Electronic Control Unit

Abstract

To provide a novel technique for detecting delay of an operation clock of a microcomputer in an electronic control device.SOLUTION: An electronic control device 1 comprises a first processing unit 5 and a second processing unit 7 configured to communicate with the first processing unit via a communication path 6. The second processing unit includes an internal counter 33 and a comparison unit 34. The first processing unit includes a delay determination unit 15 and a signal transmission unit 16. The delay determination unit acquires a state signal from the second processing unit each time a count value counted according to an operation clock signal, which is a clock signal used in the first processing unit and is different from an internal clock signal, reaches an output cycle value. The output cycle value corresponds to a value obtained by dividing an output cycle by a cycle of the operating clock signal. The delay determination unit is configured to determine whether the operation clock signal is delayed on the basis of the acquired state signal. The signal transmission unit is configured to transmit a periodical signal to the second processing unit after the state signal is acquired by the delay determination unit.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to electronic control devices. [Background technology]

[0002] Conventionally, there is known an electronic control device that includes a microcomputer and a monitoring IC that monitors the microcomputer for abnormalities. For example, the following Patent Document 1 proposes a technique in which the monitoring IC detects an abnormality in the microcomputer when it detects a data error that cannot be corrected by the error correction circuit of the microcomputer. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-72569 A Summary of the Invention [Problem to be solved by the invention]

[0004] For example, in an electronic control device, it is desirable for a monitoring IC to detect a delay in the operating clock of a microcomputer as an abnormality in the microcomputer. One aspect of the present disclosure is to provide a new technique for detecting a delay in an operating clock of a microcomputer in an electronic control device. [Means for solving the problem]

[0005] One aspect of the present disclosure is an electronic control device (1) including a first processing unit (5, 13) and a second processing unit (7) configured to communicate with the first processing unit via a communication path (6). The second processing unit includes an internal counter (33) and a comparison unit (34). The internal counter is configured to perform a counting operation according to an internal clock signal generated in the second processing unit and to reset the count value every time a periodic signal is received from the first processing unit. When the count value by the internal counter is equal to or greater than a determination period value, the comparison unit sets a status signal to an active level indicating a delay of an operating clock signal used in the first processing unit. The determination period value corresponds to a value obtained by dividing a predetermined determination period, which is longer than a predetermined output period, by the period of the internal clock signal. The comparison unit is configured to set the status signal, which has been set to the active level, to an inactive level upon receipt of the periodic signal.

[0006] The first processing unit includes a delay determination unit (15, S30) and a signal transmission unit (16, S40). The delay determination unit acquires a status signal from the second processing unit every time a count value, which is counted according to an operation clock signal that is different from the internal clock signal, becomes an output period value. The output period value corresponds to a value obtained by dividing the output period by the period of the operation clock signal. The delay determination unit is configured to determine whether or not the operation clock signal is delayed based on the acquired status signal. The signal transmission unit is configured to transmit a periodic signal to the second processing unit after the status signal is acquired by the delay determination unit.

[0007] According to such a configuration, in the electronic control device, the first processing unit acquires information indicated by the status signal, such as whether or not the operating clock signal is delayed, before the status signal is set (i.e., reset) to an inactive level by the first processing unit's own transmission of a periodic signal, thereby enabling the first processing unit to determine whether or not the operating clock signal is delayed based on the status signal acquired before the transmission of the periodic signal. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a block diagram showing the configuration of an ECU. [Diagram 2] FIG. 2 is an explanatory diagram illustrating an activation period and a transmission period. [Diagram 3] FIG. 1 is an explanatory diagram showing how a clock interruption is detected using an IC. [Figure 4] FIG. 1 is an explanatory diagram showing how an abnormality in which a clock speeds up is detected using an IC. [Diagram 5] FIG. 11 is an explanatory diagram showing a state in which an abnormality in which a clock is delayed is not detected using an IC. [Figure 6] 4 is a flowchart of a periodic process in the first embodiment. [Figure 7] 4 is a flowchart of a delay determination process in the first embodiment. [Figure 8] FIG. 2 is an explanatory diagram showing the operation of an ECU in the first embodiment. [Figure 9] 13 is a flowchart of a periodic process in the second embodiment. [Figure 10] 13 is a flowchart of a delay determination process in the second embodiment. [Figure 11] FIG. 11 is an explanatory diagram showing the operation of an ECU in the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. Note that "equal" in this specification is not limited to being equal in the strict sense, and may not be equal strictly as long as the same effect is achieved. In addition, various parameters will be described below using appropriate numerical values, but these parameters are not limited to the numerical values ​​described. In addition, the drawings do not necessarily strictly represent the length on the time axis, etc., in order to describe the features in an easy-to-understand manner.

[0010] [1. First embodiment] [1-1. Configuration] The electronic control unit (hereinafter, ECU1) shown in Fig. 1 is mounted on a vehicle and controls, for example, the drive system of the vehicle. The drive system as the control target of the ECU1 may be, for example, a transmission. However, the control target is not limited to the drive system including the transmission, and may be various configurations in the vehicle.

[0011] The ECU 1 includes a microcomputer (hereinafter, microcomputer 5) and an integrated circuit (hereinafter, IC 7). ECU is an abbreviation for Electronic Control Unit, and IC is an abbreviation for integrated circuit. The ECU 1 may further include an oscillator 3 and a driver 8. The driver 8 may be a drive circuit for controlling a fail-safe control target 9 (for example, various actuators) that is a control target of the driver 8.

[0012] In the ECU 1, the microcomputer 5 and the IC 7 perform clock synchronous communication in accordance with a predetermined communication method (for example, SPI) via a communication bus 6 (hereinafter, bus 6). SPI is an abbreviation for Serial Peripheral Interface.

[0013] <Microcomputer 5> Although not shown in the figure, the microcomputer 5 has a CPU, and memories such as a ROM, a RAM, and a flash memory. The CPU, for example, executes a program stored in the ROM to realize various functions. Execution of the program results in the execution of a method corresponding to the program. The microcomputer 5 has, as functions, a communication unit 10, an operation clock generation unit 11, a startup unit 12, and a periodic processing unit 13.

