In-vehicle electronic control apparatus having monitoring control circuit

• US 8,712,635 B2
• Filed: 12/19/2008
• Issued: 04/29/2014
• Est. Priority Date: 06/13/2008
• Status: Active Grant

• Current Assignee: Mitsubishi Electric Corporation
• Original Assignee: Mitsubishi Electric Corporation
• Inventors: Hashimoto, Koji
• Primary Examiner(s): Tran, Khoi
• Assistant Examiner(s): Kiswanto, Nicholas
• Application Number:
  US12/339,352
• Publication Number:
  US 20090312898A1
• Time in Patent Office: 1,957 Days
• Field of Search: 701/36
• US Class Current: 701/36
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24042 Signature analysis, compare recorded with current data, if error then alarm
• CPC Class Codes: G05B 2219/24195 Compare data in channels at timed intervals, for equality
• CPC Class Codes: G05B 2219/2637 Vehicle, car, auto, wheelchair

Abstract

A main control circuit unit 20A and a monitoring control circuit unit 30A are connected in series; the main control circuit unit 20A and an external control apparatus 40 are connected in series. When the monitoring control circuit unit 30A generates concurrent question information, the main control circuit unit 20A generates main-machine answer information A1n, and the external control apparatus 40 generates supplementary-apparatus answer information. The main control circuit unit 20A combines these answer information items and transmits the combined answer information items to the monitoring control circuit unit 30A; the monitoring control circuit unit 30A compares the combined answer information items with synthesis correct-solution information items stored in a correct-solution information storage memory 35A so as to perform a total abnormality determination. The main control circuit unit 20A performs an abnormality determination on the external control apparatus 40, based on correct-solution information for the external control apparatus 40; the main control circuit unit 20A generates synthesis answer information by use of the correct-solution information.

Claims

1. An in-vehicle electronic control apparatus, having a monitoring control circuit, comprising:

a main control circuit unit including;

a nonvolatile program memory storing a control program;

a RAM memory which stores calculation processing;

a first input interface circuit to which a first input sensor group is connected;

a first output interface circuit to which a first electric load group is connected; and

a microprocessor that controls the first electric load group, in response to contents of the control program and an operation status of the first input sensor group, and

a monitoring control circuit unit including;

a question information generation unit that is connected through a first serial communication circuit to the microprocessor and that sequentially and selectively transmits a plurality of question information items to the microprocessor;

a correct-solution information storage memory that stores correct-solution information items that correspond to the question information items; and

an abnormality determination unit which determines whether an abnormality in the main control circuit unit exists by comparing answer information that is received from the microprocessor and that is provided in response to the question information items with the stored correct-solution information,

wherein the main control circuit unit is connected to an external control apparatus through a second communication circuit,

wherein the main control circuit unit receives control signals from the external control apparatus and transmits the control signals to the external control apparatus,

wherein the external control apparatus is provided with collaborating supplementary apparatuses including;

supplementary-apparatus memories, each storing a control program that generates answer information items in response to the plurality of question information items transmitted from the main control circuit unit, where said answer information is transmitted to the main control circuit unit as supplementary-apparatus answer information, and

supplementary-apparatus microprocessors that collaborate with supplementary-apparatus program memories and executes the control program stored in the supplementary-apparatus program memories,

wherein, the question information generation unit generates concurrent question information items that are applied to the main control circuit unit and all the external control apparatuses or discrete question information items that are discretely applied to the main control circuit unit and the external control apparatuses;

wherein the concurrent question information or the discrete question information items are transmitted from the monitoring control circuit unit to the main control circuit unit and transmitted from the monitoring control circuit unit to the external control apparatuses via the main control circuit unit,

wherein the nonvolatile program memory includes a control program which constitutes a main-machine answer generation unit that generates main-machine answer information in accordance with the concurrent question information or the discrete question information items and a control program corresponding to a transmission answer edition unit,

