WO2019082647A1

WO2019082647A1 - Vehicle control device

Info

Publication number: WO2019082647A1
Application number: PCT/JP2018/037657
Authority: WO
Inventors: 文博大澤; 啓人栗原; 暢紀長濱
Original assignee: 日立オートモティブシステムズ株式会社
Priority date: 2017-10-24
Filing date: 2018-10-10
Publication date: 2019-05-02
Also published as: JP6807467B2; JPWO2019082647A1

Abstract

The purpose of the present invention is to provide a vehicle control device that can maintain driving performance in event of a CPU abnormality by identifying and effectively utilizing a normal CPU that is not malfunctioning. To achieve this purpose, this vehicle control device comprises: a microcomputer that has a main CPU and a sub CPU; a power supply unit; a first connection line that connects the power supply unit and the main CPU; a second connection line that connects the power supply unit and the sub CPU; and a current detection unit that detects the value of current passing through the first connection line and the value of current passing through the second connection line. If the value of the current passing through one of the first and second connection lines is greater than a preset value and the value of the current passing through the other of the first and second connection lines is at most the preset value, the microcomputer continues the driving using the main CPU or the sub CPU connected to the other connection line.

Description

Vehicle control device

The present invention relates to a vehicle control device that controls devices mounted on a vehicle.

A vehicle control device (ECU: Electronic Control Unit) that controls devices mounted on the vehicle includes a microcomputer that performs control calculations. The microcomputer generally includes a CPU (Central Processing Unit), a ROM (Read Only Memory) which is a non-volatile memory, and a RAM (Random Access Memory) which is a volatile memory. The CPU is an arithmetic unit for calculating and controlling information stored in the RAM and the ROM. If the CPU fails, the microcomputer can not carry out the correct operation, causing a failure. Therefore, the vehicle control device has a function of diagnosing the CPU.

A method of mutually diagnosing CPU abnormality using a plurality of microcomputers, and a method of checking an output result of each CPU using a plurality of CPUs incorporated in the microcomputer and diagnosing an abnormality from the coincidence There is a so-called lockstep method generally.

Japanese Patent Laid-Open No. 2003-97344 (Patent Document 1) describes a failure diagnosis method of a control CPU. In the document, a control CPU and a monitoring CPU are provided, and the control CPU and the monitoring CPU communicate with each other to confirm that they are in a normal state.

Japanese Patent Laid-Open No. 2000-172521 (Patent Document 2) describes a method of collating output results to detect an abnormality when the same input is given to a plurality of CPUs.

As described above, when an abnormality occurs in the computer or the CPU, failsafe processing is performed so that the car is not in a dangerous state. An example of failsafe processing is described below. For example, when the CPU of the control unit of the automatic transmission breaks down, the control unit of the automatic transmission is controlled to prevent the occurrence of an unintended shift, because the actuator for realizing the shift control of the automatic transmission does not operate properly. There is one that implements a fail-safe process of fixing the actuator and maintaining the transmission gear ratio of the automatic transmission constant.

JP 2003-97344 A Japanese Patent Application Laid-Open No. 2000-172521

The CPU failure diagnosis method described in Patent Documents 1 and 2 has a problem that it can not be determined as a CPU failure unless the CPU is completely broken. Another problem is that it is difficult to detect which CPU has failed. Also, when a CPU failure occurs, despite having a microcomputer or CPU that has not failed, transition to fail-safe processing is performed, and the vehicle as a whole still has the potential to be able to travel normally. There is also a problem that the driving performance is lowered.

An object of the present invention is a vehicle control apparatus capable of maintaining a driving performance by specifying a normal CPU which has not failed and effectively using a normal CPU which has not failed when a CPU abnormality occurs. It is to provide.

Other problems and novel features will be apparent from the description of the present specification and the accompanying drawings.

The outline of typical ones of the present invention will be briefly described as follows.

That is, the vehicle control device connects a microcomputer having a main CPU and a sub CPU, a power supply unit, a first connection line connecting the power supply unit and the main CPU, and the power supply unit and the sub CPU A second connection line, and a current detection unit that detects a current value flowing through the first connection line and a current value flowing through the second connection line. In the microcomputer, the current value flowing through one of the first connection line and the second connection line is larger than a set value, and the current value flowing through the other of the first connection line and the second connection line is If it is less than the set value, the operation is continued using the main CPU or the sub CPU connected to the other.

According to the vehicle control device according to the present invention, it is possible to maintain the driving performance by effectively using a normal CPU that is not broken even when an abnormality occurs in the CPU.

FIG. 1 is a diagram showing a vehicle control system according to a first embodiment. It is a figure showing an example of notional composition of a microcomputer. It is a figure which shows the conceptual structural example of a power supply part. It is a figure for demonstrating the structure of a current measurement part. It is a figure for demonstrating increase of leakage current. It is a figure for demonstrating the correction method of the increase part of leakage current. It is a figure which shows the structural example of the address space of ROM114, ROM124. 7 is a flowchart illustrating an example of a failure potential diagnosis procedure according to the first embodiment. 7 is a flowchart illustrating an example of a failure potential diagnosis procedure according to the first embodiment. FIG. 7 is a diagram for explaining the execution timing of fault potential diagnosis according to the first embodiment. It is a figure explaining the implementation timing of the failure potential diagnosis which concerns on the modification 1. FIG. FIG. 18 is a diagram for explaining the execution timing of failure potential diagnosis according to the second modification. FIG. 18 is a diagram for explaining the execution timing of failure potential diagnosis according to the third modification. FIG. 7 is a diagram for explaining a control procedure according to the first embodiment. FIG. 7 is a diagram showing a vehicle control system according to a second embodiment. FIG. 10 is a diagram for explaining a control procedure according to the second embodiment. FIG. 18 is a diagram for explaining an example of change of assignment of control tasks according to the second embodiment. FIG. 7 is a view showing a vehicle control system according to a third embodiment. FIG. 13 is a diagram for explaining a control procedure according to a third embodiment.

Hereinafter, the problems of the present invention will be described in detail.

The CPU included in the microcomputer of the vehicle control device causes the foreign matter mixed in the semiconductor manufacturing process to short-circuit the adjacent transistor or wiring, and the transistor deterioration failure due to long-term use, etc. There is a possibility of failure without depending on it.

As a commonly known failure mode of a CPU, for example, there are the following. If even one of these failure modes occurs, the failed CPU can not execute arithmetic processing correctly.
(Failure 1) The output of the arithmetic circuit inside the CPU is fixed at "0" or "1".
(Failure 2) The output of the arithmetic circuit inside the CPU shows a result different from the original correct arithmetic result.

In a general CPU failure diagnosis method, it is possible to detect a CPU failure when a transistor constituting the CPU completely fails and the CPU operation result comes to output a value different from the originally intended operation result. it can. In other words, the general CPU failure diagnosis method has a problem that it can not be determined as a CPU failure unless the CPU is completely in failure.

Therefore, in an unstable state before the CPU completely fails, or in a state before the CPU failure is determined in the CPU failure diagnosis, the output result of the CPU is used in the same manner as in the normal operation, so the CPU erroneous operation The result may be used. For example, there is a risk that the vehicle behaves in an unintended manner, for example, by giving an incorrect instruction to the actuator or transmitting an incorrect information to another unit. In addition, when a CPU failure state is diagnosed by a general CPU failure diagnosis method, failsafe control is performed such that the vehicle is in a safe state, and in general, the driving performance of the vehicle is reduced, or The vehicle can not run.

Moreover, although the general CPU failure diagnosis method is not completely failed, there is a problem that it is impossible to detect a CPU having a potential for failure in the future.

If foreign matter adheres to a transistor constituting a CPU and moves due to any cause and foreign matter adheres between adjacent transistors, the adjacent transistor may be short-circuited to cause failure of the CPU. However, depending on the short circuit state between the transistors, the potential fluctuation caused by the short circuit may remain to such an extent that it does not reach the determination threshold. In this case, even if a short circuit failure occurs between the transistors, it is difficult to detect such a failure by the general CPU failure diagnosis method. It is known that the same phenomenon also occurs due to the aging of the transistor.

If such a short circuit failure of the transistor is left, it is assumed that a short circuit condition will progress, and the complete short circuit between the transistors will be diagnosed as a CPU failure. Thus, it is desirable to detect potential failure potential that appears as a failure of the CPU in the future as early as possible.

Further, in a general CPU failure diagnosis method, a failure is diagnosed by a lock step method in which a plurality of CPUs are used and output values when the same input signal is given are compared. In the case of this lock step method, although it is possible to detect even if a failure occurs in either of the CPUs, there is a problem that it is difficult to detect which CPU has failed.

Similarly, in a mutual monitoring method of microcomputers in which information is transmitted / received to / from each other using a plurality of microcomputers and diagnosis is made from the contents of the information, transmission information is destroyed due to CPU failure or erroneous reception information It is difficult to determine which CPU has failed because there is a failure such as calculation.

As described above, in general CPU fault diagnosis, it is difficult to identify a faulty CPU. Also, in general, when one of a plurality of CPUs detects a CPU failure, a method of shifting to fail-safe processing is adopted. In other words, despite having a microcomputer or CPU that has not failed, in order to shift to fail-safe processing, the driving performance is lowered despite the fact that the vehicle as a whole can still run normally. It is the current situation that has been

Embodiment
Next, an embodiment of the present invention will be described.

In an embodiment of the present invention, a CPU incorporated in a microcomputer detects a CPU failure as early as possible by judging a failure potential of the CPU caused by foreign particles mixed in during manufacturing or aging. Can. In addition, it is possible to identify a normal CPU that has not failed and at the time of a failure of CPU or when an abnormality has occurred. By effectively using a normal CPU that has not failed, the operating performance can be calculated. A maintainable vehicle control system (100) can be provided.

In the embodiment of the present invention, the CPU (111, 112, 121, 122) is a power supply line (connection line: L1) supplying power to the CPU by shorting or aging of the transistor causing the failure of the CPU. , L 2, L 3, L 4)), and focus on the feature of increasing current (leakage current). Detecting and measuring the value of the leak current of the CPU using current measurement units (current detection units: 150, 160, 152, 162), and judging the deterioration state of the transistor from the value or amount of the measured leak current Can. That is, the failure potential of the CPU can be determined.

