JP2010176541A - Electronic control device for vehicle - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To diagnose a failure of a timer circuit stably and with high reliability in an electronic control device for vehicle on which the timer circuit performing soak timer operation is mounted. <P>SOLUTION: During a self-shut down period since an ignition switch 9 is turned off until operation of a microcomputer 2 is stopped, output of a wake up signal output from a timer IC4 is checked, and validity of a timer IC internal timer is verified. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an electronic control device for a vehicle equipped with a microcomputer, and in particular, measures the time after power supply stop of the microcomputer and when the time reaches a set value, the microcomputer is restarted for executing predetermined processing. The present invention relates to a technique for failure diagnosis (failure detection) of a vehicle electronic control device in which a timer circuit to be started is mounted.

  As a vehicular electronic control device using a microcomputer (hereinafter abbreviated as a microcomputer) for controlling an automobile engine, the vehicular electronic control device checks for an evaporative gas leak when a predetermined time has elapsed since the ignition switch was turned off. In order to automatically execute the predetermined processing, a timer circuit called a soak timer is implemented that measures the elapsed time from when power supply to the microcomputer is stopped by turning off the ignition switch and restarts the microcomputer. The thing is known (for example, patent document 1).

  In such an electronic control device for a vehicle, it is indispensable to perform a failure diagnosis for detecting a functional failure of the timer circuit. In view of this, during the period when the activation switch signal (external activation signal) for operating the main power supply means for supplying power to the microcomputer is at the active level, the timer circuit is diagnosed and the activation switch During the period when the signal is in the inactive level, the main power feeding means is operated by the timer circuit and an abnormality that makes it impossible to start the microcomputer occurs. Even if the start switch signal becomes inactive level, the main power feeding means Has been proposed to detect in advance during the active level period of the activation switch signal that an abnormality that keeps power supplied to the microcomputer occurs (for example, Patent Document 2).

JP 2005-226488 A JP 2006-307721 A

  However, in the above-described prior art, the reliability of functional failure detection varies greatly depending on the timing at which the functional failure of the timer circuit is detected during the period when the activation switch signal is at the active level. For example, there is a large difference in reliability between when it is performed immediately after the activation switch signal becomes active level and when it is performed immediately before the activation switch signal becomes inactive level.

  In the above-described prior art, since the malfunction of the timer circuit is detected during the period when the activation switch signal is at the active level, the longer the activation level period of the activation switch signal, that is, the vehicle The longer the travel time, the lower the reliability of the malfunction detection of the timer circuit.

  In addition, in the above-described prior art, the malfunction of the timer circuit is detected during the period when the activation switch signal is in the active level in the drive circuit of the main relay that turns on and off the main power supply circuit. Switch signal is input, and failure diagnosis is performed with the main relay always permitted to drive regardless of the presence or absence of the power activation signal from the timer circuit to the main relay drive circuit. The drive permission status of the main relay cannot be confirmed.

  The present invention has been made in view of the problems to be solved, and the object of the present invention is to detect a malfunction of a timer circuit with stable and high reliability, and further to a main relay drive circuit. Another object of the present invention is to provide a vehicular electronic control device that can also detect the failure of the vehicle.

  In order to achieve the above object, an electronic control device for a vehicle according to the present invention includes a power supply circuit that outputs a microcomputer operating voltage and a timer operating voltage at all times by closing a main relay, and a microcomputer output from the power supply circuit. Either a microcomputer that operates with an operating voltage, a timer circuit that operates with a timer operating voltage that is constantly output from the power supply circuit, or an external start signal that is input from the outside or an internal start signal that is output from the timer circuit is active A main relay drive circuit that closes the main relay in the case of a level, and when the external activation signal changes from an active level to an inactive level, and no microcomputer operating voltage is supplied from the power supply circuit to the microcomputer The timer circuit counter starts time measurement. When the specified time elapses, the internal activation signal output from the timer circuit is set to an active level, and the microcomputer is supplied from the power supply circuit to the microcomputer to activate the microcomputer. An electronic control unit, wherein the microcomputer performs a failure diagnosis process for performing a failure diagnosis process of the timer circuit during a delay time from when the external activation signal becomes an inactive level until the operation of the microcomputer stops. Part.

