JP3370387B2 - Abnormality countermeasure method in a multi-CPU vehicle control computer system - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention is mounted on a vehicle, executes a predetermined calculation based on an input signal from sensors in the vehicle, and outputs a control signal for controlling actuators in the vehicle. The present invention relates to a vehicle control computer system having a multi-CPU configuration, and more particularly, to a countermeasure system against an abnormality in such a system.

[0002]

2. Description of the Related Art In recent years, against the background of advances in electronics technology such as the advent of high-performance microprocessors, advances in mechatronics technology, which is a combination of mechanical technology and electronic technology, have been remarkable. As part of these advances in mechatronics,
Many electronic control systems have been adopted in vehicles such as automobiles. Such in-vehicle computer systems pursue resource saving, energy saving, driving performance, safety, comfort, etc.
It is installed in driving / safety systems, entertainment systems and other places.

Among them, a vehicle control computer system, which is required to have particularly high reliability, may lead to a serious accident unless the abnormality detection and countermeasures for each part in the system are properly performed. Therefore, reliability is improved by providing a computer system with a self-diagnosis function.

[0004]

In this case, if the computer system is composed of a single CPU, countermeasures against abnormalities can be realized relatively easily, but the control processing is divided into a plurality of divisions. When a separate CPU is assigned to each process and a multi-CPU configuration is adopted in which the processes are carried out while mutually transferring necessary data, an error is detected.
The PU also notifies the other CPU of the abnormality information, and the CPU of the other side does not take countermeasures, but the CP of the other side.
It is necessary for U to take measures. In particular, both CPUs
Since there is a problem with the reliability of the transfer data when the power supply is shared by the CPU, the CPU that receives the abnormality notification from the other CPU also needs to take some measures against the data stored in the memory. There is. However, a countermeasure method against an abnormality in such a multi-CPU system has not been established in particular, and there has been a strong demand for the development of such a new technology.

In view of such circumstances, an object of the present invention is to provide an abnormality countermeasure system in a vehicle control computer system having a multi-CPU configuration, which has improved reliability. Consequently, the present invention aims to contribute to further improvement in the safety of vehicle driving.

[0006]

The abnormality countermeasure method in the vehicle control computer system of the multi-CPU configuration according to the present invention devised to achieve the above object is mutually connected by a communication path for data transfer. At least one first microcomputer having a self-diagnosis function, and at least one second microcomputer,
The first microcomputer is included between the first microcomputer and the second microcomputer.
In the microcomputer, the abnormality of the first microcomputer, the abnormality of the second microcomputer,
When an abnormality of a portion other than the first and second microcomputers in the computer system or an abnormality of another vehicle system outside the computer system is detected, information on the occurrence of the abnormality is provided to the first microcomputer. An abnormality occurrence communication means for transmitting from the computer to the second microcomputer is provided, and the second microcomputer responds to the abnormality occurrence information from the first microcomputer, and the second abnormality communication means. It is provided with a memory for initializing a data of a desired portion out of all data related to vehicle control including a control content such as an output signal stored in a memory in the microcomputer and a control initialization means. It is what

[0007]

In the abnormality countermeasure system in the vehicle control computer system having the multi-CPU structure configured as described above, the abnormality occurrence communication means transfers information about occurrence of abnormality from the first microcomputer to the second microcomputer. Second, which was transmitted and notified of an abnormality
The microcomputer of (1) can initialize a desired portion of data out of all the data related to vehicle control including the control content such as output signal stored in the memory by the memory and the control initialization means. It is possible to use fail-safe data without using data that is problematic in terms of sex.

[0008]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment in which the present invention is applied to an engine control computer system having a multi CPU structure will be described below with reference to the accompanying drawings.

FIG. 1 is a schematic block diagram showing a hardware configuration of the engine control computer system having the multi-CPU configuration. In the engine control computer system, the engine control computer optimally controls fuel injection and ignition timing according to input signals from the respective sensors. In this figure, the sensors and actuators are omitted because they are not essential to the invention.

