JP3752884B2

JP3752884B2 - Automotive electronic control unit with self-monitoring function

Info

Publication number: JP3752884B2
Application number: JP11054199A
Authority: JP
Inventors: 淑之内海; 康裕小西
Original assignee: Mitsubishi Electric Corp
Current assignee: Mitsubishi Electric Corp
Priority date: 1999-04-19
Filing date: 1999-04-19
Publication date: 2006-03-08
Anticipated expiration: 2019-04-19
Also published as: JP2000305603A

Description

【０００１】
【発明の属する技術分野】
この発明は、車載用電子制御装置で、特にフェールセーフ機能の確実性を高めるための自己監視機能付き車載用電子制御装置に関するものである。
【０００２】
【従来の技術】
従来より車載用電子制御装置の中には、その制御系の誤動作を厳格に監視してフェールセーフ機能を強化しているものがある。例えば４輪操舵システムやアンチスキッドブレーキシステム（以下ＡＢＳという）は、運転者の操作に対して車両の操縦性及び安定性を確保するものであるため、その制御量を決定するコントロールユニット（以下ＥＣＵという）には、信頼性を確保する目的のフェールセーフ機能が盛り込まれていた。例えばＡＢＳでは車輪速情報に基づき制御量演算を行う際、ＣＰＵを２個配置し、同一入力・同一演算の結果の照合により、同一結果の場合出力し、ブレーキ液圧を制御するアクチュエータ（以下Ｈ／Ｕという）を駆動していた。つまり完全二重系による冗長性で信頼性を確保していた。このように構成された装置は、例えば特公平７−３８１６２号公報に記載されている。
【０００３】
このような従来のＥＣＵでは、同一機能のＣＰＵを２個装備するためコスト高になるという欠点があった。そこでこのコスト高の欠点を補う目的で例えば、特開平９−３０５２２３号公報記載の発明が提案されている。以下図８に基づき従来の車載用電子制御装置について説明する。図８は、ＡＢＳにおけるシステムブロック図である。１はセンサ類で車輪速センサを示し、２はアクチュエータでＨ／Ｕを示している。３はＨ／Ｕ２を駆動する駆動手段、４はセンサ１からの情報に基づき制御量を演算し、Ｈ／Ｕ２を駆動すべく駆動手段３に信号を出力するメインＣＰＵである。５０はメインＣＰＵ４を監視するサブＣＰＵで、メインＣＰＵ４と通信可能である。５１はメインＣＰＵ４又はサブＣＰＵ５０の出力により作動し、Ｈ／Ｕ２の電源供給源であるフェールセーフリレー５３を遮断するように作動するＯＲ回路である。
【０００４】
次に、従来装置の特徴であるメインＣＰＵ４を監視するサブＣＰＵ５０によるフェールセーフ機能について説明する。メインＣＰＵ４を監視する監視部５２は、チェックデータＸ及びそれらから定まる解データＺを記憶手段に予め記憶している。サブＣＰＵ５０は、このデータＸをメインＣＰＵ４に通信ライン５４を介して送信する。メインＣＰＵ４はこれらのデータＸを受信し、予め決められた演算手順で処理し、その結果を通信ライン５５を介してサブＣＰＵ５０に返信する。サブＣＰＵ５０は、この受信データと記憶していたデータＺを照合し、一致していればメインＣＰＵ４は正常と判断し、不一致であれば異常と判断しＯＲ回路５１に異常信号を出力する。この出力によりＨ／Ｕ２の駆動源である電源を遮断するので、Ｈ／Ｕ２を非作動状態にすることになり、フェールセーフ機能が働く。この従来装置はメインＣＰＵ１個によりＨ／Ｕを制御できる構成であり、サブＣＰＵは機能的にも、コスト的にもメインＣＰＵより低位の素子を使用することが可能な構成となっている。
【０００５】
【発明が解決しようとする課題】
以上のような従来装置であっても、サブＣＰＵを使用しているため、設計及び製造コスト高はまだ解消できず、さらにサブＣＰＵの占める面積により小型化の障害となっている。また、サブＣＰＵ自体の異常によりＯＲ回路への信号が、必要時正確に出力されていることを確認していないという問題点があった。
【０００６】
この発明は、前記のような問題点を解決するためになされたもので、主制御手段とこの異常を監視する監視手段とにより互いにデータを送受信し、独立に互いの異常を検出することにより、フェールセーフ機能の信頼性を向上させ、さらにコスト低減、小型化をめざした自己監視機能付き車載用電子制御装置を提供するものである。
【０００７】
【課題を解決するための手段】
この発明に係る自己監視機能付き車載用電子制御装置では、車両の状態を検出する複数のセンサと、車両を制御するアクチュエータと、このアクチュエータを駆動させる駆動手段と、前記複数のセンサからの情報を入力し、この情報に基づき制御量を演算し、この制御量に見合う信号を前記駆動手段に出力する主制御手段と、前記複数のセンサの内少なくとも１つのセンサ及び主制御手段に接続され、前記主制御手段の機能を監視する監視手段と、この監視手段から第１の禁止信号を出力し、禁止信号出力時前記アクチュエータを動作しないようにする禁止手段とを有し、前記監視手段は、前記センサ情報を入力し、前記主制御手段が行う前記制御量演算処理とは異なる簡略処理を行う第１処理手段と、この第１処理手段で処理された情報を前記主制御手段に出力する第１処理信号と、前記主制御手段からの情報を第２処理信号として入力し、この第２処理信号の情報と前記第１処理手段の情報を比較し、互いの情報に相違がある場合、前記禁止手段に第１禁止信号を出力する第１の比較手段とを備え、前記主制御手段は、前記センサ情報を入力し前記制御量演算を行う第２処理手段と、この第２処理手段の結果に対し、前記第１処理手段の前記簡略処理情報に前記第２処理手段結果と同一次元となる変換演算を行う第３処理手段と、前記監視手段の第１処理信号を入力し、前記第３処理手段で得られた情報とを比較し、互いの情報に相違がある場合、前記禁止手段に第２の禁止信号を出力する第２の比較手段と、前記第３処理手段の情報を第２処理信号として前記監視手段に出力する手段とを備えるようにしたものである。
【０００８】
また、この発明に係る自己監視機能付き車載用電子制御装置では、車両の状態を検出する複数のセンサと、車両を制御するアクチュエータと、このアクチュエータを駆動させる駆動手段と、前記複数のセンサからの情報を入力し、この情報に基づき制御量を演算し、この制御量に見合う信号を前記駆動手段に出力する主制御手段と、前記複数のセンサの内少なくとも１つのセンサ及び主制御手段に接続され、前記主制御手段の機能を監視する監視手段と、この監視手段から第１の禁止信号を出力し、禁止信号出力時前記アクチュエータを動作しないようにする禁止手段とを有し、前記監視手段は、前記センサ情報を入力し、前記主制御手段が行う前記制御量演算処理とは異なる簡略処理を行う第１処理手段と、この第１処理手段で処理された情報を前記主制御手段に出力する第１処理信号と、前記主制御手段からの情報を第２処理信号として入力し、この第２処理信号の情報と前記第１処理手段の情報を比較し、互いの情報に相違がある場合、前記禁止手段に第１禁止信号を出力する第１の比較手段とを備え、前記主制御手段は、前記センサ情報を入力し前記制御量演算を行う第２処理手段と、前記監視手段の第１処理手段からの情報に対し、前記主制御手段の第２処理手段の演算結果と同一次元となる変換演算を行う第５処理手段と、この第５処理による情報と第２処理手段の情報を比較し、この比較により互いの情報に相違がある場合、前記禁止手段に第２の禁止信号を出力する第２の比較手段と、前記第５処理手段による情報を再度元に戻すための変換演算を行い、これを前記第２処理信号として前記監視手段に出力する第６処理手段とを備えるようにしたものである。
【０００９】
また、この発明に係る自己監視機能付き車載用電子制御装置では、主制御手段は、基準となる信号を発生する第１基準信号発生手段を有し、監視手段と主制御手段は、この第１基準信号に応じて第１処理手段及び第２処理手段で処理された情報を出力又は入力するように構成されたものである。
【００１０】
また、この発明に係る自己監視機能付き車載用電子制御装置では、監視手段は、第２の基準信号を発生する第２基準信号発生手段を有し、主制御手段からの第１基準信号の周期をこの第２基準信号で計測した結果が理論値に誤差を加味した時間範囲外の場合、第１禁止信号を出力する第３比較手段と、この第３比較手段の出力又は第１比較手段の出力を第１禁止信号として出力し、この出力を保持する保持手段と、電源投入後所定時間経過後、かつ前記第１基準信号が前記時間範囲内の場合、この保持機能を一旦打ち消す解除手段とを備えるようにしたものである。
【００１２】
また、この発明に係る自己監視機能付き車載用電子制御装置では、電源投入後主制御手段は、第１の所定時間までは第３処理を行わず、第２の所定時間経過までに監視手段による第１禁止信号を入力し、禁止信号が出力されている場合、第２の所定時間以降第３処理を行うように作動するようにしたものである。
【００１３】
また、この発明に係る自己監視機能付き車載用電子制御装置では、電源投入後主制御手段は、第１の所定時間までは第５処理又は第６処理を行わず、第２の所定時間経過までに監視手段による第１禁止信号を入力し、禁止信号が出力されている場合、第２の所定時間以降第５処理又は第６処理を行うように作動するようにしたものである。
【００１４】
また、この発明に係る自己監視機能付き車載用電子制御装置では、監視手段の第１の比較手段、又は主制御手段の第２の比較手段は、情報の相違が複数回数続いた場合、第１禁止信号又は第２禁止信号を出力するようにしたものである。
【００１５】
また、この発明に係る自己監視機能付き車載用電子制御装置では、センサからの信号がディジタル信号である場合、第１処理手段は第２基準信号に基づき計測処理を行うようにしたものである。
【００１６】
さらにまた、この発明に係る自己監視機能付き車載用電子制御装置では、センサからの信号がアナログ信号である場合、第１処理手段は、アナログ／ディジタル分割変換処理を行うようにしたものである。
【００１７】
【発明の実施の形態】
実施の形態１．
以下、この発明の実施の形態１を図について説明する。
図１はこの発明の実施の形態１による自己監視機能付き車載用制御装置を示すブロック構成図である。図１において、１は車両の状態を検出するセンサ類で、２は車両を制御するアクチュエータである。３はこのアクチュエータ２を駆動する駆動手段である。４は主制御手段で、センサ１の情報に基づき制御量を演算し、駆動手段３に制御量信号を出力するものである。５は主制御手段４を監視する監視手段であり、主制御手段４との間には送信・受信の通信ラインが存在する。６はアクチュエータ２の作動を停止させるように動作する禁止手段であり、主制御手段４又は監視手段５により作動するものである。
【００１８】
監視手段５は、ライン３１によりセンサ類１の情報の少なくとも１つを入力し、所定処理を行い第１処理信号３３を介して主制御手段４に送信する第１処理手段２０と、主制御手段４からの第２処理信号３４を入力し、第１処理手段による情報と比較し相違がある場合、第１禁止信号３５を禁止手段６に出力する第１比較手段２２とで主に構成されている。なお第１処理手段２０、及び第２処理信号の入力３４は主制御手段４の第１基準信号３２に呼応して動作するように構成されている。
【００１９】
さらには、第２の基準信号を発生する第２基準信号発生手段２３と、主制御手段４からの第１基準信号３２が所定時間内にあるか否かを第２基準信号により計測することにより比較し、所定時間内に第１基準信号３２が入っていない場合、禁止手段６に第１禁止信号３５を出力する第３比較手段２４と、第１比較手段２２又は第３比較手段２４の禁止用信号を保持する保持手段２５と、第２基準信号による所定時間経過後、かつ第３比較手段２４による禁止用信号発生がない場合、保持手段２５の禁止信号を一旦打ち消す解除手段２６とを有している。
【００２０】
一方主制御手段４は、センサ１の情報を入力し制御量を演算し、駆動手段３に出力する第２処理手段１１と、第１の基準信号を発生する第１基準信号発生手段１０と、第１処理信号３３を介して入力された情報と第２処理手段１１による情報を比較し、相違がある場合、禁止手段６に第２の禁止信号３６を出力する第２比較手段１２とで構成され、第２処理手段１１にはセンサ処理情報を第１基準信号に応じて監視手段５に出力する手段を有している。
【００２１】
図１のブロック構成を具体的システムに適用した場合において、各手段の機能について詳細な説明を行う。図２はＡＢＳに適用した場合のブロック構成図である。図２中図１と同一符号は同一又は相当部分を示している。センサ類（１ａ〜１ｄ）は車輪速センサで、乗用車の場合各車輪毎に配設されて通常４個存在する。これら車輪速センサの内少なくとも１つは監視手段５にも入力されている（３１）。監視手段５はＣＰＵを含まない回路網で構成されているとする。第２基準信号発生手段２３は、第１基準信号３２と比較し１桁以上早い基準信号を発生するクロック発生回路である。例えば第１基準信号は２００Ｈｚとすると、第２基準信号は２０ＫＨｚとする。
【００２２】
第１処理手段２０は、この第２基準信号を基に車輪速信号を計測する機能を有している。この計測間隔は第１基準信号毎にクリアされるものとする。ここで車輪速は１００Ｋｍ／ｈで１ＫＨｚのパルスが入力されるとすると、第１基準信号間隔では４又は５発入力されることになり、第２基準信号２０ＫＨｚでこれを計測すると各パルス間隔はＡ＝１９又は２０カウントとなる。このカウント値Ａを第１基準信号３２に同期して主制御手段４であるＣＰＵに第１処理信号３３を介して送信する。
【００２３】
次に第１基準信号３２に同期して、第１処理値Ａを第４処理手段２１にシフトすると共に計測値をクリアする。この場合、第４処理手段２１はレジスタの機能を有し、処理値はＤ＝Ａとなる。信号ライン３４を介して入力した値Ｃと第４処理手段による値Ｄを比較し、ＣとＤが相違している場合、禁止信号３５を出力するように信号を発生する第１比較手段２２が作用する。この場合、監視手段５は主制御手段４が異常と判断し、Ｈ／Ｕ２を停止するように駆動手段３を非駆動とするので、安全性を確保して例えばノーブレーキ状態に陥るのを禁止し、運転者による通常ブレーキ状態に戻すことになる。
【００２４】
次に、第１基準信号３２に異常が発生しているか否かを監視する機能について説明する。この機能はいわゆるウオッチドッグと言われるものである。第２基準信号に基づき第１基準信号が所定範囲内に入っているかをカウントする。例えば前記の第２基準信号周波数が２０ＫＨｚであるとすれば、カウント値はＥ＝９９又は１００となる。そこで第２基準信号のバラツキ、測定誤差を考慮し範囲を９０〜１１０とする。この範囲にカウント値Ｅが入っていない場合、同様に禁止信号３５を出力するように第３比較手段２４は作用する。
【００２５】
以上のことを図３のタイムチャートを用いて時系列に沿って説明する。３２は第１基準信号、３６は第２基準信号である。車輪速１ｄが３１に示すように入力された場合、第１処理手段は、３７のように車輪速周期を計測する。つまり第１基準信号のエッジに同期しカウンタ値はクリアされ（ｔ１）、第２基準信号の立ち上がりエッジでカウントを開始し（ｔ２）、車輪速パルス３１のエッジで前回値と比較し大きい方を保持する（ｔ３、ｔ４）。この情報を主制御手段４に、次の第１基準信号のエッジで送信する。この機能により第１処理手段は、低速ほど大きな値が送信されることになる。なお、停車時は所定の値でクリップするようにしておく。
【００２６】
また、第１基準信号３２は、第２基準信号３６により計測され、３８に示すようなカウント値となる。つまり第１基準信号のエッジでクリアされ（ｔ１）、第２基準信号の立ち上りエッジでカウントを開始し（ｔ５）、次の第１基準信号のエッジ入力時点（ｔ６）の値を参照し、予め決められた上限（３９）・下限（４０）の範囲に入っているかを第３比較手段２４によりチェックするものである。
【００２７】
再度図２に戻り主制御手段４について説明する。主制御手段４はＣＰＵであり、車輪速センサ１ａ〜１ｄの信号をすべて入力し、車輪速度を演算し、車体速度を推定し、車輪加減速度及びスリップ率を演算し、各車輪のブレーキ液圧を減圧・保持・増圧することにより車輪スリップを適切な範囲に収束させるようにＨ／Ｕ２を駆動する駆動手段３の駆動回路に信号を出力する機能を有している。これらの処理は通常のＡＢＳ制御で、第２処理手段１１で行っている。ここで１ｄの車輪速を演算した情報Ｂから、第２基準信号で計測したならばどの程度の値Ｃとなるかの変換を第３処理手段１３で行う。例えばＢ＝１ｍＳ＝１００Ｋｍ／ｈが得られているので、この値から２０ＫＨＺ＝０．０５ｍｓでカウントするとＣ＝２０が求まる。このＣにある範囲を有して情報Ａと比較し、両者の相違を検出する。
【００２８】
次に、第１基準信号例えばウオッチドッグ信号に同期して、第１処理信号３３を入力する。この第１処理信号の情報Ａと第３処理手段による変換値Ｃを第２比較手段１２で比較する。ここでＣは第２基準信号のバラツキ、計測の誤差を加味して所定の範囲（例えば１７〜２３）を有するものとする。ＡとＣが相違している場合、ＣＰＵ４は監視手段５が異常として判断し、禁止手段６に信号を出力し（３７）、Ｈ／Ｕ２の駆動を強制的に停止させる。さらに、第３処理手段１３による情報Ｃを第１基準信号に同期して、監視手段５に第３処理信号３４を送信する。
ＣＰＵ４が以上のような構成を有しているため、監視手段が異常になった場合でも、アクチュエータ２の駆動を停止できるため、車両の制動力を損なうことなく走行安全性を確保でき、ＥＣＵとしての信頼性を向上できるものである。
【００２９】
さらにまた、監視手段５が異常を検出した場合、実際に禁止信号３５を出力するか否かをチェックすることも必要となる。次にこの機能について説明する。電源投入直後、ＣＰＵ４は所定時間経過までは、第３処理手段１３による所定処理を行わず、例えば第２処理手段１１の情報をそのまま送信する。この時間管理は第１基準信号を使用して行うことができる。その後禁止信号３５をＣＰＵ４が入力し、禁止信号が発生していて、かつ所定時間経った場合、第３処理手段１３は通常の処理に変える。禁止信号が発生していなければ、監視手段５が異常と判断し、第２比較手段１２が第２の禁止信号３７を出力するように作用する。この機能を有することにより、監視手段５の第１比較手段２２により禁止信号が出力されることをＣＰＵ４が監視していることになる。
