In-vehicle electronic control device

An in-vehicle electronic control device for diagnosing the details of an abnormality of a microcomputer appropriately is provided. A monitoring function for detecting a malfunction by monitoring input/output of a main function of a hardware part and a monitoring function for detecting an abnormality by monitoring the calculating result of a main function in a software part are provided in a microcomputer. The main function to be monitored is implemented with a different structure than the malfunction/abnormality monitoring function. Furthermore, a malfunction processing circuit for monitoring an abnormality of the microcomputer is provided outside the microcomputer.

TECHNICAL FIELD

The present invention relates to an in-vehicle electronic control device having a function of monitoring malfunction or abnormality of a microcomputer.

BACKGROUND ART

A technology of a conventional in-vehicle electronic control device having a CPU monitoring function is disclosed in Patent Documents 1 and 2, for example. This technology adopts a lockstep system as the above-mentioned monitoring function, which has a collation circuit for collating the processing results of two information processing units: systems A and B, each having an identical configuration. If the collation results from the collation circuit do not agree with each other, either system A or B is determined inoperative

Moreover, a configuration having two different CPUs: a control CPU and a monitoring CPU for the above-mentioned monitoring function and adopting a system that the control CPU is monitored by the monitoring CPU has been adopted (e.g., see Patent Document 3).

PRIOR ART DOCUMENTS

Patent Documents

SUMMARY OF THE INVENTION

Problems to be Solved

However, the monitoring function that has adopted the above-mentioned lockstep system cannot detect an abnormality when the control unit and the monitoring unit uses the same core, even if a computing core unit malfunctions, such as outputting an erroneous calculation result. Moreover, the monitoring function that uses two different CPUs described above cannot diagnose the control CPU's calculation precisely.

Thus, since it is impossible to conduct precise diagnosis of abnormality, the CPUs are always halted irrespective of type of abnormality whenever it occurs. However, in light of driver's increased burdens due to vehicles increasing in size while the CPUs are being halted, and standardization of safety control protocols for vehicles, etc., control by the CPUs should be continued for a type of abnormality even when it occurs.

The present invention thus aims to provide an in-vehicle electronic control device for diagnosing abnormalities of a microcomputer appropriately.

Solution to the Problems

In order to resolve the above problem, a first aspect of an in-vehicle electronic control device according to the present invention is characterized in that it includes a hardware part and a software part, a microcomputer for generating a driving signal for driving an actuator based on a signal detected by a sensor installed in a vehicle, a hardware element monitoring unit that is deployed in the microcomputer and monitors abnormality of each element of the hardware part, a software element monitoring unit that is deployed in the microcomputer and monitors abnormality of each element of the software part, and an external monitoring unit that is deployed outside the microcomputer and monitors abnormality of the microcomputer.

As such, the present invention can diagnose detailed abnormalities of a microcomputer by overall monitoring using three units of a hardware element monitoring unit, a software element monitoring unit that and an external monitoring unit. Therefore, it is possible to take a suitable action according to the details of an abnormality of the microcomputer when the abnormality has occurred.

A second aspect of the present invention is characterized in that the hardware element monitoring unit has a different configuration from that of a to-be-monitored hardware element, comprises a monitoring hardware element that has the same input/output characteristics as the to-be-monitored hardware element, and compares an output signal from the to-be-monitored hardware element and that from the monitoring hardware element when an identical signal is input to both of the to-be-monitored hardware element and the monitoring hardware element, so as to monitor abnormality of the to-be-monitored hardware element.

Since the input/output of the monitored hardware element is monitored in this manner, a malfunction of the monitored hardware element may be detected appropriately.

Furthermore, since the monitoring hardware element is implemented with a different structure from the monitored hardware, element, delay time up to completion of processing may be different therebetween, for example.

As a result, even malfunction factors influencing both of them may be detected appropriately as malfunction.

A third aspect of the present invention is characterized in that when the hardware element monitoring unit detects the abnormality, the hardware element monitoring unit takes a stop measure for halting the actuator.

In this manner, a suitable measure may be taken according to details of an abnormality of the microcomputer.

A fourth aspect of the present invention is characterized in that when the hardware element monitoring unit detects the abnormality, the hardware element monitoring unit notifies the abnormality to the external monitoring unit; and the external monitoring unit receives the notification of the abnormality from the hardware element monitoring unit, and the external monitoring unit takes a stop measure for halting the actuator.