[0014] The communication unit 10 performs clock synchronous communication (i.e., SPI communication) with the communication unit 30 included in the IC 7 via the bus 6. Although not shown, the bus 6 includes a clock signal line that supplies a communication clock for synchronous communication from the microcomputer 5 to the IC 7, a signal line for data transfer from the microcomputer 5 to the IC 7, a signal line for data transfer from the IC 7 to the microcomputer 5, and a signal line indicating whether the microcomputer 5 has selected the IC 7 as a communication partner. The communication unit 10, for example, obtains an operation clock signal (hereinafter, operation clock CKm) generated by the operation clock generation unit 11, divides or multiplies the signal to generate a communication clock of a constant frequency, outputs the communication clock to the clock signal line, and transmits and receives data synchronized with the communication clock.

[0015] The operation clock generating unit 11 generates the above-mentioned operation clock CKm of a predetermined frequency from an oscillation signal generated by an oscillator 3 including a crystal oscillator, a ceramic oscillator, etc. The operation clock CKm is a clock signal used in the microcomputer 5. For example, the CPU of the microcomputer 5 operates according to the operation clock CKm.

[0016] The startup unit 12 repeatedly starts the periodic processing unit 13. The startup unit 12 operates so that the periodic processing unit 13 is started at a predetermined output period (e.g., 10 msec). The output period here refers to a value that is predetermined as a so-called design specification (hereinafter, referred to as a design value).

[0017] Specifically, for example, the startup unit 12 may include a counter (hereinafter, startup counter 40) that performs a counting operation in accordance with the operation clock CKm and is reset each time the count value reaches a predetermined output cycle value. Here, resetting refers to setting the count value to 0. The startup unit 12 may output a startup signal each time the count value of the startup counter 40 reaches the output cycle value from 0, and start up the periodic processing unit 13 by the output of the startup signal.

[0018] The output period value corresponds to the value obtained by counting the design value of the output period (i.e., 10 msec) by the period of the operation clock CKm, specifically, the design value of the period of the operation clock CKm. Hereinafter, the design value of the period is also referred to as the design period. In other words, the output period value corresponds to the value obtained by dividing the design value of the output period by the design period of the operation clock CKm. Hereinafter, the actual period of the operation clock CKm is also simply referred to as the period of the operation clock CKm.

[0019] According to this, the startup unit 12 outputs a startup signal every “period of the operation clock CKm×output period value”, and the periodic processing unit 13 is started every “period of the operation clock CKm×output period value”. In other words, the period at which the periodic processing unit 13 is actually started (hereinafter, startup period Tc) is “period of the operation clock CKm×output period value”.

[0020] When the period of the operation clock CKm is equal to the design period of the operation clock CKm, the start-up period Tc is equal to the design value of the output period, and the periodic processing unit 13 is started every output period (i.e., 10 msec). However, due to various factors described later, an abnormality in the operation clock CKm may occur, in which the actual period of the operation clock CKm becomes longer or shorter than the design period of the operation clock CKm. When such an abnormality in the operation clock CKm occurs, the result is that the start-up period Tc, which is the period in which the periodic processing unit 13 is actually started, becomes longer or shorter than the output period.

[0021] The startup unit 12 is not limited to the above-mentioned configuration. For example, the microcomputer 5, which operates according to the operation clock CKm, may realize the function of the periodic processing unit 13 in the timer interrupt processing of the microcomputer 5 at a predetermined cycle (for example, 10 msec). The timer interrupt processing at every 10 mesec operates according to the operation clock CKm. In this case, the timer interrupt processing at every 10 mesec corresponds to the processing of the startup unit 12. Also, a circuit (not shown) in the microcomputer 5 that generates the timing of the timer interrupt at every 10 mesec (i.e., counts the timing) corresponds to the startup counter 40 described above.

[0022] The periodic processing unit 13 includes a normal processing unit 14 , a delay determination unit 15 , and a signal transmission unit 16 . The normal processing unit 14 executes processing for controlling the controlled object of the ECU 1 .

[0023] The delay determination unit 15 determines whether or not a delay (hereinafter also referred to as a lag) has occurred in the operation clock CKm. The delay of the operation clock CKm here means that the period of the actual (i.e., in operation) operation clock CKm becomes longer than the design period of the operation clock CKm.

[0024] The signal transmitting unit 16 transmits a periodic signal to the IC 7 (that is, transmits a command indicating the periodic signal by SPI communication). When started, the periodic processing unit 13 executes a series of functions in a predetermined order, such as the normal processing unit 14 → the delay determination unit 15 → the signal transmission unit 16. The periodic processing unit 13 executes at least the delay determination unit 15 and then the signal transmission unit 16. In other words, the periodic processing unit 13 executes at least the delay determination unit 15 before executing the signal transmission unit 16. The period during which the periodic processing unit 13 executes a series of functions is also referred to as one cycle.

[0025] It is assumed that the times required for the normal processing unit 14 and the delay determination unit 15 to execute the processes do not change (i.e., are equal) for each cycle (i.e., every time). According to this, as shown in FIG. 2, the wake-up period Tc and the transmission period Ts, which is the time interval at which the periodic signal is output by the signal transmitting unit 16 (that is, the actual time interval, not a design value), become substantially equal.

[0026] For example, when the operation clock CKm is normal (i.e., equal to the design cycle of the operation clock CKm), the start-up cycle Tc is equal to the output cycle, and the transmission cycle Ts is also equal to the output cycle. In other words, when the operation clock CKm is normal, the signal transmission unit 16 outputs a periodic signal every output cycle (i.e., 10 msec). However, this is not the case when the operation clock CKm is abnormal (e.g., when it is faster or slower).

[0027] <ic7> The IC7 is an IC for monitoring (i.e., judging) whether or not an abnormality occurs in the operation clock CKm in the microcomputer 5. Examples of abnormalities in the operation clock CKm include the above-mentioned delay of the operation clock CKm, the operation clock CKm becoming faster, and further, the operation clock CKm being interrupted. The operation clock CKm becoming faster means that the period of the operation clock CKm during operation becomes shorter than the design period of the operation clock CKm.

