JP2018067239A - Electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control device capable of continuing normal processing without stopping driving of a load.SOLUTION: In an electronic control device 1, an arithmetic device 2 outputs a control signal for controlling driving of an actuator 5 to an actuator driving device 4. A monitoring device 3 monitors operation of the arithmetic device and outputs a reset signal RST2 to the arithmetic device through a reset signal line 24 when an abnormality has occurred in the arithmetic device. A function monitoring part 19 determines whether or not the reset signal RST2 of the reset signal line 24 is a monitoring target reset signal generated when an original abnormality of the arithmetic device occurs or a non-monitoring-target reset signal generated when an abnormality other than the original abnormality of the arithmetic device occurs.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an electronic control device.

  There is generally provided a system in which a monitoring device monitors a watchdog signal issued by a computing device and outputs a reset signal to the computing device when an abnormality occurs in the watchdog signal. At this time, a technique is provided in which the monitoring device counts the number of reset signals issued to the arithmetic device and stops driving the actuator when a predetermined number of times is reached (see, for example, Patent Document 1).

JP 2002-235598 A

  In recent years, for example, when a power switch such as an ignition key is turned off by a user, for example, the electronic control device is expected to continue to output a stop signal for stopping driving of the actuator until the power supply of the electronic control device is turned off. It is rare. By making such improvements, functional safety can be enhanced.

  In this case, when the power switch is turned on again by the user while the arithmetic device is being finished, a reset signal is issued to the reset signal line in order to reset the arithmetic device. However, if it is not possible to determine whether the reset signal input to the reset signal line is a reset signal issued as an initialization signal of the arithmetic device or a reset signal when the arithmetic device is running out of control, For example, when the technique described in Patent Document 1 is applied, the number of times that the reset signal is issued is counted at an unintended timing, and the predetermined number of times is immediately reached, causing the actuator to stop driving. Thereby, there existed a subject that merchantability will be deteriorated.

  An object of the present invention is to provide an electronic control device that can continue normal processing without stopping driving a load even if a reset signal is issued at an unintended timing.

  According to the first aspect of the present invention, the reset signal input to the reset signal line by the determination unit becomes a monitoring target reset signal that occurs when the arithmetic device is inherently abnormal, or monitoring that occurs when the arithmetic device is not abnormally abnormal It is determined whether the reset signal is not applicable. For this reason, even if a reset signal is issued to the reset signal line, it is determined whether the reset signal is generated when the arithmetic device is originally abnormal or when it is not abnormal Can do. At this time, when the reset signal is generated at a time other than the original abnormality, the normal processing can be continued without stopping the load.

  According to the second aspect of the present invention, when the monitoring target reset signal is issued, the counting unit counts the number of times the monitoring target reset signal is generated, and the drive control stop output unit controls the driving of the load when the number of occurrences exceeds a predetermined value. Outputs a stop signal to stop. For this reason, when the monitoring target reset signal becomes equal to or higher than a predetermined value, the drive control of the load can be stopped. Even if a reset signal that is not monitored is issued to the reset signal line, the reset signal is not counted, so that the drive control of the load is not stopped.

The figure which shows the electrical structure of the electronic controller in one Embodiment functionally Timing chart showing the flow of processing (part 1) Flowchart explaining processing contents roughly Timing chart showing the flow of processing (part 2) Flow chart for schematically explaining the processing contents of the function monitoring unit

  Hereinafter, an embodiment of an electronic control device will be described with reference to the drawings. FIG. 1 functionally shows the electrical configuration of the electronic control unit. As shown in FIG. 1, the electronic control device 1 includes an arithmetic device 2, a monitoring circuit 3, and an actuator driving device (equivalent to a driving device) 4. The actuator driving device 4 may be configured outside the electronic control device 1.

  The arithmetic device 2 is, for example, a one-chip microcomputer, although not shown, for example, a CPU, a memory such as a ROM and a RAM, an I / O, an A / D conversion circuit, an interrupt control circuit, a system control circuit, and A communication circuit is provided. The arithmetic device 2 controls the drive of the actuator 5 as a load by executing a program stored in the memory. The actuator 5 is a vehicle load such as an electronic throttle, and a motor for opening and closing a throttle valve can be cited as an example.