As shown in FIG. 1, the engine control computer system includes a first microcomputer (microcomputer) 1 and a second microcomputer (microcomputer) 2.
The battery 6, the ignition switch 7, the main relay 8, the power supply circuit 9, and various sensors and actuators (not shown) are connected to them. The first microcomputer 1 and the second microcomputer 2 respectively include a central processing unit (CPU) 11, 21, a memory 12,
22, DMA (Direct Memory Access) controllers 13 and 23, serial communication interface circuit (SC
I) 14, 24 and clock generators 15, 25. Also, lines 16 and 26 are data buses, and lines 17 and 2 are
Reference numeral 7 indicates an address bus.

The SCIs 14 and 24 are circuits for converting 8-bit data into serial data and transmitting / receiving bit by bit. The SCI 14 in the first microcomputer 1 transmits the data to the SCI 24 in the second microcomputer 2. Is communication line 3
1 through and vice versa from SCI 24 to SCI
The data transmission to 14 is performed via the communication line 32. Line 33 is a clock signal line for that communication. The first microcomputer 1 operates as a master, and the line 34 is a reset signal line for resetting (initializing) the second microcomputer 2 operating as a slave. Furthermore, the first microcomputer 1 has a watchdog timer for checking whether the second microcomputer 2 is operating normally, and the line 35 is for clearing the watchdog timer periodically. A watchdog timer clear signal line from the second microcomputer 2 to the first microcomputer 1. If the signal of the signal line is fixed, the watchdog timer in the first microcomputer 1 is not cleared, and a certain predetermined time (for example, 1
After the elapse of 00 ms, the first microcomputer 1 determines that "the second microcomputer 2 is abnormal" and outputs the reset signal from the line 34 is a generally known technique.

The memories 12 and 22 are RAM portions (hereinafter referred to as "normal RAM") 122 and 2 which cannot hold information when the ignition switch 7 is off.
22 and a RAM portion that can hold information even when the ignition switch 7 is off (here, "standby RA
"M". ) 121,221. The engine control computer system is controlled by the ignition switch 7 so as to be in an operating state (on state). Even if the ignition switch 7 is in an off state, data necessary for the next operation is retained. It is in the standby state for performing the minimum required operations. The amount of power consumption in the standby state is small, and the battery 6 is not consumed in the standby state.
Therefore, the power supply line from the battery 6 to the power supply circuit 9 has two systems, that is, a standby system directly connected to the power system 9 and a main system via the main relay 8. Even if the ignition switch 7 is turned off, the power system is supplied by the standby system. The engine control computer system is configured to enter a standby state by the power that is generated. In this way, during standby, power is supplied to the CPUs 11 and 21 and the standby RAMs 121 and 221. Therefore, it becomes possible to hold data necessary for the next operation in the standby RAMs 121 and 221.

The operation is started when the ignition switch 7 is turned on. In response to this, the main relay 8 is connected and power is supplied to the power supply circuit 9 via the main system. At the start of operation, initialization is performed to set each part of the control unit to a predetermined state and inspect the state of each part. At this time, the standby RAM 12
The data stored in 1 and 221 are read out, each part is set according to the data, and part of the data is transmitted to the other microcomputer via the communication lines 31 and 32. During normal operation, data is transferred between the two microcomputers as required by the control process. Further, even when the ignition switch 7 is turned off to stop the operation, a part of the data necessary for the next operation is transmitted to another microcomputer and then the standby RA
The operation of storing in M121, 221 is performed.

The data communication is started by the CPUs 11 and 21 instructing to the DMA controllers 13 and 23 the positions of the data to be transmitted in the memories 12 and 22 and the number of bytes. In response to this, the DMA controllers 13 and 23 disconnect the CPUs 11 and 21 from the internal bus, transfer the data stored at the designated position in the memory to the SCIs 14 and 24, and the SCIs 14 and 24 serialize the data. Convert to data and send. In addition, D
It is also possible to perform data transfer to SCI by the CPU without using the MA controller.

Next, the abnormality countermeasure system in this embodiment will be described with reference to the engine control processing and the flowcharts of FIGS. In this embodiment, the first microcomputer 1 serves as a master to perform main processing of engine control, and the second microcomputer 2 serves as a slave.
Then, in the following description, a process in the case where an abnormality is detected in the second microcomputer 2 and the abnormality is notified to the first microcomputer 1 and the abnormality countermeasure is performed in the first microcomputer 1 will be described in detail. explain.

