JP2024014427A - electronic control unit - Google Patents

Abstract

[Problem] In an electronic control device, when a power off request occurs, a first microcomputer detects that the second microcomputer has stopped operating without receiving notification from another second microcomputer, and stops supplying power to the device. Make it possible to stop. The power supply device includes a plurality of microcomputers 20, 40 and a power supply unit 60, and each of the plurality of microcomputers performs immediately-before-shutdown processing in which processing operations that are being executed are stopped when a shutdown command is issued. In addition, when the first microcomputer, which is one of the plurality of microcomputers, completes the processing immediately before shutdown, the first microcomputer, which is one of the plurality of microcomputers, determines whether the current consumption of the second microcomputer, which is another microcomputer, has become less than a predetermined threshold, and When becomes less than the threshold value, the power supply from the power supply section is stopped. [Selection diagram] Figure 1

Description

The present disclosure relates to an electronic control device including a plurality of microcomputers.

As described in Patent Document 1, an electronic control device includes a main microcomputer and a sub-microcomputer, and is configured to perform a shutdown process in which each microcomputer writes its own data to a nonvolatile memory when a power-off request occurs. Are known.

In this electronic control device, when the sub microcomputer completes the shutdown processing, it notifies the main microcomputer to that effect, and when the main microcomputer completes its own shutdown processing and receives the above notification, the power supply circuit sends a notification to each microcomputer. Stop power supply to.

Japanese Patent Application Publication No. 2013-58159

According to the electronic control device, the main microcomputer stops the power supply from the power supply circuit after the main microcomputer and the sub-microcomputer complete the shutdown process. Therefore, each microcomputer can write data to be saved into the nonvolatile memory before the power supply from the power supply circuit is stopped.

By the way, in the above-mentioned electronic control device, the main microcomputer detects the end of the operation of the sub-microcomputer based on a notification signal transmitted from the sub-microcomputer when the shutdown processing is completed. Therefore, if the sub-microcomputer's shutdown process is extended for some reason and the sub-microcomputer does not send a notification signal, the main microcomputer determines that a communication failure has occurred with the sub-microcomputer and shuts down the power supply from the power supply circuit. The power supply may be stopped.

One aspect of the present disclosure is that in an electronic control device including a plurality of microcomputers, when a power off request occurs, a first microcomputer stops the operation of a second microcomputer without receiving a notification from another second microcomputer. The purpose is to detect and stop power supply to the device.

An electronic control device according to one aspect of the present disclosure includes a plurality of microcomputers (20, 40) and a power supply section (60) configured to supply power to the plurality of microcomputers. When a shutdown command for stopping the operation of each microcomputer is generated, each of the plurality of microcomputers executes a pre-shutdown process (S150, S250) for stopping the processing operation being executed.

In addition, when the first microcomputer (20), which is one of the plurality of microcomputers, completes the processing immediately before shutdown, the second microcomputer (40), which is another microcomputer different from the first microcomputer among the plurality of microcomputers, consumes It is determined whether the current is below a predetermined threshold (S160). Then, the first microcomputer stops the power supply from the power supply unit when the current consumption of the second microcomputer is less than or equal to the threshold value.

In other words, when the current consumption of the second microcomputer falls below the threshold, the first microcomputer determines that the second microcomputer has completed the processing immediately before shutdown, and the processing immediately before shutdown of the first microcomputer and the second microcomputer is completed. Sometimes the power supply from the power supply unit is stopped.

Therefore, according to the electronic control device of the present disclosure, if the immediately-before-shutdown process of the second microcomputer is extended for some reason, the first microcomputer does not supply power before the immediately-before-shutdown process of the second microcomputer is not completed. can be suppressed from stopping.

FIG. 1 is a block diagram showing the configuration of an electronic control device of a vehicle according to an embodiment. It is a flowchart showing control processing executed by a main microcomputer and a sub microcomputer. It is a time chart showing the operation of the main microcomputer and the sub microcomputer. It is a flow chart showing a modification of control processing executed by the main microcomputer and the sub microcomputer. 12 is a time chart illustrating the operation of a modified example when the processing immediately before shutdown of the sub-microcomputer is extended more than expected.

Embodiments of the present disclosure will be described below with reference to the drawings.
[composition]
An electronic control unit (hereinafter referred to as ECU) 10 of this embodiment is, for example, mounted on a vehicle and used to control an engine, a motor, etc. that serve as a power source of the vehicle.