However, when the CPU is in the drive state, the current flowing through the power supply line of the CPU includes the leak current component of the CPU and the drive current component of the CPU, and excluding the drive current component of the CPU, the leak of the CPU It is necessary to measure only the current component. Here, when the operation state of the CPU is a state in which the CPU is not driving (a non-calculation state), that is, a standby state, it is possible to make the driving current component of the CPU zero. Furthermore, separately from the CPU in the standby state, the CPU in the driven state is used to measure the current flowing to the CPU in the standby state. This current is treated as CPU leak current (Ileak 2) for fault potential diagnosis. As described above, in order to diagnose the failure potential, the CPU to be measured is in the standby state, and the measurement CPU is in the driving state.

Furthermore, since the CPU leak current (Ileak 2) for fault potential diagnosis includes variations due to manufacturing variations of the microcomputer or CPU and variations due to temperature changes of the microcomputer or CPU, excluding these variation factors of the leak current, It is necessary to extract only the increase in CPU leak current due to transistor degradation. For this reason, it is necessary to correct the measured value of the CPU leak current for failure potential diagnosis. Correction of leak current variation due to manufacturing variation of microcomputer or CPU and leak current variation due to temperature change are corrected.

As a method of correcting leak current variation due to manufacturing variation of microcomputer or CPU, measure CPU leak current value (Ileak1) for fault potential diagnosis at the time of microcomputer or CPU production, and store memory area (ROM: 114, 124) of microcomputer. ) Is stored as a leak current value at the time of CPU manufacture. By subtracting the leak current value (Ileak1) at the time of microcomputer manufacture or CPU manufacturing from CPU leak current value (Ileak2) for current failure potential diagnosis, increase in leak current from manufacture time of microcomputer or CPU to the present The minutes (ΔIleak) can be extracted. Let this be the increase amount of CPU leak current before temperature correction. Further, the CPU leak current value (Ileak1) for failure potential diagnosis may be stored by measuring the CPU leak current for failure potential diagnosis at the time of manufacture of the vehicle control device, not at the time of manufacture of the microcomputer or CPU.

Next, the change in leakage current due to temperature is corrected. Generally, it is known that CPU leakage current and CPU temperature have a correlation. Therefore, a correlation map (TCM) of the temperature of the CPU and the leak current of the CPU can be prepared in advance. The temperature of the microcomputer or CPU can be measured by a temperature sensor (TSEN: 115, 125) built in the microcomputer. Alternatively, it may be estimated from temperature information from a temperature sensor disposed on the substrate of the vehicle control device (1). From the measured CPU temperature and the CPU leak current temperature change map (TCM), it is possible to calculate the amount of change in CPU leak current due to temperature.

The CPU leak current increase amount (ΔIleakc) after the temperature correction can be calculated using the CPU leak current increase amount (ΔIleak) before the temperature correction and the CPU leak current change amount (Icv) due to the temperature. When the increase amount (ΔIleakc) of the CPU leak current after the temperature correction is larger than the determination threshold (TH) of the increase amount of the current determined to have a predetermined failure potential, the CPU has not completely failed. However, it can be determined that it has a potential for failure in the future. The determination threshold can be regarded as a set value or a predetermined value.

The measurement of the leak current and the CPU failure potential diagnosis can be performed at any timing, but it is effective to carry out at the time of starting or shutdown of the vehicle control device in order to put at least one CPU in the standby state. Also, the combination of CPUs to be diagnosed may be changed at each startup or every shutdown (FIGS. 9A, 9B, 9C, 9D).

According to the vehicle control device according to the embodiment, the CPU can calculate normally at the present time, but can detect a state in which it may fail in the future at an early stage.

As described above, although the failure is detected using a plurality of microcomputers and a plurality of CPUs, although the occurrence of a failure can be detected, the failed CPU could not be identified. Therefore, when a CPU failure occurs, fail-safe processing such as stopping the vehicle control actuator is generally executed by degenerating the vehicle control even if there is another normal CPU.

On the other hand, according to the embodiment, since the failed CPU can be identified from the result of the failure potential diagnosis of the CPU, the vehicle control is degenerated by using the normal CPU which is not failed when the failure of the CPU occurs. The traveling performance of the vehicle can be maintained without causing

Further, according to the embodiment, before the CPU having a high failure potential completely fails, the operation control that the CPU having a high failure potential takes over is transferred to another CPU, and the vehicle control device does not degenerate functions. Since the driver can be notified of the CPU failure, it is possible to move safely and smoothly to repair the vehicle.

Further, according to the embodiment, when the CPU completely fails, the normal CPU can be used even in the failure detection delay time until the failure is detected, so that the original operation performance is not sacrificed. It is possible to prevent the vehicle from acting unintended due to sudden stop or malfunction of an actuator such as a transmission or the like.

Further, according to the embodiment, before the CPU completely fails, the CPU operation load is reduced by degenerating the task calculated by the CPU having a high failure potential in advance, thereby extending the time until the CPU completely fails. can do.

Hereinafter, examples will be described using the drawings. However, in the following description, the same components may be assigned the same reference numerals and repeated descriptions may be omitted. In addition, although drawing may be represented typically compared with an actual aspect, in order to clarify description, it is an example to the last, and does not limit interpretation of this invention.

Hereinafter, Example 1 will be described using the drawings.

(Configuration of vehicle control system)
FIG. 1 is a diagram showing a vehicle control system according to a first embodiment. The vehicle control device system 1 includes a vehicle control device 100 which is an electronic control unit (ECU: Electronic Control Unit). The vehicle control device 100 is a device that electronically controls on-vehicle devices (for example, an automatic transmission, an engine, and the like) mounted on the vehicle. The vehicle control device 100 includes a main microcomputer (MMC) 110, a sub microcomputer (SMC) 120, a main power supply unit (MPSP) 130, a sub power supply unit (SPSP) 140, and a main CPU current measurement unit (MCM) 150, 152, A sub CPU current measurement unit (SMCM) 160, 162 and a temperature sensor 170 are provided. The main microcomputer (MMC) 110 may be referred to as a first microcomputer, and the sub microcomputer (SMC) 120 may be referred to as a second microcomputer.

The main microcomputer 110 is a microcomputer or a microcontroller that controls in-vehicle devices mounted on a vehicle. The main microcomputer 110 controls on-vehicle equipment by controlling, for example, an actuator (ACU) 202. Also, a message can be displayed via the display device (DISP) 203. The message may be in any form, for example, a message such as a character or an image, a notification by lighting a lamp, or the like.

The main microcomputer (MMC) 110 is a semiconductor integrated circuit device, and is formed, for example, by forming a plurality of CMOS transistors on a semiconductor chip such as single crystal silicon by a known CMOS semiconductor manufacturing technology. . The main microcomputer (MMC) 110 includes a main CPU (MCPU: first CPU) 111, a sub CPU (SCPU: second CPU) 112, a random access memory (RAM) 113 which is a volatile memory, and a ROM (read) which is a non-volatile memory. Only memory (114), a temperature sensor (TSEN) 115 capable of measuring the temperature of the main microcomputer 110, a comparator (COMP) 116, and an analog-to-digital converter (ADC) 117. The main CPU 111 and the sub CPU 112 are arithmetic devices that perform control calculations necessary to control the in-vehicle device. The RAM 113 temporarily stores data used by the main CPU 111 and the sub CPU 112. The ROM 114 stores control programs executed by the main CPU 111 and the sub CPU 112, diagnostic processing glomograms described later, etc., and information received by the main CPU 111 and the sub CPU 112, received from the sub microcomputer 120 and other in-vehicle devices. Information can be stored. The comparator 116 supplies the same input information to the main CPU 111 and the sub CPU 112, and collates the output results of the main CPU 111 and the sub CPU 112. If there is no abnormality in the main CPU 111 and the sub CPU 112, the comparison results of the comparator 116 match. When the comparison result of the comparator 116 does not match, an abnormality in the main CPU 111 or the sub CPU 112 can be detected. This configuration is a general lock step system.

A power supply line (first connection line) L1 provided between the main CPU 111 and the main power supply unit 130 includes a main current measurement unit (current detection unit) 150 that measures a drive current of the main CPU 111. The power supply line (second connection line) L2 provided between the sub CPU 112 and the main power supply unit 130 includes a sub current measurement unit (current detection unit) 160 that measures the drive current of the sub CPU 112. The analog-to-digital converter (ADC) 127 of the sub-microcomputer 120, which will be described later, is connected to the main current measuring unit 150 and the sub-current measuring unit 160 via the measurement wirings LM1 and LM2, Second connection line) Measure the current value of the drive current of the main CPU 111 and the sub CPU 112 flowing through the L1 and L2.

The sub microcomputer 120 has the same configuration as the main microcomputer 110. That is, submicrocomputer (SMC) 120 is a semiconductor integrated circuit device, and is formed, for example, by forming a plurality of CMOS transistors on a semiconductor chip such as single crystal silicon by a known CMOS semiconductor manufacturing technology. ing. The sub microcomputer (SMC) 120 includes a main CPU (MCPU) 121, a sub CPU (SCPU) 122, a random access memory (RAM) 123 which is a volatile memory, a read only memory (ROM) 124 which is a non-volatile memory, A temperature sensor (TSEN) 125 capable of measuring the temperature of the microcomputer 120, a comparator (COMP) 126, and an analog-to-digital converter (ADC) 127 are provided. The main CPU 121 and the sub CPU 122 are arithmetic devices that perform control calculations necessary to control the in-vehicle device. The RAM 123 temporarily stores data used by the main CPU 121 and the sub CPU 122. The ROM 124 stores control programs executed by the main CPU 121 and the sub CPU 122, diagnostic processing glomograms to be described later, etc., and information received by the main CPU 121 and the sub CPU 122 and received from the main microcomputer 110 and other in-vehicle devices. Information can be stored. The comparator 126 gives the same input information to the main CPU 121 and the sub CPU 122, and collates the output results of the main CPU 121 and the sub CPU 122. If there is no abnormality in the main CPU 121 and the sub CPU 122, the comparison results of the comparator 126 match. When the comparison result of the comparator 126 does not match, an abnormality of the main CPU 121 or the sub CPU 122 can be detected. This configuration is a general lock step system. The function of the sub microcomputer 120 may be limited to detecting the functional abnormality of the main microcomputer 110 only.