FIG. 2 is a schematic flowchart showing a processing procedure of an engine control main routine executed by the first microcomputer 1. When the ignition switch 7 is turned on, first, in step 502, the normal RAM is cleared. Next, the setup routine of step 504 is executed. In this routine, a value that does not cause a problem when the control data is used is set in advance as each control data before the control data is calculated and each control data is calculated. For example, the cooling water temperature is set to 85 ° C., the engine speed is set to 0 rpm, and the feedback correction count (FAF) based on the air-fuel ratio (A / F) of the fuel injection time is set to 1.0 in a predetermined memory. At the same time, for the input / output port (not shown in FIG. 1), the input signal is first read and filtered, and the control data for the output signal has not yet been calculated. Is stopped (or fixed value output, for example, injection is made to be 10 ms per revolution or ignition timing is made to be the top dead center output of each cylinder), and the no-load rotational speed control solenoid valve is set to be fully closed. For other actuators,
Similarly, the output is on the safe side.

Next, at step 506, the optimum fuel injection time corresponding to the state of the engine is calculated based on the input signal from each sensor, and the injection signal is output to the injector. At that time, along with the feedback control by the feedback correction coefficient FAF, the secular change of the feedback correction coefficient FAF is learned and corrected (the fuel injection time is corrected so that the average value of the FAF becomes a predetermined value).
Processing is performed, an A / F learning value for that purpose is calculated, and stored in the standby RAM 121. Next, step 5
At 08, the optimum ignition timing according to the state of the engine is calculated based on the input signal from each sensor, and the ignition signal is output to the igniter. Further, in the no-load speed control (ISC control) of step 510, the target speed is determined by the input signal from each sensor, and the control signal according to the engine speed is output to the ACV (solenoid valve).
Keep the idle speed at the target speed. At that time, feedback control to the target rotation speed is performed, and A /
Like the F learning value, the ISC learning value is introduced and the standby R
Stored in AM. The engine control method itself is not essential to the present invention, so a detailed description will be omitted.

Next, in step 512, a check is performed on the standby RAM. The details are
As shown in FIG. For important data or data with a history that is in the standby RAM, the relationship between the data and bit inversion so that the malfunction can be isolated if the microcomputer malfunctions and erroneous writing to the standby RAM or an abnormal read value occurs. RAM (mirror RAM) in is created. Therefore, first, a check (mirror check) as to whether or not the relationship is maintained is executed (step 602). Furthermore, for the power supply of the standby system to hold the standby RAM,
It is checked whether or not there is a temporary off state (temporary interruption) (step 604). This can be seen by looking at the port (generally reset when the power supply voltage drops below the power cutoff detection voltage (for example, 3V)) set in the microcomputer. When an abnormality is found by such a mirror check or standby power supply check, the failure code stored in the self-diagnosis and the above-mentioned A / F learning value and ISC learning value are reliable as control data. Is initialized as a fail-safe measure (steps 606 and 608).

Next, in step 514, self-diagnosis is executed. In this self-diagnosis, the signal from each sensor is checked for any abnormality, and if there is any abnormality, a predetermined failure code is stored in the standby RAM.

Next, at step 516, countermeasure processing for an abnormality relating to the other CPU, that is, the second microcomputer 2 is executed. In this embodiment, when an abnormality occurs in the second microcomputer 2, that is, for example, both C
When the power is shared by the PUs, a temporary power interruption occurs due to a sudden power fluctuation, and the C of the second microcomputer 2
When the PU 22 detects an abnormality in the standby RAM power supply, the CPU 22 of the second microcomputer 2 initializes its own memory as shown in the flowchart of FIG. As shown in FIG. 6 (a), the CPU 11 of the first microcomputer 1 is informed of the abnormality by making it longer (eg, 2 ms + 3 ms = 5 ms) than the normal cycle (eg, 2 ms). (Of course, in other embodiments, it can be shortened as shown in (b).)
That is, the CPU 11 is configured so that an interrupt is generated at the rising edge of the watchdog timer clear signal line 35 (of course, an interrupt is generated only at the rising edge or at both the rising edge and the falling edge, that is, every inversion of the signal. However, the processing procedure of the interrupt processing routine is as shown in the flowchart of FIG.

