JPH1134766A - Abnormality processing method for vehicle controlling computer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an abnormality processing method of a computer able to continue fail-safe control even in the case that abnormality is generated in a main CPU, and a reset process is performed relating to both the main CPU and a sub CPU. SOLUTION: A computer 12 is provided with a memory 30 including a main CPU26, sub CPU27, watch dog circuit 28 and a standby RAM30c. When abnormality is generated in the main CPU26, in the watch dog circuit 28, a reset process is executed relating to each CPU26, 27. The sub CPU27 detects abnormality of the main CPU26, and information displaying abnormality is written in the standby RAM30c before executing the reset process. The standby RAM30c holds a memory content before/after the reset process. In the sub CPU27, after the reset process, in the case of storing information displaying abnormality in the standby RAM30c, fail-safe control related to opening control of a throttle valve 17 is executed till operating an ignition switch 24 to an [OFF position].

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an abnormality processing method for a vehicle control computer having a main central processing unit and a sub-central processing unit for executing control relating to a vehicle.

[0002]

2. Description of the Related Art In recent years, electronic control systems in which various controls in a vehicle are performed using a computer have been widely adopted. In this electronic control system, for example, a plurality of central processing units (hereinafter, central processing units) such as a central processing unit that executes fuel injection control and ignition timing control and a central processing unit that executes transmission control.
A computer equipped with a “CPU” is used.

[0003] By the way, the computer used for controlling an automobile as described above is used in an environment having an extremely high electrical noise level, and the noise causes the program execution processing of the CPU to run away.
A situation may occur in which normal processing cannot be performed.

Therefore, in preparation for the above-mentioned CPU abnormality, each CPU periodically outputs a watchdog signal (an abnormality monitoring signal) to a watchdog circuit.
When this signal is no longer output, it is considered that an abnormality has occurred, and a method of returning the CPU to a normal state by outputting a reset signal from the watchdog circuit to the CPU has conventionally been adopted.

As this kind of technology, for example, Japanese Patent Laid-Open No.
No. 187,856, “Reset Method of Multi-Central Processing Unit System”.
In this reset method, CPs other than the main CPU are used.
If an error occurs in U (sub CPU), all CPs
By outputting a reset signal only to the CPU in which an error has occurred, instead of outputting a reset signal to U, other normal CPUs can continue processing.

On the other hand, in the above reset method, if an abnormality occurs in the main CPU, a reset signal is output to all CPUs. Usually, the main CPU
Since it has a function to control each of the other sub CPUs, if an abnormality occurs in this main CPU, even if only the same CPU is returned to a normal state, normal processing by the other sub CPUs can be performed. May not be executed.

[0007]

By the way, in an automobile control system, when an abnormality is detected in the control system, that is, when an abnormality of the CPU or the actuator controlled by the CPU is detected. If detected,
For example, control corresponding to an abnormality such as forcibly reducing the engine output, that is, fail-safe control is executed. It is desirable that such fail-safe control be continued until the engine temporarily stops.
This is because if the control shifts from the fail-safe control to the normal control during the operation of the engine, the driver may feel uncomfortable due to an increase in the engine output or the like.

Here, it is considered that the above-described reset method is applied to a computer that executes fail-safe control corresponding to the above-described abnormality of the control system.
For example, when an abnormality occurs in a CPU other than the main CPU, a reset signal is output only to the CPU. Therefore, since the reset processing is not performed on the main CPU, the fail-safe control that has been executed by the CPU and the fail-safe control corresponding to the current abnormality of the CPU can be continuously executed.

On the other hand, when an abnormality occurs in the main CPU, a reset signal is output to all CPUs. Therefore, since the reset processing is performed for all the CPUs including the main CPU, after that, information indicating that an abnormality has occurred in the main CPU before the reset processing is not held. As a result, there has been a problem that the fail-safe control that has been executed up to that time and the fail-safe control corresponding to the current CPU abnormality cannot be continuously executed after the reset processing.

The present invention has been made in view of the above circumstances, and has as its object the main central processing unit (main CPU).
If a failure occurs in both the main central processing unit and the sub central processing unit (sub CPU), the fail-safe control can be continued even if reset processing is performed on both the central processing unit and the sub central processing unit (sub CPU). It is to provide a method.