A power supply line (third connection line) L3 provided between the main CPU 121 and the sub power supply unit 140 includes a main current measurement unit (current detection unit) 152 that measures a drive current of the main CPU 121. The power supply line (fourth connection line) L4 provided between the sub CPU 122 and the sub power supply unit 140 includes a sub current measurement unit (current detection unit) 162 that measures the drive current of the sub CPU 122. The analog-to-digital converter (ADC) 117 of the main microcomputer 110 is connected to the main current measuring unit 152 and the sub current measuring unit 162 via the measurement wirings LM3 and LM4, and the power supply lines (third and fourth connections Current values of drive currents of the main CPU 121 and the sub CPU 122 flowing through the lines L3 and L4 are measured.

The submicrocomputer 120 uses the current value from the main current measurement unit 150 and the subcurrent measurement unit 160 and the temperature information from the temperature sensor 115 and fails the main CPU 111 and the sub CPU 112 of the main microcomputer 110 according to the procedure described later. The potential diagnosis is performed, and the diagnosis result is stored in a storage area such as the ROM 124 of the submicrocomputer 120. The submicrocomputer 120 notifies the main microcomputer 110 of information on the diagnosis result when the main microcomputer 110 is activated next time.

On the other hand, the main microcomputer 110 uses the current value from the main current measurement unit 152 and the sub current measurement unit 162 and the temperature information from the temperature sensor 125 to follow the procedure described later for the main CPU 121 and the sub CPU 122 of the sub microcomputer 120. And the diagnosis result is stored in a storage area such as the ROM 114 of the main microcomputer 110. The main microcomputer 110 notifies the sub microcomputer 120 of information on the diagnosis result when the sub microcomputer 120 is started next time.

Thus, the submicrocomputer 120 performs failure potential diagnosis of the main microcomputer 110, and the main microcomputer 110 performs failure potential diagnosis of the submicrocomputer 120. The reason for this is that, as described above, the CPU can not distinguish between the CPU leakage current and the CPU drive current in the driven state, so the CPU is not driven, so-called CPU standby state, and another normal drive is in progress. By measuring the drive current of the CPU in the standby state by the microcomputer, it is possible to accurately measure the leak current of the CPU.

The vehicle control device 100 receives supply of power from a battery 201 mounted on the vehicle. The main power supply unit 130 steps up or down the voltage received from the battery 201 and supplies the voltage to the main microcomputer 110. Similarly, the sub power supply unit 140 boosts or steps down the voltage received from the battery 201 and supplies the voltage to the sub microcomputer 120. Main power supply unit 130 and sub power supply unit 140 are configured to start power supply to main microcomputer 110 and sub microcomputer 120 according to the reception of power signal (PS) 200.

The main power supply unit 130 is internally divided into circuits so as to individually supply power to the main CPU 111, the sub CPU 112, the RAM 113, and the ROM 114, respectively. This is to suppress the influence of the drive current supplied to the main CPU 111 and the sub CPU 112 from the current fluctuation of the RAM 113 and the ROM 114. Similarly, the sub main power supply unit 140 is internally divided into circuits so as to individually supply power to each of the main CPU 121, the sub CPU 122, the RAM 123, and the ROM 124. This is to suppress the influence of the drive current supplied to the main CPU 121 and the sub CPU 122 from the current fluctuation of the RAM 123 and the ROM 124. The configurations of the main power supply unit 130 and the sub main power supply unit 140 will be described later with reference to FIG.

(Configuration of microcomputer)
FIG. 2 is a view showing a conceptual configuration example of the microcomputer MC. The microcomputer MC shows the configurations of the main microcomputer 110 and the main microcomputer 120. The microcomputer MC includes main CPUs (MCPUs: 111, 121), sub CPUs (SCPUs: 112, 121), RAMs (113, 123), ROMs (114, 124) and a peripheral circuit PERI. It is connected. The peripheral circuit PERI includes, for example, a temperature sensor TSEN (115, 125), a comparator COMP (116, 126), an analog-to-digital converter ADC (117, 127), a control area network (Controller Area Network) interface CANIF, It has an input / output port IOP and the like.

The microcomputer MC has an external terminal VDD1 for supplying the power supply voltage Vdd1 to the MCPU, an external terminal VDD2 for supplying the power supply voltage Vdd2 to the SCPU, an external terminal VDD3 for supplying the power supply voltage Vdd3 to the RAM, and a power supply to the ROM. It has an external terminal VDD4 for supplying the voltage Vdd4 and a reference potential terminal VSS to which a ground voltage such as 0 (zero) volt or a reference voltage Vss is supplied. The microcomputer MC further includes external terminals AVDD and AVSS for supplying the analog power supply voltage Avdd and the analog reference voltage Avss to the analog-to-digital converter ADC, the temperature sensor TSEN, the comparator COMP, CANIF, the signal input / output port IOP, etc. And an external terminal VDD5 for supplying the power supply voltage Vdd5 to the peripheral circuit PERI. The power supply voltages Vdd1, Vdd2, Vdd3, Vdd4 and Vdd5 can be different power supply voltages.

As shown in FIG. 2, the analog-to-digital converter ADC has analog signal input terminals AN0, AN1, AN2, AN3. When the microcomputer MC is the main microcomputer 110, the analog signal input terminals AN0 and AN1 are connected to the MCM 152 via the LM3, and the analog signal input terminals AN2 and AN3 are connected to the SCM 162 via the LM4. Be done. When the microcomputer MC is the main microcomputer 120, the analog signal input terminals AN0 and AN1 are connected to the MCM 150 via the LM1, and the analog signal input terminals AN2 and AN3 are connected to the SCM 160 via the LM2. Connected to The analog-to-digital converter ADC may have analog signal input terminals AN4 to ANn in addition to the analog signal input terminals AN0, AN1, AN2, and AN3. The analog signal input terminals AN4-ANn can be connected to the output of another analog sensor or the like.

The CANIF also has an input / output terminal CAN0 that can be connected to the CAN bus. The CAN bus can be connected to an electric power steering EPS or other electronic control unit (ECU) capable of CAN communication based on the CAN protocol. The signal input / output port IOP has port terminals PD0 to PDN that enable input and output of digital signals.

(Configuration of power supply unit)
FIG. 3 is a diagram showing a conceptual configuration example of the power supply unit PSP. The power supply unit PSP shows the configuration of the main power supply unit (MPSP) 130 and the sub power supply unit (SPSP) 140. The power supply unit PSP has a plurality of regulators REG1-RG6. The regulator REG1 supplies the power supply voltage to the external terminal VDD1 for supplying the power supply voltage Vdd1 to the MCPU. The regulator REG2 supplies the power supply voltage to the external terminal VDD2 for supplying the power supply voltage Vdd2 to the SCPU. The regulator REG3 supplies the power supply voltage to the external terminal VDD3 for supplying the power supply voltage Vdd3 to the RAM. The regulator REG4 supplies the power supply voltage to the external terminal VDD4 for supplying the power supply voltage Vdd4 to the ROM. The regulator REG5 supplies the power supply voltage Vdd5 to the external terminal VDD5 for supplying the power supply voltage to the peripheral circuit PERI. The regulator REG6 supplies the analog power supply voltage Avdd and the analog reference voltage Avss to the external terminals AVDD and AVSS for supplying the analog power supply voltage Avdd and the analog reference voltage Avss to the analog-digital conversion circuit ADC. The plurality of regulators REG1 to RG6 are supplied with voltages from the battery (BAT) 201 in response to the reception of the power supply signal 200 instructing start of power supply, and the power supply voltages Vdd1 to Vdd5, Avdd, and power supply voltages for analog are supplied. Generates Avdd and the analog reference voltage Avss.

Thus, the power supply unit PSP (130, 140) includes the main CPU (MCPU: 1111, 121), the sub CPU (SCPU: 112, 122), the RAM (113, 123), the ROM (114, 124), and the periphery. A plurality of regulators REG1 to RG6 are provided to enable power supply individually to each of the circuit PERI and the analog-to-digital converter ADC (117, 127). As described above, the drive current supplied to the main CPU 111 and the sub CPU 112 is the RAM (113, 123), the ROM 114 (114, 124), the peripheral circuit PERI, the analog-to-digital converter ADC (117, 127). This is to suppress the influence of the current fluctuation.

In FIG. 2 and FIG. 3, external terminal VDD5 for supplying power supply voltage to peripheral circuit PERI and regulator REG5 for generating power supply voltage for peripheral circuit PERI are further configured as a plurality of external terminals and a plurality of regulators. Also good. Thus, the power supply potential can be supplied according to the required specification of the power supply potential of each circuit or each functional module included in the peripheral circuit PERI.

(Configuration of current measurement unit)
FIG. 4 is a diagram for explaining the configuration of the current measurement unit. FIG. 4 exemplarily shows the configuration of the main current measurement unit 150 as a current measurement unit. The configuration of the current measurement unit 150 is the same as the configuration of the

current measurement units

160, 152, 162, and the other connection configuration is easily understood from FIG. 1, so the description of the configuration of the

current measurement units

160, 152, 162 Is omitted. The power supply measurement unit 150 includes a resistance element R1 having a resistance value Rs. The resistance element R1 is provided in series in the power supply line L1 provided between the output of the regulator REG1 of the main power supply unit 130 and the external terminal VDD1 of the main CPU 111 of the main microcomputer 110. The nodes VRH and VRL at both ends of the resistive element R1 are respectively connected to analog input terminals AN0 and AN1 of the analog-to-digital converter 127 built in the sub microcomputer 120 via the LM1. With the same configuration, the current measurement unit 160 is connected to the analog input terminals AN2 and AN3 of the analog-to-digital converter 127 built in the sub-microcomputer 120 via the LM2. The

current measurement units

152 and 162 are connected to analog input terminals AN0 and AN1 and AN2 and AN3 of the analog-to-digital converter circuit 117 built in the main microcomputer 110 via the LM3 and the LM4, respectively.

