On-vehicle electronic control device

• US 7,251,551 B2
• Filed: 06/04/2004
• Issued: 07/31/2007
• Est. Priority Date: 09/24/2003
• Status: Active Grant

• Current Assignee: Mitsubishi Denki Kabushiki Kaisha (Mitsubishi Electric Corporation)
• Original Assignee: Mitsubishi Denki Kabushiki Kaisha (Mitsubishi Electric Corporation)
• Inventors: Hashimoto, Kohji, Nakamoto, Katsuya, Mitsueda, Hiroyuki
• Primary Examiner(s): Keith; Jack
• Assistant Examiner(s): NGUYEN, CHUONG P
• Application Number:
  US10/860,589
• Publication Number:
  US 20050085967A1
• Time in Patent Office: 1,152 Days
• Field of Search: 701/1, 701/29, 701/30, 701 33- 36, 701/102, 701/114, 701/115, 701/48, 714 10- 12, 714/23, 714/25, 714/30, 714/33, 714/31, 714/51, 714 52- 55
• US Class Current: 701/29
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/26 using computer, e.g. microprocessor
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit

Abstract

An on-vehicle electronic control device includes an auxiliary microprocessor and subjects a microprocessor allocated to a main part of control to an external diagnosis, thereby improving reliability of performance. A microprocessor including a nonvolatile program memory into which a control program is written is serially connected to an auxiliary microprocessor including an auxiliary nonvolatile program memory. The microprocessor and the auxiliary microprocessor function in cooperation to control on-vehicle electric load groups in response to input signals from on-vehicle sensor groups and on-vehicle analog sensor group. The nonvolatile program memory and the microprocessor are subjected to runaway monitoring performed by a watchdog timer and to an external checksum diagnosis performed periodically by the auxiliary microprocessor. If an anomaly occurs in the runaway monitoring, the external checksum diagnosis, and a checksum interval, parts of electric loads are cut off of power supply by load power relay.

Claims

1. An on-vehicle electronic control device, comprising:

a nonvolatile program memory;

a microprocessor which is connected to a first serial-parallel converter via a bus;

a concurrent control circuit which is serially connected to the microprocessor via the first serial-parallel converter and a second serial-parallel converter,

wherein the microprocessor and the concurrent control circuit function in cooperation to control an on-vehicle electric load group based on input signals from an on-vehicle sensor group and contents of the nonvolatile program memory;

characterized in that the on-vehicle electronic control device further comprises;

a watchdog timer into which a watchdog signal formed of a generated pulse train outputted by the microprocessor is inputted and which, when a pulse width of the watchdog signal is equal to or larger than a predetermined value, generates a reset pulse to reactivate the microprocessor;

a nonvolatile collation information storage means that is connected to the concurrent control circuit via a bus and previously stores predetermined checksum external collation data;

external checksum means for comparing current sum data that concerns data stored in the nonvolatile program memory and is transmitted to the concurrent control circuit from the microprocessor with the checksum external collation data that is previously stored in the collation information storage means, and generating an anomaly detection output when the current sum data does not coincide with the checksum external collation data;

interval monitoring means for generating the anomaly detection output when a time interval for execution by the external checksum means exceeds a predetermined time; and

load group stopping means for stopping a partial drive of the on-vehicle electric load group in response to the anomaly detection output from at least one of the external checksum means and the interval monitoring means.

2. An on-vehicle electronic control device according to claim 1, wherein the interval monitoring means includes:

a power detection circuit operative to output a pulse upon turning on power to the microprocessor and the concurrent control circuit; and

an interval monitoring timer that generates the anomaly detection output when an interval for clear signals supplied from the concurrent control circuit exceeds a predetermined time, and is reset by an output pulse from the power detection circuit.

3. An on-vehicle electronic control device according to claim 1, further comprising operation start confirmation means for enabling the interval monitoring means after the concurrent control circuit receives a permission signal for an external checksum from the microprocessor, and generating the anomaly detection output in a case where the permission signal for the external checksum cannot be received even if the predetermined time elapses after turning on power to the concurrent control circuit.