[0011]

According to a first aspect of the present invention, there is provided a computer system comprising at least a main central processing unit and a sub central processing unit, wherein an abnormality of the main central processing unit is detected. In this case, the control mode of the vehicle is changed to the abnormal mode and the reset process is executed for the main central processing unit and the sub central processing unit. Before the processing, information for determining an abnormality of the main central processing unit is stored in a memory in which the stored contents are retained even when the reset processing is performed, and the main central processing is performed based on the information stored in the memory after the reset processing. If it is determined that an abnormality has occurred in the device, the control mode of the vehicle should be maintained in the abnormal response mode until the ignition switch of the vehicle is turned off. It is an spirit.

The vehicle control includes various controls such as fuel injection control, ignition timing control, intake air amount control (throttle control), transmission control, and traction control.

According to each of the above methods, when an abnormality occurs in the main central processing unit, information for determining an abnormality in the main central processing unit is stored in the memory before the reset processing. Since this memory retains the stored contents even after the reset process is executed, even after the reset process, an abnormality occurs in the main central processing unit before the reset process based on the information stored in this memory. You can judge what you were doing. Therefore, when an abnormality has occurred in the main central processing unit, the control mode of the vehicle can be maintained in the abnormal response mode until the ignition switch of the vehicle is turned off.

According to a second aspect of the present invention, there is provided an abnormality processing method for a vehicle control computer according to the first aspect, wherein
Its purpose is to detect an abnormality in the main central processing unit based on a signal input from the main central processing unit and store the detection result in the memory as information for determining an abnormality in the main central processing unit. Is what you do.

According to the above method, in addition to the effect of the invention described in claim 1, an abnormality of the main central processing unit is detected by the sub central processing unit based on a signal input from the main central processing unit. Is done.

According to a third aspect of the present invention, there is provided an abnormality processing method for a vehicle control computer according to the first aspect, wherein the ignition switch is controlled by the main central processing unit or the sub central processing unit. on·
The off state is stored in the memory as information for judging abnormality of the main central processing unit. If the on / off state of the ignition switch is stored as the on state in the memory after the reset processing, the ignition switch of the vehicle is stored. The purpose is to maintain the control mode of the vehicle in the abnormal response mode until is turned off.

In the above method, the on / off state of the ignition switch is stored by the main central processing unit or the sub central processing unit in the memory that retains the stored contents even when the reset processing is executed.

Here, when the main central processing unit is functioning normally and the power supply to the main central processing unit and the sub central processing unit is cut off after the ignition switch is turned off, the memory is stored in the memory. Means that the on / off state of the ignition switch is stored as the "off" state.

On the other hand, when reset processing is performed on the main central processing unit and the sub central processing unit due to the occurrence of an abnormality in the main central processing unit, the ON / OFF state of the ignition switch is set to "ON" in the memory. It will be stored as a state. Therefore, based on the information stored in the memory, the execution of the reset processing is due to the interruption of the power supply to the main central processing unit and the sub central processing unit, or an abnormality occurs in the main central processing unit. Can be determined.

Therefore, according to the above method, similarly to the first aspect of the present invention, when an abnormality occurs in the main central processing unit and reset processing is performed, until the ignition switch of the vehicle is turned off. Thus, the control mode of the vehicle can be maintained as the abnormal mode.

Further, according to the above method, when an abnormality occurs in the main central processing unit, it is not necessary to judge the abnormality in a relatively short time from the occurrence of the abnormality until the reset processing is executed.

According to a fourth aspect of the present invention, there is provided a vehicle control computer abnormality processing method according to the first aspect, wherein the ignition switch is controlled by the main central processing unit or the sub central processing unit. on·
The OFF state is stored in the memory as information for determining an abnormality of the main central processing unit, and the sub central processing unit determines whether the main central processing unit is abnormal based on a signal input from the main central processing unit. The result of the determination is stored in the memory as information for determining an abnormality of the main central processing unit, and after the reset processing, the on / off state of the ignition switch is stored as the on state in the memory,
In addition, when information indicating that an abnormality has occurred in the main central processing unit is stored in the memory, the control mode of the vehicle is maintained in the abnormal response mode until the ignition switch of the vehicle is turned off. It is intended.

