JP6911372B2 - In-vehicle electronic control device - Google Patents

Description

The present disclosure relates to a technique for diagnosing whether an in-vehicle electronic control device that executes vehicle control is normal or abnormal.

Various techniques for diagnosing whether an in-vehicle electronic control device that executes vehicle control is normal or abnormal are known. For example, according to the in-vehicle electronic control device described in Patent Document 1, a hardware monitoring means for monitoring an abnormality of each element of the hardware part of a microcomputer and an abnormality of each element of the software part of the microcomputer are monitored. It is equipped with software monitoring means and external monitoring means for externally monitoring abnormalities in the microcomputer.

Patent Document 1 attempts to diagnose the details of abnormalities between the hardware unit, the software unit, and the microcomputer by adopting such a configuration.

Japanese Unexamined Patent Publication No. 2013-12219

When a monitoring means for monitoring the hardware part of the microcomputer, the software part of the microcomputer, and the microcomputer is provided as in the technique described in Patent Document 1, the configuration for realizing the monitoring means becomes complicated. There's a problem.

The present disclosure provides a technique for diagnosing whether an in-vehicle electronic control device is normal or abnormal with a simple configuration.

One aspect of the present disclosure includes a control unit (54, S400, S404), a feature acquisition unit (56, S420), and a diagnostic unit (60, S430-S440).
The control unit executes vehicle control by hardware and software. The feature acquisition unit acquires at least one feature information representing the feature of the vehicle control executed in cooperation with the hardware and software of the control unit. The diagnosis unit diagnoses whether the control unit is normal or abnormal based on the feature information acquired by the feature acquisition unit.

According to this configuration, it is diagnosed whether the control unit is normal or abnormal based on the feature information representing the characteristics of the vehicle control executed in cooperation with the hardware and software of the control unit. Therefore, the hardware of the control unit is used. It is not necessary to diagnose each of the software and the software separately by different diagnostic units. Therefore, it is possible to diagnose whether the in-vehicle electronic control device that executes vehicle control is normal or abnormal with a simple configuration.

In addition, the reference numerals in parentheses described in this column and the scope of claims indicate the correspondence with the specific means described in the embodiment described later as one embodiment, and the technical scope of the present disclosure is defined. It is not limited.

The hardware block diagram which shows the in-vehicle electronic control apparatus of this embodiment. The functional block diagram which shows the in-vehicle electronic control apparatus of this embodiment. Explanatory drawing which shows a list of feature information. Explanatory drawing which shows an example of statistical information. A flowchart showing the main processing of vehicle control. A flowchart showing a vehicle control diagnosis process. A flowchart showing the statistics generation process. A flowchart showing a diagnostic process.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.
[1. Constitution]
The ECU 10 shown in FIG. 1 is mounted on a vehicle and executes vehicle control. ECU is an abbreviation for Electronic Control Unit. The vehicle control executed by the ECU 10 is, for example, vehicle torque control, braking control, steering control, and the like.

As a hardware configuration, the ECU 10 includes a CPU 22, an arithmetic unit 24 such as an FPU other than the CPU, a PMU 26, a cache memory 28, and a semiconductor memory 30 which is a non-transitional substantive recording medium such as a RAM, a ROM, and a flash memory. And a microcomputer 20 including a bus 40.

FPU is an abbreviation for Floating Point Unit, and PMU is an abbreviation for Processing Monitor Unit. Semiconductor memory is also called memory. A microcomputer is also called a microcomputer. The number of microcomputers 20 mounted on the ECU 10 is not limited to one, and may be plural.

As shown in FIG. 2, the ECU 10 has the OS unit 50 as a function realized by executing the OS, the BSW, the control software, the statistics generation software, and the diagnostic software as the software in which the CPU 22 is stored in the memory 30. The BSW unit 52, the control unit 54, the statistics generation unit 58, and the diagnosis unit 60 are provided. OS is an abbreviation for Operating System, and BSW is an abbreviation for Basic Software.

Further, the ECU 10 includes a feature acquisition unit 56 as a function realized by the PMU 26. In the present embodiment, the function as the feature acquisition unit 56 is realized by the dedicated hardware PMU26, but it may be realized by the hardware and software.

The control unit 54 calculates the control amount for various actuators of the vehicle, which is the control target 4, based on the sensor value indicating the running state of the vehicle acquired from the sensor group 2, and executes the vehicle control for the vehicle.