In this manner, once an abnormality is detected, the direct means for halting the actuator and means for halting the actuator via the external monitoring unit are used together, thereby making the means for halting redundant. Consequently, the actuator can be halted surely once an abnormality occurs.

A fifth aspect of the present invention is characterized in that the software element monitoring unit has a different configuration from that of a to-be-monitored software element, has a monitoring software element for the same computing as the to-be-monitored software element, inputs the same signal to the to-be-monitored software element and the monitoring software element, and monitors an abnormality of the to-be-monitored software element by determining whether difference between the calculated results from both the to-be-monitored software element and the monitoring software element falls within a permissible range.

In this manner, since the calculating result of the monitored software element is monitored, an abnormality of the software element may be detected appropriately. Furthermore, since the monitoring software element is implemented with a different structure than the monitored software element, instructions, for example, used for calculation may be different between the elements. Consequently, even though the abnormal factors influencing both of the elements may be detected as an abnormality appropriately. Moreover, since a predetermined permissible range is set up for comparing the calculating results, an abnormality diagnosis in light of a calculation error generated due to the different implementation may be carried out.

A sixth aspect of the present invention is characterized in that the permissible range is a range in which the calculating result of the monitored software element and calculating result of the monitoring software element have the same sign, and where absolute value of the calculating result of the monitored software element is smaller than that of the calculating result of the monitoring software element.

Therefore, in light of the smaller the absolute value of the calculating result of the monitored software element, the less the actual control action of the actuator, which is hard to lead to an action for causing a malfunction, a permissible range allowing an abnormality to be regarded as not detected may be set up. Consequently, excessive abnormality diagnosis may be prevented.

A seventh aspect of the present invention is characterized in that the software element monitoring unit comprises a restriction unit for restricting the computing result of the monitored software element within the permissible range once the abnormality is detected.

Therefore, even if there is an abnormality with the microcomputer, drive-control of the actuator may be continued as long as the abnormality is of a software element. In this manner, a suitable measure can be performed according to details of an abnormality of the microcomputer.

An eighth aspect of the present invention is characterized in that the external monitoring unit monitors a clock of the microcomputer, so as to monitor abnormality of the microcomputer.

In this manner, once a clock abnormality influencing every functions of the microcomputer occurs but even if the microcomputer cannot diagnose a malfunction or an abnormality, this may be detected as an abnormality. Therefore, reliable abnormality diagnosis may be performed.

A ninth aspect of the present invention is characterized in that the external monitoring unit monitors activity of the hardware element monitoring unit and activity of the software element monitoring unit, so as to monitor abnormality of the microcomputer.

In this manner, when the hardware element monitoring unit itself is not operating, or when the software element monitoring unit itself is not operating, this may be detected as an abnormality. Therefore, reliable abnormality diagnosis may be performed.

A tenth aspect of the present invention is characterized in that once the external monitoring unit detects the abnormality, the external monitoring unit takes measure to halt the actuator.

Therefore, a suitable measure may be taken according to details of an abnormality of the microcomputer.

Advantageous Effects of the Invention

The in-vehicle electronic control device according to the present invention is capable of comprehensively monitoring the hardware and software of a microcomputer and the exterior of the same, so as to diagnose abnormalities of the same appropriately. As a result, a suitable measure according to abnormalities may be taken.

DESCRIPTION OF EMBODIMENTS

FIG. 1is a block diagram showing functions of an in-vehicle electronic control device according to an embodiment.

Reference numeral1is an in-vehicle electronic control device for controlling a vehicle, and is equipped with a microcomputer (MCU)2. The MCU2is constituted by a hardware part21and a software part24.

The hardware part21includes multiple MCU internal elements and a monitoring function23for monitoring a malfunction of a main function22of these internal elements; wherein, the MCU internal elements include a central processing unit (CPU), a bus, ROM, RAM, a peripheral circuit (a timer, a serial communication unit, a CAN communication unit, an external output port), etc. Moreover, the software part24includes software elements and a monitoring function26for monitoring abnormalities of a computing processing of the software elements executed by a main function25.

That is, the software elements and the hardware elements are monitored by the MCU2.

A variety of signals detected by various sensors11deployed in the vehicle are input to the MCU2via an input I/F circuit3. The MCU2calculates an instruction signal for drive-control of actuators12(such as a brake actuator and an active suspension) deployed in the vehicle, based on the input detected signal, and outputs it to an actuator driving circuit4.

