Patent Publication Number: US-7903539-B2

Title: Electronic control unit

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     This invention generally relates to electronic control units applicable to vehicles, and more particularly to a failsafe process. 
     2. Description of the Related Art 
     In recent years, an increased number of electrical components on the vehicle has been used to improve vehicle safety and conformability, and a lot of more complicated vehicle controls has been needed. There is an increased number of signals supplied to electronic control units from sensors and switches for the purpose of various vehicle controls. 
     Each electronic control unit is equipped with a processor, which is capable of receiving a limited number of input signals. Therefore, one or more multiplexer circuits are provided at the input interface of the electronic control unit in order to handle more input signals. This kind of technique is disclosed in the following documents: Japanese Patent Application Publication No. 8-22308; Japanese Patent Application Publication No. 2-238379; Japanese Patent Application Publication No. 2-287744; and Japanese Patent No. 3202382. 
     A failsafe process should be executed to ensure the maximum safety if an abnormality occurs in any of the signals from the sensors and switches applied to the on-vehicle electronic control unit, particularly, in any of signals directly involved in travel control of vehicle. However, the conventional failsafe process has the following problem. If the input interface becomes faulty, the electronic control unit cannot discriminate abnormality in the input interface from that in the signals from the sensors and switches. This prevents reliable execution of the failsafe process. 
     The multiplexer circuits in the input interface may always be monitored in order to detect abnormality. This monitoring should be carried out by the electronic control unit when each multiplexer circuit is idle. This increases the load of the electronic control unit. 
     SUMMARY OF THE INVENTION 
     The present invention has been made in view of the above circumstances and provides an electronic control unit capable of executing reliable failsafe process. 
     According to an aspect of the present invention, there is provided an electronic control unit including: an input interface having multiplexer circuits, each of which circuits is supplied with input signals supplied from an outside of the electronic control unit; and a failsafe processing part that determines whether an abnormality occurs in the input interface by referring to a state of a specific multiplexer circuit that is at least one of the multiple multiplexer circuits when determining that an output signal of the input interface has an abnormal state and executes a failsafe process based on results of determination as to whether an abnormality occurs in the specific multiplexer circuit. 
     The electronic control unit may be configured so that, when the failsafe processing part detects an abnormality in the specific multiplexer circuit, the failsafe processing part executes the failsafe process using the input signals supplied before the abnormality in the specific multiplexer circuit is detected. 
     The electronic control unit may be configured so that, when the failsafe processing part determines that no abnormality occurs in the specific multiplexer circuit, the failsafe processing part executes the failsafe process based on the abnormal state of the output signal of the input interface. 
     The electronic control unit may be configured so that: the specific multiplexer circuit is supplied with input signals set to different logical levels; and the failsafe processing part refers to an output signal of the specific multiplexer circuit in order to detect an abnormality that occurs in the specific multiplexer circuit. 
     The electronic control unit may be configured so that: the input signals supplied from the outside of the electronic control unit includes a signal about a state of a vehicle on which the electronic control unit is mounted; and the failsafe processing part executes the failsafe process directed to ensuring vehicle security when an abnormality in the specific multiplexer circuit is detected. 
     The electronic control unit may be configured so that the failsafe processing part applies a pulse signal to the specific multiplexer circuit and determines whether the specific multiplexer circuit has an output signal that coincides with the pulse signal. 
     The electronic control unit may be configured so as to further include a switch connected between an input of the specific multiplexer circuit and a predetermined potential, wherein the failsafe processing part causes the switch to turn ON and OFF and determines, based on an output signal of the specific multiplexer circuit, whether an abnormality occurs in the input interface. 
     The electronic control unit may be configured to further include another specific multiplexer circuit that is another one of the multiplexer circuits, wherein the failsafe processing part refers to a state of said another specific multiplexer circuit in addition to the state of said specific multiplexer circuit in order to determine whether an abnormality occurs in the input interface. 
     The electronic control unit may be configured so as to further include: a switch having an end connected to a first input of the specific multiplexer circuit and a second input of the another specific multiplexer circuit and a second end connected to ground; and an inverter connected to the end of the switch and the first input of the specific multiplexer circuit, wherein the failsafe processing part causes the switch to turn ON and OFF and determines, based on output signals of the specific multiplexer circuit and the another multiplexer circuit, whether an abnormality occurs in the input interface. 
     The electronic control unit may be configured so that the failsafe processing part is implemented in an operation processing section. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Other objects, features and advantages of the present invention will become more apparent from the following detailed description when read in conjunction with the accompanying drawings, in which: 
         FIG. 1  a block diagram of an electronic control unit in accordance with an embodiment of the present invention; 
         FIG. 2  is a flowchart of a failsafe process executed in the electronic control unit shown in  FIG. 1 ; 
         FIG. 3  is a block diagram of an abnormality detecting configuration other than that employed in the configuration shown in  FIG. 1 ; 
         FIG. 4  is a block diagram of yet another abnormality detecting configuration; and 
         FIG. 5  is a block diagram of a further abnormality detecting configuration. 