With such a configuration, the drive current Is including the leak current of the main CPU 111 flowing to the resistance element R1 can be obtained by the following equation.
Is = Vs / Rs
Here, Vs is a voltage value corresponding to the voltage difference between the node VRH and the node VRL at both ends of the resistive element R1.

That is, by measuring the voltage value Vs between the node VRH and the node VRL by the analog-to-digital converter 127, the drive current Is including the leak current of the main CPU 111 can be obtained.

The output voltage value of the regulator REG1 of the main power supply unit 130 is the reference operating voltage of the main CPU 111 of the main microcomputer 110, the resistance value Rs of the resistance element R1, and the maximum current value of the drive current Is flowing through the resistance element R1. It may be determined so as to satisfy the reference operating voltage of the main CPU 111 of the main microcomputer 110 in consideration of the voltage drop (Vs) due to the drive current Is flowing through the resistance element R1. The respective output voltage values of the regulator REG2 of the main power supply unit 130 and the regulators REG1 and REG2 of the sub power supply unit 140 are also the sub CPU 112 of the main microcomputer 110 and the main CPU 121 and sub CPU 122 of the sub microcomputer 120 based on the same idea as above. It should be determined so as to satisfy each of the reference operating voltages.

Although the example using the analog-to-

digital converter circuits

117 and 127 built in the

microcomputers

110 and 120 has been described above, the present invention is not limited to this. When a conversion bit number (for example, 100 bits) larger than the conversion bit number (for example, 10 bits or 12 bits) of the analog-to-

digital converter circuits

117 and 127 is required, the vehicle control apparatus 100 externally adds a large number of conversion bits. The individual analog-to-digital converter circuit may be implemented and used instead of the analog-to-

digital converter circuits

117 and 127. In the measurement of the leak current value, since the leak current value itself is small, the leak current value can be more accurately measured by using an individual analog-to-digital converter having a large number of conversion bits.

(Leakage current and its correction)
FIG. 5 is a diagram for explaining the increase of the leak current. The main microcomputer 110 and the sub-microcomputer 120 are composed of a plurality of CMOS transistors and the like, and leakage current may increase due to factors such as the appearance of manufacturing defects and aged deterioration due to long-term use.

In FIG. 5, the vertical axis indicates the leak current value Ileak, and the horizontal axis indicates the time Time. Generally, a manufacturer of a semiconductor integrated circuit device performs a pre-shipment inspection before shipment of the semiconductor integrated circuit device, measures a leak current, and a semiconductor integrated circuit device in which the leak current Ileak1 is within a predetermined range. Ship as normal products. In FIG. 5, the leak current value Ileak1 will be described using an example measured by the pre-shipment inspection of the main microcomputer 110 and the sub microcomputer 120. However, the leak current value Ileak1 It may be measured and stored in the ROM (114, 124) of the main microcomputer 110 or the sub microcomputer 120.

At time T1, the leak current value Ileak1 of the normal product at the time of inspection before shipment is shown, and at time T2, the leak current value Ileak2 of the abnormal product whose leak current Ileak increased due to long-term use is shown. At time T1, the range of the leak current of the normal product is, for example, the range between the minimum value (0 mA (milliamps)) and the maximum value (M mA), and the main micro-circuits measured by the pre-shipment inspection It is assumed that the leak current value Ileak1 of the computer 110 or the submicrocomputer 120 is, for example, TmA.

At time T2, it is assumed that the leak current value Ileak2 of the main microcomputer 110 or the sub microcomputer 120 has increased to T + Y mA. That is, the leak current Ileak is increased by the value of YmA = ΔIleak = Ileak2-Ileak1.

The value of ΔIleak includes, in addition to deterioration over time, fluctuation of temperature characteristics of leakage current in main microcomputer 110 or sub microcomputer 120 and fluctuation of leakage current due to manufacturing variation of main microcomputer 110 or sub microcomputer 120. It is done. Therefore, it is necessary to correct the value of the increase amount ΔIleak of the leak current.

FIG. 6 is a diagram for explaining a correction method of an increase in leak current. The increase amount ΔIleak of the leak current is corrected in consideration of the leak current value Ileak1 at the time of manufacture, the leak current value Ileak2 at the time of measurement, and the temperature characteristics or temperature dependency of the leak current value Ileak2. The temperature characteristic or temperature dependency of the leak current value Ileak2 is corrected by the temperature information TM measured by the temperature sensor TSEN of the main microcomputer 110 or the sub microcomputer 120 and the temperature correction map (table) TCM of the leak current. . The temperature correction map (table) TCM is unique to each of the main microcomputer 110 or the sub microcomputer 120, and can be obtained from, for example, a semiconductor manufacturer. The temperature correction map (or temperature correction table) TCM describes the correction current value (Icv) of the leak current at each temperature.

Therefore, the increase amount ΔIleakc of the corrected leak current used for diagnosing the failure potential can be obtained by the following equation.
ΔIleakc = Ileak2 + Icv-Ileak1
Here, Icv represents the correction current value described in the temperature correction map (table) TCM in the temperature information TM.

As a result, it is possible to eliminate variations in the leak current value due to temperature and manufacturing variations of the main microcomputer 110 or the sub microcomputer 120, and to obtain the corrected increase amount ΔIleakc of the leak current value due to aging or the like. When diagnosing the failure potential, the presence or absence of the failure potential is determined depending on whether the corrected increase amount of leakage current ΔIleakc exceeds a threshold value or a predetermined value (TH). With such a configuration, it is possible to determine whether the CPU (111, 112, 121, 122) is not completely broken but has a potential to be broken in the future. The threshold value or predetermined value (TH) can also be referred to as a set value or a prescribed value.

(Example of configuration of address space of ROMs 114 and 124)
FIG. 7 is a view showing a configuration example of the address spaces of the ROM 114 and the ROM 124. As shown in FIG. 7A shows an example of the configuration of the address space of the ROM 114, and FIG. 7B shows an example of the configuration of the address space of the ROM 124.

As shown in FIG. 7A, in the address space of the ROM 114 of the main microcomputer 110, programs executed by the main CPU 111 and the sub CPU 112, data referred to at the time of program execution, maps or tables, data of operation results, etc. Is stored. The ROM 114 has, for example, a first address space ADSP1a and a second address space ADSP2a.

The first address space ADSP1a stores the control program CPROG and reference data or the like referred to when the control program CPROG is executed. The control program CPROG is a control program for electronically controlling on-vehicle devices (for example, an automatic transmission, an engine, etc.) mounted on a vehicle.

The processing program or data according to the present invention is stored in the second address space ADSP 2a, and the diagnostic program DPROG described with reference to FIGS. 8A and 8B and the control executed when judging abnormality of the CPU described with FIG. A program CNTPROG, a calculation program LCCPROG for leak current correction described in FIG. 6 is stored. The second address space ADSP 2 a further includes a temperature correction map (table) TCM of the leak current related to the main microcomputer 110, a threshold value or a predetermined value (TH), a leak current value Ileak1 (110), and the main of the sub microcomputer 120. The measured leakage current values Ileak2 (121) and Ileak2 (122) for the CPU 121 and the sub CPU 122 are stored. In the second address space ADSP2a, the corrected leak current increase amounts ΔIleakc (121), ΔIleakc (122), and the diagnosis results DResult (121) and DResult (122) concerning the main CPU 121 and the sub CPU 122 of the submicrocomputer 120. And experience information DHist indicating a diagnosis history is stored.

The diagnosis results DResult (121) and DResult (122) are the results of diagnosis regarding the submicrocomputer 120 by the diagnostic program DPROG, and the presence or absence of the failure potential of the main CPU 121 and the sub CPU 122 of the submicrocomputer 120 is stored. The experience information DHist stores data of the main microcomputer 110 or the sub-microcomputer 120 last or previously diagnosed.

As shown in FIG. 7B, in the address space of the ROM 124 of the submicrocomputer 120, programs executed by the main CPU 121 and the sub CPU 122, data referred to at the time of program execution, maps or tables, data of operation results, etc. Is stored. The ROM 124 has, for example, a first address space ADSP1b and a second address space ADSP2b.

The first address space ADSP1b stores the control program CPROG and reference data or the like referred to when the control program CPROG is executed. The control program CPROG is a control program for electronically controlling on-vehicle devices (for example, an automatic transmission, an engine, etc.) mounted on a vehicle.

The second address space ADSP 2b stores the processing program or data according to the present invention, and the diagnostic program DPROG described in FIG. 8, the control program CNTPROG executed at the time of abnormality judgment of the CPU described in FIG. A calculation program LCCPROG for leak current correction described in FIG. 6 is stored. The second address space ADSP 2 b further includes a temperature correction map (table) TCM of the leak current related to the submicrocomputer 120, a threshold value or a predetermined value (TH), a leak current value Ileak 1 (120), and the main microcomputer 110. The measured leakage current values Ileak2 (111) and Ileak2 (112) for the CPU 111 and the sub CPU 112 are stored. In the second address space ADSP2b, the corrected leak current increase amounts ΔIleakc (111), ΔIleakc (112), and the diagnosis results DResult (111) and DResult (112) concerning the main CPU 111 and the sub CPU 112 of the main microcomputer 110. And experience information DHist indicating a diagnosis history is stored.

The diagnosis results DResult (111) and DResult (112) are the results of diagnosis regarding the main microcomputer 110 by the diagnosis program DPROG, and the presence or absence of the failure potential of the main CPU 111 and the sub CPU 112 of the main microcomputer 110 is stored. The experience information DHist stores data of the main microcomputer 110 or the sub-microcomputer 120 last or previously diagnosed.

In FIGS. 7A and 7B, the measured leak current values Ileak 2 (111), Ileak 2 (112), Ileak 2 (121), Ileak 2 (122), and the increase amount of the leak current after correction. Although an example of storing ΔIleakc (111), ΔIleakc (112), ΔIleakc (121), ΔIleakc (122) in the address space of the

ROMs

114 and 124 has been shown, store these values in the address spaces of the

ROMs

114 and 124. Instead, it is also possible to temporarily store in the

RAMs

113 and 123 at the time of diagnosis.