wherein the transmission answer edition unit edits the main machine answer information and the supplementary-apparatus answer information and transmits, as answer information, synthesis correct-solution information, the main-machine answer information, or the supplementary-apparatus answer information corresponding to the synthesis correct-solution information, the main-machine answer information, or the supplementary-apparatus answer information included in the monitoring control circuit unit to the monitoring control circuit unit,

wherein, in the correct-solution information storage memory, there is stored main-machine correct-solution information items with regard to main-machine answer information generated by the main control circuit unit and/or synthesis correct-solution information obtained by combining and tallying the main-machine correct-solution information and the supplementary-apparatus correct-solution information items for the supplementary-apparatus answer information items,

wherein the supplementary-apparatus correct-solution information items are stored in the correct-solution information storage memory or in the nonvolatile program memory,

wherein the abnormality determination unit monitors an abnormality in the main control circuit unit, based at least on concurrent question information items generated by the monitoring control circuit unit or discrete question information items, and

wherein the main control circuit unit and the monitoring control circuit unit collaborate with each other so as to monitor and discriminate an abnormality in the external control apparatus.

2. The in-vehicle electronic control apparatus according to claim 1,

wherein, the nonvolatile program memory stores a control program as an external-apparatus monitoring unit and a corrected answer generation unit,

wherein the nonvolatile program memory further stores a supplementary-apparatus correct-solution information items with regard to the supplementary-apparatus answer information items,

wherein the monitoring control circuit unit is provided with a total abnormality determination unit,

wherein, the correct-solution information storage memory stores the synthesis correct-solution information,

wherein the external-apparatus monitoring unit compares the supplementary-apparatus correct-solution information items with the supplementary-apparatus answer information items so as to determine whether or not an abnormality exists in the external control apparatus,

wherein, in response to the concurrent question information items generated by the monitoring control circuit unit, the corrected answer generation unit firstly generates synthesis answer information by combining main-machine answer information generated by the main control circuit unit and supplementary-apparatus answer information items generated by the external control apparatus and transmits the synthesis answer information items to the monitoring control circuit unit;

and

wherein, if the supplementary apparatus answer information items are abnormal, the corrected answer generation unit serves as a transmission answer edition unit that combines the supplementary-apparatus correct-solution information items with regard to the supplementary-apparatus answer information items, in place of the supplementary-apparatus answer information items, and

wherein the total abnormality determination unit serves as an abnormality determination unit that compares the synthesis correct-solution information corresponding to concurrent question information generated by the monitoring control circuit unit with synthesis answer information received from the main control circuit unit so as to perform a total abnormality determination including a determination whether or not there exists an abnormality in the main control circuit unit itself and a determination whether or not the main control circuit unit monitors an abnormality in the external control apparatus.

3. The in-vehicle electronic control apparatus according to claim 1,

wherein the nonvolatile program memory comprises a control program as a circulation answer generation unit,

wherein the monitoring control circuit unit comprises an external apparatus abnormality notification unit and an abnormality determination unit,

wherein the abnormality determination unit comprises a synthesis abnormality determination unit and a discrete abnormality determination unit,

wherein, the correct-solution information storage memory stores main-machine correct-solution information with regard to the main control circuit unit, supplementary-apparatus correct-solution information items with regard to the external control apparatuses, and synthesis correct-solution information obtained by combining the main-machine correct-solution information and the supplementary-apparatus correct-solution information items,

wherein the circulation answer generation unit serves as a transmission answer edition unit that firstly generates, in response to concurrent question information items generated by the monitoring control circuit unit, synthesis answer information by combining main-machine answer information generated by the main control circuit unit and supplementary-apparatus answer information items generated by the external control apparatuses and transmits the synthesis answer information to the monitoring control circuit unit,

wherein, if the synthesis answer information items transmitted from the main control circuit unit and the synthesis correct-solution information items match , the monitoring control circuit unit continues to transmit the concurrent question information items having different contents;

and

wherein if the synthesis answer information and the synthesis correct-solution information do not match, a circulation question flag is set, and after the circulation question flag is set, the discrete question information items are sequentially transmitted to the main control circuit unit and the external control apparatuses; and

