JP3342085B2 - Electronic control unit - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control device having a self-diagnosis function, and more particularly to an electronic control device capable of detecting an abnormality in the operation of a microcomputer.

[0002]

2. Description of the Related Art Recently, various kinds of electronic control devices using microcomputers are mounted on automobiles to realize driving safety, comfort, economy and the like. One of them is a cruise control system, which relieves the driver from complicated accelerator pedal operations by electronic control, and aims to reduce fatigue and improve fuel efficiency. Cruise control system (hereinafter abbreviated as CCS)
When the main switch is turned on, the pilot indicator is turned on, the driver is notified that the vehicle can travel by CCS, the vehicle speed is set by operating the switch, and control is started.

The CCS has a self-diagnosis function. When a microcomputer monitors the operation of sensors and actuators and detects the occurrence of an abnormality in the control system, self-diagnosis information such as the location of occurrence is stored in a memory in a predetermined code. At the same time, the fail-safe function is activated depending on the content of the error. Fail safe is performed by a first fail signal and a second fail signal output with a predetermined time delay from the first fail signal. When the first fail signal does not come out for some reason, it is backed up by the second fail signal to ensure the operation reliability and safety.

The first fail signal is derived from a microcomputer, and the second fail signal is derived from a logic circuit formed by a timer or the like. The microcomputer and the logic circuit monitor the drive voltage waveform of the throttle valve opening adjustment motor driven by the duty control method. If abnormal control such as continuous energization of the motor at a duty ratio of 100% is detected for a certain period of time, the first and second fail signals are output one after another as described above, and the power supply to the motor is cut off. Danger is prevented by switching the system to a standby system such as manual operation.

[0005]

As described above, in the prior art, even if an abnormality occurs in the microcomputer and the first fail signal is not output, the second fail signal from the logic circuit side is backed up, so that the security is improved. Is secured, but it is not possible to detect that an abnormality has occurred in the microcomputer. If an abnormality occurs in the microcomputer, the pilot indicator remains lit due to malfunction, or incorrect self-diagnosis information is written, misunderstanding of the situation and delay in response,
On the contrary, there is a problem that another danger is generated, and a large amount of time and effort is spent for searching even in the case of service at a later date.

The present invention has been made in view of the above-mentioned problems, and provides an electronic control device capable of accurately notifying an abnormality of a microcomputer when a fail-safe function is activated when the microcomputer is abnormal. It is to be.

[0007]

According to the present invention, a microcomputer and a logic circuit are provided, and a control monitor signal is fed back from a load for a load driving state, and the presence or absence of an abnormality is individually monitored by the microcomputer and the logic circuit. Deriving a first signal from the microcomputer when the abnormality continues for more than a predetermined first time;
Further, an electronic control unit for deriving a second signal from the logic circuit when a predetermined second time greater than the first time is exceeded, activating a fail-safe function by at least one of the signals, and stopping load driving, Display means for displaying the first signal and the second signal, wherein the logic circuit abnormally operates the microcomputer when the first signal is not derived and the fail-safe function is activated by the second signal. The electronic control device is characterized in that the display means is displayed in a manner different from the case where both the first signal and the second signal are generated.

[0008]

In the electronic control unit according to the present invention, the microcomputer and the logic circuit individually feed back a control monitor signal from the load for the load driving state, and individually monitor the presence or absence of an abnormality. When an abnormality is detected, a first signal is output from the microcomputer and a second signal is output from the logic circuit, and the fail-safe function is reliably activated by at least the second signal. Furthermore, the logic circuit
By monitoring the presence or absence of the first signal and determining that the fail-safe function is activated by the second signal without outputting the first signal, it is determined that the operation of the microcomputer is abnormal. The fail-safe function is displayed in a manner different from that in the case of the first signal and in this case, the second signal is also generated, but the first signal is not generated and the second signal is used.

