JP2018078682A - Electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control device capable of reducing an execution frequency of fail-safe processing with a failure of a power supply circuit.SOLUTION: An ECU 1 comprises a main microcomputer 11, a sub microcomputer 12, a first power supply circuit 15, a second power supply circuit 16 and an abnormality detection part 20. Output voltages of the first power supply circuit 15 and the second power supply circuit 16 are supplied to the main microcomputer 11 and the sub microcomputer 12 via an internal power supply line Ln that is constructed inside the ECU 1. The first power supply circuit 15 is activated in a case where an ignition switch 8 is turned on, and starts outputting a predetermined target application voltage. The abnormality detection part 20 successively monitors the output voltage of the first power supply circuit 15. In a case where the output voltage of the first power supply circuit 15 is out of a normal range, the abnormality detection part 20 outputs an abnormality detection signal indicating that the first power supply circuit 15 is under an abnormal operation. In a case where the abnormality detection part 20 outputs the abnormality detection signal, the first power supply circuit 15 is stopped, and the second power supply circuit 16 is activated instead.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an electronic control device that is mounted on an automobile and that performs a predetermined fail-safe process when a power supply circuit provided in the electronic control device fails.

  A device (so-called electronic control device) for controlling a predetermined actuator mounted on a vehicle is a microcomputer (hereinafter referred to as a control microcomputer) or a power supply circuit that executes various arithmetic processes based on data input from an in-vehicle sensor. Is provided. The power supply circuit is a circuit that generates electric power suitable for the operation of the control microcomputer or the like based on electric power provided from an in-vehicle power source such as an in-vehicle battery.

  Also, this type of electronic control device generally has an abnormality detection function for monitoring whether a control microcomputer, a power supply circuit, and the like are operating normally. If the abnormality detection function detects a predetermined abnormal event, the control microcomputer or the like executes fail-safe processing corresponding to the abnormal event.

  For example, when an abnormality in the power supply circuit is detected by the abnormality monitoring function, the control microcomputer or the like stops the operation of the actuator to be controlled or limits the output of the actuator to a predetermined level or less as fail-safe processing. To do.

  Patent Document 1 proposes a configuration in which a power supply circuit, a microcomputer, and the like are duplicated in order to prevent the function provided by the electronic control device from suddenly stopping due to a failure of the power supply circuit. .

Japanese Patent Laid-Open No. 2006-128308

  Since the power supply circuit handles the power supplied from the in-vehicle power supply, a large number of components (hereinafter referred to as high power components) that can withstand large power are required. Generally, a high-power component is more likely to fail than a component that handles relatively small power (hereinafter referred to as a low-power component). Therefore, when the power supply circuit is duplicated as disclosed in Patent Document 1, there is a concern about an increase in failure rate due to an increase in power supply circuit components (particularly high power components).

  When the failure rate of the power supply circuit increases, the frequency at which fail-safe processing accompanying abnormality detection is also increased. When the execution frequency of the fail-safe process that restricts the function of the vehicle (for example, the output torque of the drive source) increases, there is a possibility that the user may feel uncomfortable or bothered.

  The present invention has been made based on this situation, and an object of the present invention is to provide an electronic control device capable of reducing the frequency of execution of fail-safe processing accompanying a failure of a power supply circuit.

  In order to achieve the object, the present invention provides a control microcomputer (11, 12) which is a microcomputer for controlling the operation of a predetermined actuator mounted on a vehicle based on data input from a sensor mounted on the vehicle. A first power supply circuit (15) as a power supply circuit that generates a voltage for driving the control microcomputer from a voltage supplied from a power supply device mounted on the vehicle and supplies the voltage to the control microcomputer; and a first power supply circuit An abnormality detection unit (20) for detecting an abnormal operation of the first power supply circuit based on the voltage output from the power supply circuit, and a power supply circuit different from the first power supply circuit, activated according to the detection result of the abnormality detection unit A second power supply circuit (16) for supplying power to the control microcomputer, and the first power supply circuit receives a start signal that is a signal for starting control from a predetermined signal source The power supply to the control microcomputer is started as a trigger, and the second power supply circuit is stopped when the abnormal operation of the first power supply circuit is not detected by the abnormality detection unit. 1 Power supply circuit is activated when an abnormal operation is detected.

  In the above configuration, when the abnormal operation of the first power supply circuit is not detected by the abnormality detection unit (hereinafter, normal), the second power supply circuit is not operating. Therefore, even if the second power supply circuit is out of order at the normal time, the failure does not appear as a malfunction (in other words, is detected). Therefore, it is possible to reduce the frequency of execution of fail-safe processing accompanying a failure of the power supply circuit.

  In addition, the code | symbol in the parenthesis described in the claim shows the correspondence with the specific means as described in embodiment mentioned later as one aspect, Comprising: The technical scope of this invention is limited is not.

It is a figure which shows the structure of the vehicle system containing ECU1 which concerns on this embodiment. It is a block diagram showing a schematic structure of ECU1 concerning this embodiment. 2 is a diagram illustrating an example of a configuration of a first power supply circuit 15. FIG. 3 is a diagram illustrating an example of a configuration of a second power supply circuit 16. FIG. It is a time chart which shows the action | operation of each part at the time of ECU1 starting. It is a time chart which shows the operation | movement of each part at the time of the 1st power supply circuit 15 failure. 4 is a time chart showing an operation when the IGSW 8 is turned off when a failure of the first power supply circuit 15 occurs. It is a time chart which shows the operation | movement at the time of IGSW8 OFF when the 1st power supply circuit 15 is operate | moving normally. It is the figure which showed the modification of ECU1. It is the figure which showed the modification of ECU1. It is the figure which showed the modification of ECU1.

  Hereinafter, an electronic control device (hereinafter referred to as an ECU: Electronic Control Unit) 1 to which the present invention is applied will be described with reference to the drawings. ECU1 in this embodiment controls the output of the drive source (for example, engine) of a vehicle based on the data input from the sensor (namely, vehicle-mounted sensor) mounted in the vehicle.

  Of course, as another aspect, the ECU 1 may control a steering actuator or a braking system. Moreover, ECU1 may control operation | movement of the motor as a drive source, and charging / discharging of a battery. The control object of ECU1 and the service of ECU1 should just be designed suitably. Further, the ECU 1 may be used in a vehicle (that is, a hybrid car) that includes both an engine and a motor as a drive source, or a vehicle (that is, an electric vehicle) that includes only a motor as a drive source.

  The ECU 1 according to this embodiment is mounted on a vehicle including an engine as a drive source, and is electrically connected to the in-vehicle battery 2. Further, as shown in FIG. 1, the ECU 1 includes an electronic throttle 3, an accelerator sensor 4, a throttle sensor 5, and a warning light 6, and a communication network built in the vehicle (hereinafter referred to as LAN: Local Area Network). 7 is connected.