  Sensor signals (or switch signals (not shown)) of various sensors 6 corresponding to the driver request are input to the arithmetic device 2. The sensor 6 is, for example, an accelerator position sensor. For example, the accelerator position sensor is a sensor that electrically converts an operation amount of an accelerator pedal that can be operated by a driver request, for example. As shown in FIG. 1, in the arithmetic device 2, the CPU executes processing based on a program stored in a ROM as a non-transitional recording medium with the above-described hardware configuration. Thereby, the arithmetic device 2 realizes at least the operation of the function blocks of the actual control unit 7, the actual control function monitoring unit 8, and the own monitoring control unit 9.

  The actual control unit 7 of the arithmetic device 2 inputs sensor signals of various sensors 6 at normal times, and actually drives and controls the actuator 5 based on the sensor signals (see Level 1 in FIG. 1). At this time, the actual control unit 7 outputs a control signal to the actuator driving device 4, and the actuator driving device 4 drives and controls the actuator 5 in accordance with the control signal.

  Further, the actual control unit 7 outputs a power relay holding signal 28 through the signal line to the inside of the monitoring circuit 3 and to a relay driving unit 14 described later. The power relay holding signal 28 is a signal for instructing the relay driving unit 14 to hold the power relay when the arithmetic device 2 drives and controls the actuator 5 through the actuator driving device 4 by the actual control unit 7. The command signal for the part 14 not to interrupt | block the power supply relay 26 accidentally is shown. The power relay holding signal 28 is also input to the function monitoring unit 19.

  The actual control function monitoring unit 8 is connected to an output line 10 for outputting an energization cutoff request signal to the actuator driving device 4. When the actual control unit 7 is driving the actuator 5 through the actuator driving device 4, the actual control function monitoring unit 8 monitors whether the actual control function by the actual control unit 7 is functioning normally and performs actual control. When an abnormality occurs in the function, an energization cutoff request signal is output to the actuator driving device 4 through the output line 10 (see Level 2 in FIG. 1). Thereby, the actuator drive device 4 stops the drive control of the actuator 5 and performs fail-safe processing. For example, when the actuator 5 is an electronic throttle, the fail-safe process allows the throttle valve opening to be maintained at a slight constant opening even if the sensor signal changes. Even if the degree of depression of the accelerator changes, the vehicle can travel at a constant speed (for example, 20 km / h). At this time, the arithmetic unit 2 notifies the driver that the process has shifted to the fail-safe process, so that the driver needs to request a repair shop to recover from this state.

  On the other hand, the self-monitoring control unit 9 communicates with the external monitoring device 3 and is configured to monitor and control the arithmetic device 2 itself according to the communication content. The watchdog signal generation unit 11 and the function A monitoring unit 12 is provided. The watchdog signal generation unit 11 generates a pulsed watchdog signal WD and outputs it to the monitoring device 3.

  On the other hand, the monitoring device 3 is configured integrally or separately from the arithmetic device 2 by, for example, an ASIC or a hybrid circuit of a microcomputer and an ASIC, and when the inside is functionally described, the waveform shaping unit 13, the relay driving unit 14, Functions as a power-on reset (POR) circuit 15, a power supply unit 16, and a monitoring unit 17 are provided.

  The waveform shaping unit 13 also functions as a power switch signal input unit. The monitoring unit 17 includes a watchdog signal (WD) monitoring unit 18 and a function monitoring unit 19. The function monitoring unit 19 functions as a determination unit and a drive control stop output unit, and monitors the function in cooperation with the function monitoring unit 12 of the arithmetic device 2 (see Level 3 in FIG. 1).

  The monitoring device 3 is connected to a power switch 22 by an ignition key switch. The power switch 22 is a switch used for starting an automobile engine, and outputs a power switch signal SW to the monitoring device 3. The power switch 22 may be, for example, an electronic push switch used for starting the engine. Hereinafter, signals output from the power switch 22 will be collectively referred to as a power switch signal SW. Since the power switch signal SW generates noise when the power switch 22 is switched, the power switch signal SW is input to the waveform shaping unit 13 in order to remove the noise. The waveform shaping unit 13 shapes the waveform by removing noise included in the power switch signal SW, and outputs the power switch signal SW to the function monitoring unit 19 in the monitoring unit 17 and to the relay driving unit 14.

