JP7143694B2 - electronic controller - Google Patents

Description

The present disclosure relates to electronic controllers.

2. Description of the Related Art There is known a technique for storing effective vehicle data in a backup storage unit in order to perform cause analysis, reproduction test, etc. of an abnormality when an abnormality occurs in an automobile (see, for example, Patent Document 1). In the following description, the vehicle data stored in the backup storage unit as described above is referred to as freeze frame data (hereinafter, freeze frame data is abbreviated as FFD).

JP 2014-231305 A

2. Description of the Related Art As various systems installed in automobiles have become more sophisticated, the processing load on microcomputers provided in electronic control units has increased. Against this background, the inventor of the present invention is considering using a plurality of microcomputers to handle control that would cause an excessive load on the microcomputer if handled by one microcomputer. Also, in adopting such a plurality of microcomputers, it is under consideration to provide one of the plurality of microcomputers with the function of storing the FFD as described above.

In the following description, the microcomputer having the FFD saving function will be referred to as the first microcomputer. A microcomputer other than the first microcomputer is called a second microcomputer. The second microcomputer is a microcomputer without an FFD saving function. The number of second microcomputers may be one or two or more. For example, if only one second microcomputer causes the load on the first microcomputer and the second microcomputer to be excessive, providing two or more second microcomputers reduces the load on each microcomputer. good.

In the above configuration, when storing the FFD, the first microcomputer stores vehicle data that cannot be acquired by the first microcomputer, if necessary, in addition to vehicle data that can be acquired by the first microcomputer. Acquired from the microcomputer. An FFD containing vehicle data obtained from these microcomputers is stored in a nonvolatile memory. When the first microcomputer and the second microcomputer as described above cooperate or share and execute various controls, the first microcomputer may be able to acquire the same type of vehicle data from two or more microcomputers.

For example, when vehicle data obtained from various sensors and the like in the first microcomputer is transmitted to the second microcomputer and used in the second microcomputer, the vehicle data is transmitted to either the first microcomputer or the second microcomputer. can also be obtained from Further, when the first microcomputer and the second microcomputer independently obtain vehicle data from the same sensor or the like, the vehicle data can be obtained from either the first microcomputer or the second microcomputer.

However, as a result of a detailed study by the inventor, even if the same type of vehicle data can be obtained from two or more microcomputers, the vehicle data obtained from each microcomputer does not always match. was found. For example, when vehicle data acquired by the first microcomputer is transmitted to the second microcomputer, the vehicle data on the second microcomputer side becomes older than the vehicle data on the first microcomputer side due to communication delays, etc. can be. Alternatively, when the vehicle data acquired by the first microcomputer is transmitted to the second microcomputer, the vehicle data on the second microcomputer side may become different from the vehicle data on the first microcomputer side due to a communication error or the like. There is

Also, for example, when the first microcomputer and the second microcomputer independently acquire vehicle data from the same sensor or the like, the vehicle data acquired by each microcomputer differs due to factors such as different acquisition timings of the vehicle data. can be data. Thus, even if the same type of vehicle data can be acquired from two or more microcomputers, the data values do not always match. In other words, the inventors have solved the problem that simply acquiring vehicle data from an appropriately selected microcomputer may make it difficult to analyze the cause of an abnormality even if the FFD containing such vehicle data is saved. I have come to find out.

In one aspect of the present disclosure, it is desirable to provide an electronic control device capable of storing FFDs that are highly likely to be useful in analyzing the cause of anomalies.

One aspect of the present disclosure is an electronic controller. The electronic control device includes a plurality of microcomputers including one first microcomputer (10) and at least one second microcomputer (20). When the state of the vehicle detected by any one of the plurality of microcomputers is either an anomaly predictive state that indicates an anomaly sign or an anomaly confirmed state that is a confirmed anomaly state, ( S320, S325, S420, S425), and stores the FFD containing the vehicle data specified to be stored in the non-volatile memory (S330, S335, S430, S435). The first microcomputer is a microcomputer that detects an anomaly predictive state or an abnormal confirmed state based on the anomaly predictive information obtained from the microcomputer that has detected the anomaly predictive state or the anomaly confirmation information obtained from the microcomputer that has detected the anomaly confirmed state. Identify the microcomputer (S110, S120, S210-S230). When saving the FFD, the first microcomputer saves the FFD containing the vehicle data obtained from the identified abnormality detection microcomputer if the vehicle data can be obtained from a plurality of information sources including the identified abnormality detection microcomputer ( S330, S335, S430, S435).

According to the electronic control device configured in this manner, the first microcomputer specifies the abnormality detection microcomputer and stores the FFD containing the vehicle data obtained from the abnormality detection microcomputer in the nonvolatile memory. Therefore, compared to the case where the FFD including the vehicle data acquired from the microcomputer that has not detected the abnormality predictive state and the abnormality confirmed state is saved, the FFD that is highly likely to be useful for analyzing the cause of the abnormality can be saved.

It should be noted that the symbols in parentheses described in this column and the scope of claims are described to facilitate understanding of the correspondence with specific configurations exemplified as one mode in the embodiments described later. The description does not mean that the technical scope of the present disclosure is limited to the same scope as the embodiments described later.

FIG. 1 is a block diagram showing the configuration of an electronic control unit. FIG. 2 is an explanatory diagram of aggregated abnormality data. FIG. 3 is a flowchart of FFD storage processing executed by the first microcomputer. FIG. 4 is a flow chart of abnormality identification processing executed by the first microcomputer. FIG. 5 is a flowchart of processing corresponding to the first microcomputer executed by the first microcomputer. FIG. 6 is a flow chart of processing corresponding to the second microcomputer executed by the first microcomputer. FIG. 7 is a flowchart of abnormality detection processing executed by the second microcomputer. FIG. 8 is a block diagram showing a configuration example in which two electronic control units each include one microcomputer. FIG. 9 is a block diagram showing a configuration example in which one electronic control unit includes two second microcomputers.