First, the watchdog timer is cleared as its original function (step 702), and then its cycle is calculated from the current time and the time of the last interrupt occurrence (step 704). After that, the current time is newly stored as the previous time (step 706). If the calculated cycle is longer than the normal cycle (for example, the judgment level is 6 ms) (judgment in step 708), it is judged that an abnormality has occurred in the second microcomputer 2, and the abnormality flag is turned on (1 ) (Step 71)
0). Since such an abnormality occurrence communication unit is provided, in the process of step 516, first, in step 802, it is determined whether or not the abnormality flag is 1, as shown in detail in FIG. Then, if it is 1, in step 804, a measure to initialize the memory and control is implemented.

Here, as the memory and control initialization range, in this embodiment, all data relating to vehicle control,
That is, the same initialization as the data initialization performed in the setup routine of step 504 and the standby RAM check of step 512 (failure code initialization of step 606 and learning value initialization of step 608) is executed. However, in other embodiments, step 5
It is also possible to use only the standby RAM that is initialized in the 12 standby RAM check. Also, step 6
The range to be processed by the learning value initialization of 08, that is, only the data relating to the basic performance of the engine in the standby RAM may be set. Further, the range processed in the fault code initialization in step 606, that is, the standby RA
Of the data stored in M, it is possible to use only the data related to the failure. The second microcomputer 2 detects an abnormality even if the first microcomputer 1 cannot detect it due to an erroneous failure determination due to an abnormality in the computer system or the second microcomputer 2 or due to sudden power fluctuations or momentary interruptions. It is also conceivable that an abnormality of the computer system that occurs is caused. Therefore, there is a problem in the reliability of the fault code itself written by the first microcomputer 1, or even if the transfer data from the second microcomputer 2 to the first microcomputer 1 is not reliable, the fault code Has a history and becomes a failure display to the user, and in the worst case, it may lead to repair of the vehicle or replacement of the engine control system. Therefore, when the data abnormality is suspected, it is necessary to initialize. That is, the data used for control and the control content have a problem in reliability, and those having a problem in safety are initialized.

After the end of step 516, the program loops back to step 506 to repeatedly execute the above processing. That is, the abnormality check of the second microcomputer 2 is also periodically executed. Above, the second microcomputer 2
Has described the case where an abnormality is reported to the first microcomputer 1. In this embodiment, the abnormality report is similarly made from the first microcomputer 1 to the second microcomputer 2, and the similar abnormality countermeasure processing is also performed in the second microcomputer 2. However, the abnormality report from the first microcomputer 1 to the second microcomputer 2 is carried out via the serial data communication line 31. In other embodiments, it is of course possible to provide a dedicated signal line for reporting an abnormality without using the watchdog timer clear signal line 35 and the serial data communication line 31 as described above. Regarding the abnormality, power supply abnormality was taken as an example, but in vehicle systems or computer systems, there are various problems such as sensor, actuator, I / O circuit abnormality, and other microcomputer runaway (error of watch dog timer clear line). For such abnormalities, a memory or control initialization method according to the control can be considered.

Although one embodiment of the present invention has been described above, the present invention is not limited to this, and it is easy for those skilled in the art to devise various embodiments. For example, it could be applied to a vehicle control computer system other than engine control.

[0025]

As described above, according to the present invention,
Reliability is improved in the abnormality countermeasure method in the vehicle control computer system having the multi-CPU configuration. Further, further improvement in safety of vehicle driving is ensured.

[Brief description of drawings]

FIG. 1 is a schematic block diagram showing a hardware configuration in an embodiment in which the present invention is applied to an engine control computer system having a multi-CPU configuration.

FIG. 2 is a schematic flowchart showing a processing procedure of an engine control main routine.

FIG. 3 is a schematic flowchart showing a processing procedure of a standby RAM check routine.

FIG. 4 is a schematic flowchart showing a processing procedure of an interrupt processing routine by a watchdog timer clear signal.

FIG. 5 is a schematic flowchart showing a procedure of abnormality countermeasure processing related to another CPU.

FIG. 6 is a time chart when an abnormality is notified using a watchdog timer clear signal.