  The in-vehicle battery 2 is a secondary battery that supplies a predetermined battery voltage Vb to the ECU 1. The in-vehicle battery 2 corresponds to the power supply device described in the claims. In addition, the power supply line (hereinafter referred to as B line) to which the output voltage of the in-vehicle battery 2 (hereinafter referred to as battery voltage Vb) is constantly applied to the vehicle and the ignition switch (hereinafter referred to as IGSW) 8 are set to ON by the user. In some cases, there is a power line to which the battery voltage Vb is applied (hereinafter referred to as an IG power line). The ECU 1 is connected to each of the B line and the IG power line.

  The electronic throttle 3 is a combination of a throttle valve 31 that adjusts the amount of intake air to the engine and a motor (hereinafter referred to as a throttle motor) 32 as an actuator for moving the throttle valve 31 as one product. The output torque of the throttle motor 32 is controlled by the ECU 1. Note that the electronic throttle 3 may be electrically connected to the ECU 1 so that the control signal of the ECU 1 is input without going through the LAN 7.

  The accelerator sensor 4 is a sensor that detects an operation position of an accelerator pedal by a driver as an accelerator operation amount. The throttle sensor 5 is a sensor that detects the position of the throttle valve 31 (in other words, the rotation angle) as the throttle opening. Detection results of the accelerator sensor 4 and the throttle sensor 5 are sequentially provided to the ECU 1.

  The warning light 6 is a device for notifying an occupant that a predetermined malfunction has occurred in the power supply circuit of the ECU 1, and is realized by using, for example, an LED or the like. The warning light 6 operates (that is, lights or blinks) based on an instruction from the ECU 1.

  The ECU 1 controls the throttle motor 32 based on data input from the accelerator sensor 4 and the throttle sensor 5. This indirectly controls the engine output torque. As shown in FIG. 2, the ECU 1 includes a main microcomputer 11, a sub-microcomputer 12, a first communication driver 13, a second communication driver 14, a first power supply circuit 15, a second power supply circuit 16, a drive maintaining unit 17, a first power supply. An activation unit 18, a second power supply activation unit 19, an abnormality detection unit 20, a stabilization filter 21, and a delay filter 22 are provided.

  The main microcomputer 11 and the sub-microcomputer 12 are a microcomputer (hereinafter referred to as a microcomputer) realized by using a CPU as a central processing unit, a ROM that is a nonvolatile storage medium, a RAM that is a volatile storage medium, a register, and the like. It is. The main microcomputer 11 is configured to operate in a predetermined voltage range. That is, a lower limit value and an upper limit value as operating voltages are defined.

  Here, as an example, it is assumed that the main microcomputer 11 is configured to operate at a voltage of 4.0V to 5.5V. Similarly, the sub-microcomputer 12 is configured to operate at a voltage of 4.0V to 5.5V. For convenience, the voltage range in which the main microcomputer 11 and the sub microcomputer 12 operate is hereinafter referred to as a microcomputer operation range. The microcomputer operating range corresponds to the operating voltage range described in the claims.

  The main microcomputer 11 and the sub microcomputer 12 are connected so as to be capable of bidirectional communication. The main microcomputer 11 is connected to the first communication driver 13 so as to be capable of bidirectional communication. The sub-microcomputer 12 is connected to the second communication driver 14 so as to be capable of bidirectional communication. The main microcomputer 11 has a reset input terminal as an input terminal for a reset signal.

  The sub-microcomputer 12 includes an input terminal to which an output signal from the abnormality detection unit 20 is input. The sub-microcomputer 12 includes a first power holding terminal, a second power holding terminal, and a clear signal output terminal as signal output terminals. The sub-microcomputer 12 includes a nonvolatile memory 121 that is a rewritable nonvolatile storage medium. The operation of the main microcomputer 11 and the sub microcomputer 12 will be described later separately.

  Each of the main microcomputer 11 and the sub microcomputer 12 corresponds to the control microcomputer described in the claims. In particular, the main microcomputer 11 corresponds to the first microcomputer described in the claims, and the sub-microcomputer 12 corresponds to the second microcomputer described in the claims.

  Hereinafter, as an example, it is assumed that each unit included in the ECU 1 is configured to operate in positive logic. Of course, each part with which ECU1 is provided as another mode may be constituted so that it may operate by negative logic. The drive maintaining unit 17, the first power supply activation unit 18, the second power supply activation unit 19, the abnormality detection unit 20, and the like are configured to output low level, high level, and two level signals.

  The first communication driver 13 is a driver circuit for the main microcomputer 11 to communicate with other devices (for example, ECUs, sensors, etc.) connected to the LAN 7. The second communication driver 14 is a driver circuit for the sub-microcomputer 12 to communicate with other devices (for example, ECUs and sensors) connected to the LAN 7. In the present embodiment, a configuration in which a communication driver for the main microcomputer 11 and a communication driver for the sub-microcomputer 12 are separately provided is adopted, but the present invention is not limited to this. The main microcomputer 11 and the sub microcomputer 12 may share one communication driver.

  The first power supply circuit 15 is a circuit module that converts the battery voltage Vb input from the in-vehicle battery 2 into a predetermined voltage suitable for the operation of the main microcomputer 11 and outputs the voltage. Here, as an example, it is assumed that the target value (hereinafter referred to as target applied voltage) of the voltage input to the main microcomputer 11 and the sub-microcomputer 12 is set to 5V. That is, the first power supply circuit 15 of the present embodiment converts the battery voltage Vb = 12V into 5V as the target applied voltage and outputs it.

  The first power supply circuit 15 is configured to be able to output a current of 550 mA based on the electric power input from the in-vehicle battery 2. That is, the first power supply circuit 15 functions as an internal power supply for supplying 5V, 550 mA of power to the main microcomputer 11 and the like. V1 shown in FIG. 2 represents the output voltage of the first power supply circuit 15 (hereinafter referred to as the first output voltage). The first power supply circuit 15 is configured such that the first output voltage V1 falls within the range of 4.95V to 5.05V.

  FIG. 3 is a diagram illustrating an example of a specific circuit configuration of the first power supply circuit 15. As shown in FIG. 3, the first power supply circuit 15 includes a first power supply IC 151 on which a power conversion circuit 151 a and a voltage control circuit 151 b are mounted, a conversion additional circuit 152, and a control additional circuit 153.

  The battery voltage Vb = 12V is input to the conversion additional circuit 152. The conversion additional circuit 152 converts the battery voltage Vb into power so that the output voltage becomes a predetermined intermediate voltage V1a in cooperation with the power conversion circuit 151a. The intermediate voltage V1a may be a value higher than the target applied voltage 5V and lower than the battery voltage Vb. Here, as an example, the intermediate voltage V1a is set to 6V.