(Example of failure potential diagnosis procedure)
FIGS. 8A and 8B are flowcharts illustrating an example of the failure potential diagnosis procedure of the CPU according to the first embodiment. The lower A in FIG. 8A and the upper A in FIG. 8B are connected. FIGS. 8A and 8B are flowcharts illustrating a procedure for diagnosing the failure potential of the main CPU 111 and the sub CPU 112 of the main microcomputer 110 using the sub microcomputer 120 when the vehicle control device 100 shuts down. A flowchart for diagnosing the failure potential of the main CPU 121 and the sub CPU 122 of the sub microcomputer 120 using the main microcomputer 110 is considered to be easily understood from FIGS. 8A and 8B, and thus the description thereof is omitted. Hereinafter, each step of FIG. 8A and FIG. 8B is demonstrated.

(Step S100)
When the main microcomputer 110 and the sub microcomputer 120 receive the power supply signal 200 indicating that the power is turned on, this flowchart is started. At the time of starting this flowchart, it is assumed that the main power supply IC 130 and the sub power supply IC 140 have started to supply power according to the power supply signal 200 respectively. This flowchart corresponds to the diagnostic program DPROG shown in FIG.

(Step S101)
The main microcomputer 110 and the sub-microcomputer 120 are provided with leak current values (Ileak1) at the time of manufacture of the main microcomputer 110 and the sub-microcomputer 120 from respective storage areas (ROMs 114 and 124) and failure potential operation experience information (DHist) Read out. The leak current value (Ileak1) described above measures the leak current of the main microcomputer 110 and the sub-microcomputer 120 not only at the time of manufacturing the main microcomputer 110 and the sub-microcomputer 120 but also at the time of manufacturing the vehicle control device 100. It may be stored in each storage area (ROMs 114 and 124).

(Step S102)
The main microcomputer 110 does not carry out the failure potential diagnosis until the condition for carrying out the failure potential diagnosis is established. The execution condition of the failure potential diagnosis is satisfied when all the self shut processing performed after the power supply signal 200 is turned off is completed.

(Step S103)
The main microcomputer 110 determines a microcomputer to be diagnosed with the failure potential of this time from the failure potential implementation experience information of the main microcomputer 110 and the sub microcomputer 120 read out in step S101, and sets it as a microcomputer to be measured. For example, when the failure potential of main CPU 111 and sub CPU 112 in main microcomputer 110 is diagnosed in the previous failure potential diagnosis, main CPU 121 and sub CPU 122 in sub microcomputer 120 are regarded as diagnosis targets in this failure potential diagnosis. Do. As described above, in this example, the reason for switching the microcomputer to be diagnosed each time self-shut processing is performed is that the main CPU and the sub CPU built in the microcomputer to be diagnosed need to be in the stop state (standby state). It is. Details will be described in the description of FIG. 9A. In this example, the microcomputer to be measured is described as the main microcomputer 110, which diagnoses the failure potential of the main CPU 111 and the sub CPU 112 built in the main microcomputer 110.

(Step S104)
In order to estimate the temperatures of the main CPU 111 and the sub CPU 112 of the microcomputer to be measured 110, the temperature of the main microcomputer 110 is measured from the temperature sensor 115 built in the main microcomputer 110. In this example, the temperature sensor 115 built in the main microcomputer 110 is used, but the temperature sensor may be the temperature sensor 170 mounted in the vehicle control device 100. Moreover, you may use the temperature value estimated by the temperature condition of the external world, and the operating time of the vehicle control apparatus 100. FIG.

(Step S105)
From the temperature information of the main microcomputer 110 acquired in step S104, the main CPU 111 and the sub CPU 112 of the measured microcomputer 110 correct the temperature change of the leakage current Ileak2 of the

CPUs

111 and 112 due to the temperature. The temperature correction value Icv of the leakage current is calculated from the correction map TCM. The temperature correction map TCM of the leak current is defined in advance for each type of microcomputer to be measured. The temperature correction map TCM of the leakage current can be stored in advance in the

ROMs

114 and 124 provided in the main microcomputer 110 and the sub microcomputer 120, as shown in FIG.

(Step S106)
The sub-microcomputer 120 is notified of the temperature correction value Icv of the leakage current calculated in step S105.

(Step S107)
The main CPU 111 and the sub CPU 112 of the microcomputer to be measured 110 are shifted to the stop state (standby state), and the subsequent calculations are performed using the sub microcomputer 120.

(Step S108)
It waits for the measured microcomputer 110 to complete transition to the standby state mode. The determination of the completion of the transition is made based on a specified time or that the output of the measured microcomputer 110 is turned off.

(Step S109)
The submicrocomputer 120 measures the current leakage current values (Ileak2 (111), Ileak2 (112)) of the main CPU 111 and the sub CPU 112 of the microcomputer to be measured 110 by the main current measurement unit 150 and the subcurrent measurement unit 160. Do.

(Step S110)
The submicrocomputer 120 processes the leak current (Ileak1) at the time of manufacture acquired in step S101 and the current leak current (Ileak2 (111), Ileak2 (112)) acquired in step S109 for each of the main CPU 111 and the sub CPU 112 From the leak current temperature correction value (Icv) acquired in S106, the diagnostic leak current values (ΔIleakc (111), ΔIleakc (112)) are calculated. That is, the calculation program LCCPROG of FIG. 7 is executed, and the calculation for correcting the leakage current value described in FIG. 6 is executed.

(Step S111)
The submicrocomputer 120 determines, for each of the main CPU 111 and the sub CPU 112, whether or not the diagnostic leak current value (ΔIleakc (111), ΔIleakc (112)) is equal to or less than the threshold value (TH). If the diagnostic leak current value (ΔIleakc (111), ΔIleakc (112)) of either the main CPU 111 or the sub CPU 112 falls below the threshold (TH), the main CPU 111 and the sub CPU 112 judge that they are normal. The process proceeds to step S113. If the diagnostic leak current value (ΔIleakc (111), ΔIleakc (112)) exceeds the threshold value (HT), it is determined that there is a failure potential, and the process proceeds to step S112. The threshold value (TH) can be stored in advance in the

ROMs

(Step S112)
The submicrocomputer 120 stores the result of having determined that there is a failure potential in step S111 in the storage area (ROM 124) in the submicrocomputer 120 as the determination results DResult (111) and DResult (112).

(Step S113)
The submicrocomputer 120 stores the execution experience information (DHist) of the failure potential diagnosis in the storage area (ROM 124) in the submicrocomputer 120. The failure potential execution experience information (DHist) is read from the storage area (ROMs 114 and 124) in step S101, and is used as information for determining a target microcomputer for failure potential diagnosis in step 103.

(Execution timing of failure potential diagnosis)
FIG. 9A is a diagram for explaining the execution timing of fault potential diagnosis according to the first embodiment. FIG. 9A is a diagram for explaining that the microcomputer to be diagnosed with the failure potential is switched at each shutdown of the vehicle control device 100 as described in step 103 of FIG. 8A. That is, for example, it is assumed that the main microcomputer 110 and the submicrocomputer 120 perform normal control, and then the power supply signal 200 is turned off. In this case, as the first shutdown, after the power supply signal 200 is turned off, the processing shifts to the self shut processing. After self-shut processing is completed and all self-shut processing is completed, the main microcomputer 110 is put into the standby state, and the sub microcomputer 120 in the driving state performs fault potential diagnosis for the main microcomputer 110 in the standby state. After execution of the fault potential diagnosis, the main microcomputer 110 and the submicrocomputer 120 are shut off.

On the other hand, for example, at the time of the second shutdown, after all the self-shut processing is completed, the submicrocomputer 120 is put into the standby state, and the main microcomputer 110 in the driven state has a failure potential with respect to the submicrocomputer 120 in the standby state. After performing diagnosis and performing fault potential diagnosis, the main microcomputer 110 and the submicrocomputer 120 are shut off.

As described above, the failure potential diagnosis of each of the main microcomputer 110 and the sub microcomputer 120 can be uniformly performed by switching the microcomputer to be diagnosed every shutoff.

(Modification 1 of implementation timing)
FIG. 9B is a diagram for explaining a modification 1 of the execution timing of failure potential diagnosis. FIG. 9A shows an example in which the microcomputer to be diagnosed is switched every shutoff.
In FIG. 9B, after the power supply signal 200 is turned off, the process proceeds to the self shut process, and then the self shut process is performed. After all the self shut process is completed, the main microcomputer 110 is put into the standby state. The computer 120 executes fault potential diagnosis for the main microcomputer 110 in the standby state. Thereafter, the sub-microcomputer 120 is put into the standby state, and the main microcomputer 110 performs fault potential diagnosis on the sub-microcomputer 120 in the standby state, and performs fault potential diagnosis.

It is possible to judge the failure potential of both the main microcomputer 110 and the sub microcomputer 120 at shorter time intervals even at the timing of execution of such failure potential diagnosis.

(Modified example 2 of implementation timing)
FIG. 9C is a diagram for explaining a modification 2 of the execution timing of the failure potential diagnosis. 9A and 9B show an example in which the failure potential diagnosis is performed after the power supply signal 200 is turned off. FIG. 9C shows an example in which the microcomputer as the diagnosis target of the failure potential is switched every time the main microcomputer 110 and the sub microcomputer 120 are activated after the power supply signal 200 is turned on, and the failure potential diagnosis is performed. There is. That is, for example, after the power supply signal 200 is turned on for the first time, the submicrocomputer 120 is put into the standby state, and the main microcomputer 110 in the driven state performs fault potential diagnosis to the submicrocomputer 120 in the standby state. carry out. Thereafter, the main microcomputer 110 and the sub microcomputer 120 are reset. In this example, in the main microcomputer 110, the sub microcomputer 120 is put in a wait state until the reset is completed, and then the main microcomputer 110 and the sub microcomputer 120 are synchronized, and the main microcomputer 110 and the sub microcomputer 120 are synchronized. The microcomputer 120 shifts to normal control.

Next, although not shown, after the power supply signal 200 is turned on for the second time, the main microcomputer 110 is put into the standby state, and the sub microcomputer 120 in the driven state fails to the main microcomputer 110 in the standby state. Conduct a potential diagnosis. After that, the main microcomputer 110 and the sub microcomputer 120 are reset, the main microcomputer 110 and the sub microcomputer 120 are synchronized, and the main microcomputer 110 and the sub microcomputer 120 shift to the normal control.