  The relay drive unit 14 energizes the internal power supply unit 16 through the power relay 26 by turning on the power relay drive signal when the power switch signal SW is input from OFF to ON when the vehicle is started. When the battery power source Vbatt is energized, the power supply unit 16 generates the arithmetic device power source Vd and outputs it to the arithmetic device 2. The arithmetic device 2 starts to operate when the arithmetic device power supply Vd is supplied. When the arithmetic device power supply Vd is supplied, the arithmetic device 2 monitors itself. The communication function can be started through the communication bus 23 with the external monitoring device 3 by the control function.

  The watchdog signal monitoring unit 18 of the monitoring unit 17 monitors the watchdog signal WD generated by the watchdog signal generation unit 11 of the arithmetic unit 2, and when an abnormality occurs, the reset signal line 24 and the OR gate 27 are monitored. And outputs the reset signal RST2 as an active level.

  The function monitoring unit 19 of the monitoring unit 17 monitors whether the reset signal RST2 of the watchdog signal monitoring unit 18 becomes a monitoring target reset signal that occurs when the arithmetic device 2 is inherently abnormal or occurs other than when the arithmetic device 2 is inherently abnormal. It has a function as a discriminating unit that discriminates whether the reset signal is not applicable. The function monitoring unit 19 includes a counting unit 20 and a flag storage unit 21 in order to realize this discrimination function. The counting unit 20 includes a counter that counts the number of times the monitoring target reset signal is generated. The flag storage unit 21 includes a count prohibition flag storage area.

  The function monitoring unit 19 monitors the reset signal generated on the reset signal line 24, and the counting unit 20 counts the number of occurrences of the monitoring target reset signal. The function monitoring unit 19 ignores the non-monitoring target reset signal when it is a non-monitoring target reset signal that occurs at times other than the original abnormality, and the counting unit 20 does not count as the monitoring target reset signal. The function monitoring unit 19 is connected to an output line 25 for outputting an energization cutoff request signal to the actuator driving device 4. The function monitoring unit 19 outputs an energization cut-off request signal to the actuator driving device 4 through the output line 25 when an abnormality occurs based on the monitoring result by the watchdog signal monitoring unit 18. The drive control can be stopped. As a result, fail-safe processing is possible in multiple stages of Level 2 and Level 3.

  The operation in this embodiment will be described below. FIG. 2 shows a timing chart up to the transition to fail-safe processing when an abnormality that has occurred in the arithmetic unit 2 reaches a predetermined time. As shown in FIG. 2, when the power switch 22 is turned on at timing t <b> 1, the on signal of the power switch signal SW is given to the relay driving unit 14 through the waveform shaping unit 13 of the monitoring device 3. The relay drive unit 14 of the monitoring circuit 3 inputs the battery power Vbatt to the power supply unit 16 by turning on the power supply relay 26. The power supply unit 16 generates a power supply Vd for the arithmetic device 2 and outputs it to the arithmetic device 2. On the other hand, when the power switch 22 is turned on, the power-on reset circuit 15 outputs the reset signal RST1 as an active level as a reset Reset through the OR gate 27. However, when the input clock is stably input to the arithmetic unit 2, At timing t2, the reset signal RST1 is applied to the arithmetic unit 2 through the OR gate 27 as a non-active level. This cancels the reset.

  Thereafter, the actual control unit 7 of the arithmetic device 2 inputs a sensor signal from the sensor 6 and controls the driving of the actuator 5 through the actuator driving device 4. At this time, at the timing t3, the actual control unit 7 outputs the power relay holding signal 28 as an active state through the signal line, and this power relay holding signal 28 is given to the relay driving unit 14 and the function monitoring unit 19 of the monitoring device 3. It is done.