  The control additional circuit 153 receives an intermediate voltage V1a that is an output voltage of the conversion additional circuit 152. The aforementioned first output voltage V1 is the output voltage of the control additional circuit 153. The additional control circuit 153 cooperates with the voltage control circuit 151b to convert the intermediate voltage V1a so that the first output voltage V1 becomes the target applied voltage.

  In addition, since a power converter circuit and a constant voltage circuit are known, these detailed description is abbreviate | omitted. Further, the first power supply circuit 15 may be realized by a configuration other than the configuration shown in FIG. The first power supply circuit 15 may be realized with the aid of a known circuit configuration.

  The first power supply circuit 15 described above includes a terminal connected to the output terminal of the first power supply activation unit 18 (hereinafter referred to as a first activation input terminal) as a signal input terminal. The first power supply circuit 15 is driven when a high-level signal is input from the first power supply activation unit 18, and outputs 5V as the output voltage V1. When the signal input from the first power supply activation unit 18 is not at a high level, that is, when a low level signal is input, the first power supply circuit 15 stops. When the first power supply circuit 15 is stopped, the first output voltage V1 is 0V. The high level signal output from the first power supply activation unit 18 functions as a drive signal for the first power supply circuit 15.

  The output terminal of the first power supply circuit 15 is connected to an internal power supply line Ln that is a power supply line. Therefore, when the first power supply circuit 15 is operating normally, 5V is applied to the internal power supply line Ln. The internal power supply line Ln is connected to the power supply terminals of the main microcomputer 11 and the sub-microcomputer 12. Furthermore, the internal power supply line Ln is also connected to the abnormality detection unit 20. Further, the output terminal of the second power supply circuit 16 is also connected to the internal power supply line Ln.

  The second power supply circuit 16 is a circuit module that converts the battery voltage Vb input from the in-vehicle battery 2 into a target applied voltage and outputs the target applied voltage. That is, the second power supply circuit 16 of the present embodiment converts the battery voltage Vb = 12V into 5V as the target applied voltage and outputs it.

  The second power supply circuit 16 is configured to be able to output a current of up to 50 mA based on the electric power input from the in-vehicle battery 2. That is, the second power supply circuit 16 functions as an internal power supply that supplies 5V and 50 mA of power. V2 shown in FIG. 2 represents the output voltage of the second power supply circuit 16 (hereinafter, the second output voltage).

  FIG. 4 is a diagram illustrating an example of a specific circuit configuration of the second power supply circuit 16. As shown in FIG. 4, the second power supply circuit 16 includes a second power supply IC 161 on which the voltage control circuit 161a is mounted, and a control additional circuit 162.

  The battery voltage Vb is input to the control additional circuit 162. The second output voltage V2 described above is an output voltage of the control additional circuit 162. The control additional circuit 162 cooperates with the voltage control circuit 161a to convert the battery voltage Vb so that the second output voltage V2 becomes the target applied voltage. The second power supply circuit 16 may be realized by a configuration other than the configuration shown in FIG. The second power supply circuit 16 may be realized with the aid of a known circuit configuration.

  The second power supply circuit 16 described above includes a terminal connected to the output terminal of the second power supply activation unit 19 (hereinafter referred to as a second activation input terminal) as an input terminal. The second power supply circuit 16 is driven when a high level signal is input from the second power supply starting unit 19 and outputs 5 V as the second output voltage V2. When a high level signal is not input from the second power supply activation unit 19, in other words, when a low level signal is output from the second power supply activation unit 19, the second power supply circuit 16 stops. When the second power supply circuit 16 is stopped, the second output voltage V2 is 0V. The high level signal output from the second power supply activation unit 19 functions as a drive signal for the second power supply circuit 16.

  The output terminal of the second power supply circuit 16 is connected to the internal power supply line Ln. Therefore, when the second power supply circuit 16 is operating normally, 5V is applied to the internal power supply line Ln. However, as will be described later, the second power supply circuit 16 is configured not to operate while the first power supply circuit 15 is operating normally.

  The drive maintaining unit 17 includes two input terminals and one output terminal, and one of the two input terminals is connected to the IG power line. The other input terminal is connected to a first power holding terminal included in the sub-microcomputer 12.

  The drive maintaining unit 17 is configured to output a logical sum of two input signals, and may be realized using a known OR circuit. The known OR circuit includes a wired OR. When the IGSW 8 is set to ON, a voltage signal (that is, a high level signal) equal to or higher than a predetermined threshold is input to the IG power line.

  The drive maintaining unit 17 outputs a high level signal when the IGSW 8 is turned on or when a high level signal is input from the sub-microcomputer 12. When the IGSW 8 is not set to ON and the first holding signal is not input from the sub-microcomputer 12, a low level signal is output. The output signal of the drive maintaining unit 17 is input to the first power supply starting unit 18 and the delay filter 22. A high level signal input from the IG power supply line to the drive maintaining unit 17 when the IGSW 8 is turned on corresponds to the activation signal described in the claims. The IGSW 8 corresponds to the signal source recited in the claims.

  The first power supply activation unit 18 includes two input terminals and one output terminal, and one of the two input terminals is connected to the output terminal of the drive maintaining unit 17. That is, the output signal of the drive maintaining unit 17 is input to the first power supply starting unit 18. The other input terminal receives a signal obtained by inverting the output signal of the second power supply starting unit 19. That is, a low level is input when the output signal of the second power supply activation unit 19 is at a high level, while a high level is input when the output signal of the second power supply activation unit 19 is at a low level. .

  The first power supply activation unit 18 is configured to output a logical product of two inputs and may be realized using a well-known AND circuit. The first power supply activation unit 18 outputs a high level signal when the output of the drive maintaining unit 17 is at a high level and the output of the second power supply activation unit 19 is at a low level. In other cases, that is, when the output of the drive maintaining unit 17 is at a low level or when the output of the second power supply starting unit 19 is at a high level, a low level signal is output.

  The second power supply activation unit 19 includes two input terminals and one output terminal, and one of the two input terminals is connected to the output terminal of the abnormality detection unit 20. The other input terminal is connected to a second power holding terminal included in the sub-microcomputer 12.

  The second power supply starting unit 19 is configured to output a logical sum of two input signals, and may be realized using a known OR circuit. The second power supply activation unit 19 outputs a high level signal when the abnormality detection unit 20 outputs a high level signal or when a high level signal is input from the sub-microcomputer 12. The second power supply activation unit 19 outputs a low level signal when the abnormality detection unit 20 does not output a high level signal and the second power supply holding signal is not input from the sub-microcomputer 12. .

  The output signal of the second power supply activation unit 19 is input to the second power supply circuit 16. Further, the output terminal of the second power supply starting unit 19 is also connected to a reset input terminal provided in the main microcomputer 11. Therefore, while the second power supply starting unit 19 outputs the high level signal, the main microcomputer 11 is held in the reset state, and the operation is stopped. Further, the output signal of the second power supply activation unit 19 is input to the first power supply activation unit 18 with the high level / low level inverted.