The failure potential of the main microcomputer 110 and the sub microcomputer 120 can also be diagnosed at such an execution timing of the failure potential diagnosis.

(Modification 3 of implementation timing)
FIG. 9D is a diagram for explaining a third modification of the execution timing of failure potential diagnosis. FIG. 9C shows an example in which the microcomputer to be diagnosed with the failure potential is switched at each activation of the main microcomputer 110 and the sub-microcomputer 120, and the failure potential diagnosis is performed. FIG. 9D shows an example in which the failure potentials of both the main microcomputer 110 and the sub microcomputer 120 are diagnosed and implemented each time the main microcomputer 110 and the sub microcomputer 120 are started. That is, after the power supply signal 200 is turned on for the first time, the submicrocomputer 120 is put into the standby state, and the main microcomputer 110 in the driven state performs fault potential diagnosis for the submicrocomputer 120 in the standby state. Perform fault potential diagnosis. After that, the main microcomputer 110 and the sub microcomputer 120 are reset, and the main microcomputer 110 is put into the standby state, and the sub microcomputer 120 in the driven state performs fault potential diagnosis for the main microcomputer 110 in the standby state. . Thereafter, the main microcomputer 110 and the sub microcomputer 120 are synchronized, and the main microcomputer 110 and the sub microcomputer 120 shift to normal control.

(Modification 4 of implementation timing)
The execution timing of the failure potential diagnosis may be a combination of the execution timing shown in FIG. 9C and the execution timing shown in FIG. 9A. That is, at start-up (power supply signal 200 is on), fault potential diagnosis of one of main microcomputer 110 and sub-microcomputer 120 is performed, and at shut-off (power supply signal 200 is off), main microcomputer 110 and sub- The other fault potential diagnosis of the microcomputer 120 is performed. The microcomputer to be diagnosed is switched each time the power is turned on or shut off.

Of course, fault potential diagnosis may be performed by combining FIG. 9B and FIG. 9D.

(Control procedure using fault potential diagnosis result)
FIG. 10 is a diagram for explaining a control procedure according to the first embodiment. FIG. 10 shows a means for using unfailed CPU information using failure potential diagnosis results when the outputs of the main CPU 111 and the sub CPU 112 in the vehicle control apparatus 100 do not match in the comparator 116. It is an example of the flowchart explaining FIG. This flowchart corresponds to the control program CNTPROG shown in FIG.

(Step S300)
When the main microcomputer 110 and the sub microcomputer 120 receive the power supply signal 200 indicating that the power is turned on, this flowchart is started. At the time of starting this flowchart, it is assumed that the main power supply IC 130 and the sub power supply IC 140 have started to supply power according to the power supply signal 200 respectively. The following describes the operation of the main microcomputer 110 as an example. As described in FIG. 1, the submicrocomputer 120 notifies the main microcomputer 110 of the information of the diagnosis results (DResult (111), DResult (112)) when the main microcomputer 110 is activated. Also, it is assumed that the main microcomputer 110 notifies the sub microcomputer 120 of the information of the diagnostic results (DResult (121), DResult (122)) when the sub microcomputer 120 is activated.

(Step S301)
The main microcomputer 110 is provided with a main CPU 111 and a sub CPU 112, and a comparator 116 for comparing the output results of each, and determines whether or not the comparison results in the comparator 116 match. If the comparison results of the comparator 116 match, there is no CPU failure, and the process proceeds to step S302. If the comparison results of the comparator 116 do not match, it is determined that there is a CPU failure, and the process proceeds to step S303.

(Step S302)
The main microcomputer 110 determines that there is no failure in the main CPU 111 and the sub CPU 112, and uses the output signal of the main CPU 111. Alternatively, the output value of the sub CPU 112 may be used.

(Step S303)
The main microcomputer 110 determines whether the failure potential diagnosis result (DResult (111)) of the main CPU 111 stored in step S112 is normal. If the failure potential diagnosis result (DResult (111)) of the main CPU 111 is normal, the process proceeds to step S304. If the failure potential diagnosis result (DResult (111)) of the main CPU 111 is abnormal, the process proceeds to step S307.

(Step S304)
The main microcomputer 110 determines whether the failure potential diagnosis result (DResult (112)) of the sub CPU 112 stored in step S112 is normal.
If the failure potential diagnosis result (DResult (112)) of the sub CPU 112 is normal, the process proceeds to step S305. If the failure potential diagnosis result (DResult (112)) of the sub CPU 112 is abnormal, the process proceeds to step S306.

(Step S305)
The main microcomputer 110 determines that there is a failure other than the main CPU 111 and the sub CPU 112, and shifts to fail-safe processing such as stopping the vehicle control actuator 202.

(Step S306)
The main microcomputer 110 determines that the main CPU 111 is normal although there is a failure in the sub CPU 112, and continues the normal processing (the operation of the normal control of the vehicle) using the output signal of the main CPU 111.

(Step S307)
In step S307, the same determination as in step S304 is performed. If the failure potential diagnosis result (DResult (112)) of the sub CPU 112 is normal, the process proceeds to step S308. If the failure potential diagnosis result (DResult (112)) of the sub CPU 112 is abnormal, the process proceeds to step S309.

(Step S308)
The main microcomputer 110 determines that the sub CPU 112 is normal although there is a failure in the main CPU 111, and continues normal processing (normal control operation of the vehicle) using an output signal of the sub CPU 112.

(Step S309)
The main microcomputer 110 determines that both the main CPU 111 and the sub CPU 112 have a failure potential, and shifts to fail-safe processing such as stopping the vehicle control actuator 202.

(Step S310)
The main microcomputer 110 notifies other units of the information on the comparison of the comparison in the comparator 116 as CPU failure information. Further, CPU failure information may be notified to other units only when the process proceeds to step S305 or step S309.

As described above, it is possible to identify a normal CPU that has not failed and to effectively use a normal CPU that has not failed, at the time of CPU failure or CPU abnormality. The vehicle control device 100 capable of maintaining the driving performance can be provided.

According to the first embodiment, the CPU (111, 112, 121, 122) incorporated in the microcomputer (110, 120) determines the CPU's failure potential caused by foreign matter mixed in at the time of manufacture or aged deterioration, CPU failure can be detected as early as possible. In addition, it is possible to identify a normal CPU that has not failed and at the time of a failure of CPU or when an abnormality has occurred. By effectively using a normal CPU that has not failed, the operating performance can be calculated. A maintainable vehicle control device 100 can be provided.

According to the first embodiment, the value of the current (leakage current) of the CPU flowing through the power supply line (connection line: L1, L2, L3, L4) supplying power to the CPU (111, 112, 121, 122) Are detected and measured using current measurement units (current detection units: 150, 160, 152, 162). Thus, the deterioration state of the transistor can be determined from the value or amount of the measured leakage current. That is, the failure potential of the CPU can be determined by the value or amount of the measured leakage current.

In the first embodiment, in the measurement of the value of the current (leakage current) of the CPU, the current flowing in the power supply line supplying power to the CPU in the standby state is measured using the CPU in the drive state. When the CPU is in the drive state, the current flowing through the power supply line of the CPU includes the leak current component of the CPU and the drive current component of the CPU. By setting the CPU under measurement to the standby state, it is possible to measure only the leak current component (Ileak2) of the CPU excluding the drive current component of the CPU.

The CPU leak current (Ileak2) for fault potential diagnosis includes manufacturing variations of the microcomputer or CPU and variations due to temperature changes of the microcomputer or CPU. In order to extract these variations in leak current and extract only the increase in CPU leak current due to transistor deterioration, correction of the measured value of CPU leak current for failure potential diagnosis is performed. There are two correction targets: correction of leak current variation due to manufacturing variation of microcomputer or CPU, and correction of leak current variation due to temperature change.

The method of correcting the leak current variation due to the manufacturing variation of the microcomputer or CPU is to measure the CPU leak current value (Ileak1) for fault potential diagnosis at the time of manufacturing the microcomputer or CPU, and to store the storage area (ROM: 114, 124) of the microcomputer. ) Is stored as a leak current value at the time of CPU manufacture. By subtracting the leak current value (Ileak1) at the time of microcomputer manufacture or CPU manufacturing from CPU leak current value (Ileak2) for current failure potential diagnosis, increase in leak current from manufacture time of microcomputer or CPU to the present The minutes (ΔIleak) can be extracted.

Correction of the change of the leak current due to the temperature is possible by preparing in advance a correlation map (TCM) of the CPU temperature and the CPU leak current. Temperature of microcomputer or CPU is measured temperature of microcomputer or CPU by temperature sensor (TSEN: 115, 125) built in microcomputer, correlation map of CPU temperature and CPU leak current or temperature change measured From the map (TCM), the amount of change (Icv) in CPU leak current with temperature is calculated.

CPU leak current increase (ΔIleakc) after temperature correction using CPU leak current increase (ΔIleak) before temperature correction and change (Icv) of CPU leak current due to temperature using correlation map (TCM) Is calculated. If the increase amount (ΔIleakc) of CPU leak current after temperature correction is larger than the determination threshold (TH) of the increase amount (ΔIleakc) of the current determined to have a predetermined failure potential, the CPU completely fails. Although it is not, it is judged that it has the potential to become a failure in the future.

As a result, at this point in time, the CPU can correctly calculate, but can detect a state that may fail in the future at an early stage. That is, since the failed CPU can be identified from the result of the failure potential diagnosis of the CPU, when the failure of the CPU occurs, the vehicle control is not degenerated using a normal CPU that is not broken. Driving performance can be maintained.

It is effective to carry out the measurement of the leak current and the CPU failure potential diagnosis at the time of startup or shutdown of the vehicle control device in order to put at least one CPU in the standby state. Also, the combination of CPUs to be diagnosed may be changed at each startup or each shutdown (see FIGS. 9A, 9B, 9C, and 9D).