4. An on-vehicle electronic control device according to claim 1,

wherein the on-vehicle sensor group includes:

a first on-vehicle sensor group that is connected to the microprocessor;

a second on-vehicle sensor group that is connected to the concurrent control circuit; and

an analog sensor group for outputting analog signals,

wherein the on-vehicle electric load group includes;

a first on-vehicle electric load group that is connected to the microprocessor;

a second on-vehicle electric load group that is connected to the concurrent control circuit,

wherein the on-vehicle electronic control device further comprises;

a direct input interface circuit operative to connect the first on-vehicle sensor group to a data bus of the microprocessor;

an indirect input interface circuit operative to connect the second on-vehicle sensor group to a data bus of the concurrent control circuit;

a direct output interface circuit operative to connect the first on-vehicle electric load group to the data bus of the microprocessor;

an indirect output interface circuit operative to connect the second on-vehicle electric load group to the data bus of the concurrent control circuit; and

a multi-channel AD converter that is connected to the data bus of at least one of the microprocessor and the concurrent control circuit, and digitally converts analog input signals from the analog sensor group sequentially,

wherein the microprocessor and the concurrent control circuit functions in cooperation to control the first on-vehicle electric load group and the second on-vehicle electric load group in response to operations of the first on-vehicle sensor group, the second on-vehicle sensor group and the analog sensor group.

5. An on-vehicle electronic control device according to claim 1, further comprising:

a power detection circuit operative to output a pulse upon turning on power to the microprocessor and the concurrent control circuit;

an anomaly storage circuit that is driven by the anomaly detection output and the reset pulse generated by the watchdog timer, so as to generate an anomaly storage output, and reset into an initial condition by a generated pulse of the power detection circuit; and

anomaly processing means for stopping a partial drive of the on-vehicle electric load group in response to an operation of the anomaly storage circuit, the anomaly processing means including a gate electrode and an anomaly alarm/display device.

6. An on-vehicle electronic control device according to claim 5, wherein the anomaly storage circuit further comprises:

an OR circuit operative to calculate a logical sum between the anomaly detection output and the reset pulse of the watchdog timer; and

a counter that generates an anomaly storage output when the number of times of outputs from the OR circuit reaches a predetermined value, and is reset into an initial condition by an outputted pulse of the power detection circuit.

7. An on-vehicle electronic control device according to claim 5,

wherein the nonvolatile program memory includes a control program comprising internal checksum collation data and internal checksum means,

wherein the internal checksum collation data that includes one of a total addition value concerning data inside the nonvolatile program memory and the function value of the total additional value;

and

internal checksum means for detecting an anomaly by comparing between the total addition value concerning the data inside the nonvolatile program memory and the internal checksum collation data, the internal checksum means being operated by the microprocessor; and

wherein the anomaly storage circuit generates an anomaly storage output in response to the anomaly detection output generated by the internal checksum means.

8. An on-vehicle electronic control device according to claim 7,

wherein the nonvolatile program memory includes:

internal checksum collation data that includes one of a total addition value concerning data inside the nonvolatile program memory and the function value of the total additional value; and

internal checksum means for detecting an anomaly by comparing between the total addition value concerning the data inside the nonvolatile program memory and the internal checksum collation data, the internal checksum means being operated by the microprocessor; and

the counter counts an anomaly operation.

9. An on-vehicle electronic control device according to claim 7, wherein the external checksum means is operated after the internal checksum means judges that the contents of the nonvolatile program memory is normal, and is not operated when the internal checksum means detects the anomaly.

10. An on-vehicle electronic control device according to claim 7, wherein the external checksum means and the internal checksum means are operated in mutually different calculation cycles of the microprocessor;

wherein another control is intervened between the external checksum control and the internal checksum control.

11. An on-vehicle electronic control device according to claim 5, further comprising:

an upstream communication check means for performing a checksum for communication information transmitted from the concurrent control circuit to the microprocessor and response timeout check and generating the anomaly detection output, the upstream communication check means being operated by the microprocessor; and

a downstream communication check means for performing a checksum for communication information transmitted from the microprocessor to the concurrent control circuit and response timeout check and generating the anomaly detection output, the downstream communication check means being operated by the concurrent control circuit,

wherein the anomaly storage circuit generates an anomaly storage output in response to the anomaly detected by one of the upstream communication check means and the downstream communication check means.