  Thereafter, the watchdog signal generation unit 11 of the arithmetic device 2 generates a pulse-like watchdog signal WD at timing t4 and starts to output it to the monitoring device 3. Thereafter, when any abnormality occurs in the arithmetic unit 2, the self-monitoring control unit 9 of the arithmetic unit 2 stops the pulse output of the watchdog signal WD by the watchdog signal generation unit 11 at timing t5. Then, the watchdog signal monitoring unit 18 of the monitoring device 3 measures the abnormality determination time with a timer (not shown), determines that the abnormality determination time is abnormal when the abnormality determination time reaches the threshold, and at timing t6. The reset signal RST2 is output as an active level to the arithmetic unit 2 through the reset signal line 24 and the OR gate 27, and the active level of the reset signal RST2 is output to the function monitoring unit 19. The arithmetic unit 2 resets itself when the reset level of the reset signal RST <b> 2 is input through the OR gate 27.

  FIG. 3 shows a schematic processing content of the function monitoring unit 19 in a flowchart. The function monitoring unit 19 monitors the reset signal RST2 issued to the reset signal line 24 by the watchdog signal monitoring unit 18 in S1 of FIG. Then, the function monitoring unit 19 executes the process of S2 of FIG. 3 at the timing t6 of FIG. 2, and determines whether the active level of the reset signal RST2 issued by the watchdog signal monitoring unit 18 is the monitoring target reset signal or not. Whether it is a reset signal is determined based on at least the power switch signal SW.

  Since the power switch signal SW is turned on at timing t6, the function monitoring unit 19 determines that the reset signal RST2 issued by the watchdog signal monitoring unit 18 is a monitoring target reset signal, and counts in S3 of FIG. The number of times the reset signal RST2 is issued is incremented by the unit 20. At the timing t6 in FIG. 2, since the number of times the reset signal is issued is less than a predetermined value (for example, twice), the function monitoring unit 19 returns the process to S1 in FIG. Continue to monitor the reset signal RST2.

  Since the reset signal RST2 is input as an active level to the arithmetic device 2, the arithmetic device 2 is restarted by the reset function. Then, the arithmetic unit 2 starts to output the pulse-like watchdog signal WD again at the timing t7 in FIG. Thereafter, when any abnormality occurs in the arithmetic device 2, the arithmetic device 2 stops the pulse output of the watchdog signal WD at the timing t8 in FIG.

  Then, the watchdog signal monitoring unit 18 of the monitoring device 3 measures the abnormality determination time using a timer, and determines that the abnormality is detected when the abnormality determination time reaches the threshold, and the reset signal RST2 at timing t9 in FIG. Is output to the reset signal line 24. Thereby, the active level of the reset signal RST2 is input to the arithmetic unit 2 and the function monitoring unit 19. The arithmetic unit 2 resets the arithmetic unit 2 itself when the active level of the reset signal RST2 is input through the OR gate 27 at the timing t9 in FIG.

  On the other hand, at the same time, the function monitoring unit 19 of the monitoring device 3 executes the determination process of S2 of FIG. 3 at timing t9 of FIG. 2, and the reset signal RST2 issued by the watchdog signal monitoring unit 18 is the monitoring target reset signal. Whether it is a non-monitoring target reset signal is determined based on at least the power switch signal SW.

  Since the power switch signal SW is turned on at timing t9, the function monitoring unit 19 determines that the active level of the reset signal RST2 issued by the watchdog signal monitoring unit 18 is the monitoring target reset signal, and the function monitoring unit 19 of FIG. In S3, the counting unit 20 increments the number of times the reset signal RST2 is issued. At the timing t9 in FIG. 2, since the number of times the reset signal RST2 is issued is equal to or greater than a predetermined value (for example, twice), the function monitoring unit 19 outputs an energization cutoff request signal to the actuator driving device 4. Thereby, the drive of the actuator 5 can be stopped and a fail safe process can be performed.

When fail-safe processing is performed, a notification device (not shown) notifies the outside. Therefore, the driver safely stops the vehicle and turns off the power switch 22 at timing t10 in FIG.
When the power switch 22 is turned off, the relay drive unit 14 of the monitoring device 3 inputs an off signal of the power switch signal SW. The power switch signal SW is input to the actual control unit 7 of the arithmetic unit 2 through the waveform shaping unit 13. Is also entered. When the real control unit 7 of the arithmetic device 2 receives the OFF signal of the power switch signal SW, the real control unit 7 performs a shutdown process, a so-called stop process.