In the vehicle electronic control device according to the present invention, preferably, the failure diagnosis unit compares a counter value of an internal counter built in the microcomputer with a count value of the counter of the timer circuit, It is determined whether or not the values are the same.
Thereby, failure diagnosis of the counter of the timer circuit is performed.

The vehicle electronic control device according to the present invention preferably includes a comparator that compares the counter value of the internal counter in which the timer circuit is built in the microcomputer and the count value of the counter of the timer circuit, The failure diagnosis unit sets an arbitrary measurement time in the timer circuit and starts time measurement by the counter, and when the predetermined time elapses, the internal activation signal changes from an inactive level to an active level. It is determined whether or not to do.
As a result, failure diagnosis of the comparator provided in the timer circuit is performed in order to compare the counter value of the internal counter built in the microcomputer with the count value of the counter of the timer circuit.

The vehicle electronic control device according to the present invention preferably includes a monitor line for confirming the state of the output line of the main relay drive circuit, and the failure diagnosis unit is in a state where the external activation signal is at an inactive level. When the internal activation signal changes from the inactive level to the active level, it is determined whether or not the level of the input line of the main relay drive circuit changes from the inactive level to the active level.
Thereby, failure diagnosis of the main relay drive circuit is performed.

In the vehicle electronic control device according to the present invention, preferably, the failure diagnosis unit forcibly cuts off supply of a timer operating voltage to the timer circuit when the internal activation signal is at an active level. Then, it is determined whether or not the internal activation signal changes from an active level to an inactive level.
Thereby, failure diagnosis of the switch means for forcibly cutting off the supply of the timer operating voltage to the timer circuit is performed.

The vehicle electronic control device according to the present invention preferably records a diagnosis result by the failure diagnosis unit in a storage unit of a microcomputer after both the external activation signal and the internal activation signal become inactive levels, When a failure is determined, the supply of the timer operating voltage to the timer circuit is cut off.
As a result, the power supply voltage to the timer circuit is cut off at the time of failure determination, and the count operation after the microcomputer operation stops is not performed.

The vehicle electronic control device according to the present invention preferably measures a power supply stop time to the microcomputer when the failure diagnosis result of the timer circuit is determined to be abnormal by the failure diagnosis unit. When the set value is reached, a process for not restarting the microcomputer is performed.
As a result, the microcomputer is not restarted in a state where the external activation signal is at the inactive level.

  According to the present invention, the normal control is performed by performing the fault diagnosis of the timer circuit during the delay time from when the external activation signal becomes inactive level until the microcomputer stops operating, that is, during the self-shut period. Is stopped, and the peripheral circuit is not operating. Therefore, it is possible to approach the timing at which the timer circuit actually starts to operate. Compared with the case where it is performed, it becomes higher. Further, since the external activation signal is at an inactive level, a failure diagnosis of the main relay drive circuit can be performed.

The block diagram which shows one Embodiment of the electronic controller for vehicles which mounted the timer circuit. The flowchart which shows the whole process which the electronic controller for vehicles of this embodiment performs. The time chart which shows the operation | movement at the time of normal. The time chart showing operation at the time of abnormality occurrence of timer IC. The time chart showing operation at the time of abnormality occurrence of timer IC. 6 is a flowchart showing functional failure diagnosis and failure diagnosis processing of the timer circuit according to the present embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows an embodiment of an electronic control device in which the timer circuit of the present invention is mounted. The electronic control unit (ECU) 1 includes a microcomputer 2 that performs engine control processing and failure diagnosis, a main power supply voltage (microcomputer operating voltage) Vm that operates the microcomputer 2, and a sub power supply voltage that operates the timer IC 4 (timer Power supply circuit 3 that outputs operating voltage (Vs), timer IC (timer circuit) 4, main relay drive circuit 5, main relay driver IC 8 that drives main relay 6, and main relay drive permission signal supply switch 16 The timer IC power switch 18, the timer IC power cut-off switch 20 for forcibly stopping the power supply of the timer IC 4, and the wake-up signal cut-off switch 21. The microcomputer 2 includes a failure diagnosis unit 25 that performs failure diagnosis in addition to the engine control process.