[0009]

FIG. 1 is a block diagram showing an electric configuration of an electronic control unit according to an embodiment of the present invention. The illustrated electronic control unit 1 constitutes a cruise control system (hereinafter abbreviated as CCS), and includes an input switch unit 3 as an input unit, a processing circuit 4 as a control unit, and a motor driver as a load driving unit. 5 and a pilot indicator 9 as display means. The load driving means is provided with a clutch driver and the like, but is not shown. The input switch unit 3 includes a control switch 3a such as a set switch, a cancel switch 3b such as a brake switch, and a vehicle speed sensor 3c.

The processing circuit 4 includes a microcomputer 4a
, A logic circuit 4b, and a memory and an input / output interface (not shown). The microcomputer 4a performs a predetermined process in response to the information input from the switch input unit 3, outputs a motor control signal MO as a control signal, and controls the motor driver 5.

The motor driver 5 generates a load drive signal in response to the motor control signal M0, and drives a throttle valve motor (hereinafter referred to as a motor) 7 as a load. When the pilot indicator 9 is lit,
This indicates that the vehicle can be driven by the CS. It should be noted in this embodiment that the pilot indicator 9
Takes the first to third types of display states, and when the fail-safe is activated when the microcomputer 4a is in an abnormal state, the pilot indicator 9 is surely turned off in the third display state to indicate that an abnormality has occurred. This is to be notified, which will be described later. In this embodiment, an 8-bit microcomputer is used as the microcomputer 4a, and the microcomputer 4a is abbreviated as an 8-bit microcomputer.

When the main switch 6 is closed, the logic circuit 4b energizes the relay driver 10 via the line L8 to drive the power supply relay 11 to conduct between the contacts, so that the power supply voltage Vb is supplied from the battery 18. The power is supplied to the motor driver 5, the clutch driver, and the like, the pilot indicator 9 is turned on, and the driver is notified by the CCS that the vehicle can run. The driver operates the control system switch 3a to set a desired vehicle speed, and starts traveling.

The motor control signal MO derived from the 8-bit microcomputer 4a and input to the motor driver 5 via the line L3 is a pulse having a constant period (for example, 50 ms).
The signal is used to control the speed of the motor 7 by a duty control method. The motor control signal MO is the motor driver 5
After the power is amplified, it is applied to the motor 7. C
Since the CS is linked to the accelerator mechanism, if abnormal control such as continuous energization of the motor 7 is performed against the driver's will, the car will be accelerated at a stretch and become a very dangerous state. In order to prevent such a danger, a fail-safe function is activated. The fail safe in the present embodiment is that the control monitor signal MP having the same waveform as the drive voltage applied to the motor 7 is transmitted from the motor driver 5 to the line L4.
The waveform is fed back to the processing circuit 4 and the 8-bit microcomputer 4a and the logic circuit 4b individually monitor and check the waveform. If an abnormality such as a duty ratio of 100% occurs, a first fail signal A from the 8-bit microcomputer 4a and a second fail signal B from the logic circuit 4b are led out to the line L10, and the relay driver 11
To shut off the contact of the power supply relay 12, cut off the power supply to the motor driver 5 and the clutch driver (not shown), stop the system, and switch to the manual operation side. When the first fail signal A is derived and the fail safe is activated, a predetermined code is written into a memory (not shown) by a self-diagnosis function, and is read out at the time of service at a later date.