  Even while the arithmetic device 2 is performing the stop process, the relay drive unit 14 of the monitoring device 3 continues the on-control of the power relay 26 for a predetermined time T2 that is expected to be longer than the end time of the stop process. . Thereby, the power supply unit 16 of the monitoring device 3 supplies the arithmetic device power supply Vd to the arithmetic device 2 for a predetermined time T2.

  At the same time, the power switch signal SW is also input to the function monitoring unit 19 through the waveform shaping unit 13. As described above, the relay drive unit 14 continues the on-control of the power supply relay 26 for the predetermined time T2 while the arithmetic device 2 is performing the stop process. During this time, the function monitoring unit 19 requests the energization interruption. The signal is continuously output to the actuator driving device 4. Then, when the predetermined time T2 has elapsed at the timing t11 in FIG. 2, the relay drive unit 14 turns off the power supply relay 26. Then, the power supply unit 16 stops supplying power to the arithmetic device 2.

  Since the function monitoring unit 19 continuously outputs the energization cutoff request signal to the actuator driving device 4 until the relay driving unit 14 turns off the power supply relay 26 and the power supply unit 16 turns off the power supply Vd for the arithmetic unit, The actuator driving device 4 does not start to drive the actuator 5 until the power output of the unit 16 is turned off, and the functional safety can be improved.

  Therefore, even if the power switch 22 is turned off while the arithmetic unit 2 is performing the stop process, it is possible to prevent a malfunction according to the off operation. Thereafter, when the power switch 22 is turned on again, the process is repeated as shown after the timing t21 in FIG. 2, but the description of this process is omitted.

  FIG. 4 is a timing chart showing the operation of each part when the power switch 22 is turned on again immediately after it is turned off from the on state. In particular, an operation explanatory diagram when the power switch 22 is turned on again while the arithmetic unit 2 is performing the stop process is shown. In the description shown in FIG. 4, in addition to the contents shown in FIG. 2, the count prohibition flag held by the function monitoring unit 19 in the flag storage unit 21 and the count value by the counting unit 20 are also illustrated. FIG. 5 shows the ON condition of the count prohibition flag using a flowchart.

  Also in the flow shown in FIG. 4, when the power switch 22 is turned on as in the description of FIG. 2 described above, the arithmetic unit 2 outputs the watch dog signal WD as shown at timings t1 to t5. If an abnormality occurs, the arithmetic unit 2 performs a reset process based on the abnormality as shown at timings t5 to t6 in FIG. The function monitoring unit 19 regards the reset signal RST2 as a monitoring target reset signal, and counts the issuance count by the counting unit 20. At timing t6 in FIG. 4, it is counted as one time. As shown in FIG. 4, during the timings t1 to t6 and the like, the function monitoring unit 19 holds the count prohibition flag in the flag storage unit 21 while being off.

  Thereafter, when the power switch 22 is turned off at timing t31 in FIG. 4, the arithmetic unit 2 starts a stop process. Although the arithmetic unit 2 starts the stop process, the power relay holding signal 28 is continuously input even when the power switch 22 is turned on again at the timing t32 when the period Ta (<T2) has elapsed from the timing t31. Therefore, the power supply unit 16 continues to supply power to the arithmetic device power supply Vd. Since power is continuously supplied to the monitoring device 3, the power-on reset circuit 15 does not output the reset signal RST1. However, when the power switch signal SW is turned from OFF to ON at timing t32, the arithmetic unit 2 intentionally stops the watchdog signal WD and resets itself.

  On the other hand, as shown in FIG. 5, the function monitoring unit 19 of the monitoring device 3 inputs the power relay holding signal 28 at the timing t32 when the power switch signal SW is turned on, and the power relay holding signal 28 is active. If the state continues, YES is determined in steps S11 and S12 in FIG. 5, and the count prohibition flag is turned from OFF to ON at timing t32 in FIG. See also S13 in FIG.

  When the function monitoring unit 19 executes the determination process shown in S2 of FIG. 3 at timing t33 in FIG. 4, whether the reset signal RST2 issued by the watchdog signal monitoring unit 18 is a monitoring target reset signal is reset. Determine if it is a signal.