In the above method, only when the on / off state of the ignition switch is stored in the memory as the on state and information indicating that an abnormality has occurred in the main central processing unit is stored, The control mode of the vehicle is maintained in the abnormal mode. Therefore, according to the above method, in addition to the effect of the invention described in claim 1, for example, when the reset process is performed accidentally due to the influence of noise or the like, the control mode of the vehicle responds to an abnormality. It is not kept in the mode.

[0024]

BEST MODE FOR CARRYING OUT THE INVENTION

[First Embodiment] A first embodiment of the present invention will now be described as an abnormality processing method in a computer for controlling an engine of a vehicle.

FIG. 1 shows a multi-cylinder gasoline engine (hereinafter, referred to as a multi-cylinder gasoline engine).
The schematic configuration of an “engine” 11 and a computer (hereinafter abbreviated as “ECU”) 12 for controlling the engine 11 and the like are shown.

As shown in FIG. 1, the engine 11 has four cylinders 13, in each of which a combustion chamber 14 is formed. Also, the engine 11
Are connected to an intake pipe 15 and an exhaust pipe 16, respectively, and the insides of the pipes 15 and 16 are connected to the combustion chamber 14.

Inside the intake pipe 15, a butterfly valve type throttle valve 17 is rotatably provided. The rotary shaft 17a of the throttle valve 17 is drivingly connected to a motor 18. When the coaxial 17a is rotated by the motor 18, the opening of the throttle valve 17 (throttle opening) is changed. The amount of intake air (intake amount) introduced into the combustion chamber 14 through the interior of the intake pipe 15 is
It is adjusted according to the opening of the throttle valve 17.

An electromagnetic clutch 19 is provided between the throttle valve 17 and the motor 18. The electromagnetic clutch 19 can cut off the connection between the two. The throttle valve 17 is urged to rotate in a valve closing direction by a spring (not shown). Therefore,
When the connection between the throttle valve 17 and the motor 18 is interrupted by the electromagnetic clutch 19, the throttle valve 17 is substantially fully closed by the urging force of the spring,
The intake air amount is reduced to a minimum amount at which idling operation is possible.

The driver's cab (not shown) of the vehicle C is provided with an accelerator pedal 20 which is depressed by a driver. Only when the accelerator pedal 20 is depressed to the maximum depressing amount, the vehicle C is mechanically connected to the pedal 20 and the throttle valve 17 to open the valve 17 by a predetermined opening degree. Is provided. Therefore, even when the connection between the throttle valve 17 and the motor 18 is cut off, the vehicle C can run limp by the opening operation of the throttle valve 17 by the link mechanism L.

A throttle sensor 22 is provided near the throttle valve 17, and outputs a signal corresponding to the opening of the throttle valve 17, that is, the throttle opening.

An accelerator sensor 23 is provided in the vicinity of the accelerator pedal 20, and outputs a signal corresponding to the depression amount of the accelerator pedal 20, that is, the accelerator opening.

The driver's cab is provided with an ignition switch 24 which is operated by a driver.
It can be operated to each position of "ACC position", "ON position", and "START position". When the position of the ignition switch 24 is in the “ON position”, the engine 11 is normally in the operating state, and the position is “LOC”.
When the vehicle is at the "K position" or the "ACC position" (hereinafter, each position of the ignition is referred to as an "OFF position"), the engine 11 is always in a stopped state, and the vehicle is normally stopped.

Next, the configuration of the ECU 12 will be described. The ECU 12 mainly executes engine control such as combustion injection control and ignition timing control, a sub CPU 27 which executes transmission control and opening control of the throttle valve 17 (throttle control), a watch dog circuit 28, and a main CPU 26. ROM29 for
a, a memory 29 composed of a RAM 29b and a standby RAM 29c, and a ROM 3 for the sub CPU 27.
0, the RAM 30b and the standby RAM 30c, the memory 30, the input circuit 33, and the processing circuit 3.
4, an A / D converter 35, an electromagnetic clutch drive circuit 37, a motor drive circuit 38, and the like.