FIG. 2 is a waveform chart showing waveforms at various parts in the present embodiment. The symbols in the figure correspond to the reference numerals in FIG. (1) is a waveform of the motor control signal MO sent to the motor driver 5, the cycle T0 is set to, for example, 50 ms, and the figure shows a waveform with a duty ratio of 50%.
(2) is a waveform of the control monitor signal MP fed back to the processing circuit 4. The control monitor signal MP has the same waveform as the motor control signal MO in a normal state, but at time t
When a waveform having a duty ratio of 100% as shown after 1 appears, the motor 7 is continuously energized and enters a very dangerous acceleration state. (3) is a waveform of the first fail signal A derived from the 8-bit microcomputer 4a. The 8-bit microcomputer 4a monitors the waveform of the control monitor signal MP and controls the control monitor with a duty ratio of 100% as after time t1. The duration T1 of the signal MP is, for example, 150 ms corresponding to three cycles.
Is exceeded, a first fail signal A which falls to a low level at time t2 is output. (4) is a waveform of the second fail signal B derived from the logic circuit 4b. When the duration T2 of the control monitor signal MP having a duty ratio of 100% exceeds, for example, 200 ms, the logic circuit 4b outputs a second fail signal B that falls to a low level at time t3. As described above, the fail-safe is formed by the dual system of the 8-bit microcomputer 4a and the logic circuit 4b.
Even if an abnormality occurs in a, the operation is reliably performed to ensure safety.

FIG. 3 is a block diagram showing a circuit configuration of the processing circuit 4 according to the present embodiment, and the same parts as those in FIG. 1 are denoted by the same reference numerals. However, the input switch section is omitted. The processing circuit 4 includes an 8-bit microcomputer 4a and a logic circuit 4
b. The logic circuit 4b includes a buffer 21, a timer circuit 22, and an exclusive OR circuit 23.
, And a NOR gate 24, all of which are integrated by an integrated circuit. The 8-bit microcomputer 4a and the logic circuit 4b are mutually connected by lines L11 to L13. The control monitor signal MP is input to the timer circuit 22 via the line L4, and is also input to the monitor input terminal mp of the 8-bit microcomputer 4a via the buffer 21. In the following description, “1” indicates a high level, and “0” indicates a low level.

"1" is output to the fail output terminal a of the 8-bit microcomputer 4a in a normal state. The duty ratio of the control monitor signal MP is 100%, and the duration thereof is a predetermined first time T1 (150 ms in this embodiment).
Is detected by the 8-bit microcomputer 4a, the first fail signal A falling to "0" is led out from the fail output terminal a to the line L12. Line L1
2 is connected to one input terminal of the exclusive OR circuit 23, and the other input terminal of the exclusive OR circuit 23 is connected to the output terminal of the timer circuit 22 via a line L10. When the control monitor signal MP having the duty ratio of 100% is input, the timer circuit 22 drops from "1" to "0" after a predetermined second time T2 (200 ms in this embodiment) has elapsed. The fail signal B is led out to the line L10. Since the line L10 is kept at "1" in the normal state, the power is supplied to the motor driver 5 without deenergizing the relay driver 11. The value is always "0" from the pilot indicator terminal pi of the 8-bit microcomputer 4a, and becomes "1" at a predetermined cycle corresponding to the content of diagnosis when the self-diagnosis function is activated.
A pilot signal PI flickering with "0" is derived,
The signal is input to one of the NOR gates 24 via a line L11. The output terminal of the timer circuit 22 is a line L
10 is connected to the reset terminal of the relay driver 11 and the other input terminal of the exclusive OR circuit 23. The diode D connected between the lines L10 and L12 is a backflow prevention diode.
While holding “1” derived to 12
When the fail signal A is derived, this is for dropping the line L10 to the same “0” as the first fail signal A. As a result, when the control monitor signal MP having the duty ratio of 100% is continuously input, the line L10 becomes “0” after 150 ms, the relay driver 11 is deenergized, and the second “50” after the same 50 ms after that. A fail signal B is derived. That is, fail-safe is performed in a dual system of the 8-bit microcomputer 4a and the logic circuit 4b.

Next, the display of the 8-bit microcomputer 4a at the time of abnormality, which is the gist of the present invention, will be described. NOR gate 2
4 is connected to the output terminal of the exclusive OR circuit 23, and the output terminal of the NOR gate 24 is connected to the pilot indicator 9 via the line L6. This causes the pilot indicator 9 to
The following three display states, which are predetermined, are taken.