The actuator driving circuit4is constituted by a bridge circuit (FET), a FET drive circuit, a relay, a relay drive circuit etc., so as to drive-control the actuators12based on the instruction signal calculated by the MCU2.

Moreover, the in-vehicle electronic control device1includes a malfunction processing circuit5, which is deployed outside the MCU2, monitoring malfunction of the MCU2.

Note that inFIG. 1, the monitoring function corresponds to a hardware element monitoring function, the monitoring function26corresponds to a software element monitoring function, and the malfunction processing circuit5corresponds to an external monitoring function.

Next, the monitoring function23of the hardware part21of the MCU2will be explained in detail.

FIG. 2is a block diagram explaining the monitoring function23of the hardware part21of the MCU2. As illustrated inFIG. 2, a malfunction processing element32is arranged as the monitoring function23for every MCU internal element (main function)31. Herein, the MCU internal element31and the malfunction processing element32are each implemented, with a different structure.

The malfunction processing element32monitors input/output of the MCU internal element31, and determines whether the MCU internal element31is inoperative. Herein, as shown inFIG. 3, the malfunction processing element32includes a computing circuit32aand a comparison circuit32b. The computing circuit32ais implemented in a different way from the computing circuit31a, which constitutes the MCU internal element31to be monitored, and has the same input/output behavioral characteristics as the computing circuit31a.

That is, the computing circuit32aoutputs the same signal as that from the computing circuit31awhen its function is normal and the computing circuit32ahas received the same signal as that from the computing circuit31a. The computing circuit32ais implemented with a different number of transistors than the computing circuit31a. Computing for malfunction processing may be simplified more than computing in the main function because only calculation of a value for diagnosis is required. Therefore, the computing circuit32ahas a simpler configuration with a different number of transistors than the computing circuit31a.

A signal input to the computing circuit31ais also input to the computing circuit32a, and the output signal thereof is input to the comparison circuit32b. The comparison circuit32bcompares the output signal from the computing circuit31ato that from the computing circuit32a. If they are different from each other, it is determined that the MCU internal element is inoperative, and the malfunction processing element32notifies an MCU internal element (external output function)33and a post-malfunction measure element34inFIG. 2of the diagnostic result or to the effect that a malfunction has been detected.

The MCU internal element33receives the diagnostic result from the malfunction processing element32, and outputs an instruction for a post-malfunction measure to the actuator driving circuit4.

The instruction for the post-malfunction measure may be, for example, a stop signal to a FET drive circuit of a bridge circuit, which constitutes the actuator driving circuit4. In this case, outputting the stop signal makes all FETs turn off, thereby halting the actuator12. Moreover, as another example of the instruction for the post-malfunction measure, there is a stop signal to the relay drive circuit of the actuator driving circuit4. In this case, outputting the stop signal makes the relay turn off, thereby stopping electric power supply to the actuator12. In such a manner in this embodiment, halting the actuator12is applied as a post-malfunction measure.

Moreover, the post-malfunction measure element34receives the diagnostic result from the malfunction processing element32, and notifies the malfunction processing circuit5of malfunction information of the MCU internal element31. Once the malfunction processing circuit5receives the malfunction information from the post-malfunction measure element34, it then outputs an instruction for the post-malfunction measure to the actuator driving circuit4.

In other words, such a redundant notification means is capable of outputting an instruction for the post-malfunction measure to the actuator driving circuit4surely even when either the MCU internal element33or the post-malfunction measure element34has lost a notification function.

Next, the monitoring function26of the software part24in the MCU2will be explained in detail.

FIG. 4is a block diagram showing an example of diagnosis of a software element. As shown inFIG. 4, a software element (main function)41includes abnormality processing software42as the monitoring function26; wherein the software element41is implemented with a different structure from the abnormality processing software42.

The abnormality processing software42monitors the calculating result of the software element41, which is monitored, and determines whether an abnormality has occurred in the software element. The abnormality processing software42includes a computing processing42a, comparison processing42b, and restriction processing42c. The computing processing42ais implemented differently from the computing processing41aof the software element41, which is monitored, and carries out the same calculation as the computing processing41a.

In other words, the computing processing42acarries out an equivalent calculation of the computing processing41ain equation with a different number of instructions than those of the computing processing41a. Computing for malfunction processing may be simplified more than the main functional processing because only calculation of a value for diagnosis is required. Therefore, the computing processing42ahas a simpler configuration with a different number of instructions than the computing processing41a.