  The timer IC 4 operates as a soak timer that automatically starts the microcomputer 2 by measuring the time during which the power supply to the microcomputer 2 is stopped. The timer IC 4 is controlled by a register 4a that stores a set value of the measurement time and a clock in the timer IC 4. A counter 4b for down-counting and a comparator 4c for checking whether the counter value of the counter 4b is zero are provided. When the counter value becomes zero, the wake-up signal Si3 as an internal activation signal is sent to the microcomputer 2 and the main Output to the relay drive permission signal supply switch 16.

  The wake-up signal Si3 is a signal that changes from a low level (inactive level) to a high level (active level) when a predetermined time (measurement time) elapses after power supply to the microcomputer 2 is stopped.

  The main relay driver circuit 5 is connected to the main relay driver IC 8 when the IGNSW signal Si1 input from an ignition switch (hereinafter referred to as IGNSW) 9 which is an external start switch or the wakeup signal Si3 output from the timer IC 4 is at a high level. To power. When the main relay driver IC 8 is supplied with power, the main relay 6 is closed.

  The IGNSW signal Si1 is an external activation signal that becomes a high level (active level) when the IGNSW 9 is turned on and becomes a low level (inactive level) when the IGNSW 9 is turned off, and is input to the microcomputer 2 The

  The main relay 6 is turned on when the IGNSW 9 is turned on or when the main relay drive permission signal supply switch 16 is turned on (closed) because the wakeup signal Si3 output from the timer IC 4 is at a high level. Close.

  The power supply circuit 3 generates the main power supply voltage Vm from the battery voltage VB supplied via the main relay 6. Thereby, the main power supply voltage Vm is turned on (closed) when the IGNSW 9 is turned on (closed) or when the wakeup signal Si3 is at a high level. In this case, the voltage is generated from the battery voltage VB supplied via the main relay 6.

  The power supply circuit 3 is constantly supplied with the battery voltage VB from the battery power supply 10, constantly generates the sub power supply voltage Vs from the battery voltage VB, and constantly supplies power to the timer IC 4 with the sub power supply voltage Vs.

The microcomputer 2 has the following three operation modes (1) to (3).
(1) When the IGNSW 9 is turned on, that is, when the IGNSW signal Si1 is at a high level and the wakeup signal Si3 is at a low level, the main power supply voltage Vm is supplied from the power supply circuit 3 and normal engine control processing is executed. .
(2) Failure diagnosis during the delay time (self-shutdown) from the time when the IGNSW signal Si1 changes from high level to low level until the supply of the main power supply voltage Vm to the microcomputer 2 stops and the operation of the microcomputer 2 stops The unit 25 performs a fault diagnosis process for the timer circuit, that is, the timer IC 4.
(3) When the wake-up signal Si3 becomes high level, the main power supply voltage Vm is supplied from the power supply circuit 3 and the system is restarted to execute failure diagnosis that should be performed after the engine is stopped, such as an evaporative diagnosis and a water temperature sensor diagnosis. .

The failure diagnosis processing of the timer IC 4 by the failure diagnosis unit 25 is to perform failure diagnosis determinations (A) to (D) below.
(A) The count value of the internal counter built in the microcomputer 2 is compared with the count value of the counter 4b of the timer IC 4 by the comparator 4c, and it is determined whether or not the count values are the same. Thereby, the failure of the counter 4b can be diagnosed.
(B) When an arbitrary value is set in the register 4a which is a storage unit of the timer IC4 to start the counter operation by the timer IC4, the comparator 4c of the timer IC4 has a counter measurement value equal to the set value of the storage unit. When it is determined, or when the counter measurement value becomes zero, it is determined whether or not the wakeup signal Si3 of the timer IC 4 changes from the low level to the high level. Thereby, the failure of the comparator 4c can be diagnosed.
(C) The level of the monitor line that monitors the state of the output line of the main relay drive circuit 5 when the wake-up signal Si3 of the timer IC 4 changes from the low level to the high level while the IGNSW signal Si1 is at the off level. Determines whether or not changes from an inactive level to an active level. That is, it is determined whether or not the output line monitor signal Si6 changes from the low level to the high level. Thereby, the failure of the main relay drive circuit 5 can be diagnosed.
(D) When the wakeup signal Si3 of the timer IC4 is at a high level, the timer circuit operation stop signal Si5 is changed from a low level to a high level. At this time, the wakeup signal Si3 of the timer IC4 is changed from a high level to a low level. Determine if it changes. Thereby, it is possible to diagnose a failure of the timer IC power switch 18 and the timer IC power cut-off switch 20 that forcibly stop the power supply of the timer IC 4.