For this reason, as shown in FIG. 1, the ECU 10 has an ignition switch (hereinafter referred to as IGSW) 2, which is a power switch of the vehicle, and when the IGSW 2 is turned on, the power supply path from the on-board battery to the ECU 10 is made conductive. Main relay 4 is connected.

The main relay 4 is a well-known device that includes a switch contact and a coil, and when the coil is energized, the switch contact closes and connects the power supply path from the vehicle battery to the ECU 10.

The ECU 10 includes a main microcomputer 20 that controls an engine to be controlled, a sub-microcomputer 40 that assists control by the main microcomputer 20, and an integrated IC 60 that supplies power to the main microcomputer 20 and the sub-microcomputer 40. It is being

The main microcomputer 20 and the sub-microcomputer 40 are microcomputers or microcontrollers that include a central processing unit (i.e., CPU) that performs various control operations.

The integrated IC 60 connects one end of the coil of the main relay 4 to ground, for example, when the IGSW 2 is turned on while the IGSW 2 is turned off and power supply to each microcomputer 20, 40 is stopped. This energizes the coil. As a result, the contact of the switch of the main relay 4 is closed, and the integrated IC 60 is supplied with the battery voltage VB from the vehicle battery.

The integrated IC 60 generates three types of power supplies VC1, VC2, and VC3 for driving the internal circuits of the microcomputers 20 and 40 using the battery voltage VB supplied from the on-vehicle battery via the main relay 4. It is supplied to the microcomputers 20 and 40.

That is, the integrated IC 60 supplies power to the main microcomputer 20 and the sub-microcomputer 40 by supplying the generated power supplies VC1, VC2, and VC3 to the plurality of functional circuits that constitute the main microcomputer 20 and the sub-microcomputer 40. Note that the integrated IC 60 is an example of a power supply unit of the present disclosure.

Moreover, the main microcomputer 20 and the sub-microcomputer 40 each include CPUs 22 and 42, semiconductor memories 24 and 44 such as ROM and RAM, and input/output units 26 and 46 as input/output interfaces as a plurality of functional circuits. Equipped with.

The power supply voltages VC1, VC2, and VC3 generated by the integrated IC 60 are supplied to the CPUs 22 and 42, the semiconductor memories 24 and 44, and the input/output units 26 and 46 of the main microcomputer 20 and the sub-microcomputer 40, respectively. .

Specifically, the output terminal 61 of the power supply voltage VC1 of the integrated IC 60 is connected to the first power supply terminals 31 and 51 of the main microcomputer 20 and the sub-microcomputer 40 via the first power supply path L1, and the output terminal 61 of the power supply voltage VC1 of the integrated IC 60 is is supplied to the CPU 22, 42 of each microcomputer 20, 40.

Further, the output terminal 62 of the power supply voltage VC2 of the integrated IC 60 is connected to the second power supply terminals 32 and 52 of the main microcomputer 20 and the sub-microcomputer 40 via the second power supply path L2, and the power supply voltage VC2 is It is supplied to the semiconductor memories 24 and 44 of the microcomputers 20 and 40.

Further, the output terminal 63 of the power supply voltage VC3 of the integrated IC 60 is connected to the third power supply terminals 33 and 53 of the main microcomputer 20 and the sub-microcomputer 40 via the third power supply path L3, and the power supply voltage VC3 is The signal is supplied to the input/output sections 26 and 46 of the microcomputers 20 and 40.

Next, the main microcomputer 20 is equipped with a current consumption monitor section 28 that monitors the current consumption of the sub-microcomputer 40. This current consumption monitor unit 28 connects the CPU 42, semiconductor memory 44, and input/output of the sub-microcomputer 40 via current sensors provided in the first to third power supply paths L1, L2, and L3 from the integrated IC 60 to the sub-microcomputer 40. The currents isb1, isb2, and isb3 flowing through the section 46 are respectively detected.

Note that the currents isb1, isb2, and isb3 detected by the current consumption monitor unit 28 are transmitted to the main circuit via the input/output unit 26 as current consumption of the CPU 42, semiconductor memory 44, and input/output unit 46 of the sub-microcomputer 40. It is input to the CPU 22 of the microcomputer 20. Then, the CPU 22 determines whether to stop the operation of the sub-microcomputer 40 based on the input current consumption.