The feature acquisition unit 56 monitors the vehicle control executed in cooperation with the hardware and software of the control unit 54, and acquires the feature information representing the feature of the vehicle control.
As shown in FIG. 3, the feature acquisition unit 56 of the present embodiment has, as feature information, the number of execution cycles, the total number of execution instructions, the number of branches in the conditional branch instruction, for each vehicle control task executed by the control unit 54. The hit rate of the L1 data cache, the hit rate of the L1 instruction cache, the hit rate of the L2 data cache, the hit rate of the L2 instruction cache, the processing rate of processing the instruction of the branch destination by the conditional branch instruction, and the like are acquired. These feature information are information for diagnosing the performance of vehicle control.

The feature acquisition unit 56 may acquire the above-mentioned feature information or other feature information for each function, each instruction, or a predetermined time in addition to each task.
The statistics generation unit 58 generates the average of the feature information acquired so far for each feature information for the same task as statistical information from the feature information acquired by the feature acquisition unit 56 for each task. The statistical information generated by the statistical generation unit 58 is not limited to the average of the feature information, but may be other statistical information such as the standard deviation. FIG. 4 shows an example in which statistical information is generated for each of the same tasks such as task A and task B for the execution cycle as an example of the feature information.

The diagnosis unit 60 compares the statistical information generated by the statistical generation unit 58 with the diagnostic information, and diagnoses whether the control unit 54 is normal or abnormal. The diagnostic information indicates a normal range of statistical information generated when the vehicle control by the control unit 54 is evaluated in advance and the control unit 54 normally executes the vehicle control.

[2. process]
Each process executed by the ECU 10 will be described below.
(1) Main processing The ECU 10 constantly executes the main processing shown in FIG. In S400, the control unit 54 acquires a sensor value indicating the running state of the vehicle from the sensor group 2 in order to execute the vehicle control. The control unit 54 sets the control amount for various actuators of the vehicle, which is the control target 4, based on the sensor value acquired from the sensor group 2.

In S402, the feature acquisition unit 56, the statistics generation unit 58, and the diagnosis unit 60 determine whether the control unit 54 is normal or abnormal, that is, the vehicle control is normal, based on the control amount of the vehicle control set by the control unit 54 in S400. The vehicle control diagnostic process for diagnosing whether or not to be executed is executed. Details of the vehicle control diagnosis process executed in S402 will be described later.

In S404, the control unit 54 executes vehicle control with a controlled amount according to the diagnosis result of S402. The diagnosis result in S402 may be a stop of vehicle control.
(2) Vehicle Control Diagnosis Process The vehicle control diagnosis process shown in FIG. 6 is executed in S402 of the main process of FIG. In S410, the feature acquisition unit 56 acquires the feature information representing the feature of the control amount of the vehicle control set by the control unit 54 in S400 of FIG. 5, and the statistics generation unit 58 generates the statistical information of the feature information. Details of the processing of S410 will be described later.

In S412, the diagnosis unit 60 diagnoses whether or not vehicle control is normally executed based on the statistical information generated in S410. Details of the processing of S412 will be described later.
(3) Statistics Generation Process The statistics generation process shown in FIG. 7 is executed in S410 of the vehicle control diagnosis process of FIG. In S420, the feature acquisition unit 56 monitors the currently executed task and acquires each of the above-mentioned feature information from the control unit 54.

In S422, the statistics generation unit 58 compares the map file indicating the address information of the software with the current program counter, and determines whether or not the process has transitioned to a different task. If the determination in S422 is No and the task has not transitioned, this process ends.

When the determination in S422 is Yes and the task transitions, the statistic generator 58 in S424 shows the average of the feature information of the same task executed so far, including the task executed so far, as shown in FIG. And store it in the memory storage destination corresponding to the task that was being executed so far. In S426, the statistics generation unit 58 sets the storage destination of the statistical information in the area for the task of the transition destination to be executed from now on.

(4) Diagnostic processing The diagnostic processing shown in FIG. 8 is executed in S412 of the vehicle control diagnostic processing of FIG.
In S430, the diagnostic unit 60 compares the map file indicating the address information of the software with the current program counter, and determines whether or not the process has transitioned to a different task. If the determination in S430 is No and the task has not changed, this process ends.

If the determination in S430 is Yes and the task transitions, the diagnostic unit 60 in S432 acquires the diagnostic information of the task that has been executed so far. As described above, the diagnostic information indicates the normal range of the statistical information generated by the statistical generation unit 58 when the vehicle control by the control unit 54 is evaluated in advance and the control unit 54 normally executes the vehicle control. ing. The diagnostic information is stored in the memory area corresponding to each task.