The electronic control unit described above will now be described with reference to exemplary embodiments.
[Configuration of electronic control unit]
An electronic control unit 1 (hereinafter referred to as an ECU 1) shown in FIG. 1 is a device configured to be able to control an automobile engine. ECU is an abbreviation of "Electronic Control Unit". The ECU 1 has a first microcomputer 10 and a second microcomputer 20 . The first microcomputer 10 and the second microcomputer 20 are microcontrollers having well-known CPUs and non-transitional physical recording media. In the case of this embodiment, the first microcomputer 10 and the second microcomputer 20 are semiconductor memories such as ROM, RAM and backup RAM (backup RAM is abbreviated as BRAM hereinafter) as non-transitional substantive recording media. Prepare.

In the first microcomputer 10, the CPU executes various processes according to programs stored in the non-transitional physical recording medium, thereby functioning the function control unit 11, the abnormality detection control unit 12, the FFD storage control unit 13, and the like. In the first microcomputer 10, the CPU executes a process according to the program, thereby executing a method corresponding to the program (that is, a control method by the first microcomputer 10). The first microcomputer 10 also includes a FFD storage BRAM 14, a RAM 15, a communication buffer 16, and the like. The FFD storage BRAM 14 corresponds to a nonvolatile memory. Also, the FFD storage BRAM 14 and RAM 15 correspond to a storage unit.

In the second microcomputer 20, the function control section 21, the abnormality detection control section 22, etc. function by executing various processes according to the programs stored in the non-transitional substantive recording medium by the CPU. In the second microcomputer 20, a method corresponding to the program (that is, a control method by the second microcomputer 20) is executed by the CPU executing processing according to the program. The second microcomputer 20 also includes a RAM 25, a communication buffer 26, and the like. The RAM 25 corresponds to a storage section.

The function control unit 11 controls objects controlled by the first microcomputer 10 . The abnormality detection control unit 12 detects an abnormality in the object controlled by the first microcomputer 10 . Vehicle data acquired from various sensors by the function control unit 11 and the abnormality detection control unit 12, vehicle data calculated by the function control unit 11 and the abnormality detection control unit 12, and information on an abnormality detected by the abnormality detection control unit 12 etc. are stored in the RAM 15 . In the case of the ECU 1 illustrated in FIG. 1, the RAM 15 stores, for example, engine speed, intake air amount, intake pipe pressure, intake air amount abnormality information, cam sensor abnormality information, and abnormality summary data.

The function control unit 21 controls objects controlled by the second microcomputer 20 . The abnormality detection control unit 22 detects an abnormality in the object controlled by the second microcomputer 20 . Vehicle data acquired from various sensors by the function control unit 21 and the abnormality detection control unit 22, vehicle data calculated by the function control unit 21 and the abnormality detection control unit 22, and information about an abnormality detected by the abnormality detection control unit 22 etc. are stored in the RAM 25 . In the case of the ECU 1 illustrated in FIG. 1, the RAM 25 stores, for example, the engine speed, ignition timing, fuel injection amount, speed sensor abnormality information, fuel system abnormality information, and the like.

Various types of vehicle data and abnormality information as described above are exchanged and used between the first microcomputer 10 and the second microcomputer 20 . In the case of this embodiment, the first microcomputer 10 has a communication buffer 16, the second microcomputer 20 has a communication buffer 26, and data is transferred from one of the first microcomputer 10 and the second microcomputer 20 to the other by the DMA method. configured as possible. DMA is an abbreviation for "Direct Memory Access".

The FFD storage BRAM 14 is configured using part of the backup RAM provided in the first microcomputer 10 . Although the details will be described later, when the first microcomputer 10 detects a sign of abnormality or when an abnormality is confirmed in the first microcomputer 10, the function control unit 11 and the abnormality detection control unit 12 handle it. The FFD containing the vehicle data stored is stored in the FFD storage BRAM 14 . Further, when the second microcomputer 20 detects a sign of an abnormality or when an abnormality is confirmed in the second microcomputer 20, the second microcomputer 20 updates the vehicle data handled by the function control section 21 and the abnormality detection control section 22 to the second microcomputer 20. 1 Transmit to the microcomputer 10. The first microcomputer 10 stores the FFD containing the vehicle data received from the second microcomputer 20 in the FFD storage BRAM 14 .

That is, in the ECU 1, the first microcomputer 10 and the second microcomputer 20 respectively execute functional control and abnormality detection control, and when an abnormality is detected in either the first microcomputer 10 or the second microcomputer 20, The FFD is saved in the first microcomputer 10 . The RAM 15 of the first microcomputer 10 is provided with a storage area for storing abnormal aggregate data as shown in FIG. The aggregated anomaly data is data in which an anomaly function, an anomaly status, and an anomaly detection microcomputer are linked.

When the anomaly detection control unit 12 detects an anomaly sign, the anomaly detection control unit 12 provides an anomaly sign information. When the abnormality detection control section 12 confirms an abnormality, the abnormality detection control section 12 provides abnormality confirmation information. When the abnormality detection control unit 12 determines that the device is normal, the abnormality detection control unit 12 provides normality information. When the anomaly detection control unit 22 detects an anomaly sign, the anomaly detection control unit 22 provides an anomaly sign information. When the abnormality detection control section 22 confirms an abnormality, the abnormality detection control section 22 provides abnormality confirmation information. When the abnormality detection control unit 22 determines that the device is normal, the abnormality detection control unit 22 provides normality information. The aggregated abnormality data is updated by the first microcomputer 10 when abnormality sign information, abnormality determination information, or normal information is provided from either the abnormality detection control section 12 or the abnormality detection control section 22 .

