JPH0514281B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a safety control method and device for a vehicle control device such as an anti-skid control device using a microcomputer.

[Conventional technology]

An anti-skid control device for an automobile is equipped with a microcomputer, and the microcomputer executes input, calculation, and output according to a predetermined control program, but a runaway state occurs for some reason during the execution of the control program. Sometimes. When the microcomputer goes out of control, the program run signal, that is, the operation pulse, which is periodically output from the microcomputer to the runaway detection circuit, is stopped.
The runaway detection circuit detects the runaway and outputs a reset signal to the microcomputer, and the microcomputer that receives the reset signal automatically returns to the initial state and starts processing from the beginning of the control program.

Here, in order to accurately detect abnormalities in computer program operation, in a control system using an electronic computer, it is necessary to confirm in advance that the runaway detection circuit operates normally, and then to control the controlled device. An abnormality monitoring method for starting a control program has been disclosed (Japanese Patent Application Laid-open No. 56740/1983).

[Problem to be solved by the invention]

However, in the conventional abnormality monitoring method described above,
Since the control program is started after confirming the normal operation of the runaway detection circuit, erroneous control due to runaway of the microcomputer can be prevented. If a substantive processing abnormality related to control content occurs,
There is a problem in that the abnormality cannot be detected and sufficient countermeasures cannot be taken. That is, for example, when a control signal is output from a microcomputer and the control signal is affected by noise, a situation may occur where the control signal and the drive signal do not match. If such an abnormality occurs in the substantive processing related to the control content for the controlled device, it becomes impossible to perform desired control on the controlled device.

The present invention has been made in view of the above points, and improves the safety of automobiles by performing stricter safety control on the control device in a vehicle control device such as an anti-skid control device without complicating its configuration. An object of the present invention is to provide a safety control method and device for a vehicle control device that can further improve performance.

[Means to solve the problem]

In order to achieve the above object, the first invention of the present application:
A sensor that detects the state of the vehicle and outputs a state detection signal, and a microcomputer that inputs, processes, and outputs the state detection signal according to a predetermined control program, and outputs an operation pulse signal at predetermined intervals. , a control device having an output circuit that outputs a drive signal according to a control signal output from the microcomputer, and a runaway detection circuit that monitors the program operation of the microcomputer based on the operation pulse signal; and a controlled part driven by a drive signal output from the circuit, and if an operation pulse signal is not input from the microcomputer to the runaway detection circuit for a predetermined time after power is turned on, the runaway detection circuit will issue a reset pulse. In the safety control method for a vehicle control device that outputs and resets at least the microcomputer, in the microcomputer, (a) prior to execution of the control program, the operation pulse signal is outputted until at least the predetermined time elapses; (b) If a reset pulse is not input from the runaway detection circuit during the output stop period of this operation pulse signal, it is assumed that the runaway detection circuit is abnormal and safety processing is performed, (c) The above When the reset pulse is input due to the normal operation of the runaway detection circuit during the output stop period, the execution of the control program is started, and (d) the actual control of the microcomputer and the output circuit is performed in the control program. (e) If it is determined that the substantive process is abnormal, the output of the operation pulse signal is intentionally stopped until at least the predetermined time has elapsed, and normal operation is resumed. The gist of the invention is a safety control method for a vehicle control device, characterized in that a reset pulse is output from the confirmed runaway detection circuit. A sensor that outputs a detection signal, a microcomputer that inputs, processes, and outputs the state detection signal according to a predetermined control program, and outputs an operating pulse signal at predetermined intervals; a control device having an output circuit that outputs a drive signal according to the control signal generated by the control signal; and a runaway detection circuit that monitors the program operation of the microcomputer based on the operation pulse signal; and a drive signal output from the output circuit. and a controlled part driven by a control unit, and if the operation pulse signal is not inputted from the microcomputer to the runaway detection circuit for a predetermined period of time after power is turned on, the runaway detection circuit outputs a reset pulse to at least control the microcomputer. In a safety control device for a vehicle control device that resets a computer, a stop means for stopping the output of the operation pulse signal until at least the predetermined time elapses prior to execution of the control program; and stopping the output of the operation pulse signal. If a reset pulse is not input from the runaway detection circuit during this period, it is assumed that there is an abnormality in the runaway detection circuit and safety processing is carried out. During the output stop period, the runaway detection circuit operates normally, and the a starting means for starting execution of the control program when a reset pulse is input; a determining means for determining an abnormality in the substantive processing of the microcomputer and the output circuit when the control program is executed; and instructing means for activating the stopping means and outputting a reset pulse from the runaway detection circuit, which is confirmed to operate normally, when the determining means determines that the substantive processing is abnormal. The gist of this paper is a safety control system for a vehicle control system that is characterized by:

