JP5786787B2 - In-vehicle control system - Google Patents

Description

  The present invention relates to an in-vehicle control system in which a plurality of control units are connected so as to communicate with each other.

  Some vehicle-mounted control systems include a plurality of vehicle-mounted devices, and the vehicle-mounted devices are connected to each other via a network. Further, there is one in which one of the plurality of in-vehicle devices (on-vehicle control device) determines a network abnormality according to the communication status between the in-vehicle devices. Here, the output voltage (power supply voltage) of the in-vehicle storage battery may be lowered depending on the operation status of each in-vehicle device. When the power supply voltage is lower than the operation guarantee voltage of each in-vehicle device, there is a possibility that a communication abnormality occurs. This communication abnormality does not necessarily occur in the communication means itself such as a network. For this reason, the in-vehicle control device that performs the abnormality determination needs to handle the communication abnormality that accompanies a decrease in the power supply voltage and the abnormality that has occurred in the communication means.

  When the in-vehicle control device and other in-vehicle devices are connected to a common power source, it is possible to grasp the operation status of the in-vehicle device subject to abnormality determination by detecting the power supply voltage of the in-vehicle control device itself. It becomes possible. Therefore, for example, in the invention described in Patent Document 1, the minimum operation guarantee voltage of the main device that performs abnormality determination is set lower than that of other control target devices, and it is detected that the power supply voltage has dropped below the minimum operation guarantee voltage. In such a case, the configuration is such that the communication abnormality record is deleted. With this configuration, it is possible not to treat an abnormality associated with a decrease in power supply voltage as an abnormality occurring in the communication means.

JP 2005-88676 A

  As a power source for an in-vehicle control system, for example, a relatively inexpensive lead storage battery is used as the first storage battery, and a lithium ion storage battery having high energy density in charge / discharge and high energy density as compared with the lead storage battery is used as the second storage battery. Has been proposed. Both storage batteries are each connected with a control unit as an in-vehicle device, and these control units are operated by power supplied from either a lead storage battery or a lithium ion storage battery.

  Here, the invention described in Patent Document 1 is based on the premise that the main apparatus and a plurality of devices to be controlled are connected to the same power source. The operation status of the control target device that is the target of abnormality determination is grasped from the voltage. For this reason, in the case where the in-vehicle control system includes a plurality of power supply units, if a power supply voltage of a control unit that performs abnormality determination differs from a power supply voltage of another control unit, the power supply voltage of the control unit that performs abnormality determination itself Even if the voltage is equal to or higher than the operation guarantee voltage, the power supply voltage of the control unit subject to the abnormality determination may be lower than the operation guarantee voltage. For this reason, the control unit that makes an abnormality determination cannot correctly determine whether the abnormality is caused by a decrease in the power supply voltage or an abnormality that has occurred in the communication means by using its own power supply voltage.

  The present invention has been made to solve the above-described problem, and in an in-vehicle control system having two or more power supply units, an abnormality due to a decrease in power supply voltage is detected when an abnormality is detected in the communication means. The main purpose is to suppress errors that are judged as such.

The first invention includes a first control unit (10) powered by a first power supply unit (21), a second control unit (13-15) powered by a second power supply unit (30), Communication means (40) for performing mutual communication between these two control units, and an on-vehicle control system in which both control units can communicate with each other by the communication means, wherein the first control unit comprises: An abnormality determination unit that determines an abnormality of the communication unit according to a transmission signal transmitted from the second control unit, a voltage detection unit that detects a power supply voltage of the second power supply unit, and a voltage detection unit that detects the abnormality. And invalidating means for invalidating the abnormality determination by the abnormality determining means when the power supply voltage is lower than a predetermined voltage.

  According to the above configuration, the first control unit supplied with power from the first power supply unit detects the power supply voltage of the second power supply unit that is the power supply of the second control unit. Further, the first control unit determines whether an abnormality has occurred in the communication means based on the transmission signal transmitted from the second control unit. When the first control unit determines that an abnormality has occurred in the communication means, if the voltage of the second power supply unit is lower than a predetermined value, only an abnormality has occurred due to a decrease in the power supply voltage of the second power supply unit. There is no abnormality in the communication means itself. Therefore, by invalidating the abnormality determination when the voltage of the second power supply unit is lower than the predetermined value, it is possible to suppress an error in determining that an abnormality has occurred in the communication unit.