  If any one of the results of the failure diagnosis determination of (A) to (D) is an abnormality determination, the microcomputer 2 operates after both the IGNSW signal Si1 and the wakeup signal Si3 become low level. During the delay time (self-shutdown) until the stop, the diagnosis result is recorded in the storage unit, the timer circuit operation stop signal Si5 is set to the high level, and the supply of the power supply voltage to the timer IC 4 is cut off. Further, at the time of abnormality determination, the power supply stop time to the microcomputer 2 is measured, and when the time reaches a set value, the operation for restarting the microcomputer 2 is not performed.

Next, a series of processes performed by the ECU 1 will be described with reference to FIGS.
First, the entire process executed by the microcomputer 2 of the ECU 1 in which the timer circuit is mounted will be described with reference to the flowchart of FIG.

  When the microcomputer 2 is activated by the main power supply voltage Vm, first, the IGNSW 9 is turned on (step S110). If the IGNSW signal Si1 is at a high level and the wakeup signal Si3 is at a low level (step S115), it is determined that the microcomputer 2 has been activated by the IGNSW 9, and normal control processing is executed (step S120).

  However, when the wakeup signal Si3 is at a high level and the IGNSW signal Si1 is at a high level, the timer IC 4 outputs a wakeup signal Si3. The stop signal Si5 is set to a high level (step S125). As a result, the power supply to the timer IC 4 is cut off by the timer IC power cut-off switch 20, and the wake-up signal cut-off switch 21 is operated by the wake-up signal cut-off signal Si7. The output of the up signal Si3 is cut off.

  By doing so, the timer circuit (timer IC 4) can be shut off from the ECU 1, and the normal control process is not hindered, and the power of the ECU 1 can be stopped by turning off the IGNSW 9.

  If the IGNSW signal Si1 is at a low level and the wakeup signal Si3 is at a low level (step S130), that is, it is determined that a self-shutdown period is in effect, and a malfunction diagnosis of the timer circuit is executed (step S140). If there is no abnormality as a result of the failure diagnosis, the soak timer Tw for starting measurement after the microcomputer is stopped is set (step S170), and the count of the soak timer is started (step S180).

  Thereafter, the main relay power holding signal Si8 output from the microcomputer 2 is switched to the low level, the supply of the battery voltage VB from the main relay 6 is cut off, and the microcomputer 2 is stopped by setting the main power supply voltage Vm to the low level.

  On the other hand, if there is an abnormality, the diagnosis result is recorded in the storage unit of the ECU 1 (step S160), the main relay power holding signal Si8 output from the microcomputer 2 is switched to the low level, and the battery from the main relay 6 is switched. The supply of the voltage VB is cut off, and the microcomputer 2 is stopped by setting the main power supply voltage Vm to a low level.

  If the IGNSW signal Si1 is at a low level and the wakeup signal Si3 is at a high level, it is determined that the microcomputer 2 has been restarted by the soak timer (timer IC4) after the microcomputer has stopped, and the engine is stopped, such as an evaporative diagnosis or a water temperature sensor diagnosis Thereafter, a diagnosis that requires a certain time interval until the diagnosis is executed is executed (step S190).

  Thereafter, the diagnosis result is recorded in the storage unit of the ECU 1 (step S200), and the timer circuit operation stop signal Si5 output from the microcomputer 2 is set to the high level (step S210). As a result, the power supply to the timer IC 4 is cut off by the timer IC power cut-off switch 20, and the wake-up signal cut-off switch 21 is operated by the wake-up signal cut-off signal Si7. The output of the up signal Si3 is cut off.

  Finally, the main relay power holding signal Si8 output from the microcomputer 2 is switched to the low level, the supply of the battery voltage VB from the main relay 6 is cut off, and the microcomputer 2 is stopped by setting the main power supply voltage Vm to the low level. .