[0028] An abnormality in which the operation clock CKm is delayed or accelerated may occur due to, for example, an abnormality in the oscillator 3 or the operation clock generating unit 11. An abnormality in the oscillator 3 may occur due to fluctuations in the control voltage when the oscillator 3 is a voltage-controlled oscillator controlled by a control voltage, or due to other factors. An interruption in the operation clock CKm may occur due to, for example, interruption or disconnection of the control voltage of the voltage-controlled oscillator described above, or due to other factors.

[0029] The IC 7 includes a communication unit 30, an internal clock generation unit 31, an internal counter 33, a comparison logic unit , a decision logic unit 35, and a fail-safe unit . The communication unit 30 performs clock synchronous communication (i.e., SPI communication) with the communication unit 10 of the microcomputer 5 via the bus 6, and when it receives a signal in a predetermined manner from the microcomputer 5, it determines that the above-mentioned periodic signal has been received. For example, the communication unit 30 may output a predetermined signal (hereinafter, an initialization signal) to the internal counter 33 when it determines that it has received a periodic signal.

[0030] The internal clock generating unit 31 generates an internal clock signal (hereinafter, internal clock CKi) with a constant frequency. The internal clock CKi is a clock signal used within the IC7. The internal clock CKi is a clock signal different from the operating clock CKm. Different includes, for example, that the oscillation signals that are the basis for generating the clock signal are different (i.e., that the oscillation signals are generated by different oscillators). The internal counter 33, the comparison logic unit 34, the decision logic unit 35, and the fail-safe unit 36 ​​operate based on the internal clock CKi.

[0031] The internal counter 33 is a counter that performs a counting operation in accordance with the internal clock CKi. The count value of the internal counter 33 is reset every time a periodic signal is received from the microcomputer 5 (for example, every time the above-mentioned initialization signal is output from the communication unit 30). In other words, the value obtained by multiplying the period of the internal clock CKi by the count value of the internal counter 33 immediately before being reset corresponds to the time interval at which the actual periodic signal is received (i.e., the transmission period Ts).

[0032] The comparison logic unit 34 compares the count value of the internal counter 33 with a predetermined threshold value to determine a delay or interruption of the operation clock CKm. Specifically, the comparison logic unit 34 reads the count value of the internal counter 33. For example, the comparison logic unit 34 may read the count value every time the internal counter 33 performs a count operation in accordance with the internal clock CKi.

[0033] The comparison logic unit 34 sets the first status flag to an active level when the count value by the internal counter 33 is equal to or greater than a first judgment period value, which is a predetermined threshold value. When the first status flag is set to an active level, it indicates that the operation clock CKm is delayed (or, more specifically, that there is a possibility that it is delayed). Here, the active level refers to an on state (for example, a state indicating 1, which is a high level). The first judgment period value is stored in advance in the comparison logic unit 34.

[0034] The first judgment period value corresponds to a value obtained by counting a predetermined first judgment period (e.g., 20 msec) that is longer than the above-mentioned output period (i.e., 10 msec) by the design period of the internal clock CKi. In other words, the first judgment period value corresponds to a value obtained by dividing the first judgment period by the design period of the internal clock CKi. The first judgment period is a threshold value for determining a delay of the operating clock CKm, and therefore a discontinuance of the operating clock CKm.

[0035] Furthermore, when the count value by the internal counter 33 is less than the first determination period value, the comparison logic unit 34 sets the first status flag to an inactive level. Here, the inactive level refers to an off state (e.g., a state indicating 0, which is a low level). Furthermore, the comparison logic unit 34 sets the first status flag, which has been set to an active level, to an inactive level upon receiving a periodic signal (e.g., upon outputting an initialization signal). The comparison logic unit 34 stores the first status flag at an active level or an inactive level in a storage device (e.g., a register, etc.).

[0036] In this embodiment, the comparison logic unit 34 further compares the count value of the internal counter 33 with a predetermined threshold value to determine whether the operation clock CKm is faster. Specifically, the comparison logic unit 34 reads out the count value of the internal counter 33 every time a periodic signal is received from the microcomputer 5 (for example, every time an initialization signal is output). The read out count value is equal to a value obtained by dividing the transmission period Ts by the period of the internal clock CKi.

[0037] The comparison logic unit 34 sets the second status flag to an active level when the count value by the internal counter 33 is equal to or less than a second judgment period value, which is a predetermined threshold value. When the second status flag is set to an active level, it indicates that the operating clock CKm is becoming faster (or, more specifically, that there is a possibility that the operating clock CKm is becoming faster). The second judgment period value is stored in advance in the comparison logic unit 34.

[0038] The second judgment period value corresponds to a value obtained by counting a preset second judgment period (e.g., 5 msec) that is shorter than the above-mentioned output period (i.e., 10 msec) by the design period of the internal clock Cki. In other words, the second judgment period value corresponds to a value obtained by dividing the second judgment period by the design period of the internal clock CKi. The second judgment period is a threshold value for determining whether the operating clock CKm is becoming faster.

[0039] Furthermore, if the count value by the internal counter 33 at the timing when the periodic signal is received is greater than the second determination period value, the comparison logic unit 34 sets the second status flag to an inactive level. The comparison logic unit 34 stores the second status flag at an active level or an inactive level in a storage device (for example, a register, etc.).

[0040] The determination logic unit 35 reads out the first status flag set by the comparison logic unit 34. As shown in Fig. 3, the determination logic unit 35 determines (i.e., determines) that a disruption of the operating clock CKm has occurred when the period during which the first status flag set to the active level is acquired is equal to or longer than a predetermined disruption abnormality determination period. Then, the determination logic unit 35 sets the disruption determination flag from an inactive level (e.g., 0, which is a low level) to an active level (e.g., 1, which is a high level).

[0041] For example, the judgment logic unit 35 may count the elapsed time during which the first status flag is continuously set to the active level from the start point by using a counter that performs a counting operation according to the internal clock CKi. The start point refers to the point at which the first status flag is set from the inactive level to the active level. The judgment logic unit 35 may set the interruption judgment flag to the active level when this count value is equal to or greater than the value obtained by dividing the interruption abnormality confirmation period by the design cycle of the internal clock CKi.

