In-vehicle electronic control apparatus having monitoring control circuit

• US 7,912,600 B2
• Filed: 05/15/2008
• Issued: 03/22/2011
• Est. Priority Date: 11/26/2007
• Status: Active Grant

• Current Assignee: Mitsubishi Electric Corporation
• Original Assignee: Mitsubishi Electric Corporation
• Inventors: Ishii, Akihiro, Iwagami, Yuki, Tsunekazu, Shoso, Tanaka, Susumu, Hashimoto, Koji
• Primary Examiner(s): NGUYEN, TAN QUANG
• Application Number:
  US12/120,921
• Publication Number:
  US 20090134970A1
• Time in Patent Office: 1,041 Days
• Field of Search: 701/29, 701/31, 701/33, 701/35, 701/102, 340/3.2
• US Class Current: 701/29
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/26 using computer, e.g. microprocessor
• CPC Class Codes: F02D 41/28 Interface circuits
• CPC Class Codes: G05B 19/0421 Multiprocessor system

Abstract

An in-vehicle electronic control apparatus, having a monitoring control circuit, according to the present invention is configured in such a way that serial interface circuits 27a and 37a are connected between a main control circuit unit 20A and a monitoring control circuit unit 30A, high-speed full-duplex block communication is performed by use of a communication permission signal ALT and a communication synchronization signal CLK, the same question information included in uplink communication information UPD is recurrently transmitted in a plurality times of communication and updated after being transmitted a predetermined times, and the main control circuit unit 20A returns answer information by use of downlink communication information DND, within a predetermined duration after the update of the question information; because the question update period is prolonged, the control load on the main control circuit unit 20A is reduced.

Claims

1. An in-vehicle electronic control apparatus, having a monitoring control circuit, comprising:

a main control circuit unit including;

a non-volatile program memory;

a RAM memory for calculation processing;

a first input interface circuit to which a first input sensor group incorporating opening and closing sensors that operate at a variable frequency is connected;

a first output interface circuit to which a first electric load group incorporating loads that operate at a variable frequency is connected;

a microprocessor that controls the first electric load group, in response to contents of a control program stored in the non-volatile program memory and an operation status of the first input sensor group, and

a monitoring control circuit unit including;

a question information generation unit that is connected to the microprocessor through a pair of serial interface circuits, that performs communication with regard to input and output signals, of the second input sensor group and the second electric load group, which are part of input and output signals for the microprocessor, and that periodically and sequentially transmits question information items to the main control circuit unit;

a correct-information storage memory that stores correct information items for the question information items; and

an abnormality determination unit that compares answer information, based on the question information, from the main control circuit unit with the correct information stored in the correct-information storage memory so as to determine whether or not an abnormality exists in the main control circuit unit,

wherein the serial interface circuits are connected between the main control circuit unit and the monitoring control circuit unit, and configure a full-duplex block communication circuit in which multi-byte downlink communication information and uplink communication information are simultaneously transmitted and received based on a communication permission signal and a communication synchronization signal;

wherein the monitoring control circuit unit is provided with a question information updating unit;

wherein the downlink communication information is transmitted through downlink communication from the main control circuit unit to the monitoring control circuit unit and includes a setting constant or a control output that is required by the monitoring control circuit unit, answer information for the question information obtained from the immediately previous uplink communication information, and code check information;

wherein the uplink communication information is transmitted through uplink communication from the monitoring control circuit unit to the main control circuit unit and includes input signal information for the monitoring control circuit unit or storage information for the setting constant or the control output obtained from the main control circuit unit, present question information, and code check information;

wherein the communication permission signal is a signal that is periodically transmitted, through an independent control signal line, from the main control circuit unit to the monitoring control circuit unit and with which the main control circuit unit permits the monitoring control circuit unit to start the full-duplex block communication;

wherein the communication synchronization signal is transmitted, through an independent control signal line, from the monitoring control circuit unit to the main control circuit unit or from the main control circuit unit to the monitoring control circuit unit and has a train of pulses whose number corresponds to at least the number of communication-information bits;

wherein the question information updating unit recurrently transmits question information included in the uplink communication information in such a way that the question information becomes the same in a plurality times of communication, and after transmitting of the question information for a predetermined duration, updates the question information; and

wherein the main control circuit unit generates answer information for the question information before the predetermined duration elapses from the update of the question information.

2. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 1,

wherein the main control circuit unit includes a fuel injection control function, or an ignition coil control function, in which engine interruption control is performed in response to the operation of a crank angle sensor, and includes a direct memory access controller connected between the serial interface circuit and the RAM memory for calculation processing;

wherein the communication permission signal is a signal for periodically granting communication permission at an approximately constant frequency, and when the interruption control is implemented, maintains the present logic level and when the interruption control is cancelled, the operating state thereof is restored;

wherein, when the interruption control is implemented, the communication synchronization signal maintains the pulse-train generating state or the pulse-train halting state thereof; and

wherein the direct memory access controller is connected between a parallel input and output bus for a serial-parallel converter included in the serial interface circuit and a data bus for the microprocessor, and transmits data to and receives data from the RAM memory for calculation processing, without the intermediary of the microprocessor.

3. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 1,

wherein the number of bits in the uplink communication information is larger than the number of bits in the downlink communication information;

and

wherein the main control circuit unit and the monitoring control circuit unit each have an interrupted information processing unit in which, when the communication permission signal is interrupted before the downlink communication is completed, the interrupted downlink communication information and uplink communication information are rescinded, and when the communication permission signal is interrupted after the completion of the downlink communication and before the completion of the uplink communication, the downlink information is made effective, but the interrupted uplink communication information is rescinded.

4. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 1,

wherein the communication permission signal is an alternate signal whose logic level changes at a timing of communication permission;

each time the logic level of the alternate signal changes, the transmission start of a new communication block is permitted; and

when a constant logic level thereof is maintained, after communication of a predetermined bits is completed, the present communication ends, and when the logic level reverses before the completion of communication of the predetermined bits, interruption processing of communication data is performed.

5. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 1,

wherein the communication permission signal is a logic signal whose logic level becomes one of “

H” and

“

L”

during a communication permission period of time and the other during a non-permission period of time;

each time the logic level of the logic signal thereof changes over to the one of logic levels, the transmission start of a new communication block is permitted; and

when a constant logic level is maintained, after communication of a predetermined bits is completed, the present communication ends, and when the logic level reverses to the other of the logic levels before the completion of communication of the predetermined bits, interruption processing of communication data is performed.

6. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 1,

wherein the communication synchronization signal is a pulse train signal the generation of which is started after the elapse of a predetermined waiting time from the timing when the monitoring control circuit unit has received the communication permission signal, or after the elapse of a predetermined waiting time from the timing when the main control circuit unit has generated the communication permission signal, and after the occurrence of which, a serial communication signal starts to travel in a stepping manner;

and

wherein generation of pulses in the communication synchronization signal is stopped after a train of pulses of a predetermined number corresponding to the number of transmission and reception bits has been generated, or even after a train of pulses of the predetermined number has been generated, generation of pulses is continued, the generation of pulses is temporarily stopped when the next communication permission signal is generated, and then generation of pulses is resumed after the elapse of the waiting time, and in the case where the next communication permission signal is generated before the predetermined number of pulses have been generated, the generation of the remaining pulses is omitted and after the elapse of the waiting time, generation of pulses is resumed.

7. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 6,

wherein the monitoring control circuit unit includes a multichannel AD converter and a second input interface circuit for the second input sensor group incorporating an analogue sensor and transmits a digitally converted value of the analogue signal to the main control circuit unit, by way of the serial interface circuits;

wherein the monitoring control circuit unit issues an AD conversion start command to the multichannel AD converter, in response to the reception of the communication permission signal; and

wherein the monitoring control circuit unit or the main control circuit unit starts generation of the communication synchronization signal at the timing of the reception of an AD conversion completion signal from the multichannel AD converter, or at the timing when the time required for all-channel AD conversion has elapsed, or after such a delay time as the AD conversion has been completed before transmission of the AD converted input signals is started.

8. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 1,

wherein the uplink communication information includes first flag information, and the downlink communication information includes second flag information;

wherein the first flag information changes at the timing when the contents of the question information is updated in the monitoring control circuit unit, and serves as a single-bit or multi-bit recognition signal that notifies of the change in the question information; and

wherein the second flag information changes at the timing when the main control circuit unit updates the contents of the answer information, in response to an update of the contents of the question information, and serves as a single-bit or multi-bit recognition signal that notifies of the update of the answer information.

9. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 8,

wherein the monitoring control circuit unit is provided with a response delay determination unit that determines that an abnormality exists in the main control circuit unit, when the time between the timing when the monitoring control circuit unit changes the contents of the first flag information and the timing when the reception data of the second flag information changes exceeds a predetermined time.

10. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 9,

wherein the monitoring control circuit unit is provided with a code error detection unit and a reset processing unit;

wherein the code error detection unit detects an intrusion of bit information or a loss of bit information in the reception data of the downlink communication information, by use of a code check unit exemplified by the sum check or the CRC check; and

wherein the reset processing unit initializes and restarts the main control circuit unit, in response to the result of monitoring and tallying of at least of one of the fact that the abnormality determination unit has determined an answer abnormality, the fact that the response delay determination unit has determined an answer delay, and the fact that the code error detection unit has detected an code error in the downlink communication information.

11. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 10,

wherein the monitoring control circuit unit includes an auxiliary microprocessor, and an auxiliary non-volatile program memory and an auxiliary RAM memory that collaborate with the auxiliary microprocessor;

wherein the auxiliary non-volatile program memory includes a control program corresponding to the abnormality determination unit, the response delay determination unit, the code error determination unit for the downlink communication information, and the reset processing unit, and stores correct-solution information for the question information; and

wherein the result of the monitoring and tallying is written in the auxiliary RAM memory.

12. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 1,

wherein the downlink communication information includes the first tag information, and the uplink communication information includes the second tag information;

wherein the program memory is provided with a control program corresponding to a tag abnormality determination unit;

wherein the first tag information is numerical data that is determined by the main control circuit unit and whose content changes each time the communication permission signal is generated, and the second tag information is numerical data, equal to the first tag information, that, in the next transmission, is returned as the second tag information by the monitoring control circuit unit that has received the first tag information; and

wherein the tag abnormality determination unit is a counter-monitoring unit in which the main control circuit unit determines whether or not the second tag information that is currently received from the monitoring control circuit unit and the immediately previous first tag information that has been transmitted by the main control circuit unit coincide with each other, and in the case where the tag information items do not coincide with each other, or in the case where the second tag information that coincides with the immediately previous first tag information is not obtained within a predetermined time, it is determined that an abnormality exists in the monitoring control circuit unit.

13. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 12,

wherein the program memory is further provided with a control program corresponding to an erroneous-answer transmission unit and a tallied information monitoring unit;

wherein the uplink communication information includes tallied information obtained through abnormality-monitoring by the monitoring control circuit unit;

wherein the erroneous-answer transmission unit is a unit that intentionally transmits erroneous-solution information, as the answer information for the question information;

wherein the intentional transmission of an erroneous answer is performed at the timing when there exist some margins for the tallied value in the abnormality monitoring and the reset processing unit in the monitoring control circuit unit is not caused to output a reset output by only a one-time transmission of the erroneous-answer; and

wherein the tallied information monitoring unit is a unit in which, by monitoring the tallied information, the main control circuit unit counter-monitors whether or not the monitoring control circuit unit normally operates.

14. The in-vehicle electronic control apparatus, having a monitoring control circuit, according to claim 13,

wherein the program memory further includes a control program corresponding to the code error detection unit or a stored-information abnormality determination unit and the reset processing unit;

wherein the code error detection unit detects an intrusion of bit information or a loss of bit information in the reception data of the uplink communication information, by use of a code check unit exemplified by the sum check or the CRC check;

wherein the storage state of setting information and output information that have been received and stored, as part of the downlink communication information, by the monitoring control circuit unit and the acknowledgement information that has been received, as part of the uplink communication information, by the main control circuit unit are compared, in the main control circuit unit, by the stored-information abnormality determination unit so that whether or not an abnormality exists is determined; and

wherein the reset processing unit initializes and restarts the monitoring control circuit unit, in response to the result of counter-monitoring and tallying of at least one of the fact that the code error detection unit has detected a code error in the uplink communication information, the fact that the stored-information abnormality determination unit has detected an abnormality in the stored information, the fact that the tag abnormality determination unit has determined that the tag information items do not coincide with each other delayed, and the fact that the tallied information obtained through the abnormality monitoring by the tallied information monitoring unit has been abnormal.