FIG. 1 shows a block diagram of an anti-skid control system which is an application example of the present invention.

1 represents a control device including a microcomputer 2. 2 is a microcomputer (hereinafter referred to as CPU)
It is abbreviated as. ), and the CPU 2 inputs vehicle wheel speed signals and braking detection signals according to a predetermined control program, performs calculations using these signals as input data, and outputs brake hydraulic control signals, etc. as the results of the calculations. I do. In addition, the control device 1 includes a shaping/amplifying circuit 3 that shapes and amplifies the AC voltage signal having a frequency proportional to the wheel speed from the wheel speed sensor 11 and sends it to the interrupt port _I1 of the CPU 2, and a stop lamp switch 12. A buffer circuit 4 inputs braking detection signals from braking detection means such as the like and detection signals from other vehicle status sensor 13 and sends them to input port _I2 of CPU2, and brake hydraulic control output from output port _{O1 of} CPU2. A brake oil pressure control actuator drive circuit 5 that inputs a signal, that is, a brake release signal, and sends a brake oil pressure control actuator drive signal to the brake oil pressure control actuator 8 (controlled part).
(corresponding to the output circuit referred to in the present invention). In the case of a four-wheeled vehicle, the wheel speed sensor 11 is composed of three sensors that individually output pulse signals indicating the wheel speeds of the front left and right wheels and the rear wheel, and the stop lamp switch 12 indicates the braking operation when the brake pedal is operated. It is connected to send signals to the control device 1 . Reference numeral 8 denotes a brake hydraulic pressure control actuator that controls the brake hydraulic system, and receives a drive signal from the brake hydraulic control actuator drive circuit 5 in the control device 1 to control the brake hydraulic pressure applied to the brake device for each wheel. It has a structure that controls the braking force. 9 is the ignition switch of the vehicle; 7 is a reset circuit that sends a reset signal to the reset input terminal I _R of the CPU 2 when the ignition switch 9 is turned on, that is, when the power is turned on; and 10 is a runaway detection circuit in the CPU 2. 6 is an alarm device that receives an alarm signal from the CPU 2 and displays a lamp, generates an alarm sound, etc. when an abnormality is determined.

6 is a runaway detection circuit that detects when the program of the CPU 2 runs out of control or stops due to disturbances such as noise, and applies a reset signal to the CPU 2. As shown in Figure 2, the charge/discharge circuit The operating pulse signal S1 output from the output port _O2 of the CPU2 is input to the S terminal of the flip-flop FF1 via the noise absorbing capacitor C1, and this signal S1 is the oscillation period of this circuit.
If no input is received within T ₂ , the runaway detection circuit 6
causes self-oscillation and outputs a reset signal S6 to the CPU ₂ every time T2. That is, output terminal O ₂
A capacitor C1, an RS flip-flop FF1, and a transistor Tr1 are connected to the input circuit for the operating pulse signal S1 from the operating pulse signal S1.
When not input, the circuit that performs self-oscillation includes a time constant circuit formed by resistors R1 and R2 and a capacitor C2, and a comparator 1CO and a comparator 2 to which charging reference potential and discharging reference potential are respectively input.
A CO, RS flip-flop FF2, and a transistor Tr2 which outputs a reset pulse signal S6 with a period _T2 to an input terminal _IR of the CPU2 are connected.