wherein if the concurrent question information items are transmitted again and the synthesis answer information and the synthesis correct-solution information match, the circulation question flag is reset, and

wherein if the synthesis answer information and the synthesis correct-solution information do not match, the circulation question flag is kept set,

wherein the circulation answer generation unit is a transmission answer edition unit that first generates, in response to concurrent question information generated by the monitoring control circuit unit, synthesis answer information by combining main-machine answer information generated by the main control circuit unit and supplementary-apparatus answer information items generated by the external control apparatuses and transmits the synthesis answer information to the monitoring control circuit unit, and that transmits answer information corresponding to the received discrete question information or the concurrent question information to the monitoring control circuit unit, when the circulation question flag is set,

wherein the discrete abnormality determination unit compares the main-machine answer information based on the discrete question information items with the main-machine correct-solution information and compares the supplementary-apparatus answer information items with the supplementary-apparatus correct-solution information items so as to discretely determine whether or not an abnormality exists in the main control circuit unit or in the external control apparatuses, and

wherein, when an abnormality in the external control apparatus is detected by the discrete abnormality determination unit, the external apparatus abnormality notification unit notifies the main control circuit unit of the occurrence of the abnormality.

4. The in-vehicle electronic control apparatus according to claim 3,

wherein the discrete question information items are each question information to be transmitted to the main control circuit unit or any one of the collaborating supplementary apparatuses in the external control apparatus, and

wherein the main control circuit unit transmits to the monitoring control circuit unit one of the main-machine answer information and supplementary-apparatus answer information based on the discrete question information items.

5. The in-vehicle electronic control apparatus according to claim 3,

wherein the discrete question information items are concurrently transmitted to the main control circuit unit and the external control apparatus;

wherein the main control circuit unit and some of the collaborating supplementary apparatuses in the external control apparatus to which the discrete question information items do not apply, do not reply to the monitoring control circuit unit, or the main control circuit unit eliminates the main-machine answer information or the supplementary-apparatus answer information items that do not apply to the main control circuit unit and the external;

control apparatus.

6. The in-vehicle electronic control apparatus according to claim 1,

wherein, the nonvolatile program memory, stores a control programs that serves as an external-apparatus monitoring unit and a selection answer generation unit, supplementary-apparatus correct-solution information items with regard to the supplementary-apparatus answer information items,

wherein the monitoring control circuit unit further comprises an abnormality analysis determination unit,

wherein, main-machine correct-solution information and synthesis correct-solution information are stored in the correct-solution information storage memory,

wherein the external-apparatus monitoring unit compares the supplementary-apparatus correct-solution information items with the supplementary-apparatus answer information items to determine whether or not an abnormality exists in the external control apparatus,

wherein the selection answer generation unit firstly transmits the synthesis answer information by combining the main-machine answer information generated by the main control circuit unit and the supplementary-apparatus answer information items generated by the external control apparatuses to the monitoring control circuit unit, and

wherein, if the supplementary-apparatus answer information is abnormal, the selection answer generation unit transmits the main-machine answer information, instead of synthesis answer information, to the monitoring control circuit unit, and

wherein, if any one of the synthesis answer information and the main-machine answer information, i.e., the present answer information items match the synthesis correct-solution information, the abnormality analysis determination unit serves as an abnormality determination unit that determines that the main control circuit unit and the external control apparatus are normal, and

wherein, if the present answer information do not match the synthesis correct-solution information but the main-machine correct-solution information match the synthesis correct-solution information, the abnormality analysis determination unit serves as an abnormality determination unit that determines that the main control circuit is normal but the external control apparatus is abnormal,

wherein, if the present answer information do not match the synthesis correct-solution information and the main-machine correct-solution information do not match the synthesis correct-solution information, the abnormality analysis determination unit serves as an abnormality determination unit that determines that the main control circuit is abnormal.