  After both the IGNSW signal Si1 and the wakeup signal Si3 become low level, the diagnosis result by the failure diagnosis unit 25 is recorded in the storage unit of the microcomputer 2, and the supply of the sub power supply voltage Vs to the timer IC 4 is cut off at the time of failure determination To do. When the failure diagnosis unit 25 determines that the failure diagnosis result of the timer IC 4 is abnormal, the power supply stop time to the microcomputer 2 is measured, and when the time reaches the set value, the operation of restarting the microcomputer 2 is performed. No processing.

  Next, the operation when the ECU 1 does not perform the functional failure diagnosis of the timer circuit will be described with reference to the timing charts of FIGS. First, normal operation will be described with reference to FIG.

  First, when the IGNSW 9 is turned on, the IGNSW signal Si1 becomes a high level, thereby turning on the main relay 6 and supplying the battery voltage VB to the power supply circuit 3. When the battery voltage VB is supplied to the power supply circuit 3, the main power supply voltage Vm is supplied to the microcomputer 2 and the microcomputer 2 is activated.

  When the microcomputer 2 is activated, the main relay power holding signal Si8 becomes high level, and normal engine control is performed during this period. At this time, no power is supplied to the timer IC 4.

  After that, when the IGNSW 9 is turned off, the microcomputer 2 switches the power supply activation signal Si4 of the timer IC 4 to a high level and activates the timer IC 4. Then, the microcomputer 2 sets a soak timer (Tw) for the timer IC 4 and starts time measurement by the timer IC 4.

  Thereafter, the microcomputer 2 switches the main relay power holding signal Si8 to the low level, cuts off the battery voltage VB from the main relay 6, and sets the main power supply voltage Vm to the low level. Thereby, the microcomputer 2 stops.

  After the end of the Tw time, the timer IC4 confirms that the counter is zero, and sets the wakeup signal Si3 to the high level. Then, a main relay drive signal is output from the main relay drive circuit 5, the main relay 6 is turned on, the battery voltage VB is supplied to the power supply circuit 3, and the microcomputer 2 is restarted by the main power supply voltage Vm.

  After restarting, the microcomputer 2 executes an evaporative diagnosis and records the diagnosis result in the storage unit of the ECU 1. Thereafter, the power activation signal Si4 of the timer IC 4 is switched to the low level, the timer IC 4 is stopped, the main relay power retention signal Si8 is switched to the low level, the battery voltage VB from the main relay 6 is shut off, and the main power voltage Vm is The microcomputer 2 is stopped by setting it to a low level. The above is the operation of the ECU 1 at the normal time.

  Here, for example, as shown in FIG. 4, when the wakeup signal Si3 does not return from the high level to the low level due to the abnormality of the timer IC4, the main relay 6 cannot be turned off, so the IGNSW 9 is turned on. / The battery voltage VB continues to be supplied to the power supply circuit 3 regardless of the off state, and the microcomputer 2 cannot be stopped by the main power supply voltage Vm. In such a situation, the battery power supply 10 consumes power remarkably.

  Further, for example, as shown in FIG. 5, when a failure has occurred in which the wakeup signal Si3 does not switch to a high level despite the counter 4b of the soak timer (timer IC4) being zero. The means for activating the microcomputer 2 is only on / off of the IGNSW 9, and the soak timer cannot be used, so that the evaporative diagnosis or the like cannot be executed.

  For example, when a failure has occurred in which the main relay drive permission signal Si2 does not switch to high level despite the wakeup signal Si3 being high level, the means for starting the microcomputer 2 is IGNSW9. Since the soak timer can no longer be used, it becomes impossible to execute an eval police diagnosis or the like.

  In order to cope with this, the microcomputer 2 executes a function failure diagnosis and a failure diagnosis process of the timer circuit during the self-shut period. The functional failure diagnosis / failure diagnosis processing of the timer circuit will be described with reference to the flowchart of FIG.

  The subroutine for performing functional failure diagnosis / failure diagnosis processing is called when the IGNSW 9 is turned off, the wake-up signal Si3 is at a low-high level, and the IGNSW 9 is changed from on to off.

  First, an arbitrary time Ts is set in the timer IC 4 and the timer count is started (step S310). Here, a functional failure diagnosis of the counter 4b of the timer IC 4 is performed.