Next, anti-skid control including the operation of the runaway detection circuit and its self-check operation will be explained with reference to the flowcharts of FIGS. 4 and 5.

The control program of the CPU 2 of the control device 1 is started from the start address at step 100, and first, at step 101, the interrupt routine (input of wheel speed signal) from step 400 is prohibited, and at step 102, fail-safe processing is performed to prohibit brake release control. After performing this, the program proceeds to a determination step 103, where it is determined whether or not it is time to turn on the starter switch 9. This determination can be made by writing a specific code into the RAM of the CPU 2 after turning on the starter switch 9, and checking the presence or absence of this code. If the starter switch 9 is turned on, the determination is ``YES'', and the process then proceeds to step 104, where a self-check of the runaway detection circuit 6 is performed.
In step 104, a counter Tc for setting a check time _T3 (a time longer than the self-oscillation period T2 of the runaway detection circuit ₆ ) is cleared. Next, the process proceeds to step 105, where the counter Tc starts counting up.
In the next judgment step 106, the count value (time) of the counter Tc is set to the set value KT ₃ corresponding to time T ₃ .
It is determined whether or not the count value has reached the set value, and steps 104 and 105 are repeatedly executed until the count value reaches the set value. During this time, the runaway detection circuit 6
It will wait for the reset signal S6 to be applied to the CPU2.

At this time, since the operating pulse signal S1 from the output terminal _O2 of the CPU 2 is stopped, the runaway detection circuit 6 outputs the signal S2 from the output Q of the flip-flop FF1 as shown in FIGS. At L level, the transistor Tr1 is in a non-conducting state. Therefore, the capacitor C2 is charged with the circuit supply voltage Vcc via the resistor R1, and rises as shown in the waveform of the voltage signal Vtc shown in FIG.
When the CO reference voltage Vref H is exceeded, the output signal S3 of the comparator 1CO becomes H level, this H level signal is applied to the input terminal S of the flip-flop FF2, the flip-flop FF2 enters the set state, and the output signal S5 of the output Q becomes the H level signal. changes to H level. Therefore, the transistor Tr2 becomes conductive, and the reset signal S6 falls to the L level. On the other hand, since the transistor Tr1 also becomes conductive, the capacitor C2 is discharged and its voltage Vtc
falls below the reference voltage Vref L of comparator 2CO, and its output signal S4 changes to H level,
By applying this to the reset terminal R of flip-flop FF2, flip-flop FF2 is reset. Therefore, the output signal S5 of the flip-flop FF2 falls to the L level, and the transistor Tr2 and
Since Tr1 is turned off, a rising reset signal S6 is applied to the input terminal _IR of CPU2, and the capacitor C
2, charging starts again and the voltage Vtc increases.
By repeating this operation, the runaway detection circuit 6 causes self-oscillation with a period T ₂ ,
While the operating pulse signal S1 is not input from the CPU 2, the reset signal S6 is applied to the CPU ₂ every time T2, and the CPU 2 is reset.

In this way, step 105 of the flowchart and
If the reset signal S6 is applied to the CPU 2 during the execution of step 106, the program of the CPU 2 is restarted from the start step 100, and the program of the CPU 2 is restarted from the start step 100.
In this case, since it is not the time to turn on the starter switch, a ``NO'' determination is made, and the process then proceeds to step 200, where the counter _CR , which counts the number of times the CPU 2 has been reset, is incremented by one.
Next, the process proceeds to determination step 201, where it is determined whether the count value of the counter _CR , that is, the number of resets, has reached a predetermined number of times _K1 that is considered abnormal, and if it is less than _K1 , the determination is "NO". The program then proceeds to step 300, where initialization processing for entering anti-skid control is performed.