  At this time, since the function monitoring unit 19 turns on the count prohibition flag of the flag storage unit 21, the watchdog signal monitoring unit 18 outputs the reset signal RST2, and the function monitoring unit 19 resets the reset signal RST2 in S1 of FIG. Even if this is monitored, the reset signal RST2 is regarded as a non-monitoring reset signal, and the process returns to S1 in FIG. 3 without incrementing the number of times the reset signal RST2 is issued. As a result, the number of issuance times of the reset signal RST2 is held as it was last time (for example, once) without being counted. Refer to the count value of the counter 20 at the timing t33 in FIG.

  After that, the function monitoring unit 19 monitors the reset signal RST2 and confirms that the non-active level “L” is input, and then returns the count prohibition flag in the flag storage unit 21 to OFF at timing t34 in FIG. The arithmetic unit 2 starts normal operation by returning the watchdog signal WD that was intentionally stopped at the timing t35 in FIG.

  For this reason, even if the arithmetic device 2 intentionally stops the watchdog signal WD when the power switch 22 is turned off and on again while the arithmetic device 2 is stopping, the monitoring device 3, the reset signal RST <b> 2 due to the stop of the watchdog signal WD is regarded as a non-monitored reset signal and is not counted by the counting unit 20. For this reason, it is possible to return to normal operation and continue normal control without fail-safe processing and retreating.

<Comparative example>
If processing such as setting a count prohibition flag is not performed, when the power switch 22 is turned off from on and turned on again, the number of resets is counted more than a predetermined number, and the process proceeds to fail safe processing. There is a risk that.

<Summary>
The features of the present embodiment are conceptually summarized.
When abnormality occurs in the arithmetic device 2, the monitoring device 3 outputs the active level of the reset signal RST2 to the arithmetic device 2 through the reset signal line 24. The function monitoring unit 19 monitors whether the active level of the reset signal RST2 issued to the reset signal line 24 becomes a monitoring target reset signal that occurs when the arithmetic device 2 is inherently abnormal or occurs other than when the arithmetic device 2 is inherently abnormal. It is determined whether the reset signal is not applicable. For this reason, even if the active level of the reset signal RST2 is issued to the reset signal line 24, the active level of the reset signal RST2 is generated at the time of the original abnormality of the arithmetic unit 2, or other than at the time of the original abnormality. It can be determined whether it has occurred. At this time, if it occurs at a time other than the original abnormal time, normal control can be continued without shifting to the fail-safe process.

  Further, when the active level of the monitoring target reset signal RST2 is issued, the counting unit 20 counts the number of occurrences of the monitoring target reset signal RST2. When the number of occurrences exceeds a predetermined value, the function monitoring unit 19 outputs an energization cutoff request signal for stopping the drive control of the actuator 5 to the actuator drive device 4 as a stop signal. For this reason, when the monitoring target reset signal RST2 becomes equal to or higher than the predetermined value, the drive control of the actuator 5 can be stopped and the process can be shifted to the fail-safe process.

  Further, even if the reset signal RST2 that is not monitored is issued to the reset signal line 24, the number of times the active level “H” of the reset signal RST2 is issued is not counted, and the drive control of the actuator 5 is stopped. And there is no transition to fail-safe processing.

  When the function monitoring unit 19 outputs the energization cut-off request signal to the actuator drive device 4, the energization cut-off request signal is continued until the power supply unit 16 is turned off. Therefore, until the power supply unit 16 is turned off. The actuator driving device 4 can no longer start driving the actuator 5, and the functional safety can be improved.

  The function monitoring unit 19 inputs a power supply relay holding signal 28 that outputs a command to hold the power supply when the arithmetic device 2 drives and controls the actuator 5 through the actuator driving device 4, and the power supply at the timing when the power switch signal SW is turned on from off. Depending on the relay holding signal 28, it is determined whether the reset signal RST2 is a monitoring target reset signal or a non-monitoring target reset signal. Thereby, it is possible to accurately determine whether the reset signal is a monitoring target reset signal or a non-monitoring target reset signal.