[0042] The interruption determination flag indicates that an interruption of the operation clock CKm has occurred when the interruption determination flag is set to an active level. The interruption abnormality determination period may be set to a time longer than the above-mentioned first determination period. For example, the interruption abnormality determination period may be set to several times or more the first determination period. The interruption determination flag enables the interruption of the operation clock CKm to be accurately determined while suppressing the influence of noise and the like.

[0043] In this embodiment, the determination logic unit 35 further reads out the second status flag set by the comparison logic unit 34. As shown in Fig. 4, when the period during which the second status flag set to the active level is acquired is equal to or longer than a predetermined clock abnormality determination period, the determination logic unit 35 determines that the operational clock CKm is speeding up (i.e., determines that the abnormality of the speeding up is occurring). Specifically, the determination logic unit 35 sets the clock error flag from an inactive level (e.g., 0, which is a low level) to an active level (e.g., 1, which is a high level).

[0044] When the clock error flag is set to an active level, it indicates that an abnormality has occurred in which the operating clock CKm is becoming faster (i.e., an abnormality has been confirmed). The clock abnormality confirmation period can be set to a relatively long time that is at least equal to or greater than the output period of the periodic signal from the microcomputer 5 described above (i.e., 10 msec). The clock abnormality confirmation period may be the same value as the interruption abnormality confirmation period described above, or may be a different value. The clock error flag accurately confirms that the operating clock CKm is becoming faster, suppressing the effects of noise, etc.

[0045] The fail-safe unit 36 ​​executes fail-safe processing when the interruption determination flag is set to an active level or when the clock error flag is set to an active level by the determination logic unit 35. For example, the fail-safe processing may be processing to forcibly turn off a higher-level power supply for driving a solenoid that controls a clutch of a transmission, thereby preventing the driving force from being transmitted to the vehicle (i.e., putting the vehicle in a neutral state).

[0046] In this case, for example, a switch that forcibly turns off the upper power supply corresponds to the fail-safe control target 9, and a circuit that generates a drive signal for switching off the switch corresponds to the driver 8. Note that the fail-safe process is not limited to this, and may be various processes that limit the functions of the vehicle to ensure the safety of the vehicle.

[0047] <Abnormal determination of the operation clock Ckm by the IC7 alone> As described above, in the IC7, the determination logic unit 35 determines the interruption of the operation clock Ckm by using an interruption determination flag that is set to the active level when the first state flag at the active level continues for a period equal to or longer than the interruption abnormality determination period.

[0048] However, as shown in FIG. 5, for the delay of the operation clock Ckm, the first state flag is set to the non-active level (i.e., reset) every time a periodic signal is received. That is, for the delay of the operation clock Ckm, the first state flag at the active level does not continue. Therefore, it is difficult for the IC7 alone to determine an abnormality regarding the delay of the operation clock Ckm by using the first state flag, such as determining a delay when the first state flag at the active level continues for a predetermined time or longer.

[0049] Therefore, in the ECU1, the periodic processing unit 13 of the microcomputer 5 acquires the first state flag from the IC7 by executing periodic processing and determines an abnormality regarding the delay of the operation clock Ckm. [1-2. Processing] The periodic processing unit 13 executes periodic processing starting from being activated by the activation unit 12.

[0050] <Periodic processing> The periodic processing executed by the periodic processing unit 13 will be described with reference to the flowchart of FIG. 6. The periodic processing is executed every time the count value counted by the start counter 40 following the operation clock Ckm at the activation unit 12 becomes the output cycle value.

[0051] In step (hereinafter, S) 10, the periodic processing unit 13 executes normal processing. Normal processing refers to predetermined processing for controlling the control target of the ECU1. For example, although not shown, the periodic processing unit 13 outputs a control signal for controlling a transmission as a control target.

[0052] Next, in S20, the periodic processing unit 13 acquires the first status flag from the IC 7 via the bus 6 using the communication unit 30 (i.e., reads the first status flag from the IC 7 by SPI communication). The periodic processing unit 13 acquires the first status flag stored in the comparison logic unit 34 (for example, a storage device such as a register) of the IC 7 at the time this step is executed.

[0053] In the next step S30, the periodic processing unit 13 executes a delay determination process, which will be described later, to determine whether or not a delay has occurred in the operating clock CKm. Next, in S40, the periodic processing unit 13 uses the communication unit 30 to transmit a periodic signal to the IC 7 by SPI communication via the bus 6 (i.e., transmits a command indicating the periodic signal by SPI communication). The periodic signal is a signal of a predetermined form used in SPI communication. The periodic processing unit 13 then ends one cycle of periodic processing.

[0054] <Delay judgment process> Next, the delay determination process executed by the periodic processing unit 13 in the above-mentioned S30 will be described with reference to the flowchart shown in FIG.

[0055] In S100, the periodic processing unit 13 acquires the read result of the first status flag. Next, in S110, the regular processing unit 13 acquires a count value of the normal counter (hereinafter also referred to as a normal count value), a count value of the abnormal counter (hereinafter also referred to as an abnormal count value), a normal flag, and an abnormal flag. The normal counter and the abnormal counter are counters included in the regular processing unit 13, and the count values ​​are stored in a memory included in the microcomputer 5, for example.

[0056] The normal flag and the abnormal flag are flags for determining whether or not the operational clock CKm is delayed, and are stored in a memory included in the microcomputer 5, for example. When the abnormality flag is turned on, it indicates a determination result (i.e., a confirmed result) that a delay has occurred in the operational clock CKm, and when it is turned off, it indicates a determination result (i.e., a confirmed result) that a delay has not occurred in the operational clock CKm. The normality flag is a flag for determining that the operational clock CKm has returned to normal after, for example, a delay has occurred in the operational clock CKm and the abnormality flag has been turned on once.

[0057] The abnormality counter counts the number of times the operational clock CKm is delayed in order to suppress the influence of noise, etc., when determining the delay of the operational clock CKm. The normality counter is a counter for determining that the operational clock CKm has returned to normal after, for example, a clock delay has occurred and the abnormality flag has been turned on once.