However, an abnormality occurred in the runaway detection circuit 6 mentioned above, and the reset signal was not applied to the CPU 2 for a period of time _T3.
The counter is set to the count value KT ₃ corresponding to (T ₃ > T ₂ ).
When Tc is reached, a determination result of "YES" is issued in determination step 106, and the process proceeds to step 107. In step 107, an alarm signal indicating an abnormality in the runaway detection circuit 6 is output from the CPU 2 to the alarm 10, and the driver is notified of the abnormality in the runaway detection circuit 6 by lighting a warning lamp or the like. Then step
Fail-safe processing is executed at 108, and brake loosening operation is prohibited.

After this, the process returns to step 104 and continues the above steps 104 until the reset signal is applied to the CPU 2.
The process from step 108 to step 108 is executed repeatedly.
The alarm will continue to be issued without transitioning to anti-skid control.

On the other hand, the runaway detection circuit 6 operates normally and the reset signal S6 is applied to the CPU 2 to reset it.
The process jumps from step 103 to step 200, and from step 201 to step 300, where initialization processing is performed.Next, in step 301, interruption of the wheel speed signal from the wheel speed sensor 11 is permitted,
Entering the interrupt routine 400 shown in FIG.
In step 401, a pulse signal indicating each wheel speed is taken in from the wheel speed sensor 11, and the pulse time is measured. Next, the process proceeds to determination step 302, where it is determined whether or not the control period time _T1 has elapsed.
The process proceeds to step 303 every time _T1 , where CPU2
The operation pulse signal S1 is output from the output terminal _O2 to the runaway detection circuit 6 with a period of _T1 , and after that,
Anti-skid control is entered from step 304.

That is, in step 304, the wheel speed is calculated from the pulse time of the wheel speed signal taken in by the interrupt routine in steps 400 and 401, and then the process proceeds to determination step 305, where it is determined whether the vehicle is currently decelerating (braking) or not. is judged by the signal from the stop lamp switch 12, and if the deceleration is not in progress, it is "NO".
As a result of the determination, the process returns to step 302, and time T ₁
The output of the operation pulse signal S1 and the calculation of the wheel speed are repeated for each time. On the other hand, if it is decelerating, step 305
The result is ``YES'', and the next step is
Proceeding to step 306, the estimated speed of the vehicle body is calculated from the wheel speed calculated in step 304. Then, in step 307, the slip rate for each wheel is calculated from the wheel speed and the estimated vehicle speed, and the process proceeds to the next judgment step 308 to determine whether the slip rate calculated in step 307 matches the preset optimal slip rate. If the slip rate matches the optimum slip rate, the judgment is ``YES'' and the process proceeds to step 310, where a brake activation signal is generated by the CPU 2, and this signal is used for brake hydraulic control. The drive signal is outputted to the actuator drive circuit 5, and the drive signal is outputted from the drive circuit 5 to the brake hydraulic pressure control actuator 8, and the brake is applied according to the operation. However, if the calculated slip rate does not match the optimum slip rate, the judgment result in step 308 becomes "NO" and the process proceeds to step 309, where a brake release signal is generated in the CPU 2 and sent to the brake hydraulic control actuator drive circuit 5. Output. When the brake hydraulic control actuator 8 receives a brake loosening drive signal from the brake hydraulic control actuator drive circuit 5, it operates to loosen the braking force that had been applied so far, and adjusts the slip rate of each wheel to the braking level. An operation is performed to approximate the optimum slip rate.

Next, proceeding to step 311, a check is executed on the output circuits of the PCU 2 and the control device 1. For example, the output signal of the actuator drive circuit 5 for brake hydraulic pressure control is taken into the CPU 2, and it matches the brake control signal generated in the CPU 2. A check is made to see if it is possible. Then, the next judgment step
Proceeding to step 312, it is determined whether the input/output circuit and CPU2 are normal.
If the two signals match and are normal, the judgment is ``YES'', and the process returns to step 302 to perform anti-skid control again, and the operations of steps 302 to 311 are executed again, as long as the input/output circuit including the CPU 2 is normal. The processing of these steps is repeated to perform anti-skid control.