  The abnormality detection unit 20 is connected to the internal power supply line Ln. While the abnormality detection unit 20 is activated, the value of the voltage applied to the internal power supply line Ln is sequentially acquired. Then, when the voltage applied to the internal power supply line Ln becomes a value outside the predetermined normal range, the event is detected as an abnormal operation of the first power supply circuit 15. That is, the abnormality detection unit 20 does not operate normally when the voltage applied to the internal power supply line Ln becomes a value outside the predetermined normal range (in other words, the abnormality is detected). This corresponds to a configuration for determining that it has occurred.

  As described later, until the abnormal operation of the first power supply circuit 15 is detected after the IGSW 8 is turned on, the second power supply circuit 16 is not operated, and the output voltage of only the first power supply circuit 15 is the internal power supply. Applied to line Ln. Therefore, monitoring the voltage applied to the internal power supply line Ln corresponds to monitoring the output voltage of the first power supply circuit 15.

  That is, the abnormality detection unit 20 is configured to detect an abnormal operation of the first power supply circuit 15 based on the output voltage of the first power supply circuit 15. Note that detecting an abnormal operation of the first power supply circuit 15 corresponds to determining whether or not the first power supply circuit 15 is operating normally. Here, it is assumed that the lower limit value of the normal range is higher than the lower limit value of the microcomputer operation range, and the upper limit value of the normal range is set lower than the upper limit value of the microcomputer operation range. For example, the normal range may be 4.5V to 5.2V. The normal range corresponds to the normal voltage range described in the claims.

  The abnormality detection unit 20 outputs a low level signal when the output voltage of the first power supply circuit 15 is within the normal range (including the boundary value). In addition, the abnormality detection unit 20 outputs a high level signal when the output voltage of the first power supply circuit 15 is outside the normal range. The high level signal output from the abnormality detection unit 20 functions as a signal indicating that an abnormality has occurred in the first power supply circuit 15. Therefore, the high level signal output by the abnormality detection unit 20 is also referred to as an abnormality detection signal. The abnormality detection unit 20 may be realized using a comparator, an AND circuit, or the like. Of course, as another aspect, the abnormality detection unit 20 may be realized by executing software by the CPU.

  In addition to the input terminals described above, the abnormality detection unit 20 includes an input terminal (hereinafter referred to as a clear signal input terminal) to which a clear signal output from the sub-microcomputer 12 is input. Once the abnormality detection unit 20 detects an abnormal operation of the first power supply circuit 15, it continues to output a high level signal until a clear signal is input from the sub-microcomputer 12. In other words, once the high level signal is output, the abnormality detection unit 20 holds the output level at a high level (in other words, latches) until the clear signal is input. An output signal from the abnormality detection unit 20 is input to the second power supply activation unit 19 and the sub-microcomputer 12. In addition, the fact that the abnormality detection unit 20 continues to output the high level signal corresponds to holding the determination result that the first power supply circuit 15 is not operating normally.

  The abnormality detection unit 20 is connected to the output terminal of the drive maintaining unit 17 through a delay filter 22 and a stabilization filter 21 as shown in FIG. That is, the output signal of the drive maintaining unit 17 is input to the abnormality detection unit 20 via the stabilization filter 21 and the delay filter 22. The abnormality detection unit 20 is activated when a high level signal is input from the delay filter 22 and starts monitoring the output voltage of the first power supply circuit 15.

  The stabilization filter 21 is a filter for stabilizing the input level to the delay filter 22. The voltage applied to the IG power line is likely to fluctuate depending on the operating state of the alternator and other electronic devices (for example, other ECUs) connected to the IG power line. If the output level of the drive maintaining unit 17 vibrates due to such voltage fluctuation, the abnormality detection unit 20 may malfunction. By interposing the stabilization filter 21 between the drive maintaining unit 17 and the abnormality detecting unit 20, the output of the drive maintaining unit 17 can be stabilized and the possibility that the abnormality detecting unit 20 malfunctions can be reduced.

  The delay filter 22 sets the activation timing of the abnormality detection unit 20 so that the abnormality detection unit 20 is activated after the first power supply circuit 15 is activated (in other words, after starting to output 5 V as the target applied voltage). It is a filter for adjusting. Adjusting the activation timing of the abnormality detection unit 20 corresponds to adjusting the timing of transmitting the high level signal input from the drive maintaining unit 17 to the abnormality detection unit 20 via the stabilization filter 21. The delay filter 22 may be realized using a capacitor or a resistor.

  The significance of introducing the delay filter 22 is as follows. There is a delay of a predetermined time Ta from when the IGSW 8 is turned on until the first output voltage V1 rises to 5V. If the delay filter 22 does not exist, the abnormality detection unit 20 is activated before the completion of the activation of the first power supply circuit 15, and as a result, the voltage drop state before the activation of the first power supply circuit 15 is changed to the first power supply circuit. There is a risk of erroneous detection as 15 abnormal operations. On the other hand, by providing the delay filter 22, the abnormality detection unit 20 is activated after the first power supply circuit 15 is started up. Therefore, the possibility of the above malfunction can be reduced.

  That is, the abnormality detection unit 20 is configured to start at a timing when a predetermined time has elapsed from the time when the high-level signal is input to the ECU 1 from the IG power supply line. The delay filter 22 plays a role of separating a voltage drop state before the completion of the startup of the first power supply circuit 15 and a voltage drop state at the time of failure of the first power supply circuit 15.

  The main microcomputer 11 is a microcomputer that calculates a control target amount for a predetermined control target (here, the electronic throttle 3) based on data such as an accelerator depression amount provided from the first communication driver 13. For example, the main microcomputer 11 calculates the control amount of the throttle motor 32 from the accelerator operation amount detected by the accelerator sensor 4 and outputs the control amount to the electronic throttle 3 via the first communication driver 13 and the LAN 7. .

  Further, the main microcomputer 11 monitors whether or not the sub-microcomputer 12 is operating normally by bidirectional communication with the sub-microcomputer 12. Whether or not the sub-microcomputer 12 is operating normally can be determined using a known method such as a watchdog timer method or a homework answering method. The watchdog timer method is a method for determining that the sub-microcomputer 12 is operating abnormally when the watchdog timer expires without being cleared by the watchdog pulse input from the sub-microcomputer 12.

  In the homework answering method, the main microcomputer 11 sends a predetermined monitoring signal to the sub-microcomputer 12, and the sub-microcomputer 12 is normal depending on whether the answer returned from the sub-microcomputer 12 is correct. This is a method for determining whether or not. In the homework answering method, the sub-microcomputer 12 generates a response signal corresponding to the monitoring signal input from the main microcomputer 11 and returns it to the main microcomputer 11. When the content of the response signal received from the sub-microcomputer 12 is different from the data corresponding to the transmitted monitoring signal, or when the response signal is not returned from the main microcomputer 11 within a predetermined time limit. It is determined that the sub-microcomputer 12 is not operating normally (that is, operating abnormally). When the main microcomputer 11 detects an abnormal operation of the sub-microcomputer 12, the main microcomputer 11 executes a predetermined return process such as resetting the sub-microcomputer 12.