【００３０】
しかし、禁止信号を一旦出力していたのもかかわらずこの出力をリセットしてしまうのことは、実使用上及び安全性確保上問題である。そこで、監視手段５は、電源投入後所定時間経過後禁止信号を保持する手段２５を解除する手段２６を有している。この機能は、第１基準信号又は第２基準信号に基づき所定時間を計測し、所定時間後（例えば電源投入後１００ｍｓ）で、第１基準信号が所定範囲に入っている場合、禁止信号を一旦リセットする信号を出力する解除手段２６で行われる。従って、禁止信号保持手段２５（例えばラッチ回路）を所定時間後一度だけリセットをかけるものである。実際に異常であっても、再度第１比較手段２２又は第２比較手段１２により禁止信号が出力されるため、第１基準信号の１周期分正常と判断されるのみで、短時間であるため実使用上問題はない。
【００３１】
以上のことを図４のタイムチャートを用いて時系列に沿って説明する。４１は電源供給ラインを示していて、ｔ０で電源が投入されたとする。第１基準信号は３２のように入力されている。４２はＣＰＵ４の内部動作の状態を示していて、第１基準信号３２の立ち上がり及び立ち下がりが４回までは、第３処理手段１３が所定処理を行っていない状態である。第１基準信号４回以降、ある時点（ｔ７）で第３処理手段が所定処理を開始したことを示している。ただしこの際、第１禁止信号３５ａが禁止信号を出力していることを検出した場合に限られる。４３は解除信号を示し、第１基準信号３２の５回目のエッジ（ｔ８）で、所定の出力信号を発生し、保持手段２５を一旦リセットするように作用する。これにより、保持手段の出力である第１禁止信号３５は、禁止信号を出力していたがｔ８からｔ９の間、禁止信号の発生を停止する。この後各手段が正常に動作すれば、ｔ９以降も禁止信号が出力されない（３５ａ）。もし、異常であれば３５ｂのように禁止信号が再び出力される。
【００３２】
以上のように各手段を構成することにより、ＣＰＵ４の異常、監視手段５の異常、第１基準信号１０の異常、第２基準信号２３の異常、及び監視手段の禁止信号出力異常３５を検出し、駆動手段３を非駆動にすることができる。また、監視手段５を回路網で構成しているので、マイコンを使用する必要もなくコスト低減が可能である。さらに、監視手段を１チップ化することにより１個のＩＣとすることもでき、引いてはＥＣＵの小型化にも貢献できるものである。
また、センサ情報の１つをＣＰＵ４と監視手段５の両方でチェックすることにもなり、信頼性を向上させているものである。
【００３３】
なお、ＣＰＵ４と監視手段５との情報の送受信の間隔（ボーレート）は、第１基準信号から発生した別の基準クロック３６に同期して行ってもよい。また、第２基準信号から作成した別の基準クロック（図示せず）に同期して送受信してもよい。つまりクロック同期式で送受信することも可能である。
さらに、送受信ライン３３，３４を２本使用したが、１本で行う半二重方式で行うことも可能である。半二重方式の場合、例えば第１基準信号のエッジ毎に送信と受信を交互に行うことになる。
また、ＣＰＵ４の第２処理手段１１は、ＣＰＵの基本動作である演算機能、タイマ機能、記憶機能、分岐機能等をすべて使用するようにソフトウエアを構成することにより、監視を強化できるようになる。
【００３４】
実施の形態２．
図５はこの発明の実施の形態２を示すもので、図２又は図３と同一符号は同一又は相当部分を示している。第１基準信号３２ａは、トリガ信号のように形成してもよい。この形態にすることにより監視手段５の回路構成において、トリガ形成回路が不要となるので簡単になる効果がある。また、センサ信号が３１のように監視手段５に入力される場合、実施の形態１のような第２基準信号による周期計測を行わず、所定時間内に入力される信号数を計測方法がある。例えば第１処理手段は、第１基準信号２周期分の期間に入力されるセンサ信号３１をカウントする。ｔ１２ではｔ１０からのカウント値４個、ｔ１３ではｔ１１からのカウント値３個を使用するものである。この構成は、周期計測法に比べ計測回路が簡単になる効果がある。
また、第１及び第２比較手段２０，１１にタイマ機能を含み、情報の相違が１回では作動しないようにすることもできる。例えば相違が２回以上続いた場合、禁止信号を出力することにより、ノイズ他による誤動作を防止できる効果がある。
【００３５】
実施の形態３．
図６はこの発明の実施の形態３を示すもので、実施の形態１との相違点であるＣＰＵ４のみを記載している。図２と同一符号は同一又は相当部分を示している。監視手段５の第１処理手段２０からの情報Ａを第５処理手段１４で所定の処理を行う。例えば、この情報が車輪速の周期計測した値である場合、又はパルス数カウント値である場合、この周期、又はカウント数から車輪速に変換処理をするものである。Ａ＝１９ならば、Ａ１＝１００＊（０．０５＊１９）によりＡ１＝９５Ｋｍ／ｈとなる。この演算結果Ａ１と第２処理手段１１からの情報Ｂとを第２比較手段１２により比較し、相違している場合第２禁止信号３７を出力する。一方、第５処理手段の情報Ａ１を再度第６処理手段１５により変換し、情報Ｃとして監視手段５に出力する。変換式はＣ＝Ａ１／（１００＊０．０５）とする。このような構成を有することにより、ＣＰＵ４での処理を簡略化できる効果がある。
【００３６】
また、第５処理手段又は第６処理手段は、電源投入後所定時間までは予め定められた所定の変換演算を行わず、監視手段の第１禁止信号が正常に出力されていることを検出すると、所定処理を行うように変更する。これにより、監視手段の動作をチェックできる。
また第６処理手段１５は、第２処理手段１１の情報により変換演算を行い、情報を送信するようにしても、同様な効果が得られる。
【００３７】
実施の形態４．
次に実施の形態４について、図７を用いて説明する。このブロック図は、４輪操舵システムや操舵力アシストのパワーステアリングシステム（以下ＥＰＳという）のように、センサ信号がアナログ信号であるシステムである。図２と同一符号は同一又は相当部分を示している。ＥＰＳはセンサ類１と、ハンドルの回転をアシストするアクチュエータ（モーター）２と、駆動手段３と、ＣＰＵ４と、監視手段５と、禁止手段６と、アクチュエータ２の電源を制御するリレー７とから構成されている。なお、禁止手段６はアクチュエータ２の電源を遮断することにより、アクチュエータ２の駆動を停止させるものである。また、センサ類１には少なくとも１つのアナログ信号（１ｅ例えばハンドルトルクセンサ）を含んでいるものとする。
【００３８】
監視手段５は、センサ類信号１ａ、１ｅのインターフェース回路２７を含み、この回路２７の出力は直接ＣＰＵ４に接続され、アナログ信号１ｅはさらに監視手段の他の部分にも接続されている。このような構成を取ることにより、インターフェース回路を共用できるばかりでなく、監視手段に一体化でき、小型化が計れる効果がある。
アナログ信号１ｅは第１処理手段２０に入力され、所定範囲に分割するいわゆるアナログ／ディジタル変換を、例えばウインドウコンパレータを有している。この変換値は第１基準信号３２に同期して、ＣＰＵ４に出力される（３３）。また、第４処理手段２１は、第１基準信号３２に同期して第１処理手段による値を格納するレジスタとして作用する。さらに、ＣＰＵ４からの情報３４を第１基準信号３２に同期して入力し、これと第４処理手段２１の値とを比較する。これら情報に相違があると第１禁止信号３５を出力する。この際手段２８において、相違が所定回数継続した場合に出力するタイマ機能を有している。
【００３９】
一方、ＣＰＵ４はセンサ類の情報を入力し、これに基づき制御量を演算し、駆動手段３に出力する第２処理手段１１を含んでいる。アナログ信号１ｅをアナログ／ディジタル変換した結果と、第１処理手段２０による情報とを比較し、これらの情報に相違が発生した場合、第２禁止信号３７を出力する第２比較手段１２を有している。また、第２処理手段のセンサ情報は第１基準信号に同期して監視手段５に送信される（３４）。
【００４０】
以上のようにアナログセンサ情報を入力するシステムにおいても、ＣＰＵ４と監視手段５とで互いに監視しあうことにより、ＥＣＵの信頼性を向上し、フェールセーフの機能を充実させることができる。
【００４１】
【発明の効果】
この発明の車載用電子制御装置は、以上説明したように構成されているので、以下に示すような効果を奏する。
【００４２】
この発明に係る自己監視機能付き車載用電子制御装置によれば、監視手段は、センサ情報を入力し、主制御手段が行う演算処理とは異なる簡略処理を行う第１処理手段と、この第１処理手段で処理された情報を主制御手段に出力する第１処理信号と、前記主制御手段からの情報を第２処理信号として入力し、この第２処理信号の情報と前記第１処理手段の情報を比較し、互いの情報に相違がある場合、禁止手段に第１禁止信号を出力する第１の比較手段とを備え、一方主制御手段は、センサ情報を入力し制御量演算を行う第２処理手段と、この第２処理手段の結果に対し、第１処理手段の簡略処理情報に前記第２処理手段結果と同一次元となる変換演算を行う第３処理手段と、前記監視手段の第１処理信号を入力し、前記第３処理手段で得られた情報とを比較し、互いの情報に相違がある場合、禁止手段に第２の禁止信号を出力する第２の比較手段と、前記第３処理手段の情報を第２処理信号として前記監視手段に出力する手段とを備えたので、主制御手段、監視手段による交互監視作用により異常時の検出が確実になり、装置の信頼性を向上できる効果がある。
【００４３】
この発明に係る自己監視機能付き車載用電子制御装置によれば、監視手段は、センサ情報を入力し、主制御手段が行う演算処理とは異なる簡略処理を行う第１処理手段と、この第１処理手段で処理された情報を主制御手段に出力する第１処理信号と、前記主制御手段からの情報を第２処理信号として入力し、この第２処理信号の情報と前記第１処理手段の情報を比較し、互いの情報に相違がある場合、禁止手段に第１禁止信号を出力する第１の比較手段とを備え、一方主制御手段は、センサ情報を入力し制御量演算を行う第２処理手段と、監視手段の第１処理手段からの情報に対し、主制御手段の第２処理手段の演算に相当し同一次元となる変換演算を行う第５処理手段と、この第５処理による情報と第２演算情報を比較し、この比較により互いの情報に相違がある場合、前記禁止手段に第２の禁止信号を出力する第２の比較手段と、前記第５処理手段による情報を再度元に戻すための変換演算を行い、これを第２処理信号として監視手段に出力する第６処理手段とを備えたので、主制御手段、監視手段による交互監視作用により異常時の検出が確実になり、装置の信頼性を向上できる効果がある。
【００４４】
また、この発明に係る自己監視機能付き車載用電子制御装置によれば、主制御手段は、基準となる信号を発生する第１基準信号発生手段を有し、監視手段と主制御手段は、この第１基準信号に応じて第１処理手段及び第２処理手段で処理された情報を出力又は入力するようにしたので、主制御手段と監視手段との情報の送受信のタイミングを簡単に取ることができる効果がある。
【００４５】
また、この発明に係る自己監視機能付き車載用電子制御装置によれば、監視手段は、第２の基準信号を発生する第２基準信号発生手段を有し、主制御手段からの第１基準信号の周期をこの第２基準信号で計測した結果が理論値に誤差を加味した時間範囲外の場合、第１禁止信号を出力する第３比較手段と、この第３比較手段の出力又は第１比較手段の出力を第１禁止信号として出力し、この出力を保持する保持手段と、電源投入後所定時間経過後、かつ前記第１基準信号が前記時間範囲内の場合、この保持機能を一旦打ち消す解除手段とを備えたので、主制御手段の基準信号の監視、及び監視手段の動作を確実にチェックできる効果がある。
【００４７】
また、この発明に係る自己監視機能付き車載用電子制御装置によれば、電源投入後主制御手段は、第１の所定時間までは第３処理を行わず、第２の所定時間経過までに監視手段による第１禁止信号を入力し、禁止信号が出力されている場合、第２の所定時間以降第３処理を行うようにしたので、監視手段の動作を確実にチェックできる効果がある。
【００４８】
また、この発明に係る自己監視機能付き車載用電子制御装置によれば、電源投入後主制御手段は、第１の所定時間までは第５処理又は第６処理を行わず、第２の所定時間経過までに監視手段による第１禁止信号を入力し、禁止信号が出力されている場合、第２の所定時間以降第５処理又は第６処理を行うようにしたので、監視手段の動作を確実にチェックできる効果がある。
【００４９】
また、この発明に係る自己監視機能付き車載用電子制御装置によれば、監視手段の第１の比較手段、又は主制御手段の第２の比較手段は、情報の相違が複数回数続いた場合、第１禁止信号又は第２禁止信号を出力するようにしたので、監視手段、又は主制御手段の異常検出に対してノイズ耐量を向上することができる。
【００５０】
また、この発明に係る自己監視機能付き車載用電子制御装置によれば、センサからの信号がディジタル信号である場合、第１処理手段は第２基準信号に基づき計測処理を行うようにしたので、センサ情報がディジタル信号である場合にも簡単に適用できる効果がある。
【００５１】
さらにまた、この発明に係る自己監視機能付き車載用電子制御装置によれば、センサからの信号がアナログ信号である場合、第１処理手段は、アナログ／ディジタル分割変換処理を行うようにしたので、センサ情報がアナログ信号である場合にも簡単に適用できる効果がある。
【図面の簡単な説明】
【図１】この発明の実施の形態１における車載用電子制御装置を示すブロック図である。
【図２】この発明の実施の形態１におけるアンチスキッド制御装置を示すブロック図である。
【図３】実施の形態１における各信号の状態を示すタイムチャートである。
【図４】実施の形態１における電源投入後の信号の状態を示すタイムチャートである。
【図５】実施の形態２における各信号の状態を示すタイムチャートである。
【図６】実施の形態３における主制御手段を示すブロック図である。
【図７】実施の形態４におけるブロック図である。
【図８】従来の車載用電子制御装置を示すブロック図である。
【符号の説明】
１センサ、２アクチュエータ、３駆動手段、４ＣＰＵ（主制御手段）、５監視手段、６禁止手段、１０第１基準信号発生手段、１１第２処理手段、１２第２比較手段、１３第３処理手段、１４第５処理手段、１５第６処理手段、２０第１処理手段、２１第４処理手段、２２第１比較手段、２３第２基準信号発生手段、２４第３比較手段、２５保持手段、２６解除手段、３２第１基準信号、３３第１処理信号、３４第２処理信号又は第３処理信号、３５第１禁止信号、３７第２禁止信号。[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an on-vehicle electronic control device, and more particularly to an on-vehicle electronic control device with a self-monitoring function for enhancing the certainty of a fail-safe function.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, some in-vehicle electronic control devices have reinforced the fail-safe function by strictly monitoring the malfunction of the control system. For example, a four-wheel steering system and an anti-skid brake system (hereinafter referred to as ABS) ensure the controllability and stability of the vehicle with respect to the driver's operation. ) Included a fail-safe function to ensure reliability. For example, in the ABS, when performing the control amount calculation based on the wheel speed information, two CPUs are arranged, output in the case of the same result by collating the result of the same input and the same calculation, and an actuator (hereinafter referred to as H / U). In other words, the reliability was ensured by the redundancy by the full duplex system. An apparatus configured in this way is described in, for example, Japanese Patent Publication No. 7-38162.
[0003]