In S434, the diagnostic unit 60 determines whether or not the statistical information of the tasks that have been executed so far is within the normal range indicated by the diagnostic information acquired in S432.
If the determination in S434 is Yes and the statistical information is within the normal range, the diagnostic unit 60 diagnoses that the control unit 54 is executing the task normally and the control unit 54 can continue normal vehicle control. , End this process. In this case, in S404 of FIG. 5, the control unit 54 executes normal vehicle control with the control amount calculated in S400.

If the determination in S434 is No and the statistical information is out of the normal range indicated by the diagnostic information and is abnormal, the diagnostic unit 60 in S436 determines whether the abnormality in the statistical information is within the permissible range that allows the continuation of vehicle control. Judge whether or not.

The permissible range is, for example, because the sensor value of the sensor group 2 changes, noise occurs in the sensor signal, the driving environment of the vehicle such as the water temperature changes, and the statistical information deviates from the normal range. It is set to allow abnormalities to the extent that the vehicle can continue to run if restricted.

If the determination in S436 is Yes and the abnormality in the statistical information is within the permissible range in which vehicle control can be continued, the diagnostic unit 60 in S438 determines that the fail control is limited vehicle control instead of normal vehicle control. The control unit 54 diagnoses that it can be continued. In this case, in S438, the diagnostic unit 60 commands the control unit 54 to control the fail.

If the determination in S436 is No and the abnormality in the statistical information is out of the permissible range in which vehicle control can be continued, the statistics generation unit 58 resets the ECU 10 in S440 to stop the vehicle. Anomalies in statistical information are out of the permissible range when a microcomputer fails, for example, an anomaly in the memory of a microcomputer that executes vehicle control, an anomaly in a data bus, or the like.

Even if the determination of S436 becomes Yes and the control unit 54 starts the fail control, if the determination of S436 becomes Yes and the statistical information returns to the normal range, the control unit 54 returns to the normal vehicle control. May be good.

[3. effect]
In the above-described embodiment described above, the following effects can be obtained.
(1) Feature information representing the characteristics of vehicle control executed in collaboration with the hardware and software of the control unit 54 is acquired for each task, and statistics such as an average value for each task are obtained based on the acquired feature information. Information is generated, and whether the control unit 54 is normal or abnormal is diagnosed based on the statistical information.

As a result, it is not necessary to separately diagnose the hardware and software of the control unit 54 by different diagnostic units. Therefore, it is possible to diagnose whether the control unit 54 is normal or abnormal with a simple configuration.

(2) By acquiring feature information for each task that executes vehicle control and generating statistical information such as the average of feature information for each task, the execution order is determined like the task that executes vehicle control. Even if the execution timing is irregular, statistically meaningful statistical information can be generated for each task.

(3) The diagnostic unit 60 in the microcomputer included in the ECU 10 diagnoses whether the control unit 54 realized by the microcomputer is normal or abnormal. As a result, it is not necessary to install a diagnostic unit for diagnosing whether the control unit 54 is normal or abnormal outside the microcomputer.

In the above-described embodiment, the ECU 10 corresponds to the in-vehicle electronic control device, the control unit 54 corresponds to the control unit, the feature acquisition unit 56 corresponds to the feature acquisition unit, and the statistics generation unit 58 corresponds to the statistics generation unit. Then, the diagnostic unit 60 corresponds to the diagnostic unit.

Further, S400 and S404 correspond to the processing of the control unit, S420 corresponds to the processing of the feature acquisition unit, S422 to S426 correspond to the processing of the statistics generation unit, and S430 to S440 correspond to the processing of the diagnosis unit.

[4. Other embodiments]
(1) In the above embodiment, the diagnostic information is preset by evaluating the vehicle control by the control unit 54. In this case, for example, when the hardware configuration or software configuration of the ECU 10 changes, the statistical information changes, so that the diagnostic information of the control unit 54 also changes. Therefore, diagnostic information is set in advance for each configuration of the ECU 10.

On the other hand, the ECU 10 may set the diagnostic information while executing the vehicle control. For example, when the number of feature information acquired for each task exceeds the number of times that statistically meaningful statistical information can be generated, the ECU 10 sets diagnostic information indicating the normal range of the statistical information based on the acquired feature information. You may. In this case, the ECU 10 may use the once set diagnostic information without changing it, or may newly set the diagnostic information every time the feature information is acquired a predetermined number of times.

(2) In the above embodiment, statistical information such as an average is calculated for the feature information, and whether the control unit 54 is normal or abnormal is diagnosed based on the statistical information. On the other hand, each time the task is executed, the control unit 54 may diagnose whether the control unit 54 is normal or abnormal depending on whether the feature information of the task is within the normal range from the preset minimum value to the maximum value. ..