  The power supply terminal of the main microcomputer 11 is connected to the internal power supply line Ln and operates based on the power supplied from the first power supply circuit 15 or the second power supply circuit 16. The reset input terminal of the main microcomputer 11 is connected to the output terminal of the second power supply starting unit 19. The reset input terminal is an input terminal for stopping the operation of the main microcomputer 11 and returning to the initial state when a high level signal as a reset signal is input.

  Therefore, the main microcomputer 11 stops its operation when the output signal of the second power supply starting unit 19 is at a high level. Note that the case where the output signal of the second power supply activation unit 19 is at a high level is a case where the second power supply circuit 16 is driven due to, for example, an abnormal operation of the first power supply circuit 15. Therefore, when the second power supply circuit 16 operates, the main microcomputer 11 is stopped.

  The sub-microcomputer 12 performs monitoring (that is, status monitoring) as to whether or not the main microcomputer 11 is operating normally by bidirectional communication with the main microcomputer 11. Whether or not the main microcomputer 11 is operating normally can be determined by using a known method as described above. When the sub-microcomputer 12 detects an abnormal operation of the main microcomputer 11, the sub-microcomputer 12 executes a predetermined process such as resetting the main microcomputer 11.

  Further, the sub-microcomputer 12 includes an input terminal (hereinafter referred to as a monitor terminal) to which the output signal of the abnormality detection unit 20 is input. The sub-microcomputer 12 performs a predetermined fail-safe process when a high level signal is input to the monitor terminal from the abnormality detection unit 20, in other words, when the abnormality detection unit 20 detects an abnormal operation of the first power supply circuit 15. Run.

  For example, the sub-microcomputer 12 shifts the operation of the engine to the retreat travel mode by stopping the drive of the throttle motor 32 as fail-safe processing. The retreat travel mode is an operation mode in which the output torque of the engine is limited to a predetermined suppression level or less. The retreat travel mode allows the user to retreat the vehicle to a safe place. If the sub-microcomputer 12 is connected to the throttle motor 32 via a drive circuit, the retreat travel may be realized by cutting off the output of the drive circuit.

  In addition, the sub-microcomputer 12 notifies other ECUs connected to the LAN 7 that a failure has occurred in the ECU 1 as fail-safe processing. In addition, the sub-microcomputer 12 may turn on the warning lamp 6 as fail-safe processing. By turning on the warning lamp 6, it is possible to notify the user that a problem has occurred in the ECU 1. In addition, information (for example, date and time) indicating a situation when an abnormality occurs in the first power supply circuit 15 may be recorded in the nonvolatile memory 121.

  The sub-microcomputer 12 executes a predetermined shutdown process when the IGSW 8 is turned off. For example, the sub-microcomputer 12 writes data necessary for the next startup to the nonvolatile memory 121 or clears the RAM as a shutdown process.

  In addition, the sub-microcomputer 12 checks whether or not the second power supply circuit 16 operates normally as a shutdown process when the IGSW 8 is turned off while the first power supply circuit 15 is operating normally (hereinafter referred to as “the first power supply circuit 15”). (Inspection processing) is performed, and the inspection result is written in the nonvolatile memory. The inspection procedure for the second power supply circuit 16 will be described later separately. As a result of the inspection process, when it is confirmed that the second power supply circuit 16 is operating normally, the fact that the second power supply circuit 16 is normal is written in the nonvolatile memory 121. For convenience, data indicating that the second power supply circuit 16 is normal is referred to as operation confirmation data.

  Further, the sub-microcomputer 12 outputs a high level signal from the first power supply holding terminal until the abnormality detection unit 20 detects the abnormality of the first power supply circuit 15 after the activation. Further, when an abnormal operation of the first power supply circuit 15 is detected by the abnormality detection unit 20, the output level from the first power supply holding terminal is shifted to a low level.

  While the high level signal is output from the first power supply holding terminal, the output of the drive maintaining unit 17 is also maintained at the high level. Therefore, even when the user unexpectedly switches to the IGSW 8 while the vehicle is running, the vehicle control by the main microcomputer 11 and the sub-microcomputer 12 can be continued. The high level signal output from the first power supply holding terminal functions as a signal for maintaining the state where the first power supply circuit 15 is driven. Therefore, the high level signal output from the first power holding terminal is also referred to as a first power holding signal.

  Further, the sub-microcomputer 12 outputs a low level signal from the second power supply holding terminal when the abnormality detection unit 20 does not detect the abnormal operation of the first power supply circuit 15. When the abnormality detection unit 20 detects an abnormal operation of the first power supply circuit 15, it starts to output a high level signal from the second power supply holding terminal. Once the high level signal starts to be output from the second power holding terminal, the state is maintained until the IGSW 8 is turned off and a predetermined shutdown process is completed.

  While the high level signal is output from the second power supply holding terminal, the output of the second power supply starting unit 19 is also maintained at the high level. Therefore, while the second power supply circuit 16 continues to operate, the first power supply circuit 15 stops. This is because when the output of the second power supply activation unit 19 is at a high level, the output of the first power supply activation unit 18 is at a low level.

  The high level signal output from the second power supply holding terminal functions as a signal for maintaining the state where the second power supply circuit 16 is driven. Therefore, the high level signal output from the second power holding terminal is also referred to as a second power holding signal.

  In addition, the sub-microcomputer 12 outputs a high level signal as a clear signal from the clear signal output terminal when the IGSW 8 is turned off while the high level signal is being output from the second power supply holding terminal. As a result, the output level of the abnormality detection unit 20 shifts to a low level.

  Note that the sub-microcomputer 12 is designed to have less arithmetic processing to be executed than the main microcomputer 11. Therefore, the current required for driving the sub-microcomputer 12 is less than the current required for driving the main microcomputer 11. Further, when the first power supply circuit 15 fails, the main microcomputer 11 stops its operation, so that the main microcomputer 11 does not consume current. Therefore, the current supply capability of the second power supply circuit 16 can be designed to be lower than the current supply capability of the first power supply circuit 15. In the present embodiment, it is adopted that the IGSW 8 is turned off as a condition for terminating the control process by the ECU 1 (hereinafter referred to as an ending condition), but is not limited thereto. The termination condition may be appropriately designed according to the service of the ECU 1.

<Operation when ECU 1 is started>
Next, the operation of each component when the IGSW 8 is turned on and the ECU 1 is activated will be described using the time chart shown in FIG. T10 shown in FIG. 5 represents the timing when the IGSW 8 is turned on.