When the IGSW2 is turned on, the integrated IC 60 turns on the main relay 4 and starts generating the power supply voltages VC1, VC2, and VC3. Therefore, when the IGSW2 is turned on, the power supply voltages VC1, VC2, and VC3 are supplied to each of the functional circuits of the main microcomputer 20 and the sub-microcomputer 40, and the microcomputers 20 and 40 become operable.

Also, at this time, the integrated IC 60 outputs a reset signal (hereinafter referred to as an RST signal) to the main microcomputer 20 to start the main microcomputer 20 (ie, perform a power-on reset). Further, when the main microcomputer 20 receives the RST signal from the integrated IC 60 and starts up, it outputs the RST signal to the sub-microcomputer 40 to start up the sub-microcomputer 40 (that is, power-on reset).

Therefore, when the IGSW 2 is turned on, the main microcomputer 20 and the sub-microcomputer 40 are activated in order, and the CPUs 22 and 42 in each microcomputer 20 and 40 operate according to the programs stored in the ROM of the semiconductor memories 24 and 44. The control process shown in FIG. 2 is started.

After the main microcomputer 20 and the sub-microcomputer 40 are started, when the CPUs 22 and 42 are normally executing control processing, they generate a monitoring watchdog signal (hereinafter referred to as a WDC signal) at regular intervals.

The WDC signal generated by the main microcomputer 20 is input to the integrated IC 60, and the WDC signal generated by the sub-microcomputer 40 is input to the main microcomputer 20. Therefore, the integrated IC 60 can monitor the operation of the main microcomputer 20 using the WDC signal from the main microcomputer 20, and the main microcomputer 20 can monitor the operation of the sub-microcomputer 40 using the WDC signal from the sub-microcomputer 40. be able to.

[process]
Next, control processing executed by the CPUs 22 and 42 of the main microcomputer 20 and the sub microcomputer 40 will be described. In FIG. 2, the flowchart on the left side represents the control process executed by the CPU 22 of the main microcomputer 20, and the flowchart on the right side represents the control process executed by the CPU 42 of the sub microcomputer 40.

As shown in FIG. 2, when the main microcomputer 20 and the sub-microcomputer 40 start up and the CPUs 22, 42 start control processing, the CPUs 22, 42 first execute normal processing in S110 and S210.

In normal processing, the CPUs 22 and 42 obtain various detection signals from various sensors that detect the states of the controlled objects and peripheral devices via the input/output units 26 and 46, and based on the obtained detection signals, Calculate various control amounts necessary to control the to the desired state. Further, the CPUs 22 and 42 control the controlled object to a desired state by outputting a control signal corresponding to the calculated control amount to the controlled object and peripheral devices via the input/output sections 26 and 46.

Next, during execution of normal processing, the CPUs 22 and 42 determine whether the IGSW 2 has been switched to the off state in S120 and S220, and if the IGSW 2 has not been switched to the off state, the CPUs 22 and 42 proceed to S110 and S210. By migrating, normal processing continues.

On the other hand, if the IGSW has been switched to the off state, it is determined in S120 and S220 that a power off request has been input, and the process moves to S130 and S230, respectively, to switch the IGSW to safely stop the control of the controlled object. Execute off-post processing.

Note that the CPUs 22 and 42 transmit and receive data necessary for control through inter-microcomputer communication during execution of normal processing and IG-off post-processing. Therefore, as shown in FIG. 3, when the IG switch is turned off at time t1, the CPUs 22 and 42 end the normal processing and start the IG-off post-processing in synchronization with each other.

Further, the CPU 22 on the main microcomputer 20 side determines whether a shutdown condition for stopping the operation of each microcomputer 20, 40 is satisfied during the execution of the IG-off post-processing in S130, and when the shutdown condition is satisfied, the CPU 22 shuts down. Generates a command.

This shutdown command is a command to stop the operation of the main microcomputer 20 and the sub-microcomputer 40 and shut them down. Then, the main microcomputer 20 generates a shutdown command by, for example, switching the main relay control flag, which is set to the on state at startup, to the off state.

The main relay control flag thus switched to the off state is also transmitted to the CPU 42 of the sub-microcomputer 40 through inter-microcomputer communication. Then, the CPU 42 on the sub-microcomputer 40 side detects a shutdown command from the main microcomputer 20 by receiving the main relay control flag.