Note that the method of realizing the functions of the units included in the first microcomputer 10 and the second microcomputer 20 as described above is not limited to software. may be implemented using For example, when the above functions are realized by an electronic circuit that is hardware, the electronic circuit may be realized by a digital circuit, an analog circuit, or a combination thereof.

[Processing Executed in First Microcomputer and Second Microcomputer]
Next, processing executed in the first microcomputer 10 and the second microcomputer 20 will be described. First, the processing executed in the first microcomputer 10 will be described based on the flow charts shown in FIGS. 3 to 6. FIG. The FFD storage processing shown in FIG. 3 is processing that is sequentially executed when the first microcomputer 10 operates.

After starting the FFD storage process, in S110, the first microcomputer 10 executes an abnormality occurrence identification process. Details of the abnormality identification process are shown in FIG. When the abnormality occurrence identification process is started, the first microcomputer 10 acquires abnormality summary data from the RAM 15 in S210. Subsequently, in S220, the first microcomputer 10 determines whether the abnormality status included in the abnormality consolidated data is normal, abnormality sign, or abnormality confirmed.

If the abnormal status is normal in S220, the process returns to S210. As a result, if the abnormal status is normal, the processing steps from S210 to S220 are repeatedly executed. On the other hand, in S220, if the abnormality status is abnormality sign or abnormality confirmed, the first microcomputer 10 identifies the abnormality detection microcomputer in S230. After completing S230, the abnormality identification process shown in FIG. 4 is terminated, and the process proceeds to S120 in FIG.

Subsequently, in S<b>120 , the first microcomputer 10 determines whether the identification result of the abnormality detection microcomputer is the first microcomputer 10 or the second microcomputer 20 . If the identification result of the abnormality detecting microcomputer is the first microcomputer 10 in S120, the first microcomputer 10 executes the process corresponding to the first microcomputer 10 in S130. Details of the processing corresponding to the first microcomputer 10 are shown in FIG. When the process corresponding to the first microcomputer 10 is started, in S320, the first microcomputer 10 determines whether the abnormality status is "continuing abnormality sign", "confirmed abnormality", or "normal".

In S320, if the abnormality status indicates that the abnormality sign is continuing, in S325, the first microcomputer 10 determines whether or not the FFD storage timing has come. When it is time to store the FFD in S325, the first microcomputer 10 causes the FFD storage BRAM 14 to store the FFD in S330, and returns to S320. As a result, when it is determined in S320 that the abnormality status is "continuing abnormality sign," the processing steps from S320 to S330 are repeatedly executed.

If the abnormality status is "continuing abnormality sign", it means that the abnormality has not yet been determined, so that the FFD containing the latest vehicle data can be stored in the FFD storage BRAM 14 by repeatedly executing S330. . The timing at which the FFD storage timing is determined in S325 varies depending on the abnormal function, and the frequency of storing the FFD is determined in advance for each abnormal function.

On the other hand, if the abnormality status is determined to be abnormal in S320, in S335 the first microcomputer 10 stores the FFD in the FFD storage BRAM 14, ends the processing corresponding to the first microcomputer 10 shown in FIG. Thus, the FFD storage processing shown in FIG. 3 ends. That is, when the abnormality status is abnormality confirmed, the FFD containing the latest vehicle data is stored in the FFD storage BRAM 14, and the FFD storage processing shown in FIG. 3 is terminated.

In S330 or S335, when storing the FFD in the FFD storage BRAM 14, the first microcomputer 10 accesses the address storage area secured in the RAM 15 and acquires the address stored in the address storage area. The address storage area stores the address of the data storage area in which the vehicle data is stored. A plurality of data storage areas are secured in the RAM 15 as data storage areas. The plurality of data storage areas include data storage areas in the RAM 15 in which vehicle data obtained and calculated by the first microcomputer 10 and vehicle data transmitted from the second microcomputer 20 are stored.

In the initial state, the address of the data storage area where the vehicle data for analysis when the first microcomputer 10 detects an abnormality is stored in the address storage area. Therefore, in S330 or S335, when the address storage area is accessed to acquire the address and the vehicle data is read from the data storage area corresponding to the address, the vehicle data for analysis when the first microcomputer 10 detects an abnormality is read. be Therefore, in S330 or S335, the FFD including the vehicle data for analysis when the abnormality is detected in the first microcomputer 10 is stored in the BRAM 14 for FFD storage.

On the other hand, if the abnormal status is normal in S320 of FIG. 5, the first microcomputer 10 ends the processing corresponding to the first microcomputer 10 shown in FIG. 5, thereby executing the FFD storage processing shown in FIG. finish. When the abnormality status is normal, for example, the condition temporarily satisfies the condition for determining the sign of abnormality, but then returns to the condition where the condition for determining the sign of abnormality is not satisfied. Therefore, in such a case, there is no need to store the FFD in the FFD storage BRAM 14, so the FFD storage processing shown in FIG. 3 ends without executing S335.

If the identification result of the abnormality detecting microcomputer is the second microcomputer 20 in S120 of FIG. 3, the first microcomputer 10 executes the process corresponding to the second microcomputer 20 in S140. Details of the processing corresponding to the second microcomputer 20 are shown in FIG. When the process corresponding to the second microcomputer 20 is started, in S405, the first microcomputer 10 stores the received data buffer secured in the communication buffer 16 in the analysis vehicle of the abnormality detection microcomputer (that is, the second microcomputer 20). Switch to a buffer that can receive communication data containing data. Communication data DMA-transferred from the transmission data buffer of the second microcomputer 20 is stored in this reception data buffer.