[0058] In the next step S120, the periodic processing unit 13 determines whether the communication between the microcomputer 5 and the IC 7 is normal. For example, the microcomputer 5 may have a communication monitoring function that determines that the communication is normal when a response to an instruction to be output to the IC 7 via the communication unit 10 is received from the IC 7, and stores the determination result in memory. The periodic processing unit 13 may determine that the communication between the microcomputer 5 and the IC 7 is being performed normally when the determination result stored in the memory indicates normality.

[0059] The regular processing unit 13 shifts the process to S130 if it determines that the communication between the microcomputer 5 and the IC 7 is normal, and shifts the process to S160 if it determines that the communication is not normal.

[0060] In S130, the periodic processing unit 13 determines whether the first status flag is at the inactive level. If it is determined that the first status flag is at the inactive level, the periodic processing unit 13 shifts the process to S140. In S140, the periodic processing unit 13 counts up (e.g., increments by 1) the count value of the normal counter, and resets (i.e., sets to 0) the count value of the abnormal counter. Then, the periodic processing unit 13 shifts the process to S160.

[0061] On the other hand, if it is determined that the first status flag is at the active level, the periodic processing unit 13 shifts the process to S150. In S150, the periodic processing unit 13 resets (i.e., sets to 0) the count value of the normal counter, and counts up (e.g., increments by 1) the count value of the abnormal counter. Then, the periodic processing unit 13 shifts the process to S160.

[0062] In S160, the periodic processing unit 13 judges whether the count value of the abnormality counter is equal to or greater than a predetermined number of determination determinations (e.g., 3). The number of determination determinations is stored in advance in a memory provided in the microcomputer 5. In this embodiment, an example in which the number of determination determinations is 3 will be described, but the number of determination determinations is not limited to this. The number of determination determinations may be any integer equal to or greater than 1, but is preferably an integer equal to or greater than 2.

[0063] The periodic processing unit 13 shifts the process to S170 when the abnormality count value is equal to or greater than the determination count, and shifts the process to S180 when the abnormality count value is less than the determination count. In S170, the regular processing unit 13 sets the abnormal flag to ON (i.e., active level) and sets the normal flag to OFF (i.e., inactive level), and then the regular processing unit 13 proceeds to S180.

[0064] In addition, in S170, when the abnormality flag is turned on, the periodic processing unit 13 can execute the fail-safe processing. When the abnormality flag is turned on, the periodic processing unit 13 may output, for example, an instruction to the IC7 to execute the above-mentioned fail-safe processing by SPI communication via the bus 6 using the communication unit 10. In accordance with this instruction, the IC7 can execute the fail-safe processing using the fail-safe unit 36.

[0065] In S180, the periodic processing unit 13 judges whether or not the abnormality flag is off and the count value of the normality counter is equal to or greater than 1. If the result is a positive judgment, the periodic processing unit 13 shifts the process to S190, sets the normality flag to on in S190, and ends the delay judgment process. On the other hand, if the result is a negative judgment in S180, the periodic processing unit 13 ends the delay judgment process.

[0066] <Activation> The operation of the microcomputer 5 and IC 7 (i.e., ECU 1) including the periodic processing unit 13 configured as described above will be described with reference to Fig. 8. In Fig. 8, time intervals such as time t1 and time t11, time t2 and time t21, time t3 and time t31, etc. are shown as easy-to-understand intervals in order to explain the operation. Fig. 8 does not necessarily show the actual timing or time intervals strictly.

[0067] The periodic processing unit 13 acquires a first status flag indicating information such as whether the operating clock CKm is delayed or not (e.g., at time t1, time t2, time t3, etc.) before the first status flag is reset by receiving a periodic signal (e.g., at time t11, time t21, time t31, etc.). The periodic processing unit 13 counts the number of times the first status flag is at an active level consecutively (e.g., at time t1, time t2, time t3, etc.) (i.e., the number of cycles in which the first status flag is at an active level consecutively in periodic processing).

[0068] When the first status flag at the active level continues for a number of determination determinations (e.g., three times) or more (e.g., at time t3), the periodic processing unit 13 determines that the operation clock CKm is delayed. Then, the periodic processing unit 13 sets the abnormality flag to ON and the normality flag to OFF.

[0069] When it is determined that the operation clock CKm is delayed at time t3 (i.e., the abnormality flag is set to ON), the periodic processing unit 13 executes fail-safe processing to limit the output to the controlled object (i.e., various actuators). By executing the fail-safe processing, the periodic processing unit 13 enables the vehicle to safely evacuate even if the operation clock CKm is delayed.

[0070] [1-3. Effects] According to the first embodiment described above in detail, the following effects are achieved. (1a) In the ECU 1, the internal counter 33 in the IC 7 performs a count operation according to the internal clock CKi, and the count value is reset every time a periodic signal is received from the microcomputer 5. The comparison logic unit 34 sets a first status flag to an active level when the count value by the internal counter 33 is equal to or greater than a first determination period value. The first determination period value corresponds to a value obtained by dividing a first determination period (e.g., 20 msec) that is longer than an output period (e.g., 10 msec) that is a design value, by the period of the internal clock CKi. In addition, the comparison logic unit 34 sets the first status flag, which has been set to the active level, to an inactive level upon reception of a periodic signal.

[0071] The microcomputer 5 includes a periodic processing unit 13, which includes a delay determination unit 15 and a signal transmission unit 16. The delay determination unit 15 acquires a first status flag from the IC 7 each time a count value counted according to the operation clock CKm becomes an output cycle value, and determines whether or not the operation clock CKm is delayed. The output cycle value corresponds to a value obtained by dividing the output cycle, which is a design value, by the design cycle of the operation clock CKm. The signal transmission unit 16 transmits a periodic signal to the IC 7 after the delay determination unit 15 acquires the first status flag.

[0072] This allows the microcomputer 5 to determine whether or not the operating clock CKm is delayed, based on the first status flag before it is reset by the transmission of the periodic signal. Furthermore, in the ECU 1 that is already equipped with the IC 7, the delay of the operation clock CKm can be determined by the microcomputer 5 without making any design changes to the IC 7. The IC 7 here refers to the above-mentioned IC 7 that resets the first status flag, which indicates whether the operation clock CKm is delayed, upon receiving a periodic signal.