However, the feature information may deviate from the normal range due to a change in the sensor value indicating the running state of the vehicle input from the sensor group 2 by the control unit 54, a noise generated in the sensor signal, a change in the running environment of the vehicle such as water temperature, and the like. be. Therefore, it is desirable to diagnose an abnormality not only once but continuously out of the normal range a predetermined number of times or more, or when the total number of times deviates from the normal range more than a predetermined number of times.

(3) Each time the same task is executed, feature information is stored in a ring buffer as a storage area for the corresponding task, and the feature information stored so far is compared with the feature information of this time. It may be diagnosed whether the vehicle control by the control unit 54 is normal or abnormal.

For example, if the feature information of the task executed this time deviates from the normal range from the minimum value to the maximum value of the feature information stored so far by a predetermined value or more, the control unit 54 diagnoses that it is abnormal. May be good. In this case, it is desirable to determine that it is abnormal when it becomes abnormal not only once but continuously a predetermined number of times or more, or when it becomes abnormal more than a predetermined number of times in total.

The feature information determined to deviate from the normal range from the minimum value to the maximum value of the feature information stored so far by a predetermined value or more is not stored in the storage area of the corresponding task.
Instead of comparing the feature information stored so far with the feature information of this time, for example, the first half portion and the second half portion of the feature information stored so far may be compared separately. In this case, when the feature information of either the first half part or the second half part is compared with the feature information of this time, it is considered abnormal if it becomes abnormal more than a predetermined number of times in succession or if it becomes abnormal more than a predetermined number of times in total. decide.

(4) In the above embodiment, vehicle torque control, braking control, steering control, and the like are exemplified as vehicle control executed by the control unit 54. In addition to this, if the control unit 54 diagnoses whether the control unit 54 is normal or abnormal based on the feature information representing the feature of the vehicle control, the temperature control, the air conditioning control, the acoustic control, etc. in the vehicle may be used as the vehicle control.

(5) A plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components, or one function possessed by one component may be realized by a plurality of components. Further, a plurality of functions possessed by the plurality of components may be realized by one component, or one function realized by the plurality of components may be realized by one component. Further, a part of the configuration of the above embodiment may be omitted. In addition, at least a part of the configuration of the above embodiment may be added or replaced with the configuration of the other above embodiment. It should be noted that all aspects included in the technical idea specified only by the wording described in the claims are embodiments of the present disclosure.

(6) In addition to the in-vehicle electronic control device 10 described above, a vehicle control system having the in-vehicle electronic control device 10 as a component, a vehicle control program for operating a computer as the in-vehicle electronic control device 10, and this vehicle control program are provided. The present disclosure can also be realized in various forms such as a recording recording medium for recording and a vehicle control method.

10: ECU (vehicle-mounted electronic control unit), 54: control unit, 56: feature acquisition unit, 58: statistics generation unit, 60: diagnostic unit

Claims (4)

Control units (54, S400, S404) configured to execute vehicle control by hardware and software, and
A feature acquisition unit (56, S420) configured to acquire at least one feature information representing the feature of the vehicle control executed in collaboration with the hardware of the control unit and the software.
A statistics generation unit (58, S422-S426) configured to generate statistical information of the feature information acquired by the feature acquisition unit, and
When the number of the feature information acquired by the feature acquisition unit exceeds a predetermined number that the statistics generation unit can generate the statistical information, diagnostic information indicating a normal range of the statistical information is provided based on the acquired feature information. A diagnostic unit (60, S430-S440) configured to set and compare the statistical information with the diagnostic information to diagnose whether the control unit is normal or abnormal.
An in-vehicle electronic control device (10). In the in-vehicle electronic control device according to claim 1,
The feature acquisition unit acquires the feature information for diagnosing the performance of the vehicle control.
In-vehicle electronic control device. In the in-vehicle electronic control device according to claim 1 or 2.
The feature acquisition unit acquires the feature information for each vehicle control task executed by the control unit.
In-vehicle electronic control device. In the in-vehicle electronic control device according to any one of claims 1 to 3.
If the statistical information is within the normal range, the diagnostic unit diagnoses that the control unit can continue normal vehicle control, and if the statistical information is out of the normal range but within the permissible range. , The control unit diagnoses that the restricted vehicle control can be continued, and if the feature information is out of the permissible range, the control unit stops the vehicle control.
In-vehicle electronic control device.

Images