In the initial state, the reception data buffer secured in the communication buffer 16 of the first microcomputer 10 is a buffer capable of receiving communication data in the initial state. The communication data in the initial state is the communication data transmitted and received between the first microcomputer 10 and the second microcomputer 20 when the states detected by the first microcomputer 10 and the second microcomputer 20 are normal states. is. The communication data in the initial state and the vehicle data for analysis by the abnormality detection microcomputer may include common data (for example, data used in normal control). In addition to the above common data, the vehicle data for analysis by the abnormality detection microcomputer includes data not included in the communication data in the initial state (for example, data corresponding to the abnormality detected by the abnormality detection microcomputer). can be included. Therefore, in S405, the reception data buffer is switched to a buffer that can receive communication data having a larger amount of data than the communication data in the initial state.

Subsequently, at S410, the first microcomputer 10 stores the vehicle data including the received data received at S405 (that is, the vehicle data for analysis by the abnormality detection microcomputer). Store. This address storage area is the same storage area as the address storage area accessed by the first microcomputer 10 in S330 or S335 described above. Subsequently, in S415, the first microcomputer 10 validates the reception notification. Specifically, in the case of this embodiment, in S415, an interrupt at the completion of DMA transfer is enabled.

In the case of the present embodiment, the interrupt at the completion of the DMA transfer is disabled during normal operation (that is, when the state detected by the first microcomputer 10 is neither the abnormality predictive state nor the abnormality confirmed state). Thereby, the first microcomputer 10 acquires the data transferred from the second microcomputer 20 at the timing required by the first microcomputer 10 without being bothered by an interrupt from the second microcomputer 20 . On the other hand, after execution of S415, in subsequent processing steps in the first microcomputer 10, an interrupt occurs each time DMA transfer from the second microcomputer 20 is completed. Therefore, when the first microcomputer 10 receives vehicle data, abnormality sign information, abnormality determination information, or the like from the second microcomputer 20, the first microcomputer 10 must immediately recognize that new received data has arrived from the second microcomputer 20. can be done.

Subsequently, in S420, the first microcomputer 10 determines whether the abnormality status is "continuing abnormality sign", "confirmed abnormality", or "normal". The determination of S420 is executed each time the above-described DMA transfer completion interrupt occurs. Accordingly, the determination of S420 is executed each time new communication data is received from the second microcomputer 20 by DMA transfer. The abnormal status to be determined in S420 is transmitted from the second microcomputer 20 to the first microcomputer 10 in the form included in the communication data transferred by DMA. Although the details will be described later, after S530 or S570 of FIG. 7 is executed in the second microcomputer 20 to determine the abnormality information, the abnormality information is transmitted from the second microcomputer 20 to the first microcomputer 10, and the abnormality is detected. The determination of S420 is performed based on the information.

In S420, if the abnormality status indicates that the abnormality sign continues, in S425, the first microcomputer 10 determines whether or not the FFD storage timing has come. When it is time to store the FFD in S425, the first microcomputer 10 causes the FFD storage BRAM 14 to store the FFD in S430, and returns to S420. As a result, when it is determined in S420 that the abnormality status is "continuing abnormality sign," the processing steps from S420 to S430 are repeatedly executed. If the abnormality status is "continuing abnormality sign", it means that the abnormality has not yet been determined, so that the FFD containing the latest vehicle data can be stored in the FFD storage BRAM 14 by repeatedly executing S430. . As in the case of S325, the timing at which the FFD storage timing is determined in S425 differs depending on the abnormal function, and the frequency of storing the FFD is determined in advance for each abnormal function. On the other hand, if the abnormality status is determined to be abnormal in S420, the first microcomputer 10 stores the FFD in the FFD storage BRAM 14 in S435. That is, when the abnormality status is abnormality confirmed, the FFD containing the latest vehicle data is stored in the FFD storage BRAM 14 .

In S430 or S435, the FFD stored in the FFD storage BRAM 14 includes "vehicle data provided from the second microcomputer 20 to the first microcomputer 10". The "vehicle data provided from the second microcomputer 20 to the first microcomputer 10" includes "vehicle data acquired and calculated from various sensors in the second microcomputer 20" and "various sensors in the first microcomputer 10. etc., and then provided from the first microcomputer 10 to the second microcomputer 20 and used in the second microcomputer 20". Further, in the above-mentioned "vehicle data acquired from various sensors and the like in the second microcomputer 20 and calculated", "Even if the first microcomputer 10 does not receive data from the second microcomputer 20, the first microcomputer 10 can include vehicle data that can be directly obtained and calculated from various sensors by itself.

Among these vehicle data, "vehicle data obtained from various sensors and the like in the first microcomputer 10, and then provided from the first microcomputer 10 to the second microcomputer 20 and used in the second microcomputer 20" and "Vehicle data that the first microcomputer 10 can directly acquire and calculate from various sensors and the like without the first microcomputer 10 receiving data from the second microcomputer 20" This is vehicle data that can be acquired by the first microcomputer 10 without being provided with the data from the microcomputer 20 . However, even if the acquisition source of the vehicle data (for example, a specific sensor, etc.) is the same, the vehicle data on the abnormality detection microcomputer (that is, the second microcomputer 20 in this case) side and the first microcomputer 10 The vehicle data on the side does not necessarily match.

For example, when the vehicle data acquired by the first microcomputer 10 is transmitted to the second microcomputer 20, the vehicle data on the second microcomputer 20 side may be transmitted from the vehicle data on the first microcomputer 10 side due to a communication delay or the like. may be outdated data. In this case, the old vehicle data provided by the second microcomputer 20 and the new vehicle data held or acquired by the first microcomputer 10 may not match in data content.

Alternatively, when the vehicle data acquired by the first microcomputer 10 is transmitted to the second microcomputer 20, data corruption (for example, bit inversion or loss) may occur due to a communication error or the like. In this case, there is a possibility that the vehicle data including corrupted data provided by the second microcomputer 20 and the vehicle data not including the corrupted data held or acquired by the first microcomputer 10 do not match each other. .

Further, for example, when the first microcomputer 10 and the second microcomputer 20 independently acquire vehicle data from the same sensor or the like, the acquisition timing of the vehicle data may differ. In this case, which of the vehicle data held in the first microcomputer 10 and the vehicle data provided from the second microcomputer 20 to the first microcomputer 10 is the older vehicle data is uncertain or unclear. data may not match.

Therefore, when the FFD is stored in the FFD storage BRAM 14 in S430 and S435, even if the vehicle data is provided from the first microcomputer 10 to the second microcomputer 20, The vehicle data is sent back, and the FFD including the vehicle data sent back from the second microcomputer 20 is stored in the FFD storage BRAM 14 . Further, even if the first microcomputer 10 obtains vehicle data from various sensors and the like and can calculate it, the second microcomputer 20 dares to receive the vehicle data obtained from various sensors and the like and calculate the second microcomputer 20. The FFD containing the vehicle data provided from the microcomputer 20 is stored in the FFD storage BRAM 14 . When the communication data provided from the second microcomputer 20 includes vehicle data and other data, the vehicle data is extracted from the communication data, and the FFD containing the vehicle data is saved.

When S435 is completed, or when the abnormal status is normal in S420, the first microcomputer 10 invalidates the reception notification in S440. Specifically, in the case of this embodiment, the interrupt at the completion of DMA transfer enabled in S415 is disabled. As a result, in subsequent processing steps, even if the DMA transfer from the second microcomputer 20 is completed, an accompanying interrupt will not occur.

Subsequently, in S445, the first microcomputer 10 switches the reception data buffer secured in the communication buffer 16 to a buffer capable of receiving communication data in the initial state. The communication data in the initial state corresponds to the communication data transmitted and received between the first microcomputer 10 and the second microcomputer 20 before switching in S405 described above. The communication data in the initial state is data or the like that the first microcomputer 10 acquires from the second microcomputer 20 for control and management on the first microcomputer 10 side. As mentioned in the explanation of S405 above, the communication data in the initial state and the vehicle data for analysis by the abnormality detection microcomputer may include common data. may include data that is not included in the communication data of Therefore, after execution of S445, the amount of data DMA-transferred from the second microcomputer 20 to the first microcomputer 10 is reduced.

Subsequently, in S450, the first microcomputer 10 stores the address of the data storage area in which the vehicle data in the initial state is stored in the address storage area. This address storage area is the same storage area as the address storage area accessed by the first microcomputer 10 in S405 described above. The vehicle data in the initial state is vehicle data for analysis when the first microcomputer 10 detects an abnormality. Therefore, after the execution of S450, the first microcomputer 10 accesses the address storage area to acquire the address, and reads the vehicle data from the data storage area corresponding to the address. It returns to the state in which the vehicle data for analysis is read. Note that when S450 is completed, the processing corresponding to the second microcomputer 20 shown in FIG. 6 is completed, thereby ending the FFD storage processing shown in FIG.

Next, processing executed in the second microcomputer 20 will be described based on the flowchart shown in FIG. The abnormality detection process shown in FIG. 7 is a process that is sequentially executed when the second microcomputer 20 operates. The abnormality detection process is executed in the second microcomputer 20 in parallel with the FFD storage process executed by the first microcomputer 10 . When the abnormality detection process is started, the second microcomputer 20 determines abnormality of various functions in the abnormality detection control section 22 in S510.

Subsequently, at S520, the second microcomputer 20 updates the abnormality information based on the determination result at S510. Subsequently, in S530, the second microcomputer 20 determines whether the state detected by the second microcomputer 20 is a normal state, an abnormality sign state, or an abnormality confirmed state, based on the latest abnormality information updated in S520. to decide. In S530, when the abnormality information is determined, the abnormality information is transmitted from the second microcomputer 20 to the first microcomputer 10. FIG. This abnormality information is referred to when the first microcomputer 10 makes the determination of S420 in FIG. If the state detected by the second microcomputer 20 in S530 is the normal state, the abnormality detection process shown in FIG. 7 ends.

On the other hand, if the state detected by the second microcomputer 20 in S530 is either an anomaly predictive state or an anomaly confirmed state, in S540 the second microcomputer 20 converts the communication data stored in the communication buffer 26 into an abnormal state. Switch to communication data including vehicle data for analysis by the detection microcomputer. The second microcomputer 20 executes S540, and the first microcomputer 10 executes the above-described S405. As a result, between the first microcomputer 10 and the second microcomputer 20, communication including vehicle data for analysis of the abnormality detection microcomputer is performed. DMA transfer of data is enabled. After the DMA transfer is started, when the first microcomputer 10 executes S430 or S435 of FIG.

Subsequently, in S550, the second microcomputer 20 determines abnormality of various functions in the abnormality detection control section 22. FIG. Subsequently, at S560, the second microcomputer 20 updates the abnormality information based on the determination result at S550. Subsequently, in S570, the second microcomputer 20 determines whether the state detected by the second microcomputer 20 is a normal state, an abnormality sign state, or an abnormality confirmed state based on the latest abnormality information updated in S560. to decide. In S570, when the abnormality information is determined, the abnormality information is transmitted from the second microcomputer 20 to the first microcomputer 10. FIG. This abnormality information is referred to when the first microcomputer 10 makes the determination of S420 in FIG.

If the state detected by the second microcomputer 20 in S570 is an abnormality sign state, the process returns to S550. As a result, if the state detected by the second microcomputer 20 is an abnormality predictive state, the processing steps from S550 to S570 are repeatedly executed. When the processing steps from S550 to S570 are repeatedly executed in the second microcomputer 20, the first microcomputer 10 determines in S420 in FIG. be done. Among them, when S430 is executed, the FFD including the vehicle data for analysis by the abnormality detection microcomputer is stored in the storage BRAM 14 .

On the other hand, if the state detected by the second microcomputer 20 in S570 is either the confirmed abnormality state or the normal state, the first microcomputer 10 determines that the abnormality is confirmed or normal in S420 of FIG. If it is determined in S420 that the abnormality has been confirmed, S435 is executed, and the FFD including the vehicle data for analysis of the abnormality detection microcomputer is stored in the storage BRAM 14 . If S420 determines normal, S435 is not executed.

Further, if the state detected by the second microcomputer 20 in S570 is either the confirmed abnormal state or the normal state, in S580 the second microcomputer 20 restores the communication data stored in the communication buffer 26 to the initial state. communication data. The second microcomputer 20 executes S580, and the first microcomputer 10 executes S445, thereby enabling DMA transfer of communication data in the initial state between the first microcomputer 10 and the second microcomputer 20. Become. After completing S580, the abnormality detection process shown in FIG. 7 ends.

[effect]
As described above, according to the ECU 1 , the first microcomputer 10 specifies the abnormality detection microcomputer and stores the FFD containing the vehicle data obtained from the abnormality detection microcomputer in the FFD storage BRAM 14 . For example, when the second microcomputer 20 is an abnormality detection microcomputer, even if the vehicle data specified to be stored as FFD can be acquired from either the first microcomputer 10 or the second microcomputer 20, the second microcomputer 20 An FFD containing vehicle data obtained from the microcomputer 20 is saved. Therefore, if the second microcomputer 20 is an abnormality detection microcomputer, it is possible to store an FFD that is more likely to be useful for analyzing the cause of an abnormality than an FFD containing vehicle data acquired from the first microcomputer 10 is stored. can be done.

Further, according to the ECU 1, in the first microcomputer 10, by executing S410 and S450 to change the address stored in the address storage area, when saving the FFD, the save source data is stored. Data storage areas can be switched.

Further, according to the ECU 1, when the second microcomputer 20 becomes the abnormality detection microcomputer, S405 to S415 are executed at that stage, and the communication data transferred from the second microcomputer 20 to the first microcomputer 10 is , switch to communication data including vehicle data for analysis by the abnormality detection microcomputer. Further, when the abnormal status of the second microcomputer 20 becomes normal, S440-S450 are executed to switch the communication data transferred from the second microcomputer 20 to the first microcomputer 10 to the communication data in the initial state. . Therefore, in anticipation of an abnormality detection, the processing load due to an increase in the amount of communication is greater than in the case where communication data including vehicle data for analysis by the abnormality detection microcomputer is constantly transferred from the second microcomputer 20 to the first microcomputer 10. and an increase in communication load can be suppressed.

[Other embodiments]
As described above, the electronic control device has been described with reference to exemplary embodiments, but the above-described embodiments are merely examples as one aspect of the present disclosure. That is, the present disclosure is not limited to the exemplary embodiments described above, and can be embodied in various forms without departing from the technical spirit of the present disclosure.

For example, in the above-described embodiment, one ECU 1 includes the first microcomputer 10 and the second microcomputer 20, but as shown in FIG. 10 and the second microcomputer 20 may be incorporated and configured to function in the same manner as in the above embodiment. In other words, even if the configuration provided by the electronic control device in the present disclosure is not incorporated in a single housing, the configurations incorporated in a plurality of housings cooperate to form the electronic control device in the present disclosure. It may be configured to function as Even if such a configuration is adopted, the same functions and effects as those of the above-described embodiment can be obtained.

Further, in the above-described embodiment, communication data can be DMA-transferred between the first microcomputer 10 and the second microcomputer 20, but data transfer between the first microcomputer 10 and the second microcomputer 20 may be any data communication channel. For example, as shown in FIG. 8, when the first microcomputer 10 and the second microcomputer 20 are respectively incorporated in the ECU 31 and the ECU 32 configured as separate bodies, communication data can be transferred using the in-vehicle LAN 33. It may be configured as Even if such a configuration is adopted, the same functions and effects as those of the above-described embodiment can be obtained.

In the above embodiment, the ECU 1 includes one first microcomputer 10 and one second microcomputer 20. However, as shown in FIG. good. That is, if there is one first microcomputer 10 that stores FFD, the number of second microcomputers 20 that do not store FFD can be set to a desired number. Even if such a configuration is employed, the same actions and effects as those of the above-described embodiment can be obtained.

Also, although not mentioned in the above embodiment, at least some of the means or functions provided by the ECU 1 include software recorded in a physical memory device and a computer that executes the software, only software, only hardware, Or it can be provided by a combination thereof. For example, when at least part of the ECU 1 is provided by an electronic circuit that is hardware, it can be provided by a digital circuit including many logic circuits, or an analog circuit.

In addition to the above, a plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components, or a function possessed by one component may be realized by a plurality of components. good. Also, a plurality of functions possessed by a plurality of components may be realized by a single component, or a function realized by a plurality of components may be realized by a single component. Also, part of the configuration of the above embodiment may be omitted. Moreover, at least part of the configuration of the above embodiment may be added or replaced with respect to the configuration of the other above embodiment. It should be noted that all aspects included in the technical idea specified by the wording described in the claims are embodiments of the present disclosure.

In addition to the electronic control device described above, a system having the electronic control device as a component, a program for making a computer function as the electronic control device, a non-transitional physical recording medium such as a semiconductor memory in which the program is recorded, The present disclosure can also be implemented in various forms, such as a control method performed by an electronic controller.

[supplement]
Note that, as is clear from the exemplary embodiments described above, the electronic control device of the present disclosure may further include the following configurations.

One aspect of the present disclosure may include a storage unit (15, 25) capable of storing data. The storage unit stores a plurality of vehicle data storage areas each storing vehicle data obtained from a plurality of information sources, and the address of any one of the plurality of vehicle data storage areas. An address storage area may be reserved. The first microcomputer may be configured to save the FFD including the vehicle data stored in the vehicle data storage area indicated by the address based on the address stored in the address storage area (S330, S335, S410, S430, S435, S450). Further, when the first microcomputer identifies the abnormality detection microcomputer, the vehicle data contained in the FFD is transferred from the abnormality detection microcomputer by storing the address of the vehicle data storage area corresponding to the abnormality detection microcomputer in the address storage area. It may be configured to switch to available vehicle data.

In one aspect of the present disclosure, the first microcomputer, triggered by the abnormality predictor information or the abnormality confirmation information provided from the abnormality detection microcomputer (S110, S120), sets the address of the vehicle data storage area corresponding to the abnormality detection microcomputer. It may be configured to be stored in the address storage area (S410, S450).

In one aspect of the present disclosure, the first microcomputer is configured to restore the address stored in the address storage area to the initial state after saving the FFD after the abnormality determination information is provided from the abnormality detection microcomputer. Good (S450).

In one aspect of the present disclosure, the abnormality detection microcomputer may be the second microcomputer (20).
In one aspect of the present disclosure, the first microcomputer and the abnormality detection microcomputer transmit between the first microcomputer and the abnormality detection microcomputer when abnormality sign information or abnormality determination information is provided from the abnormality detection microcomputer to the first microcomputer. The communication data to be received may be switched from the first communication data to the second communication data different from the first communication data (S405, S445, S540, S580).

In one aspect of the present disclosure, the abnormality detection microcomputer may be configured to transmit second communication data including vehicle data to the first microcomputer. The first microcomputer may extract vehicle data from the second communication data transmitted from the abnormality detection microcomputer and store the FFD containing the vehicle data (S430, S435).

In one aspect of the present disclosure, the first microcomputer and the abnormality detection microcomputer store the FFD after the abnormality confirmation information is provided from the abnormality detection microcomputer to the first microcomputer, and then transmit between the first microcomputer and the abnormality detection microcomputer The communication data to be received may be configured to return from the second communication data to the first communication data (S445, S580).

In one aspect of the present disclosure, the first microcomputer may be configured to provide vehicle data on the first microcomputer side to the second microcomputer. The second microcomputer may be configured to send back vehicle data on the second microcomputer side provided from the first microcomputer to the first microcomputer when the abnormality predictive state or the abnormality confirmed state is detected. When the first microcomputer saves the FFD, the vehicle data on the first microcomputer side and, if the vehicle data sent back from the second microcomputer side can be obtained, the FFD containing the vehicle data sent back from the second microcomputer side (S430, S435).

Reference Signs List 1, 31, 32, 41... Electronic control unit 10... First microcomputer 11... Function control unit 12... Abnormality detection control unit 13... Storage control unit 14... FFD storage RAM 15... RAM 16... Communication buffer 20...Second microcomputer 21...Function control unit 22...Abnormality detection control unit 25...RAM 26...Communication buffer 33...In-vehicle LAN.

Claims (9)