Such a conventional ECU has the disadvantage of increasing the cost because it is equipped with two CPUs having the same function. Therefore, for example, an invention described in Japanese Patent Application Laid-Open No. 9-305223 has been proposed in order to compensate for this high cost defect. Hereinafter, a conventional on-vehicle electronic control device will be described with reference to FIG. FIG. 8 is a system block diagram in the ABS. Reference numeral 1 denotes a sensor, a wheel speed sensor, and reference numeral 2 denotes an actuator, which indicates H / U. 3 is a driving means for driving the H / U 2, and 4 is a main CPU that calculates a control amount based on information from the sensor 1 and outputs a signal to the driving means 3 to drive the H / U 2. A sub CPU 50 monitors the main CPU 4 and can communicate with the main CPU 4. Reference numeral 51 denotes an OR circuit that operates according to the output of the main CPU 4 or the sub CPU 50 and operates to shut off the fail safe relay 53 that is a power supply source of the H / U 2.
[0004]
Next, a fail-safe function by the sub CPU 50 that monitors the main CPU 4 that is a feature of the conventional apparatus will be described. The monitoring unit 52 that monitors the main CPU 4 stores check data X and solution data Z determined therefrom in advance in a storage unit. The sub CPU 50 transmits this data X to the main CPU 4 via the communication line 54. The main CPU 4 receives these data X, processes them according to a predetermined calculation procedure, and returns the result to the sub CPU 50 via the communication line 55. The sub CPU 50 collates the received data with the stored data Z, and if they match, the main CPU 4 determines that it is normal, and if it does not match, determines that it is abnormal and outputs an abnormal signal to the OR circuit 51. Since this output cuts off the power source that is the driving source of H / U2, H / U2 is brought into an inoperative state, and the fail-safe function is activated. This conventional apparatus is configured to be able to control H / U by one main CPU, and the sub CPU is configured to be able to use lower elements than the main CPU in terms of function and cost.
[0005]
[Problems to be solved by the invention]
Even in the conventional apparatus as described above, since the sub CPU is used, the high design and manufacturing cost cannot be solved yet, and the area occupied by the sub CPU is an obstacle to miniaturization. Further, there is a problem that it is not confirmed that the signal to the OR circuit is output accurately when necessary due to abnormality of the sub CPU itself.
[0006]
The present invention was made to solve the above-described problems, by transmitting and receiving data to and from each other by the main control means and the monitoring means for monitoring this abnormality, and independently detecting each other's abnormality, It is an object of the present invention to provide an in-vehicle electronic control device with a self-monitoring function that aims to improve the reliability of the fail-safe function, further reduce the cost, and reduce the size.
[0007]
[Means for Solving the Problems]
In the on-vehicle electronic control device with a self-monitoring function according to the present invention, the state of the vehicle is detected. plural A sensor, an actuator for controlling the vehicle, drive means for driving the actuator, plural Main control means for inputting information from the sensor, calculating a control amount based on this information, and outputting a signal corresponding to the control amount to the drive means; and At least one of the plurality of sensors Monitoring means connected to the sensor and the main control means for monitoring the function of the main control means; and a prohibiting means for outputting a first prohibition signal from the monitoring means so as not to operate the actuator when the prohibition signal is output. The monitoring means inputs the sensor information, and the main control means performs Control amount Different from arithmetic processing Simplicity A first processing means for performing processing, a first processing signal for outputting information processed by the first processing means to the main control means, and information from the main control means as a second processing signal, A first comparison unit that compares the information of the second processing signal and the information of the first processing unit and outputs a first prohibition signal to the prohibition unit when there is a difference between the information; The means inputs the sensor information. Said Second processing means for performing control amount calculation; this For the result of the second processing means, the first processing means The simplified processing information has the same dimension as the result of the second processing means. When the third processing means for performing the conversion operation and the first processing signal of the monitoring means are input and the information obtained by the third processing means is compared, and there is a difference between the information, the prohibiting means The second comparing means for outputting the second prohibition signal and means for outputting the information of the third processing means as the second processing signal to the monitoring means are provided.
[0008]
In the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the state of the vehicle is detected. plural A sensor, an actuator for controlling the vehicle, drive means for driving the actuator, plural Main control means for inputting information from the sensor, calculating a control amount based on this information, and outputting a signal corresponding to the control amount to the drive means; and At least one of the plurality of sensors Monitoring means connected to the sensor and the main control means for monitoring the function of the main control means; and a prohibiting means for outputting a first prohibition signal from the monitoring means so as not to operate the actuator when the prohibition signal is output. The monitoring means inputs the sensor information, and the main control means performs Control amount Different from arithmetic processing Simplicity A first processing means for performing processing, a first processing signal for outputting information processed by the first processing means to the main control means, and information from the main control means as a second processing signal, A first comparison unit that compares the information of the second processing signal and the information of the first processing unit and outputs a first prohibition signal to the prohibition unit when there is a difference between the information; The means inputs the sensor information. Said The second processing means for performing the control amount calculation and the information from the first processing means of the monitoring means for the second processing means of the main control means Same dimension as the operation result The fifth processing means for performing the conversion operation, the information by the fifth processing and the information of the second processing means are compared, and if there is a difference between the information by this comparison, the second prohibition signal is output to the prohibition means. And a sixth processing means for performing a conversion operation for returning the information by the fifth processing means again and outputting the same as the second processing signal to the monitoring means. It is a thing.
[0009]
In the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, The main control means has a first reference signal generating means for generating a reference signal, and the monitoring means and the main control means are processed by the first processing means and the second processing means in accordance with the first reference signal. Configured to output or input information Is.
[0010]