7. The in-vehicle electronic control apparatus according to claim 2 or 3 or 6,

wherein each of the question information items is a control program that corresponds to at least one of calculation expressions that are utilized in the microprocessor and the supplementary-apparatus microprocessors in the external control apparatus or a program the content of which is the same as that of the control program which is each of the question information items;

the question information items designate copy programs stored in different addresses of the program memories, as test programs, and designate input constant table numbers corresponding to input data items utilized in the test programs; and

the actual numerical values of the input constant tables are stored in the nonvolatile program memory and the supplementary-apparatus program memories in the external control apparatus,

wherein the main control circuit unit generates main-machine answer information, based on the calculation expression and the input constants designated by the question information items, and

wherein the external control apparatus transmits the calculation result based on the calculation expression and the input constant designated by the question information items, as the supplementary-apparatus answer information, to the main control circuit unit.

8. The in-vehicle electronic control apparatus according to claim 7,

wherein the in-vehicle electronic control apparatus is an engine control apparatus,

wherein the first input sensor group includes at least an accelerator position sensor for detecting the accelerator-pedal depressing level, a throttle position sensor for detecting an opening degree of an air-intake valve, an airflow sensor for measuring the air intake amount of the engine, and an engine rotation sensor for calculating the engine rotation speed,

wherein the first electric load group includes at least a motor for controlling the valve opening degree of an air-intake throttle and a fuel-injection electromagnetic valve,

wherein the test program in the main control circuit unit is a control program for calculating a throttle-valve-opening-degree increase/decrease target correction value corresponding to an engine-output-torque increase/decrease demand correction value required by the external control apparatus, and

wherein the external control apparatus includes any one of:

a transmission control unit that switches the transmission stage of a transmission in response to a vehicle speed and an accelerator position sensor,

an electric power steering system that responds to the operation of a steering wheel,

a stability control unit for controlling a vehicle posture, and

an antilock brake system that responds to a foot brake pedal; and

wherein the external control apparatus transmits the engine-torque increase/decrease demand correction value to the main control circuit unit, via the second serial communication circuits; and

the test program in the external control apparatus is a control program for calculating the engine-torque increase/decrease demand correction value in response to an input signal to the external control apparatus.

9. The in-vehicle electronic control apparatus according to claim 8,

wherein the nonvolatile program memory further stores a control program corresponding to an external apparatus abnormality processing unit;

wherein the external apparatus abnormality processing unit is a first abnormality processing unit that operates based on discrete abnormality determination information items related to the external control apparatus, transmitted to the main control circuit unit through the discrete abnormality determination unit and the external apparatus abnormality notification unit in the monitoring control circuit unit, or that operates based on discrete abnormality determination information, on the external control apparatus, through the external-apparatus monitoring unit in the main control circuit unit; and

the external apparatus abnormality processing unit does not respond at least to an increase demand out of engine-output-torque increase/decrease demand correction value from the external control apparatus that has been determined to be abnormal, so as to maintain the present condition, notifies the external control apparatus of the fact that an abnormality therein has been detected, and stores abnormality-occurrence history information in the main control circuit unit.

10. The in-vehicle electronic control apparatus according to claim 1,

wherein the monitoring control circuit unit performs communication with regard to input/output signals, of the second input sensor group and the second electric load group, which are part of input/output signals for the microprocessor, through the first serial communication circuit,

wherein the downlink communication information, which is transmitted from the main control circuit unit to the monitoring control circuit unit, includes setting constants or control outputs that are required by the monitoring control circuit unit, the answer information items for the question information items obtained from the immediately previous uplink communication information, a second flag information, and code check information,

wherein the uplink communication information, which is transmitted from the monitoring control circuit unit to the main control circuit unit, includes input signal information for the monitoring control circuit unit or storage information for the setting constants or the control outputs obtained from the main control circuit unit, present question information items, the first flag information, and the code check information,

wherein the first flag information changes at the timing when the contents of the question information items are updated in the monitoring control circuit unit, and serves as a single-bit or multi-bit recognition signal that reports the change in the question information items, and

wherein the second flag information changes at the timing when the main control circuit unit updates the contents of the answer information in response to an update of the contents of the question information items and serves as a single-bit or multi-bit recognition signal that reports the update of the answer information.