[0073] (1b) In S100, the microcomputer 5 acquires a first status flag from the IC 7 each time the count value counted according to the operation clock CKm reaches the output cycle value. In S150, the microcomputer 5 counts the number of consecutive occurrences (i.e., the abnormal count value) that is the number of times the first status flag at the active level is consecutively acquired. In S170, the microcomputer 5 determines that a delay in the operation clock CKm has occurred if the number of consecutive occurrences is equal to or greater than the determination number (e.g., 3 times). This makes it possible to suppress the effects of noise, etc., and accurately determine the delay in the operation clock CKm.

[0074] (1c) When the period during which the first status flag is at an active level is equal to or longer than the interruption determination period, the IC7 determines that the operating clock CKm is interrupted. This makes it possible to accurately determine the interruption of the operating clock CKm while suppressing the influence of noise and the like.

[0075] (1d) When the microcomputer 5 determines that a delay has occurred in the operation clock CKm in the periodic processing unit 13, it executes a fail-safe process of restricting the output to various actuators for operating the objects controlled by the ECU 1. This allows the vehicle to safely evacuate even if a delay has occurred in the operation clock CKm.

[0076] In the above embodiment, the ECU1 corresponds to the electronic control device, the microcomputer 5 corresponds to the first processing unit, the bus 6 corresponds to the communication path, the IC7 corresponds to the second processing unit, and the comparison logic unit 34 corresponds to the comparison unit. The judgment logic unit 35 corresponds to the interruption determination unit, the delay judgment unit 15 corresponds to the delay judgment unit, and the signal transmission unit 16 corresponds to the signal transmission unit. Also, S30 corresponds to the processing as the delay judgment unit, and S40 corresponds to the processing as the signal transmission unit. S100 corresponds to the processing as the acquisition unit, S150 corresponds to the processing as the count unit, and S170 corresponds to the processing as the delay determination unit. Also, the first status flag corresponds to the status signal, the first judgment period corresponds to the judgment period, the first judgment cycle value corresponds to the judgment cycle value, and the abnormality count value corresponds to the consecutive number of times.

[0077] [2. Second embodiment] [2-1. Configuration] The second embodiment has a basic configuration similar to that of the first embodiment, and therefore differences will be described below. Note that the same reference numerals as those in the first embodiment indicate the same configuration, and the preceding description will be referred to.

[0078] In the above-described first embodiment, the periodic processing unit 13 determines that a delay in the operation clock CKm occurs when the first status flag at the active level is continuously acquired a definite determination number of times (for example, three times). In contrast, the second embodiment differs from the first embodiment in that the periodic processing unit 13 further acquires a counter value of the internal counter 33 included in the IC7 to determine a delay in the operation clock CKm.

[0079] [2-2. Processing] The periodic processing executed by the periodic processing unit 13 of the second embodiment in place of the periodic processing of the first embodiment (i.e., FIG. 6) will be described with reference to the flowchart of FIG. 9. Note that the processing of S10-S20 and S40 in FIG. 9 is similar to the processing of S10-S20 and S40 in FIG. 6, and therefore the description will be partially simplified below.

[0080] <Periodic processing> The periodic processing executed by the periodic processing unit 13 in this embodiment will be described with reference to the flowchart in Fig. 9. The periodic processing unit 13 executes normal processing in S10, reads the first status flag in S20, and then reads the count value of the internal counter 33 in the following S25. The periodic processing unit 13 executes the delay determination process shown in Fig. 10 in the following S35, and transmits a periodic signal in S40 after the execution of the delay determination process.

[0081] <Delay judgment process> Next, the delay determination process executed by the periodic processing unit 13 in the above-mentioned S35 will be described with reference to the flowchart shown in Fig. 10. Note that the delay determination process of this embodiment differs from the first embodiment in that S105, S115, S145, S155, and S165 are added to the delay process of the first embodiment shown in Fig. 7. In the following, the description of the same processes as those of the first embodiment will be partially simplified.

[0082] After acquiring the read result of the first status flag in S100, the periodic processing unit 13 acquires the read result of the count value of the internal counter 33 in the following S105. For example, the periodic processing unit 13 may transmit an instruction to the IC7 (i.e., the communication unit 30) via the bus 6 to transmit the counter value of the internal counter 33 from the IC7 to the microcomputer 5. The IC7 (e.g., the communication unit 30) may read the count value of the internal counter 33 in accordance with this instruction, and transmit this count value to the microcomputer 5 (i.e., the communication unit 10) via the bus 6 in response to the above instruction.

[0083] In this way, the periodic processing unit 13 acquires the first status flag and the count value of the internal counter 33 immediately before transmitting the periodic signal. In other words, when the operating clock CKm is not interrupted, the count value of the internal counter 33 indicates a value corresponding to the actual reception interval of the periodic signal (i.e., the transmission period Ts), and is equal to the value obtained by dividing the transmission period Ts of the periodic signal by the design period of the internal clock CKi.

[0084] Next, in S110, the regular processing unit 13 acquires the normal count value, the abnormal count value, the normal flag, and the abnormal flag. In the next S115, the periodic processing unit 13 acquires the abnormality duration stored in the memory of the microcomputer 5. The abnormality duration indicates the time during which the first status flag is continuously set to the active level in the IC 7. In other words, the abnormality duration indicates the total value of the reception intervals (i.e., the transmission period Ts) of the periodic signal measured by the IC 7 when the operating clock CKm is not interrupted but is delayed.

[0085] In the subsequent steps S120 and S130, the regular processing unit 13 executes the same processes as those in S120 and S130 shown in FIG. Here, if it is determined in S130 that the first status flag is at the inactive level, the periodic processing unit 13 shifts the process to S140. In S140, the periodic processing unit 13 counts up the normal count value (e.g., increments by 1) and resets the abnormal count value (i.e., sets it to 0 and stores it in memory). Next, in S145, the periodic processing unit 13 resets the abnormality duration (i.e., sets it to 0) and shifts the process to S160.