In the in-vehicle electronic control device with a self-monitoring function according to the present invention, the monitoring means has a second reference signal generating means for generating the second reference signal, and the period of the first reference signal from the main control means. Is measured with this second reference signal The result of the calculation added an error to the theoretical value. A third comparing means for outputting a first prohibiting signal when out of the time range; a holding means for outputting the output of the third comparing means or the output of the first comparing means as a first prohibiting signal and holding the output; After a predetermined time has elapsed since the power was turned on, the first reference signal is Writing In the case of within the range, release means for once canceling this holding function is provided.
[0012]
In the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the main control means after the power is turned on until the first predetermined time. Does not perform the third process When the first prohibition signal is input by the monitoring means until the second predetermined time elapses and the prohibition signal is output, the second predetermined time is exceeded. Descending It is made to operate so as to perform three processes.
[0013]
In the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the main control means after the power is turned on until the first predetermined time. Is the first 5 process or 6th process Without When the first prohibition signal is input by the monitoring means until the second predetermined time elapses and the prohibition signal is output, the second predetermined time is exceeded. Descending It is configured to operate so as to perform the fifth process or the sixth process.
[0014]
In the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the first comparison means of the monitoring means or the second comparison means of the main control means has a difference in information. Multiple When the number of times continues, the first prohibition signal or the second prohibition signal is output.
[0015]
In the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, when the signal from the sensor is a digital signal, the first processing means performs measurement processing based on the second reference signal.
[0016]
Furthermore, in the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, when the signal from the sensor is an analog signal, the first processing means is Analog / digital division Conversion processing is performed.
[0017]
DETAILED DESCRIPTION OF THE INVENTION
Embodiment 1 FIG.
Embodiment 1 of the present invention will be described below with reference to the drawings.
FIG. 1 is a block diagram showing a vehicle-mounted control apparatus with a self-monitoring function according to Embodiment 1 of the present invention. In FIG. 1, 1 is a sensor for detecting the state of the vehicle, and 2 is an actuator for controlling the vehicle. Reference numeral 3 denotes driving means for driving the actuator 2. Reference numeral 4 denotes main control means for calculating a control amount based on information from the sensor 1 and outputting a control amount signal to the drive means 3. Reference numeral 5 denotes monitoring means for monitoring the main control means 4, and transmission / reception communication lines exist with the main control means 4. Reference numeral 6 denotes prohibiting means that operates to stop the operation of the actuator 2, and is operated by the main control means 4 or the monitoring means 5.
[0018]
The monitoring means 5 receives at least one of the information of the sensors 1 through the line 31, performs a predetermined process and transmits it to the main control means 4 via the first processing signal 33, and the main control means. When the second processing signal 34 from 4 is inputted and compared with the information by the first processing means, it is mainly composed of the first comparison means 22 that outputs the first prohibition signal 35 to the prohibition means 6. Yes. The first processing means 20 and the second processing signal input 34 are configured to operate in response to the first reference signal 32 of the main control means 4.
[0019]
Further, by measuring the second reference signal generating means 23 for generating the second reference signal and whether or not the first reference signal 32 from the main control means 4 is within a predetermined time by using the second reference signal. In comparison, if the first reference signal 32 is not received within a predetermined time, the third comparison unit 24 that outputs the first prohibition signal 35 to the prohibition unit 6 and the first comparison unit 22 or the third comparison unit 24 are prohibited. Holding means 25 for holding the signal for use and a release means 26 for once canceling the prohibition signal of the holding means 25 when a predetermined time has passed by the second reference signal and no forbidden signal is generated by the third comparison means 24. is doing.
[0020]
On the other hand, the main control means 4 inputs the information of the sensor 1, calculates the control amount, outputs it to the driving means 3, the first reference signal generating means 10 for generating the first reference signal, Comparing the information input via the first processing signal 33 with the information from the second processing means 11 and, if there is a difference, the second comparing means 12 that outputs the second prohibition signal 36 to the prohibiting means 6 The second processing means 11 has means for outputting sensor processing information to the monitoring means 5 according to the first reference signal.
[0021]
When the block configuration of FIG. 1 is applied to a specific system, the function of each means will be described in detail. FIG. 2 is a block diagram when applied to ABS. In FIG. 2, the same reference numerals as those in FIG. 1 denote the same or corresponding parts. The sensors (1a to 1d) are wheel speed sensors, and in the case of a passenger car, there are usually four sensors arranged for each wheel. At least one of these wheel speed sensors is also input to the monitoring means 5 (31). The monitoring means 5 is assumed to be composed of a circuit network that does not include a CPU. The second reference signal generation means 23 is a clock generation circuit that generates a reference signal that is one digit faster than the first reference signal 32. For example, if the first reference signal is 200 Hz, the second reference signal is 20 KHz.
[0022]
The first processing means 20 has a function of measuring a wheel speed signal based on the second reference signal. This measurement interval is cleared for each first reference signal. If the wheel speed is 100 Km / h and 1 KHz pulses are input, 4 or 5 pulses are input at the first reference signal interval, and each pulse interval is measured when measured at the second reference signal 20 KHz. A = 19 or 20 counts. The count value A is transmitted to the CPU as the main control means 4 through the first processing signal 33 in synchronization with the first reference signal 32.
[0023]
Next, in synchronization with the first reference signal 32, the first processing value A is shifted to the fourth processing means 21 and the measurement value is cleared. In this case, the fourth processing means 21 has a register function, and the processing value is D = A. The first comparison means 22 for generating a signal so as to output a prohibition signal 35 when the value C inputted through the signal line 34 is compared with the value D by the fourth processing means and C and D are different. Works. In this case, the monitoring means 5 judges that the main control means 4 is abnormal, and the driving means 3 is not driven so as to stop the H / U 2, so that it is prohibited to fall into a no-brake state while ensuring safety. Thus, the normal braking state by the driver is restored.
[0024]