A signal input to the computing processing41ais input to the computing processing42a, and the calculating result is input to the comparison processing42b. The comparison processing42bcompares the calculating result from the computing processing41ato the calculating result from the computing processing42a. If the resulting difference does not fall within a predetermined permissible range, it is determined that an abnormality has occurred in the software element41.

That is, as illustrated inFIG. 5, a zone where the value on the main functional side (the result from the computing processing41a) relative to value on the monitoring side (the result from the computing processing42a) falls between a negative and a positive predetermined value is defined as a tolerant zone, and the remaining zone indicated by slanting lines is defined as an abnormality diagnosed zone. If a point determined based on the value on the main functional side and that on the monitoring side falls within the abnormality diagnosed zone, it is determined that the above-mentioned difference does not fall within the permissible range. Note that a straight line indicated by a broken line inFIG. 5denotes a zone where the value on the main functional side is equal to value on the monitoring side.

As such, setting up a predetermined permissible range allows determination of whether there is an abnormality in light of the computation difference due to the simplified computing processing42a.

Moreover, the abnormality diagnosed zone may be set up in the manner as shown inFIG. 6, for example. In this example, a tolerant zone is an area with a negative and a positive predetermined permissible range in which the value on the main functional side and value on the monitoring side have the same sign, and the area has a smaller absolute value on the main functional side than absolute value on the monitoring side. That is, if a point determined based on the values on the main functional side and the monitoring side falls within an abnormality diagnosed zone indicated by slanting lines inFIG. 6, it is determined that the above-mentioned difference does not fall within the permissible range. Therefore, since small actual values denote a low possibility of leading to development of malfunction and will thus be acceptable, excessive abnormality diagnosis may be prevented.

Once the comparison processing42bdetects an abnormality in the software element41, the diagnostic result is output to the restriction processing (restriction unit)42cofFIG. 4.

The calculating result from the computing processing41ais input to the restriction processing42c. When the diagnostic result to the effect that an abnormality is detected is input from the comparison processing42b, the restriction processing42crestricts the calculating result from the computing processing41ato a limited value, and outputs the limited value. It is desirable to set up the limited value by verifying a vehicle permissible range experimentally. Meanwhile, when the diagnostic result to the effect that an abnormality has been detected is not input from the comparison processing42b, the restriction processing42coutputs the calculating result from the computing processing41aas it is.

Next, a configuration of the malfunction processing circuit5will be explained in detail.

FIG. 7is a block diagram showing functions of the malfunction processing circuit5. The malfunction processing circuit5monitors a malfunction of the MCU2externally. A monitoring method of the MCU2uses a method of monitoring a clock27of the MCU2and a method of monitoring activities of the monitoring function23and the monitoring function26of the MCU2.

That is, the malfunction processing circuit5includes a clock51independent of the MCU2and a clock monitor processing52, so as to monitor the clock27of the MCU2. The clock monitor processing52detects a malfunction of the clock27by comparing a clock pulse of the clock27to that of the clock51. The clock27serves as a standard clock for a series of operations of the MCU2, and includes an RC oscillating circuit, a ceramic vibrator, a crystal oscillator, a crystal oscillator embedded oscillator, a crystal oscillator/frequency divider embedded oscillator, etc.

Note that whileFIG. 7shows the case where the clock monitor processing52is implemented in a form of software stored in the malfunction processing circuit5, the clock monitor processing52may be implemented as hardware or software in the MCU2.

Moreover, the malfunction processing circuit5includes a pulse monitor processing53for monitoring an output pulse from a watchdog timer of the malfunction processing element32, so as to monitor activity of the monitoring function23of the MCU2. The pulse monitor processing53detects an abnormality of the monitoring function23by finding that the output pulse does not appear for a predetermined period of time.

Note that whileFIG. 7shows only the case where the monitoring function23detects malfunction, the monitoring function26(abnormality processing software42) detects abnormality in the same way.

Namely, a watchdog timer outputs a pulse once the monitoring function26(abnormality processing software42) is performed correctly, and the exterior malfunction processing circuit5of the MCU2can thus diagnose that the monitoring function26is not performed (non-monitored state).

Once at least either the clock monitor processing52or the pulse monitor processing53of the malfunction processing circuit5detects a malfunction of the MCU2, it outputs an instruction for taking a post-malfunction measure to the actuator driving circuit4so as to halt the actuator12.