The throttle sensor 22 and the accelerator sensor 23 are connected to the main CPU 26 via an input circuit 33 and an A / D converter 35. Also, the sub CPU 27
Performs bidirectional communication with the main CPU 26 by DMA (Direct Memory Access), and executes throttle control based on a signal from the main CPU 26. That is, the sub CPU 27 controls the electromagnetic clutch 19 via the electromagnetic clutch drive circuit 37,
The throttle valve 17 and the motor 18 are connected. Then, the sub CPU 27 calculates a target opening related to the throttle opening in accordance with the accelerator opening detected by the accelerator sensor 23, and calculates the actual throttle opening detected by the throttle sensor 22 and the calculated target opening. The motor 18 is controlled so that the opening coincides with the opening.

The ignition switch 24 is connected to the processing circuit 3
4 is connected. Main CPU 26 and sub CPU
27 can determine the operating position of the ignition switch 24 based on the signal from the processing circuit 34. When the ignition switch 24 is operated from the “ON position” to the “OFF position”, the engine 11
Even when the operation is stopped, power is supplied to the ECU 12 for a predetermined time. Therefore, after the necessary information is written into the standby RAMs 29c and 30c by the main CPU 26 and the sub CPU 27, the power supply to each unit of the ECU 12 is stopped.

Each of the standby RAMs 29c and 30c resets the CPUs 26 and 27, that is, forcibly interrupts the currently executing process.
The recorded contents are retained even when a process of initializing the progress of the process up to that time is executed, or when the power supply to the ECU 12 is stopped as described above.

In the ECU 12 according to the present embodiment, both the main CPU 26 and the sub CPU 27 detect abnormalities of sensors such as the throttle sensor 22 and the accelerator sensor 23 and abnormalities of actuators such as the motor 18 and the electromagnetic clutch 19. And the main CPU
Both the CPU 26 and the sub CPU 27 execute fail-safe control for reducing the output of the engine 11 when an abnormality is detected in these. Further, in order to execute reset processing and fail-safe control when an abnormality occurs in the main CPU 26 or the sub CPU 27,
An abnormality monitoring signal (watchdog signal WDP) for detecting the abnormality is output from the watchdog circuit 2 from U26.
8 and the sub CPU 27. Also,
The watchdog signal WDP is output from the sub CPU 27 to the main CPU 26.

FIG. 2 is a time chart showing the watchdog signal WDP output from each of the CPUs 26 and 27. As shown in the figure, the watchdog signal WDP is L
This is a rectangular wave in which the level and the H level are repeated at a constant cycle. Watchdog circuit 28 or main CPU 2
6 outputs the watchdog signal WDP when the watchdog signal WDP is held at the L level or the H level and is not inverted even after the predetermined time elapses, as in the period A and the period B shown in FIG. It is determined that a runaway of program processing (hereinafter, simply referred to as “CPU abnormality”) has occurred in a certain CPU. And watchdog circuit 2
8 or the main CPU 26 determines the CP in which the abnormality has occurred.
The reset process is performed by outputting a reset signal RSP to U. By executing the reset processing, the CPU in which the abnormality has occurred can be returned to a normal state.

In the ECU 12 according to the present embodiment, when an abnormality occurs in the sub CPU 27, the main CPU 26 performs a reset process only on the sub CPU 27. In contrast, the main CPU 26
In the event that an abnormality has occurred, the reset processing is performed on both the main CPU 26 and the sub CPU 27 by the watchdog circuit 28.

Next, a processing method when an abnormality occurs in each of the CPUs 26 and 27 will be described. [1] When abnormality occurs in the sub CPU 27 The main CPU 26 determines that the watchdog signal WDP input from the sub CPU 27 has not been inverted for a predetermined time, that is, the signal WDP has changed from L level to H level or H level.
If the level does not change from the L level to the L level, the sub CPU 27
It is determined that an abnormality has occurred. And the main CPU 2
Reference numeral 6 outputs a reset signal RSP to the sub CPU 27 to perform a reset process.

Further, the main CPU 26 performs the reset process and controls the electromagnetic clutch 19 and the motor 18 via the respective drive circuits 37 and 38, thereby
The connection between the throttle valve 17 and the motor 18 is cut off, and the rotation of the motor 18 is stopped. Therefore, E
The change of the throttle opening by the CU 12 is no longer performed, and the opening of the throttle valve 17 decreases to a substantially fully closed state. As a result, the number of revolutions of the engine 11 decreases, and its output is forcibly suppressed to near the minimum output. That is, the fail safe control relating to the throttle control is executed by the main CPU 26. And the main CP
U26 switches this fail-safe control to the engine 1 when the ignition switch 24 is switched to the "OFF position".
Continue until 1 stops.