Therefore, during execution of the IG-off post-processing in S130 and S230, the CPUs 22 and 42 determine in S140 and S240, respectively, whether a shutdown command has been issued based on the main relay control flag. If a shutdown command has not been issued, the IG off post-processing is continued by moving to S130 and S230.

Further, when it is determined in S140 and S240 that a shutdown command has been issued, the CPUs 22 and 42 move to S150 and S250, respectively, at time t2 shown in FIG. 3, for example, and start immediately-before-shutdown processing.

This processing immediately before shutdown is, for example, the final processing for backing up various data used for control to the nonvolatile memory of the semiconductor memories 24, 44, and storing the shutdown timing, and is performed for a preset delay time. include.

Then, when the CPU 42 of the sub-microcomputer 40 completes the immediately-before-shutdown process in S250, it ends the control process and stops its own operation (that is, shuts down).
On the other hand, after the CPU 22 of the main microcomputer 20 completes the immediately-before-shutdown processing in S150, the process proceeds to S160. Then, in S160, whether the current consumption isb1, isb2, and isb3 of the sub-microcomputer 40 monitored by the current consumption monitor unit 28 have become equal to or lower than preset thresholds ith1, ith2, and ith3 for determining operation stoppage, respectively. Decide whether or not.

The process of S160 is a process of waiting until the current consumption isb1, isb2, isb3 of the sub-microcomputer 40 all become equal to or less than the threshold values ith1, ith2, ith3. Therefore, if at least one of the current consumption isb1, isb2, and isb3 of the sub-microcomputer 40 is no more than the threshold value ith1, ith2, or ith3, the process returns to S160.

Further, if it is determined in S160 that the current consumption isb1, isb2, isb3 are all below the threshold values ith1, ith2, ith3, the CPU 22 of the main microcomputer 20 determines that the sub-microcomputer 40 has stopped operating. make a decision and stop its own operation (i.e., shut down).

In other words, the main microcomputer 20 determines that the sub-microcomputer 40 has stopped operating when the current consumption isb1, isb2, isb3 of each functional circuit making up the sub-microcomputer 40 are all below the threshold values ith1, ith2, ith3. and stop its own operation.

Further, when the main microcomputer 20 stops operating in this way, the WDC signal is no longer output from the main microcomputer 20 to the integrated IC 60. Therefore, when the WDC signal is no longer output from the main microcomputer 20, the integrated IC 60 detects that the main microcomputer 20 has stopped operating, and stops energizing the coil of the main relay 4.

As a result, the supply path of the battery voltage VB from the vehicle battery to the integrated IC 60 is cut off, the integrated IC 60 stops generating the power supply voltages VC1, VC2, and VC3, and the ECU 10 completely stops operating. become.

[effect]
In the ECU 10 of this embodiment, the CPU 22 of the main microcomputer 20, as shown in FIG. Continue the processing immediately before shutdown.

When the CPU 22 of the main microcomputer 20 confirms that the sub-microcomputer 40 has been shut down, it stops its own processing operation and stops outputting the WDC signal. As a result, the integrated IC 60 stops supplying power to each of the microcomputers 20 and 40 at time t4 after the main microcomputer 20 stops outputting the WDC signal.

Therefore, according to the ECU 10 of this embodiment, when the sub-microcomputer 40 is operating, it is possible to prevent the integrated IC 60 from stopping the power supply to each microcomputer 20, 40.

Further, the CPU 22 of the main microcomputer 20 detects that the sub-microcomputer 40 has stopped operating at time t3 when the current consumption flowing through each functional circuit such as the CPU 42, the semiconductor memory 44, the input/output section 46, etc. of the sub-microcomputer 40 has become below the threshold value. Then, the power supply from the integrated IC 60 is stopped. Therefore, if the pre-shutdown processing of the sub-microcomputer 40 is unintentionally extended, the main microcomputer 20 is prevented from shutting down and the power supply from the integrated IC 60 is stopped before the sub-microcomputer 40's pre-shutdown processing is completed. can.

Further, the CPU 22 of the main microcomputer 20 can detect that the sub-microcomputer 40 has stopped operating without receiving a communication signal from the sub-microcomputer 40 indicating that the sub-microcomputer 40 has stopped operating. Therefore, for example, when the main microcomputer 20 cannot detect the stoppage of the sub-microcomputer 40 based on the notification signal from the sub-microcomputer 40, the power supply from the integrated IC 60 is stopped due to a failure in the communication path with the sub-microcomputer 40. It is also possible to prevent this from happening.

