IN-VEHICLE ELECTRONIC CONTROL APPARATUS HAVING MONITORING CONTROL CIRCUIT

• US 20090312898A1
• Filed: 12/19/2008
• Published: 12/17/2009
• Est. Priority Date: 06/13/2008
• Status: Active Grant

• Current Assignee: Mitsubishi Electric Corporation
• Original Assignee: Mitsubishi Electric Corporation
• Inventors: HASHIMOTO, Koji
• Granted Patent: US 8,712,635 B2
• Time in Patent Office: Days
• US Class Current: 701/31
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24042 Signature analysis, compare recorded with current data, if error then alarm
• CPC Class Codes: G05B 2219/24195 Compare data in channels at timed intervals, for equality
• CPC Class Codes: G05B 2219/2637 Vehicle, car, auto, wheelchair

Abstract

A main control circuit unit 20A and a monitoring control circuit unit 30A are connected in series; the main control circuit unit 20A and an external control apparatus 40 are connected in series. When the monitoring control circuit unit 30A generates concurrent question information, the main control circuit unit 20A generates main-machine answer information A1n, and the external control apparatus 40 generates supplementary-apparatus answer information. The main control circuit unit 20A combines these answer information items and transmits the combined answer information items to the monitoring control circuit unit 30A; the monitoring control circuit unit 30A compares the combined answer information items with synthesis correct-solution information items stored in a correct-solution information storage memory 35A so as to perform a total abnormality determination. The main control circuit unit 20A performs an abnormality determination on the external control apparatus 40, based on correct-solution information for the external control apparatus 40; the main control circuit unit 20A generates synthesis answer information by use of the correct-solution information.

Claims

1. An in-vehicle electronic control apparatus, having a monitoring control circuit, comprising:

a main control circuit unit including;

a nonvolatile program memory;

a RAM memory for calculation processing;

a first input interface circuit to which a first input sensor group is connected;

a first output interface circuit to which a first electric load group is connected; and

a microprocessor that controls the first electric load group, in response to contents of a control program stored in the non-volatile program memory and an operation status of the first input sensor group, and

a monitoring control circuit unit including;

a question information generation unit that is connected through a first serial communication circuit to the microprocessor and sequentially and selectively transmits a plurality of question information items;

a correct-solution information storage memory that stores correct-solution information items for the question information items; and

an abnormality determination that compares answer information, based on the question information, from the main control circuit unit with correct-solution information stored in the correct-solution information storage memory so as to determine whether or not an abnormality exists,

wherein the main control circuit unit collaborates with an external control apparatus that is connected there with via a second serial communication circuit and that receives control signals there from and transmits control signals there to;

the external control apparatus is provided with collaborating supplementary apparatuses including supplementary-apparatus microprocessors that collaborate with supplementary-apparatus program memories; and

the supplementary-apparatus program memories each have a control program corresponding to an external answer generation transmission unit that generates answer information in response to question information transmitted from the main control circuit unit and transmits the answer information, as supplementary-apparatus answer information, to the main control circuit unit,

wherein, concurrent question information that is applied to the main control circuit unit and all the external control apparatuses and discrete question information items that are discretely applied to the main control circuit unit and the external control apparatuses are added to the question information generation unit; and

the concurrent question information or the discrete question information is transmitted from the monitoring control circuit unit to the main control circuit unit and transmitted from the monitoring control circuit unit to the external control apparatuses via the main control circuit unit,

wherein the nonvolatile program memory includes a control program corresponding to a main-machine answer generation unit that generates main-machine answer information in accordance with the concurrent question information or the discrete question information and a control program corresponding to a transmission answer edition unit that transmits, in response to the concurrent question information, synthesis answer information obtained by combining and tallying the main-machine answer information and the supplementary-apparatus answer information items,

wherein, in, the correct-solution information storage memory, there is stored main-machine correct-solution information with regard to main-machine answer information generated by the main control circuit unit and/or synthesis correct-solution information obtained by combining and tallying the main-machine correct-solution information and the supplementary-apparatus correct-solution information items for the supplementary-apparatus answer information items; and

the supplementary-apparatus correct-solution information items are stored in the correct-solution information storage memory or in the nonvolatile program memory, and

wherein the abnormality determination unit monitors an abnormality in the main control circuit unit, based at least on concurrent question information generated by the monitoring control circuit unit or discrete question information items; and

the main control circuit unit and the monitoring control circuit unit collaborate with each other so as to monitor and discriminate an abnormality in the external control apparatus

2. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 1,

wherein, in the nonvolatile program memory, there is stored control programs corresponding to an external-apparatus monitoring unit and a corrected answer generation unit, supplementary-apparatus correct-solution information items with regard to the supplementary-apparatus answer information items,

wherein the monitoring control circuit unit is provided with a total abnormality determination unit,

wherein, synthesis correct-solution information is stored in the correct-solution information storage memory,

wherein the external-apparatus monitoring unit compares the supplementary-apparatus correct-solution information items with the supplementary-apparatus answer information items so as to determine whether or not an abnormality exists in the external control apparatus,

wherein, in response to the concurrent question information generated by the monitoring control circuit unit, the corrected answer generation unit firstly generates synthesis answer information by combining main-machine answer information generated by the main control circuit unit and supplementary-apparatus answer information items generated by the external control apparatus and transmits the synthesis answer information to the monitoring control circuit unit;

and the corrected answer generation unit serves as a transmission answer edition unit that combines the supplementary-apparatus correct-solution information items with regard to the supplementary-apparatus answer information items, in place of the supplementary-apparatus answer information items, when the supplementary-apparatus answer information items are abnormal, and

wherein the total abnormality determination unit serves as an abnormality determination unit that compares the synthesis correct-solution information corresponding to concurrent question information generated by the monitoring control circuit unit with synthesis answer information received from the main control circuit unit so as to perform a total abnormality determination including a determination whether or not there exists an abnormality in the main control circuit unit itself and a determination whether or not the main control circuit unit monitors an abnormality in the external control apparatus.

3. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 1,

wherein the nonvolatile program memory is provided with a control program corresponding to a circulation answer generation unit,

wherein the monitoring control circuit unit is provided with an external apparatus abnormality notification unit and an abnormality determination unit based on a synthesis abnormality determination unit and a discrete abnormality determination unit,

wherein, in the correct-solution information storage memory, there is stored main-machine correct-solution information with regard to the main control circuit unit, supplementary-apparatus correct-solution information items with regard to the external control apparatuses, and synthesis correct-solution information obtained by combining the main-machine correct-solution information and the supplementary-apparatus correct-solution information items,

wherein the circulation answer generation unit is a transmission answer edition unit that firstly generates, in response to concurrent question information generated by the monitoring control circuit unit, synthesis answer information by combining main-machine answer information generated by the main control circuit unit and supplementary-apparatus answer information items generated by the external control apparatuses and transmits the synthesis answer information to the monitoring control circuit unit,

wherein, in the case where synthesis answer information transmitted from the main control circuit unit and the synthesis correct-solution information coincide with each other, the synthesis abnormality determination unit continues to transmit the concurrent question information, while updating the content of a question;

in the case where the synthesis answer information and the synthesis correct-solution information do not coincide with each other, a circulation question flag is set, and after the circulation question flag is set, the discrete question information items are sequentially transmitted to the main control circuit unit and the external control apparatuses; and

in the case where, when concurrent question information is transmitted again, the synthesis answer information and the synthesis correct-solution information coincide with each other, the circulation question flag is reset, and in the case where the synthesis answer information and the synthesis correct-solution information do not coincide with each other, the circulation question flag is kept set,

wherein the discrete abnormality determination unit compares main-machine answer information based on the discrete question information items with the main-machine correct-solution information and compares the supplementary-apparatus answer information items with the supplementary-apparatus correct-solution information items so as to discretely determine whether or not an abnormality exists in the main control circuit unit or in the external control apparatuses, and

wherein, when an abnormality in the external control apparatus is detected by the discrete abnormality determination unit, the external apparatus abnormality notification unit notifies the main control circuit unit of the occurrence of the abnormality.

4. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 3,

wherein the discrete question information items are each question information to be transmitted to the main control circuit unit or any one of the collaborating supplementary apparatuses in the external control apparatus, and

wherein the main control circuit unit transmits to the monitoring control circuit unit one of main-machine answer information and supplementary-apparatus answer information items based on the discrete question information items.

5. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 3,

wherein the discrete question information items are concurrently transmitted to the main control circuit unit or the external control apparatus;

and the main control circuit unit and some of the collaborating supplementary apparatuses in the external control apparatus that are not question subjects reply nothing as main-machine answer information or supplementary-apparatus answer information items, or the main control circuit unit eliminates the main-machine answer information or the supplementary-apparatus answer information items obtained from the main control circuit unit and some of the collaborating supplementary apparatuses in the external control apparatus that are not question subjects so that only the answer information items that are question subjects are transmitted to the monitoring control circuit unit.

6. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 1,

wherein, in the nonvolatile program memory, there is stored control programs corresponding to an external-apparatus monitoring unit and a selection answer generation unit, supplementary-apparatus correct-solution information items with regard to the supplementary-apparatus answer information items,

wherein the monitoring control circuit unit is provided with an abnormality analysis determination unit,

wherein, main-machine correct-solution information and synthesis correct-solution information are stored in the correct-solution information storage memory,

wherein the external-apparatus monitoring unit compares the supplementary-apparatus correct-solution information items with the supplementary-apparatus answer information items so as to determine whether or not an abnormality exists in the external control apparatus,

wherein the selection answer generation unit is a transmission answer edition unit that firstly generates, in response to concurrent question information generated by the monitoring control circuit unit, synthesis answer information by combining main-machine answer information generated by the main control circuit unit and supplementary-apparatus answer information items generated by the external control apparatuses and transmits the synthesis answer information to the monitoring control circuit unit;

and the selection answer generation unit transmits the main-machine answer information, instead of synthesis answer information, to the monitoring control circuit unit, when the supplementary-apparatus answer information items are abnormal, and

wherein the abnormality analysis determination unit serves as an abnormality determination unit that determines that the main control circuit unit and the external control apparatus are normal, in the case where any one of the synthesis answer information or the main-machine answer information, i.e., the present answer information and synthesis correct-solution information coincide with each other, that determines that the main control circuit unit is normal but the external control apparatus is abnormal, in the case where, even when the present answer information and the synthesis correct-solution information do not coincide with each other, the present answer information and the main-machine correct-solution information coincide with each other, and that determines that the main control circuit unit is abnormal, in the case where the present answer information coincide neither with the synthesis correct-solution information nor with the main-machine correct-solution information.

7. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 2 or 3 or 6,

wherein each of the question information items is a control program that corresponds to at least one of calculation expressions that are utilized in the microprocessor and microprocessors in the external control apparatuses or a program the content of which is the same as that of the control program;

the question information designates copy programs stored in different addresses of the program memories, as test programs, and designates input constant table numbers corresponding to input data items utilized in the test programs; and

the actual numerical values of the input constant tables are stored in the nonvolatile program memory and the supplementary-apparatus program memories in the external control apparatuses,

wherein the main control circuit unit generates main-machine answer information, based on the calculation expression and the input constants designated by the concurrent question information or the discrete question information items, and

wherein the external control apparatus transmits the calculation result based on the calculation expression and the input constant designated by the concurrent question information or by the discrete question information items, as supplementary-apparatus answer information items, to the main control circuit unit.

8. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 7,

wherein the in-vehicle electronic control apparatus is an engine control apparatus,

wherein the first input sensor group includes at least an accelerator position sensor for detecting the accelerator-pedal depressing level, a throttle position sensor for detecting an opening degree of an air-intake valve, an airflow sensor for measuring the air intake amount of the engine, and an engine rotation sensor for calculating the engine rotation speed,

wherein the first electric load group includes at least a motor for controlling the valve opening degree of an air-intake throttle and a fuel-injection electromagnetic valve,

wherein the test program in the main control circuit unit is a control program for calculating a throttle-valve-opening-degree increase/decrease target correction value corresponding to an engine-output-torque increase/decrease demand correction value required by the external control apparatus, and

wherein the external control apparatus includes any one of a transmission control unit that switches the transmission stage of a transmission in response to a vehicle speed and an accelerator position sensor, an electric power steering system that responds to the operation of a steering wheel, a stability control unit for controlling a vehicle posture, and an antilock brake system that responds to a foot brake pedal;

the external control apparatus transmits the engine-torque increase/decrease demand correction value to the main control circuit unit, via the second serial communication circuits; and

the test program in the external control apparatus is a control program for calculating the engine-torque increase/decrease demand correction value in response to an input signal to the external control apparatus.

9. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 8,

wherein the nonvolatile program memory incorporates a control program corresponding to an external apparatus abnormality processing unit;

the external apparatus abnormality processing unit is a first abnormality processing unit that operates based on discrete abnormality determination information, on the external control apparatus, transmitted to the main control circuit unit through the discrete abnormality determination unit and the external apparatus abnormality notification unit in the monitoring control circuit unit, or that operates based on discrete abnormality determination information, on the external control apparatus, through the external-apparatus monitoring unit in the main control circuit unit; and

the external apparatus abnormality processing unit does not respond at least to an increase demand out of engine-output-torque increase/decrease demand correction value from the external control apparatus that has been determined to be abnormal, so as to maintain the present condition, notifies the external control apparatus of the fact that an abnormality therein has been detected, and stores abnormality-occurrence history information in the main control circuit unit.

10. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 1,

wherein the monitoring control circuit unit performs communication with regard to input/output signals, of the second input sensor group and the second electric load group, which are part of input/output signals for the microprocessor, through the first serial communication circuit,

wherein the downlink communication information, which is transmitted from the main control circuit unit to the monitoring control circuit unit, includes setting constants or control outputs that are required by the monitoring control circuit unit, the answer information items for the question information items obtained from the immediately previous uplink communication information, a second flag information, and code check information,

wherein the uplink communication information, which is transmitted from the monitoring control circuit unit to the main control circuit unit, includes input signal information for the monitoring control circuit unit or the storage information for the setting constants or the control outputs obtained from the main control circuit unit, the present question information items, the first flag information, and the code check information,

wherein the first flag information changes at the timing when the contents of the question information items are updated in the monitoring control circuit unit, and serves as a single-bit or multi-bit recognition signal that reports the change in the question information, and

wherein the second flag information changes at the timing when the main control circuit unit updates the contents of the answer information items in response to an update of the contents of the question information items and serves as a single-bit or multi-bit recognition signal that reports the update of the answer information.

11. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 10,

wherein the monitoring control circuit unit is provided with a question information updating unit and a response delay determination unit,

wherein the question information updating unit recurrently transmits question information included in the uplink communication information in such a way that the question information is the same in a plurality times of communication instances, and after transmitting the question information for a predetermined duration or longer, updates the question information, and

wherein the response delay determination unit is a unit that determines that an abnormality exists in the main control circuit unit when the time between the timing when the monitoring control circuit unit changes the contents of the first flag information and the timing when the reception data of the second flag information changes exceeds a predetermined time.

12. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 11,

wherein the monitoring control circuit unit is provided with a code error detection unit and a reset processing unit,

wherein the code error detection unit detects the intrusion of bit information or the loss of bit information in the reception data in the downlink communication information, by use of a code check unit exemplified by the sum check or the CRC check, and

wherein the reset processing unit serves as a second abnormality processing unit that initializes and restarts the main control circuit unit, in response to the result of monitoring/tallying of the fact that the abnormality determination unit has determined that an abnormality exists in the main control circuit unit, the fact that the response delay determination unit has determined an answer delay, or the fact that the code error detection unit has detected an code error in the downlink communication information.

13. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 12,

wherein the monitoring control circuit unit includes auxiliary microprocessor, and the auxiliary non-volatile program memory and the auxiliary RAM memory that collaborate with the auxiliary microprocessor,

wherein the auxiliary non-volatile program memory includes control programs corresponding to a question information generation unit, a question information updating unit, an abnormality determination unit, a response delay determination unit, a code error determination unit for the downlink communication information, and the reset processing unit;

and in the auxiliary non-volatile program memory, there is also stored the correct-solution information items for the question information items, and

wherein the result of tallying in monitoring is written in the auxiliary RAM memory.

14. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 12 or 13,

wherein the nonvolatile program memory is provided with control programs corresponding to an erroneous-answer transmission unit and a tallied information monitoring unit;

the uplink communication information includes tallied information obtained through abnormality-monitoring by the monitoring control circuit unit;

the erroneous-answer transmission unit is a unit that intentionally generates erroneous-solution information items for the question information items and transmits the erroneous-solution information items, as the answer information items; and

the intentional transmission of an erroneous answer is performed by the erroneous-answer transmission unit at the timing when there exist some margins for the tallied value in the abnormality monitoring and the reset processing unit in the monitoring control circuit unit is not caused to output a reset output by only a one-time erroneous-answer response, and

wherein the tallied information monitoring unit is a unit in which, by monitoring the tallied information, the main control circuit unit counter-monitors whether or not the monitoring control circuit unit normally operates.

15. The in-vehicle electronic control apparatus having a monitoring control circuit, according to claim 14,

wherein the nonvolatile program memory incorporates control programs corresponding to a code error detection unit or a stored-information abnormality detection unit and a reset processing unit,

wherein the code error detection unit detects the intrusion of bit information or the loss of bit information in the reception data in the uplink communication information, by use of a code check unit exemplified by the sum check or the CRC check,

wherein the storage state of the setting information and the output information that have been received and stored, as part of the downlink communication information, by the monitoring control circuit unit and the acknowledgement information that has been received, as part of the uplink communication information, by the main control circuit unit are compared, in the main control circuit unit, by the stored-information abnormality detection unit so that it is determined whether or not an abnormality exists, and

wherein the reset processing unit serves as a third abnormality processing unit that initializes and restarts the monitoring control circuit unit, in response to the result of counter-monitoring/tallying of the fact that the code error detection unit has detected a code error in the uplink communication information, the fact that the stored-information abnormality detection unit has detected an abnormality in the stored information, or the fact that the tallied information obtained through the abnormality monitoring by the tallied information monitoring unit has been abnormal.