Next, a function for monitoring whether or not an abnormality has occurred in the first reference signal 32 will be described. This function is what is called a watchdog. Based on the second reference signal, it is counted whether the first reference signal is within a predetermined range. For example, if the second reference signal frequency is 20 KHz, the count value is E = 99 or 100. Therefore, the range is set to 90 to 110 in consideration of variations in the second reference signal and measurement errors. When the count value E is not included in this range, the third comparison unit 24 operates so as to output the prohibition signal 35 in the same manner.
[0025]
The above will be described along the time series using the time chart of FIG. 32 is a first reference signal, and 36 is a second reference signal. When the wheel speed 1d is input as indicated at 31, the first processing means measures the wheel speed cycle as indicated at 37. That is, the counter value is cleared in synchronization with the edge of the first reference signal (t1), starts counting at the rising edge of the second reference signal (t2), and the edge of the wheel speed pulse 31 is larger than the previous value. Hold (t3, t4). This information is transmitted to the main control means 4 at the next edge of the first reference signal. With this function, the first processing means transmits a larger value at a lower speed. In addition, it is made to clip by a predetermined value at the time of a stop.
[0026]
The first reference signal 32 is measured by the second reference signal 36 and has a count value as indicated by 38. That is, it is cleared at the edge of the first reference signal (t1), starts counting at the rising edge of the second reference signal (t5), refers to the value at the edge input time (t6) of the next first reference signal, The third comparison means 24 checks whether the upper limit (39) / lower limit (40) is within the range.
[0027]
Returning to FIG. 2 again, the main control means 4 will be described. The main control means 4 is a CPU, which inputs all signals from the wheel speed sensors 1a to 1d, calculates the wheel speed, estimates the vehicle body speed, calculates the wheel acceleration / deceleration and slip ratio, and calculates the brake fluid pressure of each wheel. It has a function of outputting a signal to the drive circuit of the drive means 3 for driving the H / U 2 so that the wheel slip is converged to an appropriate range by reducing, maintaining and increasing the pressure. These processes are performed by the second processing means 11 under normal ABS control. Here, from the information B obtained by calculating the wheel speed of 1d, the third processing means 13 converts how much value C is obtained if measured by the second reference signal. For example, since B = 1 mS = 100 Km / h is obtained, C = 20 is obtained by counting from this value at 20 KHZ = 0.05 ms. Compared with information A having a certain range in C, the difference between the two is detected.
[0028]
Next, the first processing signal 33 is input in synchronization with the first reference signal, for example, the watch dog signal. The second comparison unit 12 compares the information A of the first processing signal with the conversion value C obtained by the third processing unit. Here, C has a predetermined range (for example, 17 to 23) in consideration of variations in the second reference signal and measurement errors. If A and C are different, the CPU 4 determines that the monitoring means 5 is abnormal, outputs a signal to the prohibiting means 6 (37), and forcibly stops the driving of the H / U2. Further, the third processing signal 34 is transmitted to the monitoring unit 5 in synchronization with the information C by the third processing unit 13 in synchronization with the first reference signal.
Since the CPU 4 has the above-described configuration, even when the monitoring means becomes abnormal, the driving of the actuator 2 can be stopped, so that traveling safety can be ensured without impairing the braking force of the vehicle. Can improve the reliability.
[0029]
Furthermore, when the monitoring unit 5 detects an abnormality, it is necessary to check whether or not the prohibition signal 35 is actually output. Next, this function will be described. Immediately after the power is turned on, until the predetermined time elapses, the CPU 4 does not perform the predetermined processing by the third processing unit 13 and transmits, for example, the information of the second processing unit 11 as it is. This time management can be performed using the first reference signal. Thereafter, when the prohibit signal 35 is input by the CPU 4 and the prohibit signal has been generated and a predetermined time has elapsed, the third processing means 13 changes to a normal process. If the prohibition signal has not been generated, the monitoring means 5 determines that there is an abnormality, and the second comparison means 12 acts to output the second prohibition signal 37. By having this function, the CPU 4 monitors that the prohibition signal is output by the first comparison unit 22 of the monitoring unit 5.
[0030]
However, resetting the output even though the prohibition signal has been output once is a problem in actual use and ensuring safety. Therefore, the monitoring means 5 has means 26 for canceling the means 25 for holding the prohibition signal after a predetermined time has elapsed after the power is turned on. This function measures a predetermined time based on the first reference signal or the second reference signal, and when the first reference signal is within a predetermined range after a predetermined time (for example, 100 ms after power-on), the prohibit signal is temporarily output. This is performed by the release means 26 that outputs a signal to be reset. Therefore, the prohibition signal holding means 25 (for example, a latch circuit) is reset only once after a predetermined time. Even if it is actually abnormal, since the prohibition signal is output again by the first comparison means 22 or the second comparison means 12, it is determined that the first reference signal is normal for one cycle, and the time is short. There is no problem in actual use.
[0031]
The above will be described along the time series using the time chart of FIG. Reference numeral 41 denotes a power supply line, and it is assumed that power is turned on at t0. The first reference signal is input as 32. Reference numeral 42 denotes an internal operation state of the CPU 4. The third processing means 13 is not performing a predetermined process until the first reference signal 32 rises and falls four times. This indicates that the third processing means has started the predetermined process at a certain time (t7) after the first reference signal four times. However, this is limited to the case where it is detected that the first prohibition signal 35a is outputting the prohibition signal. Reference numeral 43 denotes a release signal. At the fifth edge (t8) of the first reference signal 32, a predetermined output signal is generated and acts to reset the holding means 25 once. As a result, the first prohibition signal 35 that is the output of the holding means outputs the prohibition signal, but stops the generation of the prohibition signal from t8 to t9. Thereafter, if each means operates normally, the prohibition signal is not output after t9 (35a). If it is abnormal, the prohibition signal is output again as in 35b.
[0032]
By configuring each means as described above, the CPU 4 abnormality, the monitoring means 5 abnormality, the first reference signal 10 abnormality, the second reference signal 23 abnormality, and the monitoring means prohibition signal output abnormality 35 are detected. The driving means 3 can be made non-driven. Further, since the monitoring means 5 is constituted by a circuit network, it is possible to reduce costs without using a microcomputer. Further, by integrating the monitoring means into one chip, it is possible to make one IC, which in turn can contribute to downsizing of the ECU.
In addition, since one of the sensor information is checked by both the CPU 4 and the monitoring unit 5, the reliability is improved.
[0033]