  Simultaneously with the start of the timer count of the timer IC 4, the count of the internal counter built in the microcomputer 2 is started. After a predetermined time has elapsed, the counter value of the internal counter of the microcomputer 2 and the counter value of the timer IC 4 are simultaneously extracted, and it is determined by the comparator 4c whether or not both counter values are equal (step S320).

  If it is determined that the counter value of the internal counter of the microcomputer 2 and the counter value of the timer IC 4 are different, a failure of the counter 4b of the timer IC 4 is considered. By setting Si5 to the high level, the timer IC power cut-off switch 20 and the wake-up signal cut-off switch 21 are switched off and the wake-up signal Si3 is cut off (step S380). Thereafter, the diagnosis result (failure information) is stored in the storage unit of the microcomputer 2 (step S390).

  If it is determined that the counter value of the internal counter of the microcomputer 2 is equal to the counter value of the timer IC4, it can be determined that the counter 4b of the timer IC4 is normal. Therefore, the timer IC4 continues to count for the next diagnosis. Then, it is determined that the counter value of the timer IC 4 becomes zero (step S330). When the counter value of the timer IC 4 becomes zero, it is determined whether or not the wakeup signal Si3 is switched to a high level (step S340).

  If the wakeup signal Si3 is not switched to a high level, a failure of the comparator 4c of the timer IC 4 can be considered, so a diagnosis is determined. Also in this case, by setting the timer circuit operation stop signal Si5 from the microcomputer 2 to a high level, the timer IC power cut-off switch 20 and the wake-up signal cut-off switch 21 are switched off to switch off the wake-up signal. Si3 is shut off (step S380). Thereafter, the diagnosis result (failure information) is stored in the storage unit of the microcomputer 2 (step S390).

  If the wakeup signal Si3 is switched to the high level, the comparator 4c of the timer IC 4 can be determined to be normal, and the process proceeds to diagnosis. In the next diagnosis, a function failure diagnosis of the main relay drive circuit 5 is performed.

  In this diagnosis, the state of the output line monitor signal Si6 of the main relay drive circuit 5 is confirmed (step S350). If the output line monitor signal Si6 is not switched to the high level, a diagnosis failure is determined because a line failure on the main relay drive permission signal Si2 side or a logic circuit in the main relay drive circuit 5 is considered. Also in this case, by setting the timer circuit operation stop signal Si5 from the microcomputer 2 to a high level, the timer IC power cut-off switch 20 and the wake-up signal cut-off switch 21 are switched off to switch off the wake-up signal. Si3 is shut off (step S380). Thereafter, the diagnosis result (failure information) is stored in the storage unit of the microcomputer 2 (step S390).

  If the monitor signal Si6 of the main relay drive permission signal is switched to the high level, it can be determined that the line on the main relay drive permission signal Si2 side or the logic circuit in the main relay drive circuit 5 is functioning normally.

  Here, since the self-shut period is in progress, the level of the IGNSW signal Si1 should be low. That is, by performing the failure diagnosis during the self-shut period, the diagnosis can be performed on the line alone on the main relay drive permission signal Si2 side. That is, the fact that the level of the IGNSW signal Si1 is at a low level means that the functional failure diagnosis of the main relay drive circuit 5 can be performed in a state close to the actual use situation.

  Next, a functional failure diagnosis of the timer IC power switch 18 that forcibly stops the power supply of the timer IC 4 when the timer IC 4 runs away is performed. By setting the timer circuit operation stop signal Si5 from the microcomputer 2 to a high level, the timer IC power switch 18, the timer IC power cut-off switch 20, and the wake-up signal cut-off switch 21 are turned off, and the wake-up signal Si3 is cut off. (Step S360). By doing so, since the wake-up signal Si3 is not output to the main relay drive circuit 5, the operation of the ECU 1 can be stopped even if the timer IC 4 runs away.