a plurality of microcomputers including one first microcomputer (10) and at least one second microcomputer (20) ;
a storage unit (15, 25) capable of storing data;
with
In the first microcomputer, the state of the vehicle detected by any one of the plurality of microcomputers is either an anomaly predictive state indicating a sign of an anomaly or an anomaly confirmed state indicating that the anomaly has been confirmed. in the case (S320, S325, S420, S425), the freeze frame data including the vehicle data specified to be stored is stored in the non-volatile memory (S330, S335, S430, S435),
The first microcomputer detects the anomaly predictive state or the anomaly confirmed state based on the anomaly predictive information obtained from the microcomputer that detected the anomaly predictive state or the anomaly confirmation information obtained from the microcomputer that detected the anomaly confirmed state. When the abnormality detection microcomputer is specified (S110, S120, S210-S230) and the freeze frame data is saved, the vehicle data can be obtained from a plurality of information sources including the identified abnormality detection microcomputer. , the freeze frame data including the vehicle data obtained from the identified abnormality detection microcomputer are stored (S330, S335, S430, S435) ;
The storage unit includes a plurality of vehicle data storage areas in which the vehicle data obtained from the plurality of information sources are respectively stored, and an address of one of the plurality of vehicle data storage areas. An address storage area is allocated to store
The first microcomputer is configured to save the freeze frame data including the vehicle data stored in the vehicle data storage area indicated by the address based on the address stored in the address storage area (S330, S335, S410, S430, S435, S450),
When the abnormality detection microcomputer is specified, the first microcomputer stores the address of the vehicle data storage area corresponding to the abnormality detection microcomputer in the address storage area, so that the vehicle data included in the freeze frame data is stored in the address storage area. Data is configured to be switched to the vehicle data obtained from the abnormality detection microcomputer.
electronic controller. The electronic control device according to claim 1 ,
When the abnormality sign information or the abnormality confirmation information is provided from the abnormality detection microcomputer (S110, S120), the first microcomputer changes the address of the vehicle data storage area corresponding to the abnormality detection microcomputer to the configured to be stored in the address storage area (S410, S450)
electronic controller. The electronic control device according to claim 2 ,
The first microcomputer is configured to restore the address stored in the address storage area to an initial state after saving the freeze frame data after the abnormality determination information is provided from the abnormality detection microcomputer ( S450)
electronic controller. The electronic control device according to any one of claims 1 to 3 ,
The abnormality detection microcomputer is the second microcomputer (20),
The first microcomputer and the abnormality detection microcomputer are configured to exchange information between the first microcomputer and the abnormality detection microcomputer when the abnormality sign information or the abnormality confirmation information is provided from the abnormality detection microcomputer to the first microcomputer. The communication data to be transmitted is configured to be switched from the first communication data to the second communication data different from the first communication data (S405, S445, S540, S580).
electronic controller. A plurality of microcomputers including one first microcomputer (10) and at least one second microcomputer (20),
In the first microcomputer, the state of the vehicle detected by any one of the plurality of microcomputers is either an anomaly predictive state indicating a sign of an anomaly or an anomaly confirmed state indicating that the anomaly has been confirmed. in the case (S320, S325, S420, S425), the freeze frame data including the vehicle data specified to be stored is stored in the non-volatile memory (S330, S335, S430, S435),
The first microcomputer detects the anomaly predictive state or the anomaly confirmed state based on the anomaly predictive information obtained from the microcomputer that detected the anomaly predictive state or the anomaly confirmation information obtained from the microcomputer that detected the anomaly confirmed state. When the abnormality detection microcomputer is specified (S110, S120, S210-S230) and the freeze frame data is saved, the vehicle data can be obtained from a plurality of information sources including the identified abnormality detection microcomputer. , the freeze frame data including the vehicle data obtained from the identified abnormality detection microcomputer are stored (S330, S335, S430, S435) ;
The abnormality detection microcomputer is the second microcomputer (20),
The first microcomputer and the abnormality detection microcomputer are configured to exchange information between the first microcomputer and the abnormality detection microcomputer when the abnormality sign information or the abnormality confirmation information is provided from the abnormality detection microcomputer to the first microcomputer. The communication data to be transmitted is configured to be switched from the first communication data to the second communication data different from the first communication data (S405, S445, S540, S580).
electronic controller. The electronic control device according to claim 4 or claim 5 ,
The abnormality detection microcomputer is configured to transmit the second communication data including the vehicle data to the first microcomputer,
The first microcomputer extracts the vehicle data from the second communication data transmitted from the abnormality detection microcomputer and saves the freeze frame data including the vehicle data (S430, S435).
electronic controller. The electronic control device according to any one of claims 4 to 6,
After the abnormality determination information is provided from the abnormality detection microcomputer to the first microcomputer, the first microcomputer and the abnormality detection microcomputer save the freeze frame data, and then the first microcomputer and the abnormality detection microcomputer The communication data transmitted between the second communication data is returned to the first communication data (S445, S580).
electronic controller. The electronic control device according to any one of claims 4 to 7 ,
The first microcomputer is configured to provide the vehicle data on the first microcomputer side to the second microcomputer,
The second microcomputer is configured to send back the vehicle data provided from the first microcomputer and on the side of the second microcomputer to the first microcomputer when the abnormality predictive state or the abnormality confirmation state is detected. is,
When the freeze frame data is saved, the first microcomputer can obtain the vehicle data on the first microcomputer side and the vehicle data sent back from the second microcomputer side. (S430, S435) to store the freeze frame data including the vehicle data sent back from
electronic controller. A plurality of microcomputers including one first microcomputer (10) and at least one second microcomputer (20),
In the first microcomputer, the state of the vehicle detected by any one of the plurality of microcomputers is either an anomaly predictive state indicating a sign of an anomaly or an anomaly confirmed state indicating that the anomaly has been confirmed. in the case (S320, S325, S420, S425), the freeze frame data including the vehicle data specified to be stored is stored in the non-volatile memory (S330, S335, S430, S435),
The first microcomputer detects the anomaly predictive state or the anomaly confirmed state based on the anomaly predictive information obtained from the microcomputer that detected the anomaly predictive state or the anomaly confirmation information obtained from the microcomputer that detected the anomaly confirmed state. When the abnormality detection microcomputer is specified (S110, S120, S210-S230) and the freeze frame data is saved, the vehicle data can be obtained from a plurality of information sources including the identified abnormality detection microcomputer. , the freeze frame data including the vehicle data obtained from the identified abnormality detection microcomputer are stored (S330, S335, S430, S435) ;
The abnormality detection microcomputer is the second microcomputer (20),
The first microcomputer is configured to provide the vehicle data on the first microcomputer side to the second microcomputer,
The second microcomputer is configured to send back the vehicle data provided from the first microcomputer and on the side of the second microcomputer to the first microcomputer when the abnormality predictive state or the abnormality confirmation state is detected. is,
When the freeze frame data is saved, the first microcomputer can obtain the vehicle data on the first microcomputer side and the vehicle data sent back from the second microcomputer side. (S430, S435) to store the freeze frame data including the vehicle data sent back from
electronic controller.

Images