FIG. 11 is a diagram illustrating a vehicle control system according to a second embodiment. The vehicle control device system 1a shown in FIG. 11 includes a vehicle control device 100a that is an electronic control unit (ECU: Electronic Control Unit), as in FIG. The vehicle control device 100a is a device that electronically controls on-vehicle devices (for example, an automatic transmission, an engine, and the like) mounted on the vehicle. The vehicle control device 100 a of FIG. 11 is configured such that the comparator 116 in the main microcomputer 110 and the comparator 126 in the sub microcomputer 120 are eliminated as compared with the vehicle control device 100 of FIG. 1. The main microcomputer 110 of the vehicle control device 100a has a parallel processing type in which the main CPU 111 and the sub CPU 112 simultaneously execute different controls. Other than the above, the vehicle control device 100 is the same as the vehicle control device 100, so the description thereof is omitted.

FIG. 12 is a diagram for explaining a control procedure according to the second embodiment. In the control procedure of the second embodiment, the vehicle control device 100a determines whether the result of the failure potential diagnosis is normal or not, and degenerates the control function originally implemented when it is abnormal. As a result, it is possible to extend the time until the CPU completely fails, and to maintain the functions originally possessed by the vehicle control device 100a even if the CPU completely fails.

(Step S400)
When the main microcomputer 110 and the sub microcomputer 120 receive the power supply signal 200 indicating that the power is turned on, this flowchart is started. At the time of starting this flowchart, it is assumed that the main power supply IC 130 and the sub power supply IC 140 have started to supply power according to the power supply signal 200 respectively. The following describes the operation of the main microcomputer 110 as an example. In addition, the failure potential diagnosis is as described above, and the description thereof will be omitted because it is the same.

(Step S401)
The main microcomputer 110 determines whether or not there is execution experience (DHist) of failure potential diagnosis of the main CPU 111 and the sub CPU 112. If there is no implementation experience (DHist) of failure potential diagnosis, the control is ended, and if there is implementation experience (DHist), the process proceeds to step S402.

(Step S402)
The main microcomputer 110 determines whether the failure potential diagnosis result (DRsult (111)) of the main CPU 111 is normal. If the failure potential diagnosis result (DRsult (111)) of the main CPU 111 is normal, the process proceeds to step S403. If the failure potential diagnosis result (DRsult (111)) is abnormal, the process proceeds to step S407.

(Step S403)
The main microcomputer 110 determines whether the failure potential diagnosis result (DRsult (112)) of the sub CPU 112 is normal. If the failure potential diagnosis result (DRsult (112)) of the sub CPU 112 is normal, the process proceeds to step S404. If the failure potential diagnosis result (DRsult (112)) is abnormal, the process proceeds to step S405.

(Step S404)
The main microcomputer 110 determines that neither the main CPU 111 nor the sub CPU 112 has a failure potential, and continues the normal operation according to the normal task operation setting.

(Step S405, Step S406)
The main microcomputer 110 determines that there is no failure potential in the main CPU 111 and that there is a failure potential in the sub CPU 112. Then, the function (task D) assigned to the control task of the sub CPU 112 is reduced, and the calculation load of the sub CPU 112 is reduced. This extends the time until the sub CPU 112 completely fails. At the same time, in step S406, the function (task D) assigned to the control task of the main CPU 111 is expanded. As a result, although the sharing ratio of calculation of the main CPU 111 and the sub CPU 112 changes, it is possible to create a situation in which the control task calculated in total of the vehicle control device 100a does not change. However, since the function exceeding the operation load limit of the main CPU 111 can not be assigned to the main CPU 111, it is necessary to determine in advance the function to be assigned to the main CPU 111 and the function to reduce from the sub CPU 112. FIG. 13 shows an example of the change in assignment of the control task when it is detected that the failure potential of the sub CPU 112 is high. Details will be described in FIG.

(Step S407)
It is omitted because it is the same as step S403.

(Step S408, Step S409)
As a means similar to steps S405 and S406, the function (task) of the control task of the main CPU 111 is reduced, and the function (task) of the control task of the sub CPU 112 is expanded.

(Step S410)
The main microcomputer 110 determines that both the main CPU 111 and the sub CPU 112 have a failure potential, and continues the normal operation according to the normal task operation setting. Here, the normal task operation setting is the meaning of task setting for the normal operation in which the task change is not performed.

(Example of control task assignment change)
FIG. 13 is a diagram for explaining an example of change in assignment of control tasks according to the second embodiment. FIG. 13 is an example of change in assignment of control tasks when it is detected that the failure potential of the sub CPU 112 is high. If the main CPU 111 and the sub CPU 112 have no failure potential and the CPU is normal according to the failure potential diagnosis of FIG. 12, as shown in FIG. 13A, the main CPU 111 performs task A and task B as scheduled processing as shown in FIG. Execute and execute background job (hereinafter, BGJ) 1 in idle time. On the other hand, the sub CPU 112 executes task C and task D as scheduled processing, and executes BGJ 2 in idle time.

Here, when it is determined by the fault potential diagnosis in FIG. 12 that there is a fault potential in the sub CPU 112, an example is shown in which the task D of the sub CPU 112 is allocated to the main CPU 111 as shown in FIG. . The main CPU 111 executes task A, task B, and extended task D, and executes background job (hereinafter, BGJ) 1 in idle time. On the other hand, the sub CPU 112 executes task C and executes BGJ 2 in idle time. That is, the task D being executed by the sub CPU 112 is in a state of being transferred to the main CPU 111.

The failure potential diagnosis of FIG. 12 is performed after the power supply signal 200 is turned off, and the task assignment change is performed when the vehicle control device 100a is activated by the key-on of the vehicle. For this reason, there is no influence on the vehicle behavior due to sudden change of control due to task assignment change during normal control.

Further, although the sub CPU 112 assigns the function of the task D to the main CPU 111 to reduce the operation load, it does not change that the failure potential is high. When the sub CPU 112 completely fails, the task C function, BGJ2, will be lost, so it is preferable to assign a function that does not affect the vehicle running even if it is lost in advance. In this case, even if the sub CPU 112 completely fails, the vehicle can continue traveling safely.

When changing from the task execution state of (A) of FIG. 13 to the task execution state of (B) of FIG. 13, normal task operation setting for defining the task execution state of (A) of FIG. The abnormal time task operation setting 1 defining the task execution state of FIG. 13B is stored, for example, in the storage area of the ROM 114 of the main microcomputer 110. When there is no failure potential in the main CPU 111 and the sub CPU 112 and the

CPUs

111 and 112 are normal, the normal task operation setting is performed. On the other hand, when it is determined that the sub CPU 112 has a failure potential, the normal task operation setting is changed to the abnormal task operation setting. As described above, the change from the normal task operation setting to the abnormal task operation setting 1 is made when the vehicle control device 100a is activated by the key-on of the vehicle.

When it is determined that the main CPU 111 has a failure potential, for example, the task is changed such that the task B executed by the main CPU 111 is transferred to the sub CPU 112 based on the same idea as described above. I can do it. In this case, the abnormal task operation setting 2 used when it is determined that the main CPU 111 has a failure potential may be provided in addition to the normal task operation setting and the abnormal task operation setting 1. The abnormal task operation setting 2 may be stored in the storage area of the ROM 114 of the main microcomputer 110 together with the normal task operation setting and the abnormal task operation setting 1.

According to the second embodiment, before the CPU (112) having a high failure potential completely fails, the operation control (task D) handled by the CPU (112) having a high failure potential is transferred to another CPU (111). The CPU failure can be notified to the driver of the vehicle without degrading the function of the vehicle control device (100a), so that the movement for repairing the vehicle can be performed safely and smoothly.

Further, according to the second embodiment, when the CPU (112) completely fails, the normal CPU (111) can be used even in the failure detection delay time until the failure is detected. Therefore, it is possible to prevent an unintended behavior of the vehicle due to sudden stop or malfunction of an actuator such as an engine or a transmission without sacrificing the original driving performance of the vehicle control device (100a). .

Further, according to the second embodiment, before the CPU (112) completely fails, the task (D) to be calculated by the CPU (112) having a high failure potential is degenerated in advance. As a result, the calculation load of the CPU (112) can be reduced, and therefore, the period until the CPU (112) completely fails can be extended.

FIG. 14 is a diagram showing a vehicle control system according to a third embodiment. The vehicle control system 1b shown in FIG. 14 includes a vehicle control system 100b, which is an electronic control unit (ECU), as in FIG. The vehicle control device 100 b is a device that electronically controls on-vehicle devices (for example, an automatic transmission, an engine, and the like) mounted on the vehicle. Compared with the vehicle control device 100 of FIG. 1, the vehicle control device 100 b of FIG. 14 has only the CPU 111 of the main microcomputer 110 and only the CPU 121 of the sub microcomputer 120. As a result of this change, the current

measurement units SCM

160 and 162 are deleted. In addition, the comparator 116 in the main microcomputer 110 and the comparator 126 in the sub microcomputer 120 are deleted. As a substitute for the

comparators

116 and 126, a signal collating unit COMPb having a function as a comparator is provided in the vehicle control device 100b as a semiconductor integrated circuit device different from the main microcomputer 110 and the sub microcomputer 120. The other configuration is the same as that of the first embodiment, and the description thereof is omitted.

The signal collating unit COMPb outputs an output signal Smmc of the main microcomputer (first microcomputer) 110 or CPU (first CPU) 111 and an output signal Ssmc of the sub microcomputer (second microcomputer) 120 or CPU (second CPU) 121. Compare whether they match. When the output signal Smmc and the output signal Ssmc match, for example, the output signal Smmc of the main microcomputer 110 is used, and the signal comparison unit COMPb is connected to the actuator (ACU) 202 connected to the signal comparison unit COMPb or the signal comparison. A display device 203 and an electric power steering device (EPS) 204 connected to the unit COMPb via a CAN bus are driven.

The signal collating unit COMPb is also adapted to receive the diagnosis result DResult (121) of the failure potential from the main microcomputer 110 and the diagnosis result DResult (111) of the failure potential from the sub microcomputer 120, and these diagnosis signals DResult (121), the control procedure using the fault potential diagnosis result described in FIG. 15 is executed according to DResult (111).

FIG. 15 is a diagram for explaining a control procedure according to the third embodiment. Hereinafter, the control procedure of the third embodiment will be described with reference to FIG.