[Modified example]
In the above embodiment, when the CPU 22 on the main microcomputer 20 side completes its own immediate-shutdown process, it determines whether the current consumption of each functional circuit of the sub-microcomputer 40 is below a threshold value, and determines whether the current consumption is below the threshold value. At some point, the processing operation is stopped.

Therefore, for example, if the pre-shutdown processing on the sub-microcomputer 40 side is extended longer than expected due to some abnormality and the current consumption of each functional circuit does not fall below the threshold, the main microcomputer 20 side will operate the sub-microcomputer 40. It becomes impossible to judge when to stop.

Therefore, in the control process of the main microcomputer 20, as shown in FIG. 4, the processes of S170 and S180 may be further executed.
That is, in the control process shown in FIG. 4, when it is determined in S160 that the current consumption of the sub-microcomputer 40 is not below the threshold value, the process moves to S170, and the elapsed time from the start of the process in S160 is measured. .

Further, in S170, it is determined whether the elapsed time exceeds a preset abnormality determination time. If it is determined in S170 that the elapsed time since the start of the process in S160 has not exceeded the abnormality determination time, the process in S160 is executed again to meet the time t11 shown in FIG. Wait until the sub-microcomputer 40 shuts down.

On the other hand, if it is determined in S170 that the elapsed time since the start of the process in S160 has exceeded the abnormality determination time, that is, if the shutdown standby time of the sub-microcomputer 40 has elapsed, the process moves to S180.

Then, in S180, it is detected that some kind of abnormality that cannot be shut down (hereinafter referred to as a shutdown abnormality) has occurred in the sub-microcomputer 40, and the control process is ended. As a result, the main microcomputer 20 stops its own operation (that is, shuts down) at time t11 shown in FIG. 5 as the control processing ends.

Further, when the main microcomputer 20 stops operating in this manner, the integrated IC 60 turns off the main relay 4 at time t12 shown in FIG. 5, and stops power supply to the main microcomputer 20 and the sub-microcomputer 40. Therefore, the power state of each microcomputer 20, 40 is turned off. Then, the sub-microcomputer 40 stops operating (ie, shuts down) at time t13 shown in FIG. 5 due to a decrease in the power supply voltage.

As described above, in the ECU 10 of this modification, when the sub-microcomputer 40 cannot be shut down due to some abnormality, the main microcomputer 20 side detects the shutdown abnormality of the sub-microcomputer 40 based on the elapsed time after the end of the pre-shutdown processing. To detect.

When a shutdown abnormality is detected, the main microcomputer 20 ends the control process, so the integrated IC 60 turns off the main relay 4 and stops power supply to the main microcomputer 20 and sub-microcomputer 40.

Therefore, when a shutdown abnormality occurs in the sub-microcomputer 40, it is possible to prevent the integrated IC 60 from being unable to stop power supply to each of the microcomputers 20 and 40 (that is, stop the operation of the ECU 10).

Next, when the main microcomputer 20 detects the shutdown abnormality of the sub-microcomputer 40 in S180, the current consumption of each functional circuit of the sub-microcomputer 40 at that time indicates that the current consumption has not fallen below the threshold value. Identify functional circuits. The identified functional circuit is then stored in the nonvolatile memory of the semiconductor memory 24 as the functional circuit that caused the shutdown abnormality of the sub-microcomputer 40.

Therefore, the user must identify the cause of the shutdown abnormality based on the functional circuit stored in the nonvolatile memory of the semiconductor memory 24 when the main microcomputer 20 detects the shutdown abnormality, and take measures to avoid the shutdown abnormality. You will be able to do this.

Note that if a shutdown abnormality is detected in S180, a notification to that effect may be provided, or the time of occurrence may be stored in the nonvolatile memory of the semiconductor memory 24. Further, in S180, when a shutdown abnormality of the sub-microcomputer 40 is detected, the current consumption of each functional circuit of the sub-microcomputer 40 may be stored in the nonvolatile memory of the semiconductor memory 24.

Further, when the functional circuit that caused the shutdown abnormality is identified in S180, the sub-microcomputer 40 is caused to execute a predetermined fail-safe process depending on the type of the functional circuit. may be shut down more safely.

Although the embodiments and modified examples of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments and modified examples, and can be implemented with various modifications.
For example, in the above embodiment, it was explained that the ECU 10 controls the engine or motor that is the power source of the vehicle, but the technology of the present disclosure is an electronic control device that controls the control target using a plurality of microcomputers. If so, it can be applied in the same manner as the above embodiment.