     
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       FIG. 1  is a block diagram of an electronic control unit in accordance with an embodiment of the present invention. The electronic control unit may, for example, be a transmission control of vehicle. 
     Referring to  FIG. 1 , the electronic control unit includes an operation processing section  10 , an input interface  20 , an output interface  30  and multiple connector terminals CN 1  through CN 4 . The input interface  20  includes multiple multiplexer circuits MUX 1  through MUX 4 . Each of the multiplexer circuits MUX 1  through MUX 4  has four inputs, to which connectors CN 1  through CN 4  are respectively connected. Each of the connectors CN 1  through CN 4  has four terminals. 
     The multiplexer circuits MUX 1  through MUX 4  are connected to common select signal lines SEL 1  and SEL 2 , and are provided with a select signal through the lines SEL 1  and SEL 2 . The select signal is defined in combination with “0” and “1” on the signal lines SEL 1  and SEL 2 . Each of the multiplexer circuits MUX 1  through MUX 4  selects one of the four input signals in accordance with the four combinations of “0” and “1” on SEL 1  and SEL 2 . The signals selected by the multiplexer circuits MUX 1  through MUX 4  are applied to the operation processing section  10 . The four input signals of the multiplexer circuit MUX 1  are denoted as IN 1  through IN 4 , and those of the multiplexer circuit MUX 2  are denoted as IN 5  through IN 8 . Further, the four input signals of the multiplexer circuit MUX 3  are denoted as IN 9  through IN 12 . These signals IN 1  through IN 12  supplied from the outside of the electronic control unit will be referred to as external input signals IN simply. The multiplexer circuit MUX 4  is specifically used to detect abnormality. One of the four input signals of the multiplexer circuit MUX 4  receives a given voltage Vcc, and the three remaining input signals are connected to ground GND. 
     The external input signals IN may be a shift lever position detecting signal, and signals from sensors and switches involved in transmission control to which the electronic control unit shown in  FIG. 1  is applied. The signals from the sensors and switches may express the current operation or state of the vehicle. 
     The operation processing section  10  may include a hardware structure and a software structure. The hardware structure may include a processor, memories such as ROM and RAM, an A/D converter, and a D/A converter. The A/D converter converts analog signals from the input interface  20  into digital signals. The D/A converter converts digital signals from the processor into analog signals. The software structure may include a program necessary for transmission control of vehicle and a program for the failsafe process executed when an abnormality occurs. The operation processing section  10  is supplied with the external input signals IN via the input interface  20 , and outputs various signals necessary for, for example, the transmission control to the output interface  30 . 
     In the failsafe process, the operation processing section  10  may output the select signal via the select signal lines SEL 1  and SEL 2  for every 1 ms in order to sequentially read the external input signals IN. Then, the operation processing section  10  refers to the states of the external input signals IN and determines whether an abnormality occurs. 
     In accordance with instructions from the operation processing section  10 , the output interface  30  outputs the control signals and data to external devices provided outside of the electronic control unit shown in  FIG. 1 , such as parts of the transmission system. 
     A description will now be given, with reference to  FIG. 2 , of an example of the failsafe process executed by the operation processing section  10  of the electronic control unit. The operation processing section  10  periodically executes the failsafe process shown in  FIG. 2  while executing various controls involved in transmission control. 
     The operation processing section  10  refers to the external input signals IN from the input interface  20  and determines whether an abnormality occurs (step ST 1 ). When no abnormality is detected, the operation processing section  10  ends the process. When an abnormality is detected, the operation processing section  10  reads the output of the multiplexer circuit MUX 4  specifically assigned to abnormality detection, and determines whether an abnormality occurs in the multiplexer circuit MUX 4  (step ST 2 ). 
     It should be noted that one of the four inputs of the multiplexer circuit MUX 4  is set at the given potential Vcc, and the three remaining inputs are set at the ground potential GND. The operation processing section  10  uses the four input signals to determine whether an abnormality occurs in the multiplexer circuit MUX 4  (step ST 3 ). More particularly, the operation processing section  10  determines whether a predetermined logical operation on the fourth inputs of the multiplexer circuit MUX 4  results in a predetermined value obtained when no abnormality occurs. When the predetermined value is obtained, no abnormality occurs in the multiplexer circuit MUX 4 . In contrast, when a value other than the predetermined value is obtained, an abnormality occurs in the multiplexer circuit MUX 4 . 
     When no abnormality is detected in the multiplexer circuit MUX 4 , the operation processing section  10  determines that the input interface  20  operates normally (step ST 7 ), and determines that an abnormality occurs in the external input signals (step ST 8 ). In other words, it is determined whether the external input signals have an abnormal state. Then, the operation processing section  10  executes the failsafe process having an appropriate content that is predetermined on the basis of the state of the external input signals IN (step ST 9 ). Thus, the appropriate failsafe process for an abnormality in the vehicle can be executed reliably. 