11. The in-vehicle electronic control apparatus according to claim 10,

wherein the monitoring control circuit unit comprises a question information updating unit and a response delay determination unit,

wherein the question information updating unit recurrently transmits question information items included in the uplink communication information in such a way that the question information items are the same in a plurality of communication instances,

wherein after transmitting the question information items for a predetermined duration or longer, the question information updating unit updates the question information, and

wherein the response delay determination unit determines that an abnormality exists in the main control circuit unit when the time between the timing when the monitoring control circuit unit changes the contents of the first flag information and the timing when the reception data of the second flag information changes exceeds a predetermined time.

12. The in-vehicle electronic control apparatus according to claim 11,

wherein the monitoring control circuit unit is provided with a code error detection unit and a reset processing unit,

wherein the code error detection unit detects the intrusion of bit information or the loss of bit information in the reception data in the downlink communication information, by use of a code check unit exemplified by the sum check or the CRC check, and

wherein the reset processing unit serves as a second abnormality processing unit that initializes and restarts the main control circuit unit, in response to the result of monitoring/tallying at least one value obtained from:

the abnormality determinations unit determining that an abnormality exists in the main control circuit unit,

the response delay determination unit determining an answer delay, or

the code error detection unit detecting an code error in the downlink communication information.

13. The in-vehicle electronic control apparatus according to claim 12,

wherein the monitoring control circuit unit comprises an auxiliary microprocessor, an auxiliary non-volatile program memory, and an auxiliary RAM memory that collaborate with the auxiliary microprocessor,

wherein the auxiliary non-volatile program memory includes auxiliary control programs corresponding to a question information generation unit, a question information updating unit, an abnormality determination unit, a response delay determination unit, a code error determination unit for the downlink communication information, and the reset processing unit,

wherein the auxiliary non-volatile program memory stores the correct-solution information items for the question information items, and

wherein the result of tallying in monitoring is stored to the auxiliary RAM memory.

14. The in-vehicle electronic control apparatus according to claim 12 or 13,

wherein the nonvolatile program memory stores a control program as an erroneous-answer transmission unit and a tallied information monitoring unit;

wherein the uplink communication information includes tallied information obtained through abnormality-monitoring by the monitoring control circuit unit;

wherein the erroneous-answer transmission unit serves as a unit that intentionally generates erroneous-solution information items for the question information items and transmits the erroneous-solution information items, as the answer information items;

where the transmitting is at a timing when there exist some margins for the tallied value in the abnormality monitoring and the reset processing unit in the monitoring control circuit unit such that the monitoring control circuit unit is not caused to output a reset output by only one erroneous-answer response, and

wherein the tallied information monitoring unit serves as a unit that monitors the tallied information, the main control circuit unit counter-monitors whether or not the monitoring control circuit unit normally operates.

15. The in-vehicle electronic control apparatus according to claim 14,

wherein the nonvolatile program memory stores a control program serves as a code error detection unit or a stored-information abnormality detection unit and a reset processing unit,

wherein the code error detection unit detects intrusion of bit information or the loss of bit information in the reception data in the uplink communication information, by use of a code check unit exemplified by the sum check or the CRC check,

wherein state of setting information and output information that are received and stored as part of the downlink communication information, by the monitoring control circuit unit, and

wherein the acknowledgement information is received, as part of the uplink communication information, by the main control circuit unit,

wherein the setting information and output information are compared with the acknowledgement information, in the main control circuit unit determining whether or not the abnormality exists, and

wherein the reset processing unit serves as a third abnormality processing unit that initializes and restarts the monitoring control circuit unit, in response to the result of counter-monitoring/tallying a code error detected in the uplink communication information, an abnormality detected in the stored information, or the tallied information obtained through the abnormality monitoring by the tallied information monitoring unit is abnormal.