Lighting: Main switch 6 is turned on and CC
Lights when the vehicle is in the runnable state by S. That is, N
When both inputs of the OR gate 24 are “0, 0”, the light is turned on. This is a state in which the lines L10 and L12 are both "1" and the line L11 is "0", and the first fail signal A, the second fail signal B, and the pilot signal PI are not all output. Therefore, if the pilot indicator 9 is lit, it is informed that the CCS function is normal and the vehicle can run.

Flicker: Flicker occurs when the first fail signal A and the second fail signal B are both output and the fail safe is activated. This is a duty ratio of 100
% In which the control monitor signal MP is input and fail-safe is performed. Since both the first fail signal A and the second fail signal B are output, it is determined that the output of the exclusive OR circuit 23 becomes “0”. At the same time, it is determined that the 8-bit microcomputer 4a is functioning normally with respect to the fail safe. On the other hand, 8-bit microcomputer 4
a, by deriving the first fail signal A, derives the pilot signal PI that flickers at a predetermined cycle based on the self-diagnosis function. Therefore, the pilot indicator 9 repeats blinking, indicating that the fail safe has been performed. It will be announced. The pilot signal PI having a plurality of cycles is set in advance based on the information so that the pilot indicator 9 blinks even when the self-diagnosis information is output due to a cause other than fail-safe. Can be easily determined.

Light-off: When the first fail signal A is not output and the fail-safe is performed by the second fail signal B, the light is turned off. The fact that the first fail signal A is not output from the 8-bit microcomputer 4a despite the fact that the control monitor signal MP having a duty ratio of 100% is input for more than 150 ms means that the level of the line L12 remains high. No change indicates that an abnormality has occurred in the 8-bit microcomputer 4a, which is determined by the output of the exclusive OR circuit 23.
From the timer circuit 22, the low-level second
The fail signal B is output, the relay driver 11 is deenergized, and safety by fail safe is ensured. In this case, the exclusive OR circuit 23 is provided by the second fail signal B.
Becomes "1", the output of the NOR gate 24 becomes "0" irrespective of the pilot signal PI, the pilot indicator 9 is turned off, and it is notified that the CCS is stopped. Further, by using the output of the NOR gate 24 for erasing the self-diagnosis information, it is possible to prevent erroneous information from being recorded when an abnormality occurs.

FIG. 4 is an overall flowchart for explaining the operation of the 8-bit microcomputer and the logic circuit 4b in this embodiment. Parts corresponding to those in FIGS. 1 to 3 are denoted by the same reference symbols, and will be described with reference to these drawings. In step n1, the main switch is turned on.
N, and at step n2, the pilot indicator 9 is illuminated to notify that the vehicle can travel by CCS. The flow advances to step n3 to wait for the set SW to be turned on. In the next step n4, a motor control signal MO having a duty ratio corresponding to the set vehicle speed is sent to the motor driver 5. As a result, the motor 7 is driven in step n5, and in step n6
, The control monitor signal MP is fed back from the motor driver 5, and the duty ratio of the control monitor signal MP is changed to the 8-bit microcomputer 4a.
And the logic circuit 4b. Step n
At 7, the 8-bit microcomputer 4a determines whether the duty ratio is 100%. If the answer is no, the process returns to step n6. If the answer is affirmative, the process proceeds to step n8, and it is determined whether or not the duration T1 exceeds 150 ms. In parallel with this, the duration time of the logic circuit 4b is also measured by the timer circuit 12. 150m
If negative at s or less, it is determined to be transient and the process returns to step n6 to continue the control. If it exceeds 150 ms, it is determined in step n9 whether the first fail signal A has been output from the 8-bit microcomputer 4a. If it is output, the 8-bit microcomputer 4a is normal, and the pilot signal PI is derived at the same time in step n10. Therefore, in step n11, the pilot indicator 9 flickers at a predetermined cycle to notify that the fail safe has been activated. Is done. At the same time, the line L10 falls to "0" by the first fail signal A in step n12.
The contact of the power supply relay 11 is cut off, the power supply to the motor driver 5 is cut off, and the process proceeds to step n13 to ensure safety by fail-safe.