The schematic block diagram of a vehicle-mounted control system. The flowchart of abnormality judgment invalidation processing. The timing chart at the time of engine starting by driver operation. Timing chart at the time of automatic restart by idling stop control. The flowchart of the abnormality determination invalidation process in other embodiment.

  The vehicle on which the in-vehicle control system according to this embodiment is mounted is a vehicle that uses an engine as a travel drive source, and automatically stops the engine when a predetermined automatic stop condition is satisfied, and satisfies a predetermined automatic restart condition. It has an idling stop function that automatically restarts the engine in the event of an accident.

  The in-vehicle control system shown in FIG. 1 includes ECU_A10 to ECU_F15 as a plurality of control units, and uses a lithium ion storage battery 21 and a lead storage battery 30 built in the battery unit 20 as power sources. The ECU_A10 to ECU_F15 are mainly composed of a microcomputer composed of a CPU, a ROM, a RAM, and the like. The ECU_A10 to ECU_F15 perform various controls by executing various control programs stored in the ROM.

  ECU_A 10 to ECU_F 15 have a function of communicating with each other, and are connected by a connection line to constitute a network 40. Here, the network 40 is, for example, a CAN (Controller Area Network).

  ECU_A10 is an idling stop ECU that performs idling stop control. The ECU_A10 automatically stops the engine when idling stop control satisfies a predetermined automatic stop condition such as a brake switch being ON. Here, the brake switch is a switch that is turned on when a brake pedal is depressed by a driver. The ECU_A10 then automatically restarts the engine by the starter 51 when a predetermined automatic restart condition is satisfied.

  Moreover, ECU_A10 judges whether abnormality has generate | occur | produced in communication with other ECU. Specifically, the ECU_A10 to ECU_F15 periodically transmit a signal (for example, a heartbeat signal) indicating that the ECU_A10 to the ECU_F15 are operating normally to the network 40. The ECU_A10 determines that communication with the ECU_B11 to ECU_F15 can be normally performed by acquiring the heartbeat signals transmitted from the ECU_B11 to ECU_F15, and when the data cannot be acquired, the ECU_B10 performs communication with the ECU_B11 to ECU_F15. Judge that an abnormality has occurred. In addition, ECU_B11 and ECU_C12 also determine whether or not communication with other ECUs can be performed normally by acquiring a heartbeat signal transmitted by other ECUs, similar to ECU_A10.

  ECU_B11 and ECU_C12 are an engine ECU that controls fuel injection, ignition, and the like in the engine, a transmission ECU that controls gear transmission, an air conditioner ECU that controls air conditioning, and the like.

  The ECU_D 13 is a body control ECU that controls the vehicle body such as opening and closing of a door. ECU_E14 and ECU_F15 are a steering ECU for controlling the steering, a brake control ECU for controlling the brake, and the like.

  As a basic configuration of power supply to each ECU, ECU_A 10 to ECU_C 12 are supplied with power from the lithium ion storage battery 21, and ECU_D 13 to ECU_F 15 are supplied with power from the lead storage battery 30. Note that fuses for preventing inflow of overcurrent are provided at the power input terminals of ECU_A10 to ECU_F15, respectively.

  The microcomputers included in each of the ECU_A10 to ECU_F15 are not guaranteed to operate unless a voltage equal to or higher than the operation guarantee voltage K1 (for example, 10V) is input. That is, each ECU is provided with a power supply circuit that generates a constant voltage Vcc (for example, 5 V) that is an operating voltage of a microcomputer, a voltage supplied to a relay switch, an actuator, or the like controlled by the ECU (for example, 8 V). It has been. If the power supply voltage, that is, the input voltage of the power supply circuit is equal to or higher than the operation guarantee voltage K1, these voltages can be properly generated, and as a result, the operation of each ECU is guaranteed.

  ECU_A10, ECU_E14, ECU_F15 are provided with booster circuits 101, 141, 151. The booster circuits 101, 141, 151 supply boosted power to the power supply circuit. For this reason, even if the supplied voltage drops temporarily, if the voltage is higher than the boost lower limit voltage K2 (for example, 6V), the unit internal voltage can be boosted to the operation guarantee voltage K1 (for example, 10V). it can. That is, even if the input voltage of the ECU drops below the operation guarantee voltage K1, if the boost lower limit voltage K2 is equal to or higher than the boost lower limit voltