JP2017218081A - Electronic control unit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to monitor a calculation load of an electronic control device from the exterior independent of communication.SOLUTION: An electronic control device measures an execution time of processing (periodic processing and interruption processing) which is executed within a periodic processing time at an execution interval of periodic processing, and determines the execution time or a ratio of the execution time to the periodic processing time (S1) as a calculation load. The electronic control device converts the calculation into an analog voltage value of a prescribed range (S2), and outputs a voltage according to the analog voltage value to the exterior from an analog input-output port (S3).SELECTED DRAWING: Figure 4

Description

  The present invention relates to an electronic control device mounted on an automobile.

  As described in JP-A-2006-23603 (Patent Document 1), an electronic control device mounted on an automobile executes periodic processing that occurs regularly and interrupt processing that occurs irregularly. To do.

Japanese Patent Laid-Open No. 2006-23603

  However, in the electronic control unit, for example, when the interrupt process rapidly increases in a transitional period such as acceleration / deceleration, the interrupt process is executed in addition to the regular process. Processing omission may occur. When the processing omission occurs, for example, the control target device of the electronic control device performs an unexpected operation, or the program falls into an infinite loop and stops. For this reason, it is conceivable to monitor the calculation load of the electronic control device with an external device. For example, if the calculation load of the electronic control device increases, it becomes difficult to synchronize communication, and the external device monitors the calculation load. It becomes impossible to do.

  Therefore, an object of the present invention is to provide an electronic control device that can monitor a calculation load from the outside without depending on communication.

  For this reason, the electronic control unit has means for measuring the calculation load of the microcomputer, means for converting the calculation load into an analog voltage value, and means for outputting a voltage corresponding to the analog voltage value to the outside.

  According to the present invention, it is possible to monitor the calculation load from the outside without depending on communication.

It is a system diagram showing an example of an electronic control system. It is a block diagram which shows an example of the specific structure of a microcomputer. It is explanatory drawing of the process which a microcomputer performs, and the problem which generate | occur | produces there. It is a flowchart which shows an example of a calculation load output process. It is a figure which shows an example of a calculation load and an output voltage. It is a flowchart which shows an example of a calculation load monitoring process. It is a flowchart which shows an example of a selection execution process. It is a figure which shows an example of the priority table which set the priority of the regular process. It is a figure which shows an example of the priority table which set the priority of the interruption process. It is explanatory drawing of the method of changing a threshold value according to the driving | running state change of a motor vehicle. It is a system diagram which shows the 1st modification of an electronic controller. It is a system diagram which shows the 2nd modification of an electronic controller.

Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings.
FIG. 1 shows an example of an electronic control system mounted on an automobile.

  The electronic control system 100 controls a main electronic control device (main ECU) 200 that controls control target devices such as a fuel injection device, an automatic transmission, and an electric brake device, and a control target device different from the main ECU 200. And a secondary electronic control unit (sub ECU) 300 that monitors the calculation load of the main ECU 200. The main ECU 200 incorporates a microcomputer (microcomputer) 250 to be monitored, and the sub ECU 300 incorporates a microcomputer 350 serving as a main body for monitoring the microcomputer 250 of the main ECU 200.

  As shown in FIG. 2, the microcomputer 250 of the main ECU 200 can be exemplified as a CPU (Central Processing Unit) 250A, a ROM (Read Only Memory) 250B that can be cited as an example of a nonvolatile memory, and an example of a volatile memory. Communication circuit for communicating with RAM (Random Access Memory) 250C, watchdog timer 250D, analog input / output port 250E for inputting / outputting analog signals, digital input / output port 250F for inputting / outputting digital signals, and other electronic control devices 250G is an electronic device enclosed in one package. Here, as the ROM 250B, a flash ROM capable of electrically erasing and writing data can be used. Note that the microcomputer 350 of the sub ECU 300 also has the same configuration as the microcomputer 250 of the main ECU 200.

Here, processing executed by the microcomputer 250 in the main ECU 200 and problems occurring therein will be described.
The microcomputer 250 of the main ECU 200 executes a periodic process that periodically occurs and an interrupt process that occurs irregularly as jobs for controlling the control target device. The periodic process is a process that is executed at predetermined time intervals such as a 2 ms period and a 10 ms period. The interruption process is a process that occurs in order to respond to the changing driving state when the driving state of the automobile changes, for example.

  As processes executed by the microcomputer 250 of the main ECU 200, periodic processes A to D and interrupt processes a to e are assumed. When the interrupt processes a to e do not occur, the microcomputer 250 executes the regular processes A to D within the regular process time that is the regular process execution interval, as shown in FIG. At this time, the ratio of the time required for execution of the regular processes A to D with respect to the regular process time is approximately 59%, for example, and the calculation load of the microcomputer 250 is approximately 59%. When interrupt processing ac occurs, the microcomputer 250 executes the interrupt processing ac in addition to the periodic processing AD within the regular processing time. In this case, the ratio of the time required for execution of the periodic processes A to D and the interrupt processes a to c with respect to the periodic process time is, for example, about 87%, and the calculation load of the microcomputer 250 is about 87%.

  Further, when interrupt processes a to e occur according to changes in the driving state of the automobile, the microcomputer 250 executes the interrupt processes a to e in addition to the regular processes A to D within the regular process time. At this time, for example, when processing is executed in the order of periodic processing A, interrupt processing a, periodic processing B, interrupt processing b, periodic processing C, interrupt processing c to e, and periodic processing D, the periodic processing time The regular processing D does not end within this, so-called processing overflow occurs. When processing overflow occurs, if the processing is important, the control target device may perform an unexpected operation or the program may fall into an infinite loop and stop. If the interrupt process e does not occur, all processes are executed within the regular processing time.

  For this reason, as described in the background art, it is conceivable to monitor the calculation load of the microcomputer 250 of the main ECU 200 with an external device. For example, if the calculation load of the microcomputer 250 increases, it becomes difficult to synchronize communication. The external device cannot monitor the calculation load. Therefore, as will be described below, the calculation load of the microcomputer 250 is converted into an analog voltage value, and the voltage corresponding to the analog voltage value is output from the analog input / output port 250E to the outside. Can be monitored from the outside.

  FIG. 4 shows an example of a calculation load output process that the microcomputer 250 repeatedly executes every predetermined time t1 when the main ECU 200 is activated. For example, the microcomputer 250 executes a calculation load output process by the CPU 250A executing a control program stored in advance in the ROM 250B (the same applies hereinafter). In the following description, for the purpose of simplifying the description, the microcomputer 250 of the main ECU 200 is abbreviated as the main ECU 200 (the same applies hereinafter).

  In step 1 (abbreviated as “S1” in FIG. 4, the same applies hereinafter), the main ECU 200 measures the execution time of the processing (periodic processing and interrupt processing) executed within the periodic processing time, and the periodic processing time. The computation load (CPU usage rate) that is the total processing time for is measured. The calculation load is not limited to the CPU usage rate, and for example, a known index such as the measured processing time itself or the resource usage rate can be employed.

  In step 2, the main ECU 200 converts the calculation load into an analog voltage value so that the calculation load 0% to 100% is distributed in a predetermined voltage range, for example, 0V to 5V. Note that the voltage range in which the calculation load is distributed can be determined in consideration of the calculation accuracy of the CPU 250A, the output characteristics of the analog input / output port 250E, and the like.

  In step 3, the main ECU 200 outputs a voltage corresponding to the analog voltage value from the analog input / output port 250E to the outside. The main ECU 200 may maintain this state so that the voltage output from the analog input / output port 250E can be referred to at an arbitrary time.

  According to this calculation load output process, the main ECU 200 measures the execution time of the process executed within the regular process time every predetermined time t1, changes this to an analog voltage value, and then responds to the analog voltage value. The voltage is output from the analog input / output port 250E. For this reason, as shown in FIG. 5, even after the main ECU 200 is activated, the sub ECU 300 outputs the voltage corresponding to the calculation load to the outside even when the communication between the main ECU 200 and the sub ECU 300 is not established. The calculation load of the main ECU 200 can be monitored. The sub ECU 300 can monitor the calculation load without depending on the communication between the main ECU 200 and the sub ECU 300.

  In the example shown in FIG. 5, assuming that the analog input / output port 250E outputs a voltage in the range of 0V to 5V, the execution time [μs] of the processing executed within the regular processing time is used as the calculation load, and the calculation is performed. A load of 1000 [μs] is output as 200 [mV]. Referring to this example, immediately after the activation of the main ECU 200, for example, the calculation load is relatively high due to various initialization processes, the calculation load is about 11000 [μs], and the corresponding voltage is about 2200 [mV]. It will be understood that When the initialization process of the main ECU 200 is completed, the calculation load decreases to about 7000 [μs], and the voltage corresponding to this reaches about 1400 [mV]. It will be understood that the voltage corresponding to about 6000 [μs] is stable at about 1200 [mV].

  In addition, since the calculation load of the main ECU 200 can be visually recognized by a general-purpose device such as an oscilloscope, for example, in a verification experiment of the main ECU 200, it can be confirmed whether or not the calculation load is excessively high.

  FIG. 6 shows an example of a calculation load monitoring process that the microcomputer 350 repeatedly executes every predetermined time t2 when the sub ECU 300 is activated. Here, it is desirable that the sub-ECU 300 repeatedly executes the calculation load monitoring process at the same predetermined time t1 as the calculation load output process of the main ECU 200 in order to monitor the calculation load in synchronization with the voltage output of the main ECU 200.

In step 11, the sub ECU 300 reads a voltage from the analog input / output port 250 </ b> E in order to monitor the calculation load of the main ECU 200.
In step 12, sub ECU 300 determines whether or not the voltage is higher than a predetermined threshold value. Here, the predetermined threshold value is a threshold value for determining whether or not there is a possibility that a processing loss may occur due to the occurrence of an interrupt process due to an increase in the computation load of the main ECU 200, for example, It can be set as appropriate in consideration of the control content of the control target device, the processing capability of the main ECU 200, and the like. If sub ECU 300 determines that the voltage is higher than the predetermined threshold, the process proceeds to step 13 (Yes), while if it is determined that the voltage is equal to or lower than the predetermined threshold, the process proceeds to step 15. (No).

  In step 13, the sub ECU 300 determines whether or not the state in which the voltage has become higher than a predetermined threshold has continued for a predetermined time by using, for example, a built-in timing function. Here, the predetermined time is a threshold value for eliminating a temporary increase in calculation load, and is appropriately set in consideration of, for example, the control content of the control target device, the processing capability of the main ECU 200, and the like. be able to. If the sub-ECU 300 determines that the state has continued for a predetermined time, the process proceeds to step 14 (Yes), whereas if the sub-ECU 300 determines that the state has not continued for a predetermined time, the process proceeds to step 15 ( No).

  In step 14, the sub ECU 300 determines that the calculation load of the main ECU 200 is abnormal, and transmits the determination result to the main ECU 200. When the sub ECU 300 determines that the calculation load of the main ECU 200 is abnormal, for example, a warning light on an instrument panel may be turned on to notify the driver or the like that an abnormality has occurred. .

  In step 15, the sub ECU 300 determines that the calculation load of the main ECU 200 is normal, and transmits the determination result to the main ECU 200.

  According to the calculation load monitoring process, the sub ECU 300 determines whether or not the calculation load of the main ECU 200 is excessively increased through whether or not the voltage output from the main ECU 200 is higher than a predetermined threshold value. . Then, sub ECU 300 determines that the computation load of main ECU 200 is abnormal when the state where the voltage is higher than a predetermined threshold value continues for a predetermined time. On the other hand, if the state where the voltage is higher than the predetermined threshold value has not continued for a predetermined time, sub-ECU 300 determines that the calculation load of main ECU 200 is normal. Thereafter, sub ECU 300 transmits the determination result to main ECU 200. At this time, since the main ECU 200 outputs a voltage immediately after activation or when the computation load is high, the sub ECU 300 can monitor the computation load as long as the main ECU 200 is activated.

  Note that, when the voltage becomes higher than a predetermined threshold, the sub ECU 300 can determine that the calculation load of the main ECU 200 is abnormal without determining whether or not the state has continued for a predetermined time. . However, by determining whether or not the above state has continued for a predetermined time, it is possible to improve the determination accuracy for determining that the calculation load of the main ECU 200 is abnormal. The sub ECU 300 can also diagnose whether or not the A / D converter is normal through the change state of the voltage output from the main ECU 200.

  By the way, if the calculation load of the main ECU 200 becomes abnormal, if this is left unattended, for example, the program falls into an infinite loop, and the control target device cannot be controlled according to the driving state of the automobile. For this reason, the sub ECU 300 can also reset the main ECU 200 when it is determined that the calculation load of the main ECU 200 has become abnormal. In this way, the watchdog timer 250D that monitors the processing state of the main ECU 200 is not necessary, and the manufacturing cost of the microcomputer 250 can be reduced.

  However, in the main ECU 200, when the calculation load becomes excessively high, if the process according to the driving state of the vehicle is specified and the process to be executed is selected according to the priority of each process, the main ECU 200 is selected. It is possible to continue to control the control target device without resetting. Hereinafter, this method will be described.

  FIG. 7 shows an example of a selection execution process that is executed by the main ECU 200 triggered by the occurrence of a periodic process or an interrupt process. Here, as a premise for executing the selection execution process, the main ECU 200 stores the determination result in the RAM 250C, for example, so that the determination result transmitted from the sub ECU 300 can be referred to at an arbitrary time. Note that the selection execution process described below has a smaller calculation load than the regular process and the interruption process for the main ECU 200 to control the control target device, and therefore, even if this is executed, the influence is small.

  In step 21, the main ECU 200 refers to, for example, a determination result stored in the RAM 250C, and determines whether or not an abnormality in which the calculation load is higher than a predetermined threshold value has occurred. If the main ECU 200 determines that an abnormality has occurred, the process proceeds to step 22 (Yes). If the main ECU 200 determines that no abnormality has occurred, the main ECU 200 steps the process to execute the generated process. Proceed to 27 (No).

  In step 22, the main ECU 200 reads the sensor output attached to a predetermined location of the automobile, for example, whether the engine is stopped in an engine operating state, stopped in an idling stop state, or traveling at a low speed below a predetermined vehicle speed. The driving state of the automobile is determined, for example, whether the vehicle is traveling at a higher speed than the vehicle speed. In addition, as a driving | running state of a motor vehicle, it is not restricted to said 4 types, It can also be 3 types or less or 5 types or more.

  In step 23, the main ECU 200 identifies the priority indicating the importance of the process for each of the periodic process and the interrupt process that may occur in the operating state determined in step 22. That is, the ROM 250B of the main ECU 200 stores a priority table for periodic processing as shown in FIG. 8, and a priority table for interrupt processing as shown in FIG. In the priority table of the periodic process and the interrupt process, high, medium and low priorities according to the driving state of the vehicle are set for each of the periodic processes A to D, respectively. Here, the priority “high” must be executed, the priority “medium” should be executed once every predetermined number of times, and the priority “low” has little influence even if the processing is skipped. Processing is shown (the same applies hereinafter). Referring to the periodic process priority table, for example, it is possible to specify that the priority of the periodic process B when the vehicle is stopped in the idling stop state is “high” that must be executed. Then, the main ECU 200 refers to the priority table stored in the ROM 250B according to the periodic process or interrupt process that triggered the execution of the selection execution process, and determines the priority according to the driving state and process of the vehicle. Identify.

  In step 24, the main ECU 200 determines whether or not the priority specified in step 23 is “low”, that is, whether the process to be executed has little influence even if the execution is skipped. If the main ECU 200 determines that the priority is “low” (Yes), the main ECU 200 skips the execution of the process and ends the process. On the other hand, if the main ECU 200 determines that the priority is not “low”, that is, the priority is “medium” or “high” (No), the process proceeds to step 25.

  In step 25, the main ECU 200 determines whether or not the priority specified in step 23 is “medium”, that is, whether or not the process has only to be executed once every predetermined number of times. If the main ECU 200 determines that the priority is “medium”, the process proceeds to step 26 (Yes), while the priority is not “medium”, that is, the priority is determined to be “high”. If so, the process proceeds to step 27 (No).

  In step 26, since the priority of the process is “medium”, the main ECU 200 can skip the execution of the process, for example, based on whether or not a predetermined number of times have elapsed since the previous process was executed. Determine whether or not. Then, the main ECU 200 terminates the process if it is determined that skipping is possible (Yes), and proceeds to step 27 if it determines that skipping is not possible (No).

  In step 27, the main ECU 200 executes the process that triggered the execution of the selection execution process.

  According to the selection execution process, the main ECU 200 executes the process unconditionally if the calculation load is normal when the periodic process or the interrupt process occurs, while if the calculation load is abnormal, The execution of the process is skipped according to the priority of the process. At this time, since the priority of processing is specified according to the driving state of the automobile, the priority suitable for the actual driving state can be specified. And since execution of a process with low priority is skipped, an important process can be executed within the regular processing time. For example, control of the control target device can be continued without resetting the main ECU 200. it can. Note that the processing priority is not limited to three levels of high, medium, and low, but may be at least two levels of high and low.

  In the above embodiment, the predetermined threshold value for determining whether or not the calculation load of the main ECU 200 is abnormal is a fixed value, but in accordance with a change in the driving state of the automobile as follows. It can also be changed dynamically.

  When the driving state of the automobile changes, various interruption processes occur in response to the driving state change in addition to the periodic processing that occurs in the steady state. That is, when the driving state of the vehicle is in a transition period, when the driving state of the vehicle is switched, or when the calculation load of the main ECU 200 is changed, the number of processes that occur is increased or decreased. To change the predetermined threshold. Here, as an example in which the driving state of the automobile becomes a transitional period, for example, when the brake is operated to decelerate the vehicle while traveling, the accelerator pedal is depressed to accelerate the vehicle while traveling, and the like. Moreover, as an example in which the driving state of the automobile is switched, for example, when shifting to an idling stop when the vehicle is stopped, returning from the idling stop can be cited. Furthermore, as an example of shifting to a state in which the calculation load of the main ECU 200 changes, for example, when performing memory diagnosis at power-on, shifting to idling stop can be cited. In addition, the magnitude | size which changes a predetermined | prescribed threshold value according to the said driving | running state change can be suitably set considering the calculation load etc. of the interruption process generate | occur | produced by each state change, for example.

  In this way, as shown in FIG. 10, the predetermined threshold value is changed when the driving state of the vehicle changes, the transition period, the switching of the driving state, or the calculation load changes. Therefore, it is possible to make an abnormality determination according to a change in the driving state. In the example shown in FIG. 10, the predetermined threshold value is the ratio [%] of the processing time to the regular processing time.

  When the main ECU 200 constituting the electronic control system 100 includes a dual core processor in which two microcomputers A and B are enclosed in one package as shown in FIG. 11, for example, one microcomputer B is connected to the other. The calculation load of the microcomputer A can be monitored. Further, when the main ECU 200 constituting the electronic control system 100 includes only one microcomputer C as shown in FIG. 12, the voltage output from the microcomputer C is read by itself and is calculated based on the voltage. The load can be self-diagnosed.

Here, the technical idea that can be understood from the above-described embodiment will be described below.
(1) The electronic control device includes means for measuring a calculation load of the microcomputer, means for converting the calculation load into an analog voltage value, and means for outputting a voltage corresponding to the analog voltage value to the outside. .

(2) The electronic control device further includes means for inputting the voltage.
(3) The electronic control device further includes means for determining that the operation load of the microcomputer is abnormal when the voltage becomes higher than a predetermined threshold value.

(4) The electronic control device further includes means for selecting processing to be executed by the microcomputer when it is determined that the calculation load of the microcomputer is abnormal.
(5) The electronic control device further includes means for dynamically setting the predetermined threshold value according to a driving state of the automobile.

(6) The electronic control unit determines that the computation load of the microcomputer is abnormal when the voltage has become higher than a predetermined threshold and the state continues for a predetermined time.

(7) When the electronic control unit determines that the calculation load of the microcomputer is abnormal, the electronic control unit selects processing to be executed by the microcomputer according to the priority of the processing.

(8) The priority of the process is set for each driving state of the automobile.
(9) The calculation load is an execution time or a ratio of processing executed within the regular processing time.
(10) The processing is regular processing and interrupt processing.

200 Main ECU
250 Microcomputer
250E Analog I / O port

Claims (5)

Means for measuring the computing load of the microcomputer
Means for converting the calculation load into an analog voltage value;
Means for outputting a voltage corresponding to the analog voltage value to the outside;
An electronic control device comprising: Further comprising means for inputting the voltage;
The electronic control device according to claim 1. Means for determining that the operation load of the microcomputer is abnormal when the voltage is higher than a predetermined threshold;
The electronic control device according to claim 1 or 2, characterized by the above. When it is determined that the operation load of the microcomputer is abnormal, the apparatus further includes means for selecting a process to be executed by the microcomputer.
The electronic control device according to claim 3. Further comprising means for dynamically setting the predetermined threshold in accordance with the driving state of the vehicle;
The electronic control device according to claim 3 or 4, characterized by the above.