Furthermore, in the above embodiment, the functional circuits that constitute the main microcomputer 20 and the sub-microcomputer 40 are described as being the CPUs 22 and 42, the semiconductor memories 24 and 44, and the input/output sections 26 and 46. This is just an example, and may be configured as appropriate. For example, each of the microcomputers 20 and 40 may further include functional circuits such as an A/D converter, a D/A converter, and a drive circuit.

In the above embodiment, when the main microcomputer 20 detects that the sub-microcomputer 40 has stopped operating, it stops its own operation, stops outputting the WDC signal to the integrated IC 60, and sends the main relay 4 to the integrated IC 60. It was explained as something that turns off. However, the main microcomputer 20 may be configured to stop the operation of the ECU 10 by directly switching the main relay 4 to the OFF state when detecting that the sub-microcomputer 40 has stopped operating.

Further, a plurality of functions of one component in the embodiment described above may be realized by a plurality of components, or one function of one component may be realized by a plurality of components. Further, a plurality of functions possessed by a plurality of constituent elements may be realized by one constituent element, or one function realized by a plurality of constituent elements may be realized by one constituent element. Further, a part of the configuration of the above embodiment may be omitted. Further, at least a part of the configuration of the above embodiment may be added to or replaced with the configuration of other embodiments.

In addition to the above-mentioned electronic control device, the present disclosure also relates to a system including the electronic control device as a component, a program for causing a computer to function as an electronic control device, and a non-transitional actual system such as a semiconductor memory in which this program is recorded. The present disclosure can also be implemented in various forms, such as a recording medium and a control method using multiple microcomputers.

10... ECU, 20... Main microcomputer, 40... Sub microcomputer, 22, 42... CPU, 24, 44... Semiconductor memory, 26, 46... Input/output section, 60... Integrated IC.

Claims (4)

multiple microcomputers (20, 40),
a power supply unit (60) configured to supply power to the plurality of microcomputers;
An electronic control device comprising:
Each of the plurality of microcomputers is configured to perform immediately-before-shutdown processing (S150, S250) to stop the processing operation being executed when a shutdown command to stop the operation of each microcomputer is generated;
Further, when the first microcomputer (20), which is one of the plurality of microcomputers, completes the immediately-before-shutdown processing, the first microcomputer (20), which is one of the plurality of microcomputers, executes the second microcomputer (20), which is another microcomputer different from the first microcomputer among the plurality of microcomputers. 40) is configured to determine whether or not the current consumption has become below a predetermined threshold (S160), and to stop the power supply from the power supply unit when the current consumption becomes below the threshold; Electronic control unit. The electronic control device according to claim 1,
The first microcomputer measures the elapsed time from when the second microcomputer starts the immediately-before-shutdown processing until the current consumption falls below the threshold, and determines that the elapsed time is a predetermined abnormality determination time. determining whether the elapsed time exceeds the abnormality determination time (S170), detecting a shutdown abnormality of the second microcomputer (S180), and stopping the power supply from the power supply unit; An electronic control unit configured to: The electronic control device according to claim 2,
The power supply unit is configured to supply power to the plurality of functional circuits (42, 44, 46) constituting the second microcomputer through different power supply paths, respectively,
The first microcomputer detects each current supplied from the power supply section to the plurality of functional circuits of the second microcomputer via the different power supply paths, and detects the progress until the current becomes equal to or less than the threshold value. An electronic control device configured to identify a functional circuit whose time exceeds the abnormality determination time as the functional circuit that caused the shutdown abnormality. The electronic control device according to any one of claims 1 to 3,
The electronic control device is mounted on a vehicle,
The power supply unit is configured to start supplying power to the plurality of microcomputers to activate the plurality of microcomputers when the power switch (2) of the vehicle is switched from an off state to an on state,
When the plurality of microcomputers are activated by power supply from the power supply unit, they execute preset normal processing (S110, S220), and when the power switch is turned off during execution of the normal processing, , configured to execute post-off processing (S130, S140) that ends the normal processing,
Furthermore, the first microcomputer generates the shutdown command during execution of the post-off process and sends it to the second microcomputer, thereby instructing the first microcomputer and the second microcomputer to perform the immediately-before-shutdown process. An electronic control device configured to carry out.

Images