Returning to step n9, if the first fail signal A is not output, it means that an abnormality has occurred in the 8-bit microcomputer 4a, and the process proceeds to step n17 to control the control monitor signal MP having the duty ratio of 100%. It is determined whether or not the duration of the data exceeds 200 ms. At this point, the process proceeds to step n14, where the second fail signal B is output from the logic circuit 4b. In step n15, 8
The pilot signal PI from the bit microcomputer 4a is ignored, and the output level of the NOR gate 24 becomes "0" instead.
At step n16, the pilot indicator 9 is turned off, an abnormality of the 8-bit microcomputer 4a is notified, and at the same time, the level of the line L10 drops to "0" by the second fail signal B, so that the process returns to step n12 and the power supply relay 11 is cut off. In step n13, safety by fail-safe is ensured.

In the above description, the cruise control system is taken as an example. However, the present invention is not limited to this, and is widely applied to an electronic control device having a double fail-safe function. It will be obvious to those skilled in the art that the use is not limited to the vehicle. As described above, in the present invention, the fail-safe of the system is formed by the dual system of the microcomputer and the logic circuit, and when a failure occurs in the microcomputer during the operation of the fail-safe, the fact can also be notified. As a result, it is possible to display the occurrence of an abnormality in the microcomputer without compromising safety, and it is easy to determine the situation and respond to it. It will improve.

[0024]

As described above, according to the present invention, the microcomputer and the logic circuit individually monitor the presence or absence of an abnormality by feeding back a control monitor signal from the load regarding the load driving state. When an abnormality is detected, the first signal and the second signal are separately output from the microcomputer and the logic circuit. The second signal backs up the first signal,
Since at least the fail-safe operation is ensured by the second signal, safety is ensured. Furthermore, the logic circuit is also monitored for the presence or absence of the first signal output from the microcomputer. When the fail-safe function is activated by the second signal without outputting the first signal, an abnormality occurs in the operation of the microcomputer. This can be reliably detected. In the fail-safe function, although the first signal is generated and the second signal is generated in this case, the first signal is not generated and displayed in a different manner from the case of the second signal. It is easy.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an electrical configuration of an electronic control unit according to an embodiment of the present invention.

FIG. 2 is a waveform chart showing signal waveforms of respective units shown in FIG.

FIG. 3 is a block diagram showing a circuit configuration of the control unit shown in FIG. 1;

FIG. 4 is a flowchart for explaining the operation of the present embodiment.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Electronic control unit 3 Input switch part 3a Control system switch 3b Cancel system switch 3c Vehicle speed sensor 4a Microcomputer 4b Logic circuit 5 Motor driver 6 Main switch 7 Throttle valve opening adjustment motor 9 Pilot indicator 11 Relay driver 12 Power relay 21 Buffer Circuit 22 Timer circuit 23 Exclusive OR circuit 24 NOR gate A First fail signal B Second fail signal MO Motor control signal MP Control monitor signal PI Pilot signal

Continuation of the front page (56) References JP-A-4-66746 (JP, A) JP-A-3-13545 (JP, U) JP-A-59-45651 (JP, U) (58) Fields investigated (Int) .Cl. ⁷ , DB name) G06F 11/30

Claims (1)

(57) [Claims] The microcomputer includes a microcomputer and a logic circuit, wherein a control monitor signal is fed back from a load for a load driving state, and the microcomputer and the logic circuit individually monitor the presence / absence of an abnormality. A first signal is derived from the microcomputer when continuing over time, and a second signal is derived from the logic circuit when exceeding a predetermined second time greater than the first time, and at least one of the signals An electronic control device for activating a fail-safe function and stopping a load drive, comprising at least a display unit that is displayed by the first signal and the second signal, wherein the logic circuit does not derive the first signal, When the fail-safe function is activated by the second signal, the operation of the microcomputer is abnormal. It detected, the electronic control unit, characterized in that to display the display means in a manner different from the case where the first signal and the second signal are both generated.