On the other hand, the check performed in step 311 shows that CPU2
If an abnormality is detected in an output circuit including Proceed to step 104 to wait for the reset signal S6 in circuit 6, and
In step 104, the counter Tc is reset again.
Counter Tc at step 105 and step 106
The count-up operation starts. During this time,
An error has occurred in CPU2 or the input/output circuit, and CPU2
When the operation pulse signal S1 from the runaway detection circuit 6 to the runaway detection circuit 6 is stopped, the runaway detection circuit 6 outputs a time T ₂
A reset signal S6 is sent to CPU2 every time
2 is reliably reset and returns the program to its initial state. In this way, when an abnormality occurs in the CPU 2 or the input/output circuit, instead of resetting the CPU 2 using the CPU 2 program, the runaway detection circuit 6 can be activated to reset the CPU 2 hardware-wise. Compared to the initialization used, the CPU 2 can be returned to the initial state more reliably.

On the other hand, as shown in the flowchart of Figure 4,
If an error occurs in CPU2 or the input/output circuit multiple times after turning on the starter switch,
In step 200, the reset counter _CR counts the number of resets, and in step 201, it is determined whether or not the number of resets has reached a predetermined number _K1.If it has reached this number _K1 , the next step is started.
Proceed to 202 and send the alarm signal from CPU 2 to alarm 10.
In step 203, fail-safe processing is performed to prohibit the brake release operation.
Note that this counting of the number of resets can also be performed using the hard counter 14 (FIG. 1) in addition to the program.

As explained above, according to this embodiment, the program runaway detection circuit of the microcomputer can be automatically self-checked when the starter switch is turned on, and the reliability of the control device can be further improved. . In addition, if the program detects an abnormality in the microcomputer including the input/output circuit, the runaway detection circuit is activated and the microcomputer is reset by hardware, so the control device can be initialized and returned to normal more reliably. I can do it. Furthermore, by using a counter to measure the number of resets of the microcomputer in such an abnormal situation, if the number of resets is abnormally large, fail-safe processing can be performed to improve safety.

〔Effect of the invention〕

As explained above, according to the first invention of the present application,
When an abnormality in the substantive processing of the microcomputer and output circuit is detected in the control program, the program operation of the microcomputer is monitored by intentionally stopping the output of the operation pulse signal until at least a predetermined period of time has elapsed. Since the microcomputer is reset using the runaway detection circuit, there is no need to provide a new circuit for performing the above-mentioned safety process in the event of an abnormality.

Furthermore, before executing the control program, the microcomputer determines whether or not the runaway detection circuit operates normally, and starts executing the control program only when it confirms that it operates normally. In this case, the microcomputer can be reliably returned to its initial state by a reset pulse from a runaway detection circuit that has been confirmed to operate normally.

In addition, the second invention of the present application provides that, in realizing the safety control method according to the first invention, when confirming the operation of the runaway detection circuit, and when an abnormality occurs in the substantive processing of the microcomputer and the output circuit. When resetting the microcomputer in the case of
Both are configured to actuate the stop means. By sharing the same means for different purposes in this way, the configuration can be simplified.

[Brief explanation of the drawing]

The figures show anti-skid control to which the present invention is applied. Fig. 1 is a block diagram of the electric circuit of the anti-skid control system, Fig. 2 is a circuit diagram of the runaway detection circuit, and Fig. 3 is the timing of each signal in the runaway detection circuit. FIG. 4 is a flowchart showing the self-check of the runaway detection circuit, check of the number of resets, and anti-skid control, and FIG. 5 is a flowchart showing the interrupt routine for wheel speed signal measurement. DESCRIPTION OF SYMBOLS 1... Control device, 2... Microcomputer (CPU), 5... Actuator drive circuit for brake hydraulic pressure control (output circuit), 6... Runaway detection circuit,
8... Actuator for brake hydraulic pressure control (controlled part), 10... Alarm, 11, 12, 13...
sensor.