  (A) in FIG. 5 represents the voltage applied to the IG power supply line. (B) to (H) are outputs of the drive maintaining unit 17, the first power supply activation unit 18, the first power supply circuit 15, the delay filter 22, the abnormality detection unit 20, the second power supply activation unit 19, and the second power supply circuit 16. Represents. (I) represents a voltage applied to the internal power supply line Ln, and (J) and (K) represent operating states of the main microcomputer 11 and the sub-microcomputer 12.

  (L) and (M) in FIG. 5 represent output levels of the first power holding terminal and the second power holding terminal. (N) shows the recorded contents of the operation check data. Here, as an example, it is assumed that data indicating that the second power supply circuit 16 is normal is recorded as operation confirmation data in the nonvolatile memory 121 by the previous inspection process.

  When the IGSW 8 is set to ON, the battery voltage Vb is applied to the drive maintaining unit 17, so that the output level of the drive maintaining unit 17 is high as shown in (B). Further, when the ECU 1 is activated, the output level of the second power source holding unit 19 and the output level of the abnormality detection unit 20 are low level, and therefore the output level of the second power source activation unit 19 is low level. Therefore, as shown in (C), the output level of the first power supply starting unit 18 also becomes high level, and the first power supply circuit 15 starts to start. That is, the first power supply circuit 15 starts supplying power to the main microcomputer 11 and the like with the IGSW 8 turned on as a trigger.

  Ta shown in (D) of FIG. 5 represents the time required for the output voltage to converge to the target applied voltage after starting the first power supply circuit 15 (that is, the rise time). A time Tb shown in (E) represents a delay time from when the high level signal is input to when the high level signal is output in the delay filter 22. The delay filter 22 is configured such that the delay time Tb is longer than the rise time of the first power supply circuit 15.

  When the rising of the first power supply circuit 15 is completed, 5V is applied also to the internal power supply line Ln, so that the main microcomputer 11 and the sub microcomputer 12 are activated. The sub-microcomputer 12 starts to output a high level signal from the first power supply holding terminal in the course of the initialization process associated with activation. When activated, the sub-microcomputer 12 clears the operation confirmation data as shown in (N). That is, data indicating that the second power supply circuit 16 is normal is deleted.

  When the first power supply circuit 15 is operating normally, in other words, when the first output voltage V1 is within the normal range, the output level of the abnormality detection unit 20 is at a low level. The level of the signal output from the second power supply holding terminal by the sub-microcomputer 12 is also low. Therefore, the second power supply activation unit 19 is maintained in a stopped state. Therefore, the second output voltage V2 is 0V.

<Operation when the first power supply circuit fails>
Next, the operation of each component when the first power supply circuit 15 performs an abnormal operation (for example, a voltage drop) will be described using the time chart shown in FIG. T20 shown in FIG. 6 represents the timing when the voltage of the first power supply circuit 15 falls below the lower limit value of the normal range.

  FIG. 6A shows the voltage applied to the IG power line, in other words, the on / off state of the IGSW 8. (B) to (F) represent the outputs of the first power supply activation unit 18, the first power supply circuit 15, the abnormality detection unit 20, the second power supply activation unit 19, and the second power supply circuit 16. (G) represents the voltage applied to the internal power supply line Ln, and (H) and (I) represent the output levels of the first power holding terminal and the second power holding terminal. (J) and (K) represent the operating states of the main microcomputer 11 and the sub-microcomputer 12. Note that the outputs of the drive maintaining unit 17 and the delay filter 22 are maintained at a high level as long as at least the IGSW 8 is on. Therefore, the illustration of these outputs is omitted here.

  When the first power supply circuit 15 fails and the first output voltage V1 falls below the lower limit value of the normal range, the abnormality detection unit 20 detects the voltage behavior as an abnormal operation of the first power supply circuit 15. Therefore, as shown in (C), the abnormality detection unit 20 starts to output a high level signal from time T20.

  Further, as the output level of the abnormality detection unit 20 transitions to a high level, the output level of the second power supply activation unit 19 also transitions to a high level. For this reason, the first power supply activation unit 18 does not satisfy the AND condition and starts outputting a low level signal.

  The second power supply circuit 16 is activated in response to the input of the high level signal from the second power supply activation unit 19, and starts to output 5V. Further, the first power supply circuit 15 stops its operation because the output level of the first power supply activation unit 18 has become low level. That is, when the first power supply circuit 15 fails, the second power supply circuit 16 supplies 5V to the internal power supply line Ln instead of the first power supply circuit 15. Therefore, as shown in FIG. 6, power supply to various microcomputers is maintained. As shown in (H) and (I), the sub-microcomputer 12 stops the output of the first power supply holding signal with the output of the second power supply holding signal.

  In the present embodiment, when the first power supply circuit 15 fails, the reset signal is still input to the main microcomputer 11. Thereby, when the first power supply circuit 15 fails, the main microcomputer 11 substantially stops operating.

  According to such a configuration, after the abnormality detection of the first power supply circuit 15, the configuration that requires electric power in the ECU 1 is reduced. Therefore, the current supply capability of the second power supply circuit 16 can be designed to be lower than the current supply capability of the first power supply circuit 15. As a result, the introduction cost of the second power supply circuit 16 can be reduced. Even when the main microcomputer 11 is stopped, various fail-safe processes are executed by the sub-microcomputer 12, so that the same safety as in the prior art can be ensured.

<About the shutdown process when the first power supply fails>
Next, the operation of each component when the IGSW 8 is turned off in the state where the second power supply circuit 16 is driven will be described using the time chart shown in FIG. Even after the IGSW 8 is set to OFF, the sub-microcomputer 12 continues to operate for a fixed time (for example, 1 second) and performs a predetermined shutdown process (for example, data saving). T30 shown in FIG. 7 represents a timing when the IGSW 8 is turned off, and T31 represents a timing when the shutdown process of the sub-microcomputer 12 is completed.

  FIG. 7A shows the voltage applied to the IG power supply line. (B) represents the operating state of the sub-microcomputer 12. (C) to (H) represent outputs of the abnormality detection unit 20, the second power supply holding terminal, the second power supply activation unit 19, and the second power supply circuit 16. (G) represents the voltage applied to the internal power supply line Ln.

  The sub-microcomputer 12 outputs a clear signal to the abnormality detection unit 20 when the IGSW 8 is turned off. Therefore, as shown in (C), the output signal of the abnormality detection unit 20 is at a low level. On the other hand, the sub-microcomputer 12 continues to output the second power holding signal as shown in (D) until the shutdown process is completed at time T31. Therefore, the output level of the second power supply starting unit 19 is maintained at a high level until time T31. Therefore, even after the IGSW 8 is turned off, the second power supply circuit 16 continues to operate for a predetermined time and continues to output 5V.

  The sub-microcomputer 12 uses the power supplied from the second power supply circuit 16 in this way to complete the shutdown process, and finally stops outputting the second power supply holding signal.

