetermined phase difference and a failure determination means for comparing both outputs from the phase difference setting means to perform a failure determination are provided therebetween.

According to a second aspect of the present invention, an input signal from a sensor or the like is branched into two systems, and a predetermined time difference is set between the input signals of the two systems to be input to the control means. With respect to the two-system output signals output from the control unit in correspondence with the time-difference setting means and the two-system input signals to which the predetermined time difference is set, respectively, the predetermined relationship is opposite to the input side. The second time difference setting means for setting and outputting the time difference and the failure determination means for comparing both outputs from the second time difference setting means to determine the failure.

According to a preferred aspect of the first and second inventions, the control means is a control means for the ABS of the vehicle.

[0015]

According to the first aspect of the present invention, the watchdog pulse, which is a rectangular wave signal output from the control means (controlling microcomputer) and repeatedly turned on and off at a constant cycle, has a predetermined phase difference. Since the watchdog pulses of the two systems are branched and the watchdog pulses of the two systems are compared with each other, if a cycle abnormality occurs in the original watchdog pulse, the potential of the watchdog pulses of the two systems or Since the theoretical values do not match each other, the failure of the control means (control microcomputer) can be easily detected without providing a monitoring microcomputer, so that the circuit can be simplified and the cost of the electronic control unit can be reduced. Can be achieved.

According to the second aspect of the present invention, the input signal from the sensor or the like is branched into two systems, and a predetermined time difference is set between the input signals of the two systems to control means (control microcomputer). ) And the two-system output signals output from the control means (control microcomputer) corresponding to the two-system input signals for which the predetermined time difference is set are opposite to those on the input side. Since the above-mentioned predetermined time difference is set in relation to the two outputs and the two outputs are compared, if an abnormality occurs in the control means (control microcomputer),
Since the phases of the output signals of the two systems do not match each other, it is possible to easily detect the failure of the control means (control microcomputer) without providing a monitoring microcomputer and a W / D monitor. As in the first aspect, the cost of the electronic control unit can be reduced. According to the second aspect of the invention, the failure can be detected with higher accuracy than the first aspect of the invention.

[0017]

Embodiments of the present invention will be described below.

<First Embodiment> As shown in FIG. 1, an electronic control unit U for controlling an automobile ABS executes an ABS control calculation based on an input from a sensor 4 and outputs a control signal (for example, a control signal). A control microcomputer 11 that outputs a pressure reduction signal) to a drive circuit (not shown) of an actuator (for example, a solenoid valve for braking pressure reduction) 5, and a watchdog that is output from the control microcomputer 11 and has a constant period T. While splitting the pulse into two systems,
A phase difference setting circuit 12 for setting and outputting a predetermined phase difference between the two systems of watchdog pulses
And a mismatch detection circuit 13 for comparing both outputs from the phase difference setting circuit 12.

The phase difference setting circuit 12 has a delay circuit 14, and the watchdog pulse output from the control microcomputer 11 is used as the pulse A as it is, and the mismatch detection circuit 13 is used.
The delay circuit 14 outputs one cycle T (1
It has a function of outputting a watchdog pulse delayed by an integer multiple of the period) to the mismatch detection circuit 13 as a pulse B.

The disagreement detection circuit 13 uses the exclusive OR (X
It is a circuit that is configured by an OR circuit and detects whether or not the period and phase of the pulse A and the pulse B match.
Although a relay drive circuit and the like are attached after the mismatch detection circuit 13, their illustration and description are omitted.

Next, the operation of the electronic control unit U shown in FIG. 1 will be described with reference to the timing charts of FIGS.

(1) When the microcomputer is normal (t = t ₁ ): As shown in FIG. 3, the pulses A and B have the same cycle and the same phase, and the mismatch detection circuit 13 detects the match between the pulses A and B. , F / S relay 7 is turned on, and the actuator 5 is controlled.

(2) Microcomputer runaway (t = t ₂ ): As shown in FIG. 4, the output of pulse A is disturbed, but pulse B is 1
Since the waveform is output before the period T (sec), a mismatch occurs between the pulses A and B. The mismatch detection circuit 13 detects this and turns off the F / S relay 7 to bring the system down.

<Second Embodiment> As shown in FIG. 5, an electronic control unit U for controlling an automobile ABS executes an ABS control operation based on an input from a sensor 4 and outputs a control signal (for example, A control microcomputer 11 for outputting a pressure reduction signal) to an actuator (for example, a solenoid valve for reducing the braking pressure) 5 and an input signal from the sensor 4 are branched into two systems, and the input signals of the two systems are connected between them. A first time difference setting circuit 15 for setting a predetermined time difference to the control microcomputer 11 and inputting it to the control microcomputer 11, and two signals output from the control means corresponding to the two input signals having the predetermined time difference set. A second time difference setting circuit 16 for setting and outputting the above-mentioned predetermined time difference with respect to the output signal of the system in the opposite relationship to the input side, and the second time difference setting circuit 16 It is constituted by a mismatch detecting circuit 17 for comparing the output.