[Explanation of symbols]

1 ... 1st microcomputer 11 ... CPU 12 ... Memory 121 ... Standby RAM 122 ... Normal RAM 13 ... DMA controller 14 ... Serial communication interface circuit 15 ... Clock generator 16 ... Data bus 17 ... Address bus 2 ... Second microcomputer Computer 21 ... CPU 22 ... Memory 221 ... Standby RAM 222 ... Normal RAM 23 ... DMA controller 24 ... Serial communication interface circuit 25 ... Clock generator 26 ... Data bus 27 ... Address bus 31 ... From first microcomputer to second microcomputer Communication line 32 for serial data to computer ... Communication line 33 for serial data from second microcomputer to first microcomputer ... Communication line 34 for clock signal ... First microcomputer Reset signal line 35 ... watchdog timer clear signal line 6 ... battery 7 ... ignition switch 8 ... main relay 9 ... power supply circuit from the second microcomputer to the first microcomputer to La second microcomputer

─────────────────────────────────────────────────── ─── Continuation of the front page (58) Fields surveyed (Int.Cl. ⁷ , DB name) G06F 11/16-11/20 G06F 11/30 G06F 15/16-15/177 G05B 9/03 JISST file ( JOIS)

Claims (5)

(57) [Claims] 1. A multi-CPU configuration including at least one first microcomputer having a self-diagnosis function and at least one second microcomputer, which are mutually connected by a communication path for data transfer. In the abnormality countermeasure method for a vehicle control computer system, the first microcomputer is configured to perform a wobble at a predetermined cycle.
Set the watchdog timer clear signal to the watchdog timer clock.
The signal is output via the rear signal line, and the second microcomputer
Monitor the watchdog timer clear signal
Based on the detection of abnormality of the first microcomputer
And, the first microcomputer, the first micro
Computer abnormality, the first in the computer system
Abnormalities in parts other than the first and second microcomputers
Of other vehicle systems outside the computer system
When an abnormality is detected, information regarding the occurrence of the abnormality is
Occurrence of abnormality for transmission to the second microcomputer
Communication means is provided, and the abnormality occurrence communication means is the microcomputer.
Connect the watchdog timer clear signal line connected between
And a signal different from the signal having the predetermined cycle.
By transmitting the information about the occurrence of the abnormality, the second microcomputer, the first microphone
(B) In response to the abnormality occurrence information from the computer,
The output data stored in the memory of the second microcomputer
All data related to vehicle control including control contents such as force signals
Memory and memory for initializing the data of the desired part of the data
An abnormality countermeasure system in a vehicle control computer system having a multi-CPU configuration , characterized by comprising: 2. A multi-CPU configuration including at least one first microcomputer having a self-diagnosis function and at least one second microcomputer, which are connected to each other by a communication path for data transfer. In an abnormality countermeasure method for a vehicle control computer system, an abnormality of the first microcomputer in the first microcomputer between the first microcomputer and the second microcomputer, When an abnormality in a part other than the first and second microcomputers in the system or an abnormality in another vehicle system outside the computer system is detected, information about the occurrence of the abnormality is sent from the first microcomputer. Abnormality occurrence communication hand for transmitting to the second microcomputer Is provided, the second microcomputer in response to the abnormality occurrence information from said first microcomputer, the second
Failure , stored in the memory of the microcomputer of
An abnormality countermeasure system in a vehicle control computer system having a multi-CPU configuration, comprising a memory for initializing data relating to the above and a control initialization means. 3. A multi-CPU configuration including at least one first microcomputer having a self-diagnosis function and at least one second microcomputer, which are connected to each other by a communication path for data transfer. In an abnormality countermeasure method for a vehicle control computer system, an abnormality of the first microcomputer in the first microcomputer between the first microcomputer and the second microcomputer, When an abnormality in a part other than the first and second microcomputers in the system or an abnormality in another vehicle system outside the computer system is detected, information about the occurrence of the abnormality is sent from the first microcomputer. Abnormality occurrence communication hand for transmitting to the second microcomputer Is provided, the second microcomputer in response to the abnormality occurrence information from said first microcomputer, the second
Control stored in the memory of the microcomputer of
An abnormality countermeasure method in a vehicle control computer system having a multi-CPU configuration, comprising a memory for initializing data relating to a learning value used for correcting data and a control initialization means. 4. The abnormality occurrence communication means includes a watchdog timer connected between the microcomputers.
The abnormality countermeasure in the vehicle control computer system having the multi-CPU configuration according to claim 2 or 3 , which is realized by transmitting the abnormality occurrence information using a watchdog timer clear signal line for periodically clearing. method. 5. The abnormality occurrence communication means is realized by transmitting the abnormality occurrence information using a serial data communication line connected between the respective microcomputers . Abnormality countermeasure method in a vehicle control computer system having a multi-CPU configuration.