12. An on-vehicle electronic control device according to claim 6, further comprising:

an upstream communication check means for performing a checksum for communication information transmitted from the concurrent control circuit to the microprocessor and response timeout check and generating the anomaly detection output, the upstream communication check means being operated by the microprocessor; and

a downstream communication check means for performing a checksum for communication information transmitted from the microprocessor to the concurrent control circuit and response timeout check and generating the anomaly detection output, the downstream communication check means being operated by the concurrent control circuit,

wherein the counter counts an anomaly operation.

13. An on-vehicle electronic control device according to claim 5,

wherein the concurrent control circuit includes:

an auxiliary nonvolatile program memory; and

an auxiliary microprocessor that Operates based on contents of the auxiliary nonvolatile program memory,

wherein the nonvolatile program memory includes a control program comprising;

runaway monitoring means for monitoring a watchdog signal formed of a generated pulse train from the auxiliary microprocessor and inputted into the microprocessor, and when a pulse width of the watchdog signal is equal to or larger than a predetermined value, causes the microprocessor to generate the reset pulse to reactivate the auxiliary microprocessor,

wherein the anomaly storage circuit generates an anomaly storage output in response to the reset pulse generated by the runaway monitoring means.

14. An on-vehicle electronic control device according to claim 6,

wherein the concurrent control circuit includes:

an auxiliary nonvolatile program memory; and

an auxiliary microprocessor that operates based on contents of the auxiliary nonvolatile program memory,

wherein the nonvolatile program memory includes a control program comprising;

runaway monitoring means for monitoring a watchdog signal formed of a generated pulse train from the auxiliary microprocessor and inputted into the microprocessor, and when a pulse width of the watchdog signal is equal to or larger than a predetermined value, causes the microprocessor to generate the reset pulse to reactivate the auxiliary microprocessor,

wherein the counter generates an anomaly storage output in response to the reset pulse generated by the runaway monitoring means.

15. An on-vehicle electronic control device according to claim 5,

wherein the concurrent control circuit includes:

an auxiliary nonvolatile program memory; and

an auxiliary microprocessor that operates based on contents of the auxiliary nonvolatile program memory,

the collation information storage means uses a partial region of the auxiliary nonvolatile program memory;

the checksum external collation data is stored in the partial region and includes a predetermined private cryptographic number;

the nonvolatile program memory includes a function conversion program; and

the function conversion program performs a function conversion on the total addition value concerning the data inside the nonvolatile program memory such that the current sum data transmitted from the microprocessor to the auxiliary microprocessor coincides with the private cryptographic number.

16. An on-vehicle electronic control device according to claim 12, wherein:

the auxiliary nonvolatile program memory includes;

data of a trial calculation formula for the microprocessor;

correct answer data for the trial calculation formula; and

a control program comprising a calculation check means executed by the auxiliary microprocessor;

the nonvolatile program memory includes a trial calculation execution program;

the data of the trial calculation formula is transmitted from the auxiliary microprocessor to the microprocessor;

the trial calculation execution program is executed by the microprocessor to return calculation result data based on the received data of the trial calculation formula to the auxiliary microprocessor; and

the calculation check means is executed by the auxiliary microprocessor to compare between the received calculation result data and the correct answer data for judgment, generate the anomaly detection output when the received calculation result data does not coincide the correct answer data, and cause the anomaly storage circuit to generate an anomaly storage output in response to the anomaly detection output.

17. An on-vehicle electronic control device according to claim 12, wherein:

the auxiliary nonvolatile program memory includes;

data of a trial calculation formula for the microprocessor;

correct answer data for the trial calculation formula; and

a control program comprising a calculation check means executed by the auxiliary microprocessor;

the nonvolatile program memory includes a trial calculation execution program;

the data of the trial calculation formula is transmitted from the auxiliary microprocessor to the microprocessor;

the trial calculation execution program is executed by the microprocessor to return calculation result data based on the received data of the trial calculation formula to the auxiliary microprocessor; and

the calculation check means is executed by the auxiliary microprocessor to compare between the received calculation result data and the correct answer data for judgment, generate the anomaly detection output when the received calculation result data does not coincide the correct answer data, and cause the counter to perform a counting operation in response to the anomaly detection output.