(Step S500)
When the main microcomputer 110 and the sub microcomputer 120 receive the power supply signal 200 indicating that the power is turned on, this flowchart is started. At the time of starting this flowchart, it is assumed that the main power supply IC 130 and the sub power supply IC 140 have started to supply power according to the power supply signal 200 respectively.

(Step S501)
The signal collating unit COMPb compares whether the output signal Smmc of the main microcomputer 110 and the output signal Ssmc of the sub microcomputer 120 match, and determines whether the matching result matches. If the collation results of the signal collating unit COMPb match (YES), it is determined that there is no CPU failure, and the process proceeds to step S502. If the comparison result of the signal comparison unit COMPb does not match (NO), it is determined that there is a CPU failure, and the process proceeds to step S503.

(Step S502)
The signal comparison unit COMPb determines that the CPU 111 of the main microcomputer 110 has no failure, and uses the output signal Smmc of the main microcomputer 110 as it is. Alternatively, it may be determined that the CPU 121 of the submicrocomputer 120 has no failure, and the output signal Ssmc of the submicrocomputer 120 may be used.

(Step S503)
The signal comparison unit COMPb determines whether the failure potential diagnosis result (DResult (111)) of the CPU 111 stored in step S112 is normal. If the failure potential diagnosis result (DResult (111)) of the CPU 111 is normal, the process proceeds to step S504. If the failure potential diagnosis result (DResult (111)) of the CPU 111 is abnormal, the process proceeds to step S507.

(Step S504)
The signal comparison unit COMPb determines whether the failure potential diagnosis result (DResult (121)) of the CPU 121 of the sub microcomputer 120 stored in step S112 is normal. If the failure potential diagnosis result (DResult (121)) of the CPU 121 is normal, the process proceeds to step S505. If the failure potential diagnosis result (DResult (121)) of the CPU 121 is abnormal, the process proceeds to step S506.

(Step S505)
It is determined that there is a failure other than the CPU 111 of the main microcomputer 110 and the CPU 121 of the sub microcomputer 120, and the process shifts to fail-safe processing such as stopping the vehicle control actuator 202.

(Step S506)
The signal collating unit COMPb determines that the CPU 111 of the main microcomputer 110 is normal although there is a failure in the CPU 121 of the sub microcomputer 120, and uses the output signal Smmc of the main microcomputer 110 to perform normal processing (normal Continue the control operation).

(Step S507)
In step S507, the same determination as in step S504 is performed. If the failure potential diagnosis result (DResult (121)) of the CPU 121 is normal, the process proceeds to step S508. If the failure potential diagnosis result (DResult (121)) of the CPU 121 is abnormal, the process proceeds to step S509.

(Step S508)
The signal collating unit COMPb determines that the CPU 121 of the sub microcomputer 120 is normal although there is a failure in the CPU 111 of the main microcomputer 110, and performs normal processing using the output signal Sscm of the main microcomputer 110 (normal to vehicle Continue the control operation).

(Step S509)
The signal comparison unit COMPb determines that there is a failure potential in both the CPU 111 of the main microcomputer 110 and the CPU 121 of the sub microcomputer 120, transitions to a safe state such as stopping the vehicle control actuator 202, and performs failsafe processing. Transition.

Note that the signal comparison unit COMPb may notify the other units of the information on the comparison failure as the CPU failure information. Further, CPU failure information may be notified to other units only when the process proceeds to step S505 or step S509.

According to the third embodiment, it is possible to obtain the same effect as that of the first embodiment, and at the present stage, the CPU can normally calculate, but it is possible to detect in the early stage a state that may fail in the future. it can.

Since a faulty CPU can be identified from the result of the CPU fault potential diagnosis, vehicle control is degenerated by effectively using a normal CPU that is not faulty at the time of CPU fault occurrence or CPU anomaly occurrence. It is possible to provide a vehicle control device (100b) capable of maintaining the driving performance without causing the vehicle control.

As mentioned above, although the invention made by the present inventor was concretely explained based on an example, the present invention is not limited to the above-mentioned embodiment and an example, and it can not be overemphasized that it can change variously .

100: vehicle control device 110: main microcomputer (MMC) 111: main CPU (MCPU) 112: sub CPU (SCPU) 113: RAM 114: ROM 115: temperature sensor (TSEN) 116: comparator (COMP) 120: sub microcomputer (SMC) 130: main power supply IC (MPSP) 140: sub power supply IC (SPSP) 150: main CPU current measurement unit (MCM) 160: sub CPU current measurement unit (SCM) 200: power supply signal (PS) 201: battery (battery) BAT) 202: Actuator (ACU) 203: Display device (DISP) L1, L2, L3, L4: Connection line

Claims

A microcomputer having a main CPU and a sub CPU;
A power supply unit,
A first connection line connecting the power supply unit and the main CPU;
A second connection line connecting the power supply unit and the sub CPU;
A current detection unit that detects a current value flowing through the first connection line and a current value flowing through the second connection line;
In the microcomputer, the current value flowing to one of the first connection line and the second connection line is larger than a set value, and the current value flowing to the other of the first connection line and the second connection line is The vehicle control apparatus which continues driving | running | working using the said main CPU or said sub CPU connected to said other, when below the said setting value.
In the vehicle control device according to claim 1,
The microcomputer includes a comparison unit that compares an output signal from the main CPU with an output signal from the sub CPU.
The microcomputer continues the driving of the vehicle using the main CPU or the sub CPU having the current value equal to or less than the set value among the main CPU and the sub CPU when the comparison result of the comparing unit is not identical. Vehicle control device.
In the vehicle control device according to claim 1,
The vehicle control device, wherein the current value is a leak current value.
In the vehicle control device according to claim 3,
Has a temperature sensor,
The vehicle control device according to claim 1, wherein the leak current value is a leak current value corrected by the temperature information from the temperature sensor and the leak current value at the time of manufacture of the microcomputer.
In the vehicle control device according to claim 4,
The current detection unit detects the current value when the microcomputer is in the standby state,
The corrected leak current value is calculated from the current value, the temperature information, a temperature correction map representing the correlation between the leak current and the temperature, and the leak current value at the time of manufacturing the microcomputer. Vehicle control device.
A microcomputer having a main CPU and a sub CPU;
A power supply unit,
A first connection line connecting the power supply unit and the main CPU;
A second connection line connecting the power supply unit and the sub CPU;
A current detection unit that detects a current value flowing through the first connection line and a current value flowing through the second connection line;
In the microcomputer, the current value flowing through one of the first connection line and the second connection line is larger than a set value, and the microcomputer flows through the other connection line of the first connection line and the second connection line. The vehicle control device which changes the function assigned to the main CPU or the sub CPU connected to the other connection line when the current value is equal to or less than the set value.
The first CPU,
The second CPU,
A comparison unit that compares an output signal from the first CPU with an output signal from the second CPU;
Including
Comparing the leak current value of the first CPU and the leak current value of the second CPU with a threshold to determine the failure potential of the first CPU and the second CPU;
A vehicle control device which continues driving of a vehicle using the first CPU or the second CPU having the low failure potential among the first CPU and the second CPU when the comparison result of the comparing unit is not identical.
In the vehicle control device according to claim 7,
A microcomputer incorporating the first CPU, the second CPU, and the comparison unit;
A power supply unit,
A first connection line connecting the power supply unit and the first CPU;
A second connection line connecting the power supply unit and the second CPU;
A current measuring unit that detects a current value flowing through the first connection line and a current value flowing through the second connection line;
And a temperature sensor.
In the vehicle control device according to claim 8,
The leak current value of the first CPU and the leak current value of the second CPU are the current value measured by the current measurement unit, the leak current value at the time of manufacture of the microcomputer, and temperature information from the temperature sensor. The vehicle control device, which is a leak current value corrected by the temperature correction map that represents the correlation between the leak current and the temperature.
In the vehicle control device according to claim 9,
The vehicle control device, wherein the current measuring unit detects the current value when the microcomputer is in a standby state.
In the vehicle control device according to claim 7,
A first microcomputer incorporating the first CPU;
A second microcomputer incorporating the second CPU;
A power supply unit,
A first connection line connecting the power supply unit and the first CPU;
A second connection line connecting the power supply unit and the second CPU;
A first current measurement unit that detects a first current value flowing through the first connection line;
A second current measurement unit that detects a second current value flowing to the second connection line;
And a temperature sensor.
In the vehicle control device according to claim 11,
The leak current value of the first CPU is a temperature correction that represents the first current value, the leak current value at the time of manufacturing the first microcomputer, the temperature information from the temperature sensor, and the correlation between the leak current and the temperature. It is the leak current value corrected by the map and
The leak current value of the second CPU is a temperature correction that represents the correlation between the leak current value at the time of manufacturing the second microcomputer, the temperature information from the temperature sensor, the leak current and the temperature of the second current value. The vehicle control device which is the leak current value corrected by the map.
In the vehicle control device according to claim 12,
The first microcomputer has a first analog-to-digital converter circuit connected to the second current measurement unit,
The vehicle control device, wherein the second microcomputer includes a second analog-to-digital converter connected to the first current measurement unit.
In the vehicle control device according to claim 13,
The first analog-to-digital converter circuit measures the second current value using the second current measurement unit when the second microcomputer is in the standby state.
The vehicle control device, wherein the second analog-to-digital converter circuit measures the first current value using the first current measuring unit when the first microcomputer is in the standby state.
In the vehicle control device according to claim 14,
One of the first microcomputer and the second microcomputer is in the standby state, and the other of the first microcomputer and the second microcomputer is in the activation state.
The first current value of the first microcomputer or the second current value of the second microcomputer of the first microcomputer in the standby state is measured by the first microcomputer or the second microcomputer in the activated state. Vehicle control device to be done.
In the vehicle control device according to claim 15,
In the measurement of the first current value of the first microcomputer or the second current value of the second microcomputer in the standby state, the first microcomputer and the second microcomputer complete the self shut process. Vehicle control device to be done after.
In the vehicle control device according to claim 16,
The vehicle control device, wherein the standby state and the activation state of the first microcomputer and the second microcomputer are switched every time the self shut processing.