[0086] On the other hand, if it is determined in S130 that the first status flag is at the active level, the periodic processing unit 13 shifts the process to S150, where it resets the normal count value (i.e., sets it to 0) and counts up the abnormal count value (e.g., increments it by 1).

[0087] Next, in S155, the periodic processing unit 13 adds the time equivalent to the count value by the internal counter 33 to the abnormality duration stored in the memory to obtain a new abnormality duration, overwrites and stores this new abnormality duration in the memory, and transitions to the process of S160. The time equivalent to the count value by the internal counter 33 refers to a value obtained by multiplying the design cycle of the internal clock CKi by the count value of the internal counter 33 acquired in S105.

[0088] In S160, the periodic processing unit 13 shifts the process to S170 if the abnormality count value is equal to or greater than a predetermined number of determinations (for example, 3), and shifts the process to S165 if the abnormality count value is less than the number of determinations.

[0089] In S165, the regular processing unit 13 determines whether or not the abnormality count value is equal to or greater than the sub-determination count and the abnormality duration is equal to or greater than a predetermined duration threshold value (for example, 80 msec).

[0090] The sub-determination count is an integer smaller than the final determination count, such as a value obtained by subtracting a predetermined reduction value (e.g., 1) from the final determination count. The sub-determination count is an integer equal to or greater than 1, and in this case, the final determination count is an integer equal to or greater than 2. In this embodiment, the sub-determination count is set to 2, which is the value obtained by subtracting 1 as a reduction value from 3, which is the final determination count (i.e., 3-1).

[0091] The continuation threshold value may be set to a time (e.g., 80 msec, described later) that is shorter than the time obtained by multiplying a delay clock period (e.g., 40 msec) that is predetermined as the minimum value of the period of the delayed operation clock CKm to be detected by the number of final determinations (e.g., 3). However, the delay clock period may be set to any time equal to or longer than the first determination period.

[0092] Here, if the result is a positive determination, the periodic processing unit 13 shifts the process to S170, where it sets the abnormality flag to ON, sets the normality flag to OFF, outputs an instruction to the IC 7 to execute fail-safe processing, and shifts the process to S180. On the other hand, if the result is a negative determination, the periodic processing unit 13 shifts the process to S180.

[0093] In the subsequent steps S180 and S190, the regular processing unit 13 executes the same processes as S180 and S190 shown in Fig. 7. Then, the regular processing unit 13 ends the delay determination process. <Activation> The operation of the ECU 1 equipped with the microcomputer 5 and IC 7 including the periodic processing unit 13 configured as described above will be described with reference to Fig. 11. Here, an example in which the operation clock CKm has a period (e.g., 90 msec) that is much slower than the output period (i.e., 10 msec) will be described as an example of a delay of the operation clock CKm.

[0094] At time t1, the first status flag set to an active level by the IC7 is read by the microcomputer 5. As a result, the abnormal count value is counted up from 0 to 1, and the normal count value is reset (i.e., set to 0) from the maximum value that can be counted by the normal counter, for example. Then, a time period (e.g., 90 msec) corresponding to the count value of the internal counter 33 acquired from the IC7 together with the first status flag is stored in the memory as the abnormality duration. At time t1, the abnormality determination flag is set to OFF, and the normal determination flag is set to ON. Normal control is being performed on various actuators that execute control of the control target of the ECU1 (e.g., the above-mentioned transmission).

[0095] At time t2, the first status flag set to the active level by the IC7 is read by the microcomputer 5. As a result, the abnormal count value is counted up from 1 to 2, and the normal count value is reset (i.e., the reset state is maintained). Then, a time period (e.g., 90 msec) equivalent to the count value of the internal counter 33 acquired from the IC7 together with the first status flag is added to the abnormality duration already stored in the memory. The abnormality duration after the addition is stored in the memory as a new abnormality duration (e.g., 180 msec).

[0096] At time t2, the first state flag set to the active level has been detected twice in succession (i.e., the abnormality count value=2), and the abnormality duration (i.e., 180 msec) is equal to or greater than the duration threshold (i.e., 80 msec). Therefore, at time t2, the abnormality determination flag is set to ON, and the normality determination flag is set to OFF. The control capabilities of various actuators that control the control target of the ECU 1 (e.g., the above-mentioned transmission) are restricted more than usual by fail-safe processing.

[0097] This allows the delay of the operation clock CKm to be determined without waiting for the abnormality count value to reach or exceed the determination number (e.g., 3). As a result, the fail-safe process is quickly performed without waiting for the abnormality count value to reach or exceed the determination number.

[0098] [2-3. Effects] According to the second embodiment described above in detail, in addition to the effects (1a) to (1d) of the first embodiment described above, the following effect is also obtained.

[0099] (2a) In S100, the microcomputer 5 acquires the first status flag from the IC 7, and in S105, acquires the count value of the internal counter 33 when the first status flag is acquired. In S165, when it is determined that the abnormal count value is less than the final determination count, the microcomputer 5 determines the delay of the operation clock signal when the abnormal count value is equal to or greater than the sub-determination count and the abnormality duration is equal to or greater than the duration threshold. The sub-determination count is a value smaller than the final determination count. The abnormality duration is a time equivalent to the total value of the count values ​​of the internal counter 33 when the first status flag at the active level is acquired consecutively for the sub-determination count. The equivalent time refers to a value obtained by multiplying the total value of the count values ​​by the design period of the internal clock CKi that operates the internal counter 33.

[0100] This allows the delay of the operation clock CKm to be promptly determined when the period of the operation clock CKm becomes very long, without waiting for the abnormality count value to reach or exceed the determination number. As a result, the process can be promptly shifted to the fail-safe process, without waiting for the abnormality count value to reach or exceed the determination number.

[0101] (2b) The continuation threshold may be set to a value smaller than the product of the delay clock period to be detected and the number of determinations. The delay clock period to be detected may be a value that is predetermined as the minimum period of the delayed operating clock CKm to be detected. This makes it possible to obtain the effect of (2a).

[0102] In the above embodiment, S100 and S105 correspond to the processing performed by the acquisition unit, and S165 corresponds to the processing performed by the early delay determination unit. The abnormality duration corresponds to the time period equivalent to the total value.