As such, this embodiment monitors the MCU comprehensively through three measures: hardware monitoring, software monitoring, and external monitoring, so as to monitor the MCU for abnormality.

In other words, since in the hardware monitoring, a malfunction processing element is arranged for every MCU internal element, and an input/output signal of the MCU internal element is monitored, malfunction of every MCU internal element may be diagnosed carefully.

Moreover, since the malfunction processing element is implemented with a different structure than the MCU internal elements to be monitored, a different delay time up to completion of processing, for example, may be provided. As a result, malfunction factors influencing both elements in common may be detected as malfunction appropriately. Furthermore, since the malfunction processing element made up of a reduced number of transistors is implemented with a simpler structure than the MCU internal element to be monitored, the malfunction processing element may be provided comparatively simply at low cost.

Furthermore, since the software monitoring as well as the hardware monitoring is conducted in the MCU, a malfunction in calculation, which cannot be detected by the malfunction, processing element for hardware monitoring, may be detected.

In the software monitoring, abnormality processing software is arranged as a software element, so as to monitor the calculating result of the software element, and abnormalities of the software element may thus be diagnosed appropriately. Furthermore, since the abnormality processing software is implemented with a different structure than the software element to be monitored, a different instruction, for example, may be used for calculation for the elements. As a result, malfunction factors influencing both elements in common may be detected as malfunction appropriately.

Moreover, since a predetermined permissible range is set up for comparing calculating results, abnormality diagnosis in light of calculation error generated due to simplified structure of the abnormality processing software may be carried out. The permissible range is a limit in which the calculating result of the monitored software element and that of the abnormality processing software have the same sign, and the absolute value of the calculating result of the monitored software element is smaller than absolute value from the abnormality processing software. This allows even a case where there is a comparatively large difference between the calculating result of the monitored software element and that of the abnormality processing software when the calculating result of the monitored software element is a value that may not lead to a malfunction and the actual control action of the actuator is small. Therefore, excessive abnormality diagnosis may be prevented.

Once a malfunction of the MCU internal element is detected in the hardware monitoring, a measure for suspending the actuator is taken. Meanwhile, once an abnormality of the software element is detected in the software monitoring, correction for restricting the calculating result of the software element within the permissible range is performed, and a measure for continuing drive-control of the actuator is taken.

The electronic control MCU embedded in a vehicle is generally halted when an abnormality occurs irrespective of the details of the abnormality. However, from the viewpoint of the driver's burden due to enlarged vehicles when the control halts and standardization of vehicle safety control etc., it is necessary to continue control if an abnormality occurs depending on details of the abnormality. Since the embodiment can diagnose an abnormality of the MCU carefully, appropriate measure may be taken, such as suspending or continuing control according to the details of the abnormality.

Furthermore, since external monitoring or monitoring a malfunction of the MCU from the outside of the MCU is performed, factors influencing both of the MCU's monitoring functions, the hardware monitoring and the software monitoring, may be diagnosed.

For example, a clock independent of the MCU may be deployed outside the MCU, so as to monitor the clock of the MCU. If the MCU cannot diagnose either malfunction or abnormality and a clock abnormality influencing the monitoring functions of the MCU has occurred, it will be detected as an abnormality. Moreover, this may be detected as abnormality by monitoring the output pulse of the watchdog timer, which is provided for each monitoring function inside the MCU, when each monitoring function inside the MCU has stopped. Thus, malfunction of the MCU may be detected outside the MCU.

In this external monitoring, once a malfunction of the MCU is detected by its own monitoring function, or once information indicating that a malfunction of the MCU internal element is detected is obtained from the abnormality processing element, a measure for suspending the actuator will be taken. Namely, when a malfunction of the MCU internal element is detected through hardware monitoring, a means for suspending the actuator directly through hardware monitoring, and a means for suspending the actuator via external monitoring may be used together. As a result, once a malfunction of the MCU internal element occurs, the actuator may be suspended surely.

INDUSTRIAL APPLICABILITY

According to the in-vehicle electronic control device of the present invention, comprehensive monitoring: internal monitoring of the hardware part and the software part in the microcomputer and external monitoring of the microcomputer is possible. This allows detailed, appropriate diagnosis of an abnormality of the microcomputer, and a suitable measure will be taken according to details of the abnormality, which is useful.

REFERENCE SIGNS LIST