[2] When an Error Occurs in the Main CPU 26 As described above, when an error occurs in the sub CPU 27, only the CPU 27 is reset. Even the main CP
The fail-safe control can be executed by U26.

On the other hand, when an abnormality occurs in the main CPU 26, a reset process is performed for both the CPUs 26 and 27, so that the fail-safe process is executed in accordance with the processing procedure described below. Like that.

FIG. 4 is a flowchart showing each process of an "abnormality detection routine" for detecting an abnormality of the main CPU 26. In this “abnormality detection routine”, the ignition switch 24 is operated to the “ON position” and the ECU
After the power supply to each of the sections 12 is started, the sub C
This is a process included in the main routine executed by the PU 27.

In step 100 shown in the figure, the sub CPU 27 determines whether or not the watchdog signal WDP input from the main CPU 26 is inverted. If a negative determination is made here, the sub CPU 27 shifts the processing to step 102.

In step 102, the sub CPU 27
Increments the abnormality detection counter value CFAIL by "1". The abnormality detection counter value CFAIL corresponds to the elapsed time from when the inversion of the watchdog signal WDP stops and the state remains at the H level or the L level.

Next, at step 104, the sub CP
U27 determines whether or not the abnormality detection counter value CFAIL has become larger than the determination counter value CFAILK.
The determination counter value CFAILK is for determining whether or not the elapsed time after the stoppage of the inversion of the watchdog signal WDP has exceeded a predetermined time.
s ".

When an affirmative determination is made in step 104, the sub CPU 27 determines that an abnormality has occurred in the main CPU 26 and shifts the processing to step 106. Then, in step 106, the sub CPU 27 sets an abnormality determination flag XFAIL indicating that an abnormality has occurred in the main CPU 26 to "1", and stores the contents of the abnormality determination flag XFAIL in the standby RAM 3.
Write to 0c. Then, the sub CPU 27 shifts the processing to step 112.

On the other hand, if the determination in step 100 is affirmative, the sub CPU 27
Since no abnormality has occurred in the
Move to In step 108, the sub CPU 27
Sets the abnormality detection counter value CFAIL to “0”. Thereafter, the sub CPU 27 shifts the processing to step 112. Also, when a negative determination is made in step 104, the ECU 12 shifts the processing to step 112.

In step 112, the sub CPU 27
Determines whether the current ignition switch 24 is at the “ON position”. If an affirmative determination is made here, the sub CPU 27 shifts the processing to step 114.

In step 114, the sub CPU 27
Sets the position determination flag XIGON for determining the position of the ignition switch 24 to "1", and writes the contents of the position determination flag XIGON to the standby RAM 30c.

On the other hand, if a negative determination is made in step 112, the sub CPU 27 proceeds to step 1
The process proceeds to S16, where the position determination flag XIGON is set to "0" and the contents of the position determination flag XIGON are written to the standby RAM 30c. Further, in step 117, the sub CPU 27 sets the abnormality determination flag XF
AIL is set to "0", and the contents of the abnormality determination flag XFAIL are written to the standby RAM 30c.

Here, for example, when an abnormality occurs in the main CPU 26 and the watchdog circuit 28
When the reset processing is executed for the sub CP
Since the process in U27 is forcibly terminated, the position determination flag XIGON is stored as "1" in the standby RAM 30c after the reset process.

On the other hand, when the ignition switch 24 is turned to the "OFF position" by the driver, the position determination flag XIGON is written as "0" in the standby RAM 30c by the sub CPU 27. The supply is stopped. Therefore, after the reset processing, the position determination flag XIGON is stored as "0" in the standby RAM 30c.

As a result, the position determination flag XI stored in the standby RAM 30c after the reset processing is performed.
Before the reset process, the main C
It is possible to determine whether or not an abnormality has occurred in the PU 26.

