JPH0240735A - Abnormality detecting device for control unit for vehicle - Google Patents

Abstract

PURPOSE:To securely detect the runaway of the microcomputer in the control unit by displaying the end of respective program routines for input, arithmetic, and output processes individually and resetting a watch dog timer when AND operation among the respective displays is completed. CONSTITUTION:The watch dog timer which is normally reset and enters an overflow state in the case of abnormality is provided to detect the abnormality. This control unit displays the completion of the input process, the completion of the arithmetic process, and the completion of the output process when three kinds of subroutines for the input process, arithmetic process, and output process as basic processes of a microcomputer is completed. When the AND operation among those displays is completed, a reset signal is outputted and the watch dog timer provided to the CPU of the control unit is reset. On the other hand, when at least one of those three kinds of subroutines is not completed, the reset signal is not outputted and the watch dog timer enters the overflow state, so that the runaway of the microcomputer in the control unit is securely detected.

Description

[Detailed description of the invention] (Field of industrial use) The present invention is... The present invention relates to an abnormality detection device for a vehicle control unit equipped with a watchdog timer.

(Prior Art) For example, as shown in Japanese Patent Application Laid-Open No. 62-70948. For vehicles equipped with a watchdog timer (guard dog timer), the watchdog timer monitors a runaway condition trs<abnormality ts) of a control program of a vehicle control unit mainly configured with a micro combinator. Abnormality detection devices for control units are well known in the art.

However, for example, if a watchdog timer is used to detect abnormalities in the control unit, depending on the malfunction pattern of the micro combinator, it is possible that the watchdog timer itself may malfunction, including its own reset signal generation routine. In such a case, the watchdog timer cannot perform normal monitoring operation.

Therefore, in an abnormality detection device using a watchdog timer as described above, for example, a plurality of control units (CPUs) having exactly the same configuration are installed in parallel, and each control unit (CPU) set by the plurality of control units (CPUs) The control variables on the control program are calculated simultaneously, and if the mutual calculation results do not match, it is determined that the control unit is out of control (abnormality), and the control by the control unit is stopped. A so-called fail-operable system was adopted, which automatically switches to a relatively simple and highly reliable secondary back gamma tube system.

(Problem to be Solved by the Invention) However, in the case of the configuration of the conventional abnormality detection device as described above, even if the control unit actually goes out of control, the calculation results of the control variables of each control unit do not match. If there is, it will not be judged as abnormal.

As a result, for example, in the entire control program, (a) input signal processing routine, (b) controlled variable calculation processing routine,
(C) For example, if any of the three basic types of routines in the controlled variable output processing routine or each k is unable to execute all steps for some reason (in short, the routine If the control unit no longer rotates normally), the control unit cannot be determined to be abnormal.

As a result, if left as is, there is a risk that control will be performed using an incorrect control amount. In such a case, in a control system in which the control routine of the watchdog timer itself and the control amount output processing routine are each executed by interrupt processing with respect to the main routine, the interface of the control unit is This often occurs when noise enters the loved request terminal and the background routine including the control amount calculation routine cannot be executed.

(Means for Solving the TS Problem) The abnormality detection device for a vehicle control unit according to the present invention has been developed with the aim of solving the problems in the prior art as described above. Set up a watchdog timer,
During normal operation, the microcomputer generates a reset signal at predetermined intervals to reset the watchdog timer, while during abnormality, the watchdog timer
In an abnormality detection device for a control unit for a vehicle, which detects an abnormality in a control unit by causing an overflow of the current, the control program for the control unit is a 3F program that is broadly divided into at least input processing, arithmetic processing, and output processing. An operation completion display means for individually displaying the completion of operation processing for each routine of the routine is provided, and a reset signal is sent to the watchdog timer only when the AND condition of each operation completion display of these three operation completion display means is satisfied. The invention is characterized in that it generates.

(Function) In the abnormality detection device for a vehicle control unit of the present invention, the control program is divided into at least three basic routines: input processing, controlled variable calculation processing, and controlled variable output processing, and the three routines are The completion of each operation is displayed by the operation completion display means, and the watchdog timer reset signal is output from the microcomputer only when all AND conditions for the operation completion display of each operation completion display means are satisfied. The watchdog timer is reset, and the input, calculation,
If all the steps in any one of the three types of routines forming the basic operation of the output microcomputer are not properly processed, the reset signal is not generated as a whole. As a result, the watchdog timer will overflow, and the overflow will accurately and reliably control the 0-
In other words, runaway of the microcomputer in the control unit can be detected.

(Effects of the Invention) Therefore, according to the configuration of the abnormality detection device for a vehicle control unit of the present invention, all the routines of input processing, arithmetic processing, and output processing, which are the basics of the microcomputer control operation constituting the control unit, can be performed. Unless execution is normal, the watchdog timer reset signal is not output, and even if a runaway occurs in a routine including the watchdog routine, accurate abnormality determination is possible.

As a result, the reliability of the detection function of the abnormality detection device is greatly improved.

(Embodiment) FIGS. 1 to 7 show an embodiment of the abnormality detection device for a vehicle control unit of the present invention.

First, FIG. 6 shows a throttle valve control system for an automobile engine, which is configured to include, for example, an electronic control function (program) for a throttle valve as the vehicle control unit.

That is, in FIG. 6, reference numeral 1 denotes the engine body, and intake air is supplied to each cylinder via an air flow meter 2 and a throttle chamber 3. Further, fuel is supplied from the fuel tank 12 to the engine side by the fuel pump 13 and injected by the Fehr injector 5.

The amount of air taken into the cylinder during running is controlled by a throttle valve 6 provided in the throttle chamber 3. The throttle valve 6 is electrically driven in accordance with the opening degree θPA of the accelerator pedal 31, for example, via the engine control unit 9 equipped with a throttle valve control program as described above.

That is, the depression amount PA of the accelerator pedal 31,
In other words, the accelerator opening (θPA) is determined by the accelerator opening sensor 3.
After being detected in step 2, it is input into the RAM of the engine control unit 9 and stored in memory. On the other hand, the engine control unit 9 performs a process such as "accelerator depression amount PA - target throttle opening PT" as shown in FIG. 7, for example.
Equipped with a data map (ROM data) of J characteristics,
Outputting a throttle actuator control signal at a predetermined voltage level according to the input value of the accelerator depression 1llPA to drive the throttle actuator 33;
Operate the throttle valve 6. The actual opening degree PT' of the throttle valve 6 can be determined by the throttle sensor 34 again if necessary.
detected by.

By the way, in the throttle valve 6, both ends 61 and 62 of the support shaft 6a are respectively projected outward from a part of the throttle body of the throttle chamber 3, and one side end 61 of the two projecting parts is to the output shaft 33a of the throttle actuator 33 via the first electromagnetic clutch 35;
Further, the other end 62 is connected to the shaft end 37a of the swing type link lever 37 via the second electromagnetic clutch 36. A lever side end 37b of the swing type link lever 37 is connected to the accelerator pedal 31 via a throttle wire 38. In this case, the first electromagnetic clutch 35 is a normally closed type and constitutes the main control system, while the second electromagnetic clutch 36 is a normally open type. It constitutes a fail-safe backup control system for the main electronically controlled throttle control system.

Turn on each of these first and second electromagnetic clutches 35°36
(connected) and 0FF (disconnected) states are also controlled based on control signals from the engine control unit 9.

On the other hand, the symbol 1O indicates an exhaust pipe equipped with a three-way catalytic converter 11. The exhaust pipe IO is also provided with an air-fuel ratio control sensor 19 for detecting the oxygen concentration (A/F) in the exhaust gas.

On the other hand, reference numeral 14 is a spark plug provided in the cylinder head portion IA of the engine body 1, and a predetermined ignition voltage is applied to the spark plug 14 via a distributor 17 and an igniter 18. The application timing, that is, the ignition timing, is determined by the igniter 1 from the engine control unit (ECU 9).
It is controlled by an ignition timing control signal 1ga supplied to 8. Further, reference numeral 20 denotes a boost pressure sensor 2
0, and an engine boost pressure B corresponding to the engine load is detected and input to the ECU 9. Further, reference numeral 16 is a water temperature thermistor provided in the water jacket section of the engine cylinder block section IB.

As is well known, the engine control unit (ECU) 9 is mainly composed of a microcomputer (CPU), and includes memory (ROM and RAM) and an interface (I10) circuit.
In this embodiment, the engine control unit 9 is functionally configured as shown in the block diagram of FIG. 2, for example.

In FIG. 2, the reference numeral 50 is a central information processing unit (CPU) equipped with a watchdog timer function that constitutes the central part of the engine control unit 9, and includes, for example, an 8-bit single chip along with a ROM 51 and a RAM 52, which will be described later. It is formed by a micro combinator. The central information processing unit (CPu) 50 executes, for example, a background routine for controlling the throttle valve which is the basis shown in the flowchart of FIG. 3 and an interrupt for a watchdog timer that is included in the background routine at a predetermined period. It is equipped with at least 2N control programs including a routine (FIG. 4) to perform highly reliable control processing.

Next, reference numeral 53 is an input signal processing circuit of the engine control unit 9, and the input signal processing circuit 53
is configured to include an A/D converter 53a and an input board 53b. Further, the output signal processing circuit is, for example, D
/A converter 54 and an output buffer circuit 55. Further, reference numeral 57 indicates a free running counter, and the free running counter 57
functions as a clock signal generator that generates a reference clock signal (such as cycle time) at a predetermined period. Further, reference numeral 56 is an output boat, and a watchdog reset circuit 58 is connected to the output boat 56, and the watchdog timer (WDT) in the central information processing unit is connected to the watchdog reset circuit 58.
An overflow signal is output, and the overflow signal is sent to the reset terminal R of the central information processing unit (CPU) 50.
is supplied to

The watchdog reset circuit 58 is configured to generate the reset signal when the watchdog output is not inverted for a certain period of time (for example, about 100 m5ec).

That is, in the watchdog system (guard dog monitoring system), a reset signal is inputted from the YAC compiler at a predetermined period to the watchdog timer in the central information processing unit 50, and the central information Processing bag! ! As long as 50 is normal, the above output boat 5
6. Reset is periodically applied through the watchdog reset circuit 58.

On the other hand, if the control routine within the central information processing unit 50 does not run normally due to some abnormality, it becomes impossible to supply the reset signal and the watchdog timer overflows.

Therefore, in principle, an abnormality in the central information processing unit 150 can be detected from the fact of the overflow.

However, as already mentioned in the section of the prior art, there may be cases where it is not possible to reliably detect an abnormality using only the above-mentioned basic monitoring function. Therefore, in this embodiment, the entire control program shown in FIG. 4 is divided into (a) an input signal processing routine, (b) a control amount calculation processing routine, and (c) a background routine shown in FIG. The control amount output processing routine is divided into three basic types, and the normal operation (processing) completion of each step is checked individually, and the watchdog is used for the first time with the completion of all operations as a logical product condition. It is designed to output a reset signal for the timer (WPT), and for this purpose, the above (a) is preliminarily performed on the background routine shown in Fig. 3, which is the basis.
This system is characterized by the fact that identification flags are set to indicate completion or non-completion of each of the operations in (c). First, we will explain the contents of the basic background routine shown in Fig. 3. go.

First, in step SI, the operating state or data holding state of each part is initialized.

Next, in step S, the accelerator opening sensor 32 described above
, that is, the accelerator depression flPA is input. As a result, the input signal processing flag FIN is cleared to FIN=0, assuming that the input processing is completed.

Next, the process proceeds to step S, where the target throttle opening PT corresponding to the accelerator depression ff1PA input in step S is determined based on the map shown in FIG.
Calculate (lookup). Then, on the condition that the calculation operation is completed, the process proceeds to the next step S, and this time, the control amount calculation flag FCAL is cleared to FCAL=0.

Thereafter, after outputting the throttle actuator control amount corresponding to the target throttle opening degree PT calculated in step S4 above to the D/A converter 54, the control amount output flag FOUT is set to FOUT=Q in the final step S7. clear.

Next, in the watchdog timer interrupt routine of FIG. 4, the values of the above-mentioned flags FIN, FCAL, and FOUT are set to 0,
In other words, it is determined whether those operations have been completed normally and each flag value has been cleared.

If both of these results are YES, the process proceeds to step S4, inverts the watchdog output described above (see Figures 5 (a) to (d)), and notifies the abnormal state, and then proceeds to the final step S6. Each of the above flags F I N
, FCAL, and FOUT are each set to 1.

On the other hand, if any or all of the determinations in steps S and -S are No, the processing is roughly divided into the three types described above: (a) input signal processing, (b) control amount calculation processing, (6) )
If the operation of any one of the control amount output processes is not completed normally, the process moves to the final step Ss without going through the watchdog output reversal operation of step S4, and flags FI corresponding to each of the above processes are set. N.FCA
Set L and FOUT to 1.

[Brief explanation of the drawing]

Fig. 1 is a complaint correspondence diagram of the present invention, Fig. 2 is a system block diagram of an abnormality detection device for a vehicle control unit according to an embodiment of the present invention, and Fig. 3 is a control program for the control unit of the device. 4 is a flowchart showing the interrupt routine of the watchdog timer in the device, and FIG. 5 is a time chart showing the operation sequence corresponding to the configuration of the device in FIG. 1. The chart, Fig. 6 is a system diagram of an engine control system to which the same device is applied, and Fig. 7 shows the relationship between accelerator depression amount (opening degree) PA and target throttle opening in the system shown in Fig. 1. FIG. 6...Throttle valve 9 Kaiφ@Engine control unit (ECU)
) 32...Accelerator opening degree sensor 33 ・ 35 ・ 36 ・ 50 ・ 5 l ・ 52 ・ 56 ・ 57 ・ 58 ・ Throttle actuator 1st electromagnetic clutch 2nd ffi magnetic clutch processing device 10M AM Output boat Free running counter watch dog reset circuit Figure 3 Figure 5 PA (accelerator depression amount)

Claims (1)

[Claims] 1. A watchdog timer is provided, and when normal, the microcomputer generates a reset signal at predetermined intervals to reset the watchdog timer, while when an abnormality occurs, the watchdog timer overflows to detect an abnormality in the control unit. In the abnormality detection device for a control unit for a vehicle, the control program for the control unit includes at least three types of program routines broadly classified into input processing, arithmetic processing, and output processing. The vehicle is characterized in that an operation completion display means is provided to display the operation completion display, and a reset signal to the watchdog timer is generated only when a logical product condition of each operation completion display of these three operation completion display means is satisfied. Anomaly detection device for control unit.