     When the operation processing section  10  determines, at step ST 3 , that an abnormality occurs in the multiplexer circuit MUX 4 , the operation processing section  10  determines that the external input signals IN have no abnormality (step ST 4 ). When an abnormality occurs in the multiplexer circuit MUX 4 , it can be determined that the input interface  20  is faulty as a whole. It is known that in most cases, an abnormality occurs on the select signal lines SEL 1  and SEL 2  to which the multiplexer circuits MUX 1  through MUX 4  are connected. Thus, if one of the multiplexer circuits MUX 1  through MUX 4  becomes faulty and affects any of the signal lines SEL 1  and SEL 2 , each of the multiplexer circuits MUX 1  through MUX 4  will not operate normally. From the above viewpoint, it is sufficient to monitor only a part of the multiplexer circuits MUX 1  through MUX 4  (at least one multiplexer circuit; MUX 4  is assigned as such a specific multiplexer circuit in the present embodiment) and determine whether an abnormality occurs in the monitored part. If an abnormality is detected in the monitored part, it can be concluded that the whole input interface  20  becomes faulty. It is therefore possible to discriminate abnormality in the input interface  20  from that in the external input signals IN and execute an appropriate failsafe process reliably. 
     The operation processing section  10  uses the normal external input signals IN prior to detection of the abnormality at step ST 1 , and executes the failsafe process for ensuring security, such as evacuation of the vehicle to a road shoulder (step ST 5 ). It should be noted that the external input signals IN obtained after detection of the abnormality may be likely to indicate an abnormal value or state because the input interface  20  is faulty as a whole. If the faulty external input signals IN are used for vehicle control, the failsafe process cannot be carried out reliably. 
     The operation processing section  10  stores information indicative of the occurrence of an abnormality that occurs in the multiplexer circuit MUX 4  in a built-in memory (step ST 6 ). The information stored in the built-in memory may be used to analyze the abnormality by the dealer and enable quick vehicle repair. 
     As described above, the present embodiments determines whether an abnormality occurs in the multiplexer circuit MUX 4  of the input interface  20  by referring to the state of the external input signals prior to execution of the failsafe process, and changes the content of the failsafe process so as to correspond to the abnormality detected at step ST 3 . The failsafe process thus executed is more reliable. 
     In the above-mentioned embodiment, the entire multiplexer circuit MUX 4  is assigned to detection of an abnormality that occurs in the input interface  20 . The present invention includes another configuration, which is exemplarily shown in  FIG. 3 . As shown in  FIG. 3 , the operation processing section  10  supplies one of the four inputs of the multiplexer circuit MUX 4  with an input signal ISG, which is specifically used for abnormality detection and has a rectangular waveform. The three remaining inputs of the multiplexer circuit MUX 4  are used for a given control. The operation processing section  10  compares the input signal ISG with an output signal OSG output from the multiplexer circuit MUX 4 . The operation processing section  10  determines that the multiplexer circuit MUX 4  is operating normally when the signals ISG and OSG coincide with each other, and determines that an abnormality occurs in the multiplexer circuit MUX 4 , if not. 
     The configuration shown in  FIG. 3  uses only one input for abnormality detection of the multiplexer circuit MUX 4 , in other words, the input interface  20 . Further, the use of the rectangular waveform signal ISG makes it possible to detect an abnormality in the multiplexer circuit MUX 4  more reliably. 
     Yet another configuration for abnormality detection for the multiplexer circuit MUX 4  or the input interface  20  may be used. Referring to  FIG. 4 , the operation processing section  10  supplies a switch SW with a control signal CSG for turning ON and OFF the switch. The switch SW is connected between one of the four inputs of the multiplexer circuit MUX 4  and ground. When the switch SW is OFF, the output of the multiplexer circuit MUX 4  is in the floating state. When the switch SW is ON, the output of the multiplexer circuit MUX 4  is at the ground potential. The operation processing section  10  selects the input to which the switch SW is connected, and refers to the states of the output signal of the multiplexer circuit MUX 4  by turning ON and OFF the switch SW. Preferably, the switch SW is turned ON and OFF at timings that do not affect the vehicle control. 
     There is a further configuration for detecting an abnormality in the input interface  20 . Referring to  FIG. 5 , the operation processing section  10  turns ON and OFF a switch SW 1  having a terminal grounded. The operation processing section  10  controls the multiplexer circuit MUX 3  to select the switch SW 1 , and controls the multiplexer circuit MUX 4  to an inverter INV connected to another terminal of the switch SW 1 . The operation processing section  10  turns ON the switch SW 1 . The operation processing section  10  receives the ground potential through the multiplexer circuit MUX 3  and the high-potential produced by the inverter INV through the multiplexer circuit MUX 4 , when the input interface  20  operates normally. If the operation processing section  10  receives identical-level signals from the multiplexer circuits MUX 3  and MUX 4 , the operation processing section  10  determines that an abnormality occurs in the input interface  20 . 
     The present invention includes detection of abnormality that occurs in circuits other than the multiplexer circuits in the input interface  20 . The present invention is not limited to the four-input multiplexer circuits but includes other types of multiplexer circuits having an arbitrary number of inputs and/or outputs. 
     The present invention includes not only the electronic control units for use in vehicles but also electronic control units for industrial machines and electrical equipment. 
     The present invention is based on Japanese Patent Application No. 2006-052831 filed Feb. 28, 2006, the entire disclosure of which is herein incorporated by reference.