  A specific example will be described in detail. On the condition that immediately before the reset signal RST2 is issued, the power relay holding signal 28 is in an active state at the timing when the power switch signal SW is turned on from off, the function calculation is performed. The unit 19 turns on the count prohibition flag from OFF and stores it in the flag storage unit 21. Therefore, even if the reset signal RST2 is subsequently issued, the number of times the reset signal RST2 is issued is not counted.

  Once the transition to fail-safe processing has occurred, it may be necessary to inspect and repair again with a dealer or the like, but by performing processing as shown in this embodiment, it is normal that there is no need to transition to fail-safe processing. Control can continue. Thereby, deterioration of merchantability can be prevented while ensuring the reliability of the vehicle.

  FIG. 5 shows the on condition of the count prohibition flag. However, at the timing t1 shown in FIGS. 1 and 4, the power switch 22 is turned on from the off state when the vehicle is started as usual, and the condition of S11 is satisfied. Even at this timing t1, since the power relay holding signal 28 is at the non-active level, the condition of S12 is not satisfied, and the count prohibition flag is not turned on from off.

(Other embodiments)
The present invention is not limited to the above-described embodiments, can be implemented with various modifications, and can be applied to various embodiments without departing from the gist thereof. For example, the following modifications or expansions are possible.

In addition to the monitoring device 3, a configuration having the function of the function monitoring unit 19 may be provided separately, and the function monitoring unit 19 outside the monitoring device 3 may execute the process.
The reference numerals in parentheses described in the claims indicate the correspondence with the specific means described in the embodiment described above as one aspect of the present invention, and limit the technical scope of the present invention. It is not a thing. An aspect in which a part of the above-described embodiment is omitted as long as the problem can be solved can be regarded as the embodiment. In addition, any conceivable aspect can be regarded as an embodiment as long as it does not depart from the essence of the invention specified by the words described in the claims.

  Moreover, although this invention was described based on embodiment mentioned above, it understands that this invention is not limited to the said embodiment and structure. The present invention includes various modifications and modifications within an equivalent range. In addition, various combinations and forms, as well as other combinations and forms including one element, more or less, are within the scope and spirit of the present disclosure.

  In the drawings, 1 is an electronic control device, 2 is a computing device, 3 is a monitoring device, 5 is an actuator (load), 13 is a waveform shaping unit (power switch signal input unit), 16 is a power supply unit, and 19 is a function monitoring unit ( (Determination unit, drive control stop output unit), 20 is a counting unit, and 24 is a reset signal line.

Claims (5)

An arithmetic unit (2) that outputs a control signal for driving and controlling the load (5) to the driving unit (4);
A monitoring device (3) that monitors the operation of the arithmetic device and outputs a reset signal (RST2) to the arithmetic device through a reset signal line (24) when the arithmetic device is abnormal;
A determination unit that determines whether a reset signal of the reset signal line is a monitoring target reset signal that is generated when the arithmetic device is abnormal or a non-monitoring reset signal that is generated when the arithmetic device is not abnormal. 19)
An electronic control device comprising: A counter (20) for counting the number of occurrences of the monitoring target reset signal when issuing the monitoring target reset signal;
A drive control stop output unit (19) for outputting a stop signal for stopping the drive control of the load when the number of occurrences of the monitoring target reset signal counted by the counting unit exceeds a predetermined value;
The electronic control device according to claim 1, further comprising: A power supply unit (16) for supplying power to the arithmetic device to the arithmetic device;
The electronic control device according to claim 2, wherein the drive control stop output unit continues the stop signal until the power supply unit turns off the power supply for the arithmetic device when outputting the stop signal. A power switch signal input unit (13) for inputting a power switch signal (SW);
The determination unit inputs a power relay holding signal (28) that outputs a power holding command when the arithmetic device controls driving of the load, and sets the power relay holding signal at a timing at which the power switch signal is turned on. 4. The electronic control device according to claim 1, wherein the electronic control device determines whether the reset signal is the monitoring target reset signal or the non-monitoring target reset signal. A counter (20) for counting the number of occurrences of the monitoring target reset signal when issuing the monitoring target reset signal;
5. The counting unit does not count the number of occurrences of the monitoring target reset signal when the determination unit determines that the signal input to the reset signal line is the non-monitoring reset signal. The electronic control device described.

Images