The information transmission / reception interval (baud rate) between the CPU 4 and the monitoring unit 5 may be synchronized with another reference clock 36 generated from the first reference signal. Further, transmission / reception may be performed in synchronization with another reference clock (not shown) created from the second reference signal. That is, it is also possible to transmit and receive in a clock synchronous manner.
Furthermore, although the two transmission / reception lines 33 and 34 are used, it is also possible to carry out by a half-duplex method in which one transmission line is used. In the case of the half-duplex method, for example, transmission and reception are alternately performed for each edge of the first reference signal.
Further, the second processing means 11 of the CPU 4 can enhance the monitoring by configuring the software to use all the arithmetic functions, timer functions, storage functions, branch functions, etc., which are the basic operations of the CPU. .
[0034]
Embodiment 2. FIG.
FIG. 5 shows a second embodiment of the present invention. The same reference numerals as those in FIG. 2 or 3 indicate the same or corresponding parts. The first reference signal 32a may be formed like a trigger signal. By adopting this form, the trigger forming circuit is not necessary in the circuit configuration of the monitoring means 5, so that there is an effect that it is simplified. In addition, when the sensor signal is input to the monitoring unit 5 like 31, there is a method for measuring the number of signals input within a predetermined time without performing the period measurement using the second reference signal as in the first embodiment. . For example, the first processing means counts the sensor signal 31 input during a period corresponding to two cycles of the first reference signal. At t12, four count values from t10 are used, and at t13, three count values from t11 are used. This configuration has an effect of simplifying the measurement circuit as compared with the period measurement method.
In addition, the first and second comparing means 20 and 11 may include a timer function so that the difference in information does not operate once. For example, if the difference continues two or more times, outputting a prohibition signal has an effect of preventing malfunction due to noise or the like.
[0035]
Embodiment 3 FIG.
FIG. 6 shows a third embodiment of the present invention, and shows only the CPU 4 which is different from the first embodiment. The same reference numerals as those in FIG. 2 denote the same or corresponding parts. The fifth processing unit 14 performs predetermined processing on the information A from the first processing unit 20 of the monitoring unit 5. For example, when this information is a value obtained by measuring the cycle of the wheel speed, or when it is a pulse number count value, conversion processing is performed from this cycle or the count number to the wheel speed. If A = 19, A1 = 95 Km / h by A1 = 100 * (0.05 * 19). The calculation result A1 and the information B from the second processing means 11 are compared by the second comparison means 12, and if they are different, a second prohibition signal 37 is output. On the other hand, the information A1 of the fifth processing means is converted again by the sixth processing means 15 and output to the monitoring means 5 as information C. The conversion formula is C = A1 / (100 * 0.05). By having such a configuration, there is an effect that the processing in the CPU 4 can be simplified.
[0036]
Further, when the fifth processing means or the sixth processing means detects that the first prohibition signal of the monitoring means is normally output without performing a predetermined conversion calculation predetermined until a predetermined time after the power is turned on. Then, it is changed to perform a predetermined process. Thereby, the operation of the monitoring means can be checked.
Further, the sixth processing means 15 performs the conversion operation based on the information of the second processing means 11 and transmits the information, and the same effect can be obtained.
[0037]
Embodiment 4 FIG.
Next, Embodiment 4 will be described with reference to FIG. This block diagram is a system in which the sensor signal is an analog signal, such as a four-wheel steering system or a steering assist power steering system (hereinafter referred to as EPS). The same reference numerals as those in FIG. 2 denote the same or corresponding parts. The EPS is composed of sensors 1, an actuator (motor) 2 that assists the rotation of the handle, a drive unit 3, a CPU 4, a monitoring unit 5, a prohibiting unit 6, and a relay 7 that controls the power supply of the actuator 2. Has been. The prohibiting unit 6 stops the driving of the actuator 2 by cutting off the power supply of the actuator 2. Further, it is assumed that the sensors 1 include at least one analog signal (1e, for example, a handle torque sensor).
[0038]
The monitoring means 5 includes an interface circuit 27 for sensor signals 1a and 1e, the output of this circuit 27 is directly connected to the CPU 4, and the analog signal 1e is further connected to other parts of the monitoring means. By adopting such a configuration, not only the interface circuit can be shared, but also the monitoring circuit can be integrated and the size can be reduced.
The analog signal 1e is input to the first processing means 20, and has so-called analog / digital conversion for dividing into a predetermined range, for example, a window comparator. This converted value is output to the CPU 4 in synchronization with the first reference signal 32 (33). Further, the fourth processing means 21 acts as a register that stores the value by the first processing means in synchronization with the first reference signal 32. Further, the information 34 from the CPU 4 is inputted in synchronization with the first reference signal 32, and this is compared with the value of the fourth processing means 21. If there is a difference between these pieces of information, the first prohibition signal 35 is output. At this time, the means 28 has a timer function for outputting when the difference continues a predetermined number of times.
[0039]
On the other hand, the CPU 4 includes second processing means 11 for inputting sensor information, calculating a control amount based on the information, and outputting the calculated control amount to the driving means 3. The result of analog / digital conversion of the analog signal 1e is compared with the information by the first processing means 20, and when there is a difference between these information, the second comparison means 12 for outputting the second prohibition signal 37 is provided. ing. The sensor information of the second processing means is transmitted to the monitoring means 5 in synchronization with the first reference signal (34).
[0040]
Even in the system for inputting analog sensor information as described above, the CPU 4 and the monitoring means 5 monitor each other, thereby improving the reliability of the ECU and enhancing the fail-safe function.
[0041]
【The invention's effect】
Since the on-vehicle electronic control device according to the present invention is configured as described above, the following effects can be obtained.
[0042]