  Here, the microcomputer 2 confirms the state of the wakeup signal Si3 (step S370). If the wakeup signal Si3 is at a high level, it is considered that the timer IC power switch 18 has not been normally turned off (opened). Therefore, diagnosis is determined. Also in this case, by setting the timer circuit operation stop signal Si5 from the microcomputer 2 to a high level, the timer IC power cut-off switch 20 and the wake-up signal cut-off switch 21 are switched off to switch off the wake-up signal. Si3 is shut off (step S380). Thereafter, the diagnosis result (failure information) is stored in the storage unit of the microcomputer 2 (step S390).

  If the wake-up signal Si3 is at a low level, it can be determined that the timer IC power switch 18 has been normally turned off (opened), and therefore can be determined to be functioning normally.

  After the above-described failure diagnosis, the main relay power holding signal Si8 output from the microcomputer 2 is switched to the low level, the supply of the battery voltage VB from the main relay 6 is cut off, and the main power supply voltage Vm is set to the low level. 2 is stopped (step S400).

  According to the present embodiment, as described above, the functional failure diagnosis is performed during the self-shut period immediately before the microcomputer stops, so that the reliability of the functional failure diagnosis is kept higher than that during the IGNSW on period. Can do. In addition, by performing the functional failure diagnosis during the self-shut period, it is possible to diagnose the main relay drive circuit.

1 ECU
2 Microcomputer 3 Power supply circuit 4 Timer IC
5 Main relay drive circuit 6 Main relay 8 Main relay driver IC
9 Ignition switch (IGNSW)
DESCRIPTION OF SYMBOLS 10 Battery 16 Main relay drive permission signal power supply switch 18 Timer IC power switch 20 Timer IC power cutoff switch 21 Wake-up signal cutoff switch 25 Fault diagnosis unit

Claims (7)

A power supply circuit that outputs a microcomputer operating voltage and outputs a timer operating voltage at all times by closing the main relay, a microcomputer that operates based on a microcomputer operating voltage output from the power supply circuit, and a timer that is constantly output from the power supply circuit A timer circuit that operates according to an operating voltage; and a main relay drive circuit that closes the main relay when either an external start signal input from the outside or an internal start signal output from the timer circuit is at an active level. When the external activation signal changes from the active level to the inactive level and the microcomputer operating voltage is not supplied from the power supply circuit to the microcomputer, the timer circuit counter starts measuring time and the specified time is The timer circuit outputs when it has passed Serial internal activation signal to the active level, the A vehicle electronic control unit which activates the microcomputer to supply the microcomputer operating voltage to the microcomputer emissions from the power supply circuit,
The microcomputer includes a failure diagnosis unit that performs a failure diagnosis process of the timer circuit during a delay time from when the external activation signal becomes an inactive level to when the operation of the microcomputer stops. An electronic control device for a vehicle.   The failure diagnosis unit compares a counter value of an internal counter built in the microcomputer with a count value of the counter of the timer circuit and determines whether or not both count values are the same. The vehicular electronic control device according to claim 1.   The failure diagnosis unit sets an arbitrary measurement time in the timer circuit and starts time measurement by the counter, and the internal activation signal changes from an inactive level to an active level when the arbitrary set time has elapsed. The vehicle electronic control device according to claim 1, wherein it is determined whether or not to perform the operation. A monitor line for confirming the state of the output line of the main relay drive circuit;
When the internal activation signal changes from the inactive level to the active level while the external activation signal is at the inactive level, the level of the input line of the main relay drive circuit changes from the inactive level to the active level. The vehicle electronic control device according to claim 1, wherein it is determined whether or not to perform the operation.   The failure diagnosis unit forcibly cuts off the supply of the timer operating voltage to the timer circuit when the internal activation signal is at an active level, and whether or not the internal activation signal changes from an active level to an inactive level. The vehicle electronic control device according to claim 1, wherein:   After both the external activation signal and the internal activation signal become inactive levels, the diagnosis result by the failure diagnosis unit is recorded in the storage unit of the microcomputer, and the timer operating voltage is supplied to the timer circuit at the time of failure determination The vehicle electronic control device according to claim 1, wherein the electronic control device for a vehicle is cut off.   When the failure diagnosis result of the timer circuit is determined to be abnormal by the failure diagnosis unit, an operation for measuring a power supply stop time to the microcomputer and restarting the microcomputer when the time reaches a set value The vehicle electronic control device according to any one of claims 1 to 6, wherein a process that is not performed is performed.

Images