Claims (1)

[Scope of Claims] 1. A sensor that detects the state of the vehicle and outputs a state detection signal; and a sensor that inputs, processes, and outputs the state detection signal according to a predetermined control program, and generates an operation pulse at predetermined intervals. A microcomputer that outputs a signal, an output circuit that outputs a drive signal according to a control signal output from the microcomputer, and a runaway detection circuit that monitors the program operation of the microcomputer based on the operation pulse signal. and a controlled unit driven by a drive signal output from the output circuit, and if an operation pulse signal is not input from the microcomputer to the runaway detection circuit for a predetermined period of time after power is turned on, In the safety control method for a vehicle control device in which the runaway detection circuit outputs a reset pulse to reset at least the microcomputer, in the microcomputer, (a) prior to execution of the control program, at least the predetermined time period is set; (b) If the reset pulse is not input from the runaway detection circuit during the period when the output of the operation pulse signal is stopped, it is safely assumed that the runaway detection circuit is abnormal. (c) When the reset pulse is input due to the normal operation of the runaway detection circuit during the output stop period, the execution of the control program is started, and (d) The microcomputer is activated in the control program. and determine whether there is an abnormality in the substantive processing of the output circuit, and (e) if it is determined that the substantive processing is abnormal, intentionally stop outputting the operation pulse signal until at least the predetermined time elapses. A safety control method for a vehicle control device, characterized in that a reset pulse is output from the runaway detection circuit that has been confirmed to operate normally. 2. The sensor includes a wheel speed sensor that detects the rotational speed of the wheel and a braking detection means that detects braking of the vehicle, and the control circuit includes the output circuit that is an actuator drive circuit for controlling brake hydraulic pressure. 2. The safety control method for a vehicle control device according to claim 1, wherein the anti-skid control device includes: and the controlled part is an actuator for controlling brake hydraulic pressure. 3. A sensor that detects the state of the vehicle and outputs a state detection signal, and a microcomputer that inputs, processes, and outputs the state detection signal according to a predetermined control program, and outputs an operation pulse signal at predetermined intervals. a control device comprising: an output circuit that outputs a drive signal according to a control signal output from the microcomputer; and a runaway detection circuit that monitors program operation of the microcomputer based on the operation pulse signal; and a controlled part driven by a drive signal output from an output circuit, and if the operation pulse signal is not input from the microcomputer to the runaway detection circuit for a predetermined period of time after power is turned on, the runaway detection circuit is reset. A safety control device for a vehicle control device that outputs a pulse to reset at least the microcomputer, further comprising a stop means for stopping output of the operation pulse signal until at least the predetermined time elapses, prior to execution of the control program. , a safety processing means that performs safety processing by assuming that the runaway detection circuit is abnormal if no reset pulse is input from the runaway detection circuit during the output stop period of the operation pulse signal; A starting means for starting execution of the control program when the reset pulse is inputted due to normal operation of the detection circuit; a determining means for determining that the substantive processing is abnormal; and when the determining means determines that the substantive processing is abnormal, it activates the stopping means and generates a reset pulse from the runaway detection circuit that is confirmed to operate normally. A safety control device for a vehicle control device, comprising: an instruction means for outputting an output. 4. The sensor includes a wheel speed sensor that detects the rotational speed of the wheel and a braking detection means that detects braking of the vehicle, and the control circuit includes the output circuit that is an actuator drive circuit for controlling brake hydraulic pressure. 4. The safety control device for a vehicle control device according to claim 3, wherein the controlled part is an actuator for controlling brake hydraulic pressure.