According to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the monitoring means inputs sensor information and is different from the arithmetic processing performed by the main control means. Simplicity First processing means for performing processing, a first processing signal for outputting information processed by the first processing means to the main control means, and information from the main control means are input as second processing signals. And comparing the information of the two processing signals with the information of the first processing means, and when there is a difference between the information, the first control means for outputting the first prohibition signal to the prohibition means, while the main control means is , Second processing means for inputting the sensor information and calculating the control amount, and for the result of the second processing means, the first processing means The simplified processing information has the same dimension as the result of the second processing means. The third processing means for performing the conversion operation and the first processing signal of the monitoring means are input, and the information obtained by the third processing means is compared. Since the second comparison means for outputting the second prohibition signal and the means for outputting the information of the third processing means to the monitoring means as the second processing signal are provided, the alternate monitoring action by the main control means and the monitoring means As a result, the detection at the time of abnormality is ensured, and the reliability of the apparatus can be improved.
[0043]
According to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the monitoring means inputs sensor information and is different from the arithmetic processing performed by the main control means. Simplicity First processing means for performing processing, a first processing signal for outputting information processed by the first processing means to the main control means, and information from the main control means are input as second processing signals. And comparing the information of the two processing signals with the information of the first processing means, and when there is a difference between the information, the first control means for outputting the first prohibition signal to the prohibition means, while the main control means is The second processing means for inputting the sensor information and calculating the control amount; and the information from the first processing means for the monitoring means, the second processing means for the main control means Corresponds to computation and has the same dimension The fifth processing means for performing the conversion operation and the information by the fifth processing and the second calculation information are compared, and if there is a difference between the information by this comparison, the second prohibition signal is output to the prohibition means. And a sixth processing means for performing a conversion operation for returning the information by the fifth processing means again and outputting the same as a second processing signal to the monitoring means. By the alternate monitoring action by the monitoring means, detection at the time of abnormality is ensured, and there is an effect that the reliability of the apparatus can be improved.
[0044]
Moreover, according to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, The main control means has a first reference signal generating means for generating a reference signal, and the monitoring means and the main control means are processed by the first processing means and the second processing means in accordance with the first reference signal. Output or input information, so that the timing of information transmission / reception between the main control means and the monitoring means can be easily taken. There is an effect that can.
[0045]
According to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the monitoring means has the second reference signal generating means for generating the second reference signal, and the first reference signal from the main control means Is measured with this second reference signal The result of the calculation added an error to the theoretical value. A third comparing means for outputting a first prohibiting signal when out of the time range; a holding means for outputting the output of the third comparing means or the output of the first comparing means as a first prohibiting signal and holding the output; After a predetermined time has elapsed since the power was turned on, the first reference signal is Writing When within the range, the release means for once canceling this holding function is provided, so that there is an effect that the reference signal of the main control means can be monitored and the operation of the monitoring means can be reliably checked.
[0047]
Moreover, according to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the main control means after the power is turned on until the first predetermined time. Is the first 3 treatment Without When the first prohibition signal is input by the monitoring means until the second predetermined time elapses and the prohibition signal is output, the second predetermined time is exceeded. Descending Since the three processes are performed, there is an effect that the operation of the monitoring means can be surely checked.
[0048]
Moreover, according to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the main control means after the power is turned on until the first predetermined time. Is the first 5 process or 6th process Without When the first prohibition signal is input by the monitoring means until the second predetermined time elapses and the prohibition signal is output, the second predetermined time is exceeded. Descending Since the fifth process or the sixth process is performed, the operation of the monitoring unit can be reliably checked.
[0049]
Moreover, according to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, the first comparison means of the monitoring means or the second comparison means of the main control means has a difference in information. Multiple Since the first prohibition signal or the second prohibition signal is output when the number of times continues, the noise tolerance can be improved with respect to the abnormality detection of the monitoring means or the main control means.
[0050]
Moreover, according to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, when the signal from the sensor is a digital signal, the first processing means performs the measurement process based on the second reference signal. There is an effect that can be easily applied even when the sensor information is a digital signal.
[0051]
Furthermore, according to the vehicle-mounted electronic control device with a self-monitoring function according to the present invention, when the signal from the sensor is an analog signal, the first processing means is: Analog / digital division Since the conversion process is performed, there is an effect that can be easily applied even when the sensor information is an analog signal.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an in-vehicle electronic control apparatus according to Embodiment 1 of the present invention.
FIG. 2 is a block diagram showing an anti-skid control device according to Embodiment 1 of the present invention.
FIG. 3 is a time chart showing the state of each signal in the first embodiment.
FIG. 4 is a time chart showing a state of a signal after power is turned on in the first embodiment.
FIG. 5 is a time chart showing the state of each signal in the second embodiment.
FIG. 6 is a block diagram showing main control means in the third embodiment.
FIG. 7 is a block diagram in a fourth embodiment.
FIG. 8 is a block diagram showing a conventional on-vehicle electronic control device.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Sensor, 2 Actuator, 3 Drive means, 4 CPU (main control means), 5 Monitoring means, 6 Prohibition means, 10 1st reference signal generation means, 11 2nd processing means, 12 2nd comparison means, 13 3rd processing Means, 14 fifth processing means, 15 sixth processing means, 20 first processing means, 21 fourth processing means, 22 first comparison means, 23 second reference signal generating means, 24 third comparison means, 25 holding means, 26 Release means, 32 First reference signal, 33 First processing signal, 34 Second processing signal or third processing signal, 35 First prohibition signal, 37 Second prohibition signal