<Shutdown process when the first power supply is healthy>
Next, with reference to the time chart shown in FIG. 8, the operation of each component when the IGSW 8 is turned off while the first power supply circuit 15 is operating normally (that is, without an abnormality). explain. Even after the IGSW 8 is set to OFF, the main microcomputer 11 and the sub-microcomputer 12 continue to operate for a predetermined time (for example, 1 second), and perform a predetermined shutdown process (for example, data saving). When the IGSW 8 is turned off without any abnormality in the first power supply circuit 15 after the IGSW 8 is turned on, the sub-microcomputer 12 executes an inspection process as part of the shutdown process.

  7 represents the timing when the IGSW 8 is turned off, and T41 represents the timing when the shutdown process of the main microcomputer 11 is completed. T42 represents the timing when the shutdown process in the sub-microcomputer 12 is completed.

  Even after the IGSW 8 is turned on, the sub-microcomputer 12 continues to output the first power holding signal as shown in (D). Therefore, the output of the first power supply activation unit 18 is also maintained at a high level. As a result, the state where 5V generated by the first power supply circuit 15 is applied to the internal power supply line Ln continues. The main microcomputer 11 and the sub-microcomputer 12 each execute a shutdown process with the power supplied by the first power supply circuit 15.

  When the main microcomputer 11 completes its own shutdown process, the main microcomputer 11 outputs a signal indicating that fact (hereinafter, an end notification) to the sub-microcomputer 12. When receiving the end notification from the main microcomputer 11, the sub-microcomputer 12 outputs the second power holding signal and stops outputting the first power holding signal.

  Thereby, the 1st power supply circuit 15 stops. In addition, since the second power supply activation unit 19 becomes high level by the second power supply holding signal, when the second power supply circuit 16 is healthy, the second power supply circuit 16 is activated and starts to output 5V. If the sub-microcomputer 12 is operating at the timing when the predetermined time Tchk has elapsed since the output of the second power supply holding signal, the sub-microcomputer 12 indicates that the second power supply circuit 16 is normal and the second power supply data Is recorded in the nonvolatile memory 121. Finally, the output of the second power holding signal is stopped, and the second power circuit 16 is stopped.

  As described above, when the sub-microcomputer 12 performs the inspection process after the IGSW 8 is turned off, when the second power supply circuit 16 operates normally, the nonvolatile memory 121 indicates that the second power supply circuit 16 is normal. You can leave data. Further, when the second power supply circuit 16 has failed and the second power supply circuit 16 has not started up normally, an address (hereinafter referred to as a test result record) where the second power supply data is to be recorded in the nonvolatile memory 121. Nothing is recorded in (Address). That is, the second power supply data remains cleared.

  Therefore, according to the above configuration, whether the second power supply circuit 16 operates normally by referring to the test result recording address of the nonvolatile memory 121 when the sub-microcomputer 12 is turned on next time when the IGSW 8 is turned on. Can be recognized. If the second power supply circuit 16 is out of order, the warning lamp 6 is turned on, or other ECUs are notified that a malfunction has occurred in the ECU 1.

<Summary of Embodiment>
In the above configuration, when the abnormal operation of the first power supply circuit 15 is not detected by the abnormality detection unit 20 (hereinafter, normal), the second power supply circuit 16 does not operate. Therefore, even if the second power supply circuit is out of order at the normal time, the failure does not appear as a malfunction (in other words, is detected). Therefore, it is possible to reduce the frequency of execution of fail-safe processing accompanying a failure of the power supply circuit.

  The case where the second power supply circuit 16 operates is only when the inspection process is executed and when the first power supply circuit 15 fails. That is, the operation time of the second power supply circuit 16 is shorter than the operation time of the first power supply circuit 15. Therefore, it is possible to suppress the probability that the second power supply circuit 16 will fail due to the increase in the total operation time.

  Further, when the first power supply circuit 15 fails, the second power supply circuit 16 is activated to supply power to the sub-microcomputer 12. The sub-microcomputer 12 operates with power supplied from the second power supply circuit 16 and executes fail-safe processing such as realization of retreat travel. Therefore, it is possible to provide the same safety and convenience as the prior art disclosed in Patent Document 1.

  In the above configuration, the normal range is set within the microcomputer operation range. According to such a configuration, the power source can be switched to the second power supply circuit 16 before the various microcomputers are stopped.

  Further, in the above configuration, not only the lower limit value but also the upper limit value is defined as the normal range. Therefore, not only the voltage drop but also the case where the first output voltage V1 becomes abnormally high can be detected as an abnormal operation. Further, when the output voltage of the first power supply circuit 15 becomes a value exceeding the upper limit value of the normal range, the first power supply circuit 15 is stopped. According to such a configuration, it is possible to reduce the risk of applying a voltage exceeding the upper limit value of the microcomputer operating range (that is, overvoltage) to the main microcomputer 11 and the sub-microcomputer 12. Therefore, it is possible to reduce the risk that the main microcomputer 11 and the sub-microcomputer 12 will fail due to the failure of the first power supply circuit 15.

  By the way, as another aspect, a configuration in which the second power supply circuit 16 is operated without stopping the first power supply circuit 15 even after the abnormal operation of the first power supply circuit 15 is detected is conceivable. In such a configuration, when a failure occurs in the first power supply circuit 15 that outputs a voltage higher than the output voltage (here, 5V) of the second power supply circuit 16, the second power supply circuit 16 substantially functions. No longer. This is because the first power supply circuit 15 and the second power supply circuit 16 output a voltage to a common power supply line (that is, the internal power supply line Ln). In response to such a problem, in the above configuration, when an abnormal operation of the first power supply circuit 15 is detected, the first power supply circuit 15 is stopped, so that the output voltage of the second power supply circuit 16 can function. .

  In the above configuration, when at least one of the output of the abnormality detection unit 20 and the output of the second power holding terminal of the sub-microcomputer 12 is at a high level, the second power supply circuit 16 continues to operate. Therefore, even when the signal line through which the output signal of the abnormality detection unit 20 flows is disconnected, the power supply can be continued. That is, the vehicle control by the ECU 1 can be continued.

  Moreover, according to the said structure, it can suppress that a power supply is turned off by the failure of one signal wire | line during execution of important control, such as driving | running | working, and it stops control. As a result, reliability can be improved.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to the above-mentioned embodiment, The various modifications described below are also contained in the technical scope of this invention, and also in addition to the following However, various modifications can be made without departing from the scope of the invention.

  In addition, about the member which has the same function as the member described in the above-mentioned embodiment, the same code | symbol is attached | subjected and the description is abbreviate | omitted. In addition, when only a part of the configuration is mentioned, the configuration of the above-described embodiment can be applied to the other portions.

[Modification 1]
In the above-described embodiment, the mode in which the normal range is set within the microcomputer operation range is disclosed, but the present invention is not limited to this. The normal range may be set larger than the microcomputer operating range so as to include the microcomputer operating range. For example, the normal range may be set to 3.9 V to 5.6 V with respect to the microcomputer operating range (4.0 to 5.5 V).