At about the same time when the abnormality of the main CPU 26 is determined in step 104, the watchdog circuit 28 also detects the abnormality of the main CPU 26. Accordingly, as described above, the reset signal RSP is output from the watchdog circuit 28 to both the main CPU 26 and the sub CPU 27,
The reset processing is performed on 26 and 27. here,
In the ECU 12 according to the present embodiment, the sub CPU 2
Before the reset process of step 7 is performed, the timing at which the reset signal RSP is output is adjusted so that at least the process of step 106, that is, the writing of the abnormality determination flag XFAIL to the standby RAM 30c is completed.

After executing the processing of step 114 or step 117, the sub CPU 27 again executes step 100.
Execute the following processing. Next, each processing of the "abnormal processing routine" will be described with reference to the flowchart shown in FIG. This “abnormality processing routine” is performed after the ignition switch 24 is operated to the “ON position” and power supply to each unit of the ECU 12 is started, or after the sub CPU
This is a process (initial routine) that is executed only once after the reset process is performed on the subroutine 27 and before the main routine of the sub CPU 27 is executed.

In step 200, the sub CPU 27
Reads the abnormality determination flag XFAIL stored in the standby RAM 30c and determines whether the flag XFAIL is "1". If an affirmative determination is made here, the sub CPU 27 shifts the processing to step 202.

In step 202, the sub CPU 27
Reads the position determination flag XIGON stored in the standby RAM 30c and determines whether the flag XIGON is "1". If a positive determination is made here, the sub CPU 27 shifts the processing to step 204.

In step 204, the sub CPU 27
Indicates an abnormality determination flag XFAIL and a position determination flag XIG
Since both ONs are set to “1”, it is determined that an abnormality has occurred in the main CPU 26 before the reset processing is performed, and fail-safe control relating to throttle control is started. The sub CPU 27 continues this fail-safe control until the ignition switch 24 is operated to the “OFF position” and the operation of the engine 11 is stopped. Then, after executing the processing of step 204, the sub CPU 27 ends the processing of this routine.

On the other hand, the sub CPU 27
Alternatively, if a negative determination is made in step 202, the processing of this routine is terminated. This step 2
00 or at step 202, for example, when the engine 11
The case where the process of this routine is performed first after the power supply to the U12 is started or the case where the reset process of the main CPU 26 is performed accidentally due to noise or the like can be cited.

After ending the processing of this routine, the sub CPU 27 starts the processing relating to the main routine described above. As described above, in the present embodiment, the main CP
When an abnormality occurs in U26, an abnormality determination flag XFAI
After the L and the position determination flag XIGON are stored as "1" in the standby RAM 30c, the watchdog circuit 28 performs a reset process on each of the CPUs 26 and 27. Therefore, even after the reset processing, each flag XFAI stored in the standby RAM 30c is set.
Based on the contents of L and XIGON, it is possible to reliably determine that an abnormality has occurred in the main CPU 26 before the reset processing. As a result, according to the present embodiment, even if an abnormality occurs in the main CPU 26 and the reset processing is performed on the CPU 26 and the sub CPU 27, after the reset processing, until the ignition switch 24 becomes the “OFF position”. In addition, the fail-safe control that has been performed and the fail-safe control corresponding to the abnormality of the main CPU 26 can be continuously performed.

In this embodiment, after the reset processing, the position determination flag XIGO is stored in the standby RAM 30c.
Only when both N and the abnormality determination flag XFAIL are stored as "1", fail-safe control relating to throttle control is executed. Therefore, for example, the main CPU 2
In the case where the reset processing is performed accidentally due to noise or the like instead of the abnormality of the abnormality determination flag X, the abnormality determination flag X
Since FAIL is “0”, failsafe control is not executed. That is, according to the present embodiment, the main C
It is possible to reliably determine that an abnormality has occurred in the PU 26 and perform the fail-safe control only in that case.

[Second Embodiment] Next, a second embodiment will be described. The abnormality processing method of the ECU 12 according to the present embodiment differs from the first embodiment in the processing procedure in the “abnormal processing routine” described above.

FIG. 5 is a flowchart showing each processing of the "abnormal processing routine" in this embodiment. In step 300 shown in the figure, the sub CPU 27 sets the abnormality determination flag XF stored in the standby RAM 30c.
AIL is read, and it is determined whether or not the flag XFAIL is “1”. If the determination is affirmative here, the sub C
The PU 27 shifts the processing to Step 302.