Claims

A plurality of sensors for detecting the state of the vehicle, an actuator for controlling the vehicle, a driving means for driving the actuator, and information from the plurality of sensors are input, and a control amount is calculated based on this information. Main control means for outputting a signal commensurate with the amount to the drive means, monitoring means connected to at least one of the plurality of sensors and the main control means, and monitoring the function of the main control means, and this monitoring means A first prohibiting signal is output from the prohibiting means for preventing the actuator from operating when the prohibiting signal is output.
The monitoring means inputs the sensor information, performs a simplified process different from the control amount calculation process performed by the main control means, and information processed by the first processing means as the main control. The first processing signal output to the means and the information from the main control means are input as the second processing signal, the information of the second processing signal and the information of the first processing means are compared, and the information is different from each other. And a first comparison means for outputting a first prohibition signal to the prohibition means,
It said main control unit includes a second processing means for inputting said sensor information performs the control amount calculation, to the result of the second processing unit, the second processing means to the simplified processing information of the first processing means The third processing means for performing a conversion operation having the same dimension as the result and the first processing signal of the monitoring means are input, the information obtained by the third processing means is compared, and there is a difference between the information A second comparison unit that outputs a second prohibition signal to the prohibition unit, and a unit that outputs information of the third processing unit to the monitoring unit as a second processing signal. In-vehicle electronic control unit with monitoring function.

A plurality of sensors for detecting the state of the vehicle, an actuator for controlling the vehicle, a driving means for driving the actuator, and information from the plurality of sensors are input, and a control amount is calculated based on this information. Main control means for outputting a signal commensurate with the amount to the drive means, monitoring means connected to at least one of the plurality of sensors and the main control means, and monitoring the function of the main control means, and this monitoring means A first prohibiting signal is output from the prohibiting means for preventing the actuator from operating when the prohibiting signal is output.
The monitoring means inputs the sensor information, performs a simplified process different from the control amount calculation process performed by the main control means, and information processed by the first processing means as the main control. The first processing signal output to the means and the information from the main control means are input as the second processing signal, the information of the second processing signal and the information of the first processing means are compared, and the information is different from each other. And a first comparison means for outputting a first prohibition signal to the prohibition means,
It said main control unit includes a second processing means for inputting said sensor information performs the control amount calculation, to the information from the first processing means of the monitoring unit, the operation result of the second processing means of said main control means The fifth processing means for performing a conversion operation having the same dimension as that of the second processing means, and the information by the fifth processing and the information of the second processing means are compared. Second comparison means for outputting a prohibition signal and a sixth processing means for performing a conversion operation for returning the information by the fifth processing means back to the original and outputting this to the monitoring means as the second processing signal And a vehicle-mounted electronic control device with a self-monitoring function.

The main control means has a first reference signal generating means for generating a reference signal, and the monitoring means and the main control means are processed by the first processing means and the second processing means in accordance with the first reference signal. 3. The vehicle-mounted electronic control device with a self-monitoring function according to claim 1, wherein the information is output or input.

The monitoring means has a second reference signal generating means for generating a second reference signal, and the result of measuring the period of the first reference signal from the main control means with the second reference signal takes into account an error in the theoretical value. If the time is out of the time range, the third comparing means for outputting the first prohibiting signal, and the holding means for outputting the output of the third comparing means or the output of the first comparing means as the first prohibiting signal and holding the output. when, after after power predetermined time, and if the first reference signal is within the pre-Symbol time between range, according to claim 1 or claim 2, characterized in that a releasing means for canceling the retention feature once The vehicle-mounted electronic control device with a self-monitoring function as described.

After the power is turned on, the main control means does not perform the third process until the first predetermined time, and inputs the first prohibition signal by the monitoring means until the second predetermined time elapses, and when the prohibition signal is output, 2. The vehicle electronic control device with a self-monitoring function according to claim 1, wherein the electronic control device operates so as to perform the third process after the second predetermined time.

After the power is turned on, the main control means does not perform the fifth process or the sixth process until the first predetermined time, and inputs the first prohibition signal by the monitoring means until the second predetermined time elapses, and the prohibition signal is output. 3. The vehicle electronic control device with a self-monitoring function according to claim 2, wherein the electronic control device operates so as to perform the fifth process or the sixth process after the second predetermined time.

The first comparison means of the monitoring means or the second comparison means of the main control means outputs the first prohibition signal or the second prohibition signal when the information difference continues a plurality of times. The vehicle-mounted electronic control apparatus with a self-monitoring function of Claim 1 or Claim 2.

3. The on-vehicle electronic control device with a self-monitoring function according to claim 1, wherein when the signal from the sensor is a digital signal, the first processing means performs measurement processing based on the second reference signal.

3. The on-vehicle electronic control device with a self-monitoring function according to claim 1, wherein when the signal from the sensor is an analog signal, the first processing means performs an analog / digital division conversion process.