[Modification 2]
In order to realize the second power supply circuit 16 at a lower cost, a control mode in which the main microcomputer 11 is stopped during the operation of the second power supply circuit 16 has been disclosed. This is because the current supply capability required for the second power supply circuit 16 can be designed low if the main microcomputer 11 is stopped.

  On the other hand, as another mode, both the main microcomputer 11 and the sub-microcomputer 12 may be operated even when the second power supply circuit 16 is operated. In that case, it is assumed that the second power supply circuit 16 is configured to have a capability of supplying a current necessary for driving both the main microcomputer 11 and the sub-microcomputer 12. FIG. 9 shows an example of a circuit configuration in which the main microcomputer 11 can operate even when the second power supply circuit 16 operates.

[Modification 3]
In the above description, the configuration in which the first power supply circuit 15 stops when the abnormality detection unit 20 detects an abnormality in the first power supply circuit 15 is disclosed, but is not limited thereto. For example, as shown in FIG. 10, a configuration in which the first power supply circuit 15 continues to operate even after the abnormality detection unit 20 detects an abnormality in the first power supply circuit 15 may be adopted.

  In the configuration shown in FIG. 10, since the output terminal of the second power supply starting unit 19 and the reset input terminal of the main microcomputer 11 are connected, the main microcomputer is detected after the abnormality of the first power supply circuit 15 is detected. 11 stops. FIG. 11 shows a configuration in which both the main microcomputer 11 and the first power supply circuit 15 continue to operate even after the abnormality of the first power supply circuit 15 is detected.

[Modification 4]
In the embodiment described above, the sub-microcomputer 12 has only a limited vehicle control function such as retreat travel, but is not limited thereto. The sub-microcomputer 12 may have a function for executing vehicle control similar to that of the main microcomputer 11. In addition, although the aspect in which the ECU 1 is activated when the IGSW 8 is turned on has been disclosed above, the activation trigger of the ECU 1 is not limited thereto. The ECU 1 may be activated when a signal indicating that the charging plug is connected is input, or may be activated spontaneously upon expiration of an internal timer or the like. A signal that functions as a trigger for starting power supply by the main microcomputer 11 and an output source (that is, a signal source) of the signal may be appropriately designed.

DESCRIPTION OF SYMBOLS 1 ECU (electronic control apparatus), 2 vehicle-mounted battery, 3 electronic throttle, 8 ignition switch, 11 main microcomputer, 12 sub microcomputer, 13 1st communication driver, 14 2nd communication driver, 15 1st power supply circuit, 16 2nd power supply Circuit, 17 Drive maintenance unit, 18 First power supply startup unit, 19 Second power supply startup unit, 20 Abnormality detection unit, 21 Stabilization filter, 22 Delay filter, Ln Internal power supply line

Claims (10)

A control microcomputer (11, 12) that is a microcomputer that controls the operation of a predetermined actuator mounted on the vehicle based on data input from a sensor mounted on the vehicle;
A first power supply circuit (15) as a power supply circuit for generating a voltage for driving the control microcomputer from a voltage supplied from a power supply device mounted on the vehicle and supplying the control microcomputer;
An abnormality detector (20) for detecting an abnormal operation of the first power supply circuit based on a voltage output from the first power supply circuit;
A second power supply circuit (16) that is different from the first power supply circuit and that is activated in accordance with a detection result of the abnormality detection unit and supplies power to the control microcomputer;
The first power supply circuit starts power supply to the control microcomputer triggered by the input of a start signal that is a signal for starting the control from a predetermined signal source,
The second power supply circuit includes:
When the abnormal operation of the first power supply circuit is not detected by the abnormality detection unit, it is stopped,
The electronic control device is activated when an abnormal operation of the first power supply circuit is detected by the abnormality detection unit. In claim 1,
In the control microcomputer, a lower limit value and an upper limit value of a voltage at which the control microcomputer operates are set as an operating voltage range,
A normal voltage range that is a range in which the abnormality detection unit considers that the output voltage of the first power supply circuit is normal with respect to the output voltage of the first power supply circuit is preset,
The normal voltage range is set to be included in the operating voltage range,
The electronic control device, wherein the abnormality detection unit detects that the output voltage of the first power supply circuit is a value outside the normal voltage range as an abnormal operation of the first power supply circuit. In claim 2,
The electronic control device according to claim 1, wherein the first power supply circuit stops operation when an abnormal operation of the first power supply circuit is detected by the abnormality detection unit. In any one of Claims 1-3,
The control microcomputer includes a first microcomputer and a second microcomputer,
When the abnormal operation of the first power supply circuit is not detected by the abnormality detection unit, both the first microcomputer and the second microcomputer operate,
The electronic control device according to claim 1, wherein the control microcomputer stops the operation when the abnormality detection unit detects an abnormal operation of the first power supply circuit. In claim 4,
The second microcomputer is
A memory (121) capable of holding data even when power is not supplied from the first power supply circuit;
Controlling the respective operating states of the first power supply circuit and the second power supply circuit,
The second microcomputer is
Abnormal operation of the first power supply circuit is detected after a predetermined signal for starting the control is input from the signal source until a predetermined end condition for ending the control is satisfied. If not, the first power supply circuit is stopped as the termination condition is satisfied, and the second power supply circuit is started,
When the second microcomputer is still operating at a point in time after the second power supply circuit is activated, operation confirmation data indicating that the second power supply circuit is normal is recorded in the memory. An electronic control device characterized by that. In claim 5,
The electronic control device according to claim 2, wherein the second microcomputer deletes the operation confirmation data recorded in the memory each time the second microcomputer is activated. In claim 5 or 6,
The abnormality detection unit, once detecting an abnormal operation of the first power supply circuit, receives a determination result that an abnormality has occurred in the first power supply circuit and a predetermined clear signal from the second microcomputer. Until
While determining that an abnormality has occurred in the first power supply circuit, an abnormality detection signal indicating that an abnormality has occurred in the first power supply circuit is output,
The second microcomputer operates the second power supply circuit by outputting a second power holding signal,
The second power supply circuit operates when the abnormality detection unit outputs the abnormality detection signal, or when the second microcomputer outputs the second power holding signal. Control device. In any one of Claims 4-7,
The electronic control device according to claim 2, wherein the second microcomputer executes a predetermined fail-safe process when an abnormal operation of the first power supply circuit is detected by the abnormality detection unit. In any one of Claims 4-8,
The electronic control device according to claim 2, wherein the second power supply circuit is configured to be able to output electric power for driving both the first microcomputer and the second microcomputer. In any one of Claim 1 to 9,
The electronic controller according to claim 1, wherein the abnormality detection unit is configured to start at a timing when a predetermined time has elapsed from the calculation time, with a time when the activation signal is input as a calculation time.

Images