[0103] 3. Other embodiments Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments and can be implemented in various modified forms.

[0104] (3a) In the above embodiment, the processing of the periodic processing unit is in the order of normal processing unit → delay determination unit → signal transmission unit, as shown in Fig. 2, but the present disclosure is not limited to this. If the order of the delay determination unit and the signal transmission unit is not changed, there is no problem with anomaly detection for a slow clock, so it may be delay determination unit → signal transmission unit → normal processing unit. In the above embodiment, the periodic processing unit 13 includes the normal processing unit 14, the delay determination unit 15, and the signal transmission unit 16, and executes a series of these functions, but the present disclosure is not limited to this. For example, the periodic processing unit 13 may execute only the delay determination unit 15 and the signal transmission unit 16, or may execute other functions in addition to the normal processing unit 14, the delay determination unit 15, and the signal transmission unit 16. In either case, the functions of the periodic processing unit 13 are executed every time in a predetermined order, and among the functions, the delay determination unit 15 is executed before the signal transmission unit 16 (i.e., in other words, the signal transmission unit 16 is executed after the delay determination unit 15).

[0105] (3b) In the above embodiment, the microcomputer 5 and IC 7 communicate via the bus 6 in accordance with the SPI. However, the communication method may be any clock-synchronous communication method and is not limited to SPI.

[0106] (3c) In the above-described embodiment, the active level may be an off state (for example, a state indicating a low level, 0), and the inactive level may be an on state (for example, a state indicating a high level, 1).

[0107] (3d) In the above embodiment, in the delay determination process executed by the microcomputer 5, the abnormality duration indicates the time during which the first status flag is continuously set to the active level in the IC7, but the present disclosure is not limited to this. The abnormality duration may indicate the count value of the internal counter 33 corresponding to the time during which the first status flag is continuously set to the active level in the IC7, or the total value of the count values. In this case, the continuation threshold value (e.g., 80 msec) may indicate the count value of the internal counter 33 corresponding to the time called the continuation threshold value. The count value of the internal counter 33 corresponding to the time corresponds to a value obtained by dividing the time by the design cycle of the internal clock CKi that operates the internal counter 33. In S165, the microcomputer 5 may determine whether the abnormality count value is equal to or greater than the sub-determination number (i.e., 2) and whether the abnormality duration indicated by the count value is equal to or greater than the continuation threshold value indicated by the count value.

[0108] (3e) The ECU1, microcomputer 5, IC7, and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the ECU1, microcomputer 5, IC7, and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the ECU1, microcomputer 5, IC7, and the method described in the present disclosure may be realized by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. In addition, the computer program may be stored in a computer-readable non-transient tangible recording medium as instructions executed by a computer. The method for realizing the functions of each part included in the ECU1, microcomputer 5, and IC7 does not necessarily need to include software, and all of the functions may be realized using one or more hardware.

[0109] (3f) Multiple functions possessed by one component in the above embodiments may be realized by multiple components, or one function possessed by one component may be realized by multiple components. Also, multiple functions possessed by multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0110] (3g) In addition to the above-mentioned ECU 1, microcomputer 5, IC 7, or periodic processing unit 13, the present disclosure can also be realized in various forms, such as a program for causing the ECU 1, microcomputer 5, IC 7, or periodic processing unit 13 to function, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a clock delay determination method. [Explanation of symbols]

[0111] 1...ECU, 5...microcomputer, 6...bus, 7...IC, 13...periodic processing unit, 15...delay determination unit, 16...signal transmission unit, 33...internal counter, 34...comparison logic unit.

Claims

1. An electronic control device (1) comprising a first processing unit (5, 13) and a second processing unit (7) configured to communicate with the first processing unit via a communication path (6), The second processing unit is an internal counter (33) configured to perform a counting operation in accordance with an internal clock signal generated within the second processing unit and to reset a count value every time a periodic signal is received from the first processing unit; a comparison unit (34) configured to set a status signal to an active level indicating a delay of an operation clock signal used in the first processing unit when the count value by the internal counter is equal to or greater than a determination period value corresponding to a value obtained by dividing a predetermined determination period longer than a predetermined output period by the period of the internal clock signal, and to set the status signal set to the active level to an inactive level upon receipt of the periodic signal; Equipped with The first processing unit is a delay determination unit (15, S30) configured to obtain the status signal from the second processing unit each time a count value counted according to the operation clock signal, which is different from the internal clock signal, reaches an output cycle value corresponding to a value obtained by dividing the output cycle by a cycle of the operation clock signal, and to determine whether or not the operation clock signal is delayed based on the obtained status signal; a signal transmission unit (16, S40) configured to transmit the periodic signal to the second processing unit after the status signal is acquired by the delay determination unit; An electronic control device comprising:

2. 2. The electronic control device according to claim 1, In the first processing unit, The delay determination unit an acquisition unit (S100) configured to acquire the state signal from the second processing unit each time a count value counted according to the operation clock signal reaches the output period value; A counting unit (S150) configured to count the number of consecutive times that the status signal having the active level is consecutively acquired by the acquiring unit; a delay determination unit (S170) configured to determine a delay of the operational clock signal when the consecutive number of times is equal to or greater than a predetermined number of determination times; An electronic control device comprising:

3. 3. The electronic control device according to claim 2, In the first processing unit, The delay determination unit the acquisition unit acquires the status signal from the second processing unit, and acquires the count value of the internal counter at the time when the status signal is acquired; an early delay determination unit (S165) configured to determine a delay of the operating clock signal when it is determined that the consecutive number of times is less than the final determination number, the consecutive number of times is equal to or greater than a sub-determination number which is smaller than the final determination number, and when a time corresponding to a total value of the count values ​​of the internal counter when the status signal at the active level is continuously acquired the sub-determination number of times is equal to or greater than a predetermined continuation threshold value; The electronic control device further comprises:

4. The electronic control device according to any one of claims 1 to 3, The second processing unit is a disruption determination unit (35) configured to determine that the operation clock signal is disrupted when the period during which the status signal is at the active level is equal to or longer than a predetermined disruption abnormality determination period; The electronic control device further comprises:

Images