On the other hand, if a negative determination is made in step 300, the sub CPU 27 proceeds to step 3
Move to 04. Then, in step 304, the sub CPU 27 determines whether or not the position determination flag XIGON is “1”. Here, when an affirmative determination is made, the sub CPU 27 shifts the processing to step 302.

In step 302, the sub CPU 27
Since either the abnormality determination flag XFAIL or the position determination flag XIGON is set to “1”, it is determined that an abnormality has occurred in the main CPU 26 before the reset processing is performed, and the throttle control Start fail-safe control. And the sub CPU2
7 continues this fail-safe control until the ignition switch 24 is switched to the "OFF position" and the engine 11 stops.

After executing the processing of step 302, the sub CPU 27 ends the processing of this routine. Similarly, when a negative determination is made in step 304, the sub CPU 27 ends the processing of this routine. Then, the sub CPU 27 starts the process related to the main routine described above.

As described above, in this embodiment, unlike the first embodiment, even when the abnormality determination flag XFAIL is "0", the reset is performed when the position determination flag XIGON is "1". Main CPU before processing
26, it is determined that an abnormality has occurred, and the fail-safe control is executed after the reset processing.

When an abnormality occurs in the main CPU 26,
The sub CPU 27 needs to determine the abnormality and write the abnormality determination flag XFAIL to "1" in the standby RAM 30c in a relatively short time from when the abnormality occurs until the reset process is performed. Therefore,
When the load on the sub CPU 27 is increasing, the main C
When an abnormality occurs in the PU 26, the abnormality determination and the writing to the standby RAM 30c are delayed, and there is a concern that the reset processing may be performed while the abnormality determination flag XFAIL remains "0".

Here, the abnormality determination by the sub CPU 27 and the abnormality determination flag XFAI in the standby RAM 30c are set.
In order to reliably write L, the timing at which the reset signal RSP is output from the watchdog circuit 28 to the sub CPU 27 may be appropriately delayed. However, it is not a preferable method to delay the reset process in spite of the occurrence of the abnormality in the main CPU 26 as described above.

In this regard, regarding the position determination flag XIGON, even in the case described above, even if the reset processing is started without executing the write processing (step 114 in FIG. 4) to the standby RAM 30c, The flag XIGON is set to “1” as in the case where the writing process is executed normally, and there is no risk of erroneous determination.
Therefore, according to the present embodiment, even in the case described above, it can be determined that an abnormality has occurred in the main CPU 26 before the reset processing based on the position determination flag XIGON, and a failure occurs after the reset processing. Safe control can be performed.

Each of the above embodiments can be implemented by changing the configuration as follows. Even if the configuration is changed in this way, it is possible to obtain substantially the same operational effects as those of the embodiments.

In the above embodiments, the main CPU 26
Watchdog signal W input to sub CPU 27 from
An abnormality of the main CPU 26 is determined based on the DP. On the other hand, the main CPU 26 and the sub CPU
27 is performing mutual communication by DMA,
The state of this communication may be monitored by the sub CPU 27, and if a transmission signal is not input from the main CPU 26 to the sub CPU 27 for a predetermined time or more, it may be determined that an abnormality has occurred in the main CPU 26.

In the above embodiments, the abnormality determination flag X
The abnormality of the main CPU 26 is determined using both the FAIL and the position determination flag XIGON. On the other hand, based on one of the abnormality determination flag XFAIL and the position determination flag XIGON, the main CPU
26 may be determined.

In each of the above embodiments, the position of the ignition switch 24 is determined by the sub CPU 27, and the contents thereof are written in the standby RAM 30c.
Although the abnormality of the main CPU 26 is determined, the position of the ignition switch 24 is determined by the main CPU 26, and the contents thereof are stored in the standby RAM 29.
You may make it write in c.

In the above embodiments, the main CPU 26
, The transmission control and the throttle control are mainly executed by the sub CPU 27. However, the CPUs 26 and 27 are not limited to those performing these controls, but execute various other controls. You may.

In each of the above embodiments, the ECU 12
Although the ECU 12 has two central processing units, the main CPU 26 and the sub CPU 27, the ECU 12 may have a configuration having three or more central processing units.

In the above embodiment, the ECU 12 has the memories 29 and 30 corresponding to the main CPU 26 and the sub CPU 27, respectively.
A configuration in which one memory is shared by the PUs 26 and 27 may be used.

In each of the above embodiments, the fail-safe control shuts off the connection between the throttle valve and the motor and stops the motor. However, as the same control, for example, the throttle opening is changed to the normal opening. Alternatively, the fuel injection amount may be forcibly reduced, or the fuel injection amount may be reduced.

[0081]

According to the first to fourth aspects of the present invention, information for determining an abnormality of the main central processing unit is stored in the memory before the reset processing. Since this memory retains the stored contents even after the reset process is executed, even after the reset process, the main central processing unit detects an abnormality before the reset process based on the information stored in the memory. It can be determined that this has occurred. As a result, even if an abnormality occurs in the main central processing unit and the reset processing is executed for both the main central processing unit and the sub central processing unit, the control of the vehicle is performed until the ignition switch of the vehicle is turned off. The mode can be maintained as the abnormal mode.

In particular, according to the third aspect of the present invention,
When an abnormality occurs in the main central processing unit, it is not necessary to judge the abnormality in a relatively short time from the occurrence of the abnormality until reset processing is executed. Can be prevented from occurring.

Further, in the invention described in claim 4, the on / off state of the ignition switch is stored as an on state in the memory, and information that an abnormality has occurred in the main central processing unit is stored. Only when this is the case, the control mode of the vehicle is maintained in the abnormal response mode. Therefore, it is possible to reliably determine that an abnormality has occurred in the main central processing unit. For example, when the reset processing is performed accidentally due to the influence of noise or the like, the vehicle is erroneously determined. Can be prevented from being held in the abnormal mode, and the control mode of the vehicle can be held in the abnormal mode only after an abnormality has occurred in the main central processing unit.

[Brief description of the drawings]

FIG. 1 is a schematic configuration diagram showing configurations of an engine and an ECU according to a first embodiment.

FIG. 2 is a time chart showing a change of a watchdog signal.

FIG. 3 is a flowchart illustrating an abnormality processing procedure according to the first embodiment.

FIG. 4 is a flowchart illustrating an abnormality detection procedure according to the first embodiment.

FIG. 5 is a flowchart illustrating an abnormality processing procedure according to the second embodiment.

[Explanation of symbols]

12 ... ECU, 24 ... Ignition switch, 26 ...
Main CPU, 27 ... Sub CPU, 30c ... Standby RAM.

Claims (4)

[Claims] An apparatus comprising at least a main central processing unit and a sub-central processing unit, wherein when an abnormality of the main central processing unit is detected, reset processing is performed on the main central processing unit and the sub-central processing unit. An abnormality processing method for a vehicle control computer, wherein information for judging an abnormality of the main central processing unit before the reset processing is retained even if the reset processing is executed. When it is determined that an abnormality has occurred in the main central processing unit based on the information stored in the memory after the reset processing, the vehicle control mode until the ignition switch of the vehicle is turned off. The abnormal processing method of the vehicle control computer, characterized in that the abnormal condition mode is maintained. 2. The abnormality processing method for a vehicle control computer according to claim 1, wherein the auxiliary central processing unit detects an abnormality in the main central processing unit based on a signal input from the main central processing unit. And storing the detected result as the information in the memory. 3. The abnormality processing method for a vehicle control computer according to claim 1, wherein the main central processing unit or the sub central processing unit
The on / off state of the ignition switch is stored in the memory as the information, and the on / off state of the ignition switch is stored as the on state in the memory after the reset processing. An abnormality processing method for a vehicle control computer, wherein the control mode of the vehicle is maintained in the abnormal mode until the vehicle is turned off. 4. The abnormality processing method for a vehicle control computer according to claim 1, wherein the main central processing unit or the sub central processing unit
The on / off state of the ignition switch is stored in the memory as the information, and the sub central processing unit determines the abnormality of the main central processing unit based on a signal input from the main central processing unit, and determines the abnormality. The determination result is stored in the memory as the information, and after the reset processing, the on / off state of the ignition switch is stored in the memory as an on state, and the memory has an abnormality in the main central processing unit. When the information indicating that the occurrence has occurred is stored, the control mode of the vehicle is maintained in the abnormal response mode until the ignition switch of the vehicle is turned off. Processing method.