The first time difference setting circuit 15 is provided with a delay circuit 18, and the input from the sensor 4 is input as it is to the control microcomputer 11 as the input A, and the sensor 4 is also provided.
Has a function of delaying the input from the control circuit 11 by the delay circuit 18 for a predetermined time T and inputting this delay signal as the input B to the control microcomputer 11.

The second time difference setting circuit 16 is provided with a delay circuit 19 and outputs an actuator control signal (output to the actuator 5) which is calculated based on the input A from the sensor 4 and output from the control microcomputer 11. Delay circuit 1
9 delays a predetermined time T, and outputs the delay signal as the output A to the mismatch detection circuit 17, and at the same time, the actuator control signal calculated by the delay input B and output from the control microcomputer 11 (in the actuator 5, (Not output) is output as the output B to the mismatch detection circuit 17.

The discrepancy detection circuit 17 uses the exclusive OR (X
OR) circuit, and a second time difference setting circuit 1
6 is a circuit for detecting the coincidence / non-coincidence of the phases of the output A and the output B of FIG.

Next, the operation of the electronic control unit U shown in FIG. 5 will be described with reference to the timing chart of FIG.

(1) When the microcomputer is normal (t = t ₁ + ΔT):
The output A delayed by the time T on the output side matches the output B delayed by the time T on the input side. The mismatch detection circuit 17 detects the match between the outputs A and B, turns on the F / S relay 7, and controls the actuator 5.

(2) At the time of microcomputer runaway (t = t ₂ + ΔT):
Looking at the output of the time t ₂ + [Delta] T, the output A is a normal because the output obtained by calculating the input time t ₂ at time t _2, the output B is input at the time t ₂ at time t ₂ [Delta] T Since it is the calculated output, it becomes abnormal and a mismatch occurs between the outputs A and B. The mismatch detection circuit 17 detects this and outputs F
/ S relay 7 is turned off and the system goes down.

As described above, in each of the first and second embodiments, the failure of the control microcomputer 11 can be easily detected without providing the monitoring microcomputer.
The circuit is also simplified, and the cost of the electronic control unit U can be reduced.

[Brief description of drawings]

FIG. 1 is a system configuration diagram of an electronic control unit according to a first embodiment of the present invention.

FIG. 2 is a timing chart used to explain the operation of the electronic control unit shown in FIG.

FIG. 3 is a timing chart used to explain the operation of the electronic control unit of FIG. 1 when the microcomputer is operating normally.

4 is a timing chart used to explain the operation of the electronic control unit of FIG. 1 when the microcomputer is out of control.

FIG. 5 is a system configuration diagram of an electronic control unit according to a second embodiment of the present invention.

6 is a timing chart used to explain the operation of the electronic control unit of FIG.

FIG. 7 is a system configuration diagram of a conventional electronic control unit.

[Explanation of symbols]

 11 Control Microcomputer 12 Phase Difference Setting Circuit 13, 17 Mismatch Detection Circuit 14, 18, 19 Delay Circuit 15 First Time Difference Setting Circuit 16 Second Time Difference Setting Circuit

Claims (4)

[Claims] 1. An electronic control unit comprising a control means for calculating and outputting a controlled variable of a controlled object based on an input signal from a sensor or the like, wherein the watchdog pulse output from said control means is 2
Phase difference setting means for branching to the system and setting and outputting a predetermined phase difference between the watchdog pulses of the two systems, and both outputs from the phase difference setting means are compared to determine a failure. A failure detection device for an electronic control unit, comprising: 2. The failure detection device for an electronic control unit according to claim 1, wherein the control means comprises a control means for an anti-skid brake control system of a vehicle. 3. An electronic control unit having a control means for calculating and outputting a controlled variable of a controlled object based on an input signal from a sensor or the like, and branching an input signal from the sensor or the like into two systems, Corresponding to a first time difference setting means for setting a predetermined time difference between the input signals of the two systems and inputting them to the control means, and an input signal of the two systems for which the predetermined time difference is set. Second time difference setting means for setting and outputting the predetermined time difference in the opposite relationship to the input side with respect to the two-system output signals output from the control means, and the second time difference setting A failure detection device for an electronic control unit, comprising: failure determination means for comparing both outputs from the means to determine a failure. 4. The failure detection device for an electronic control unit according to claim 3, wherein the control means comprises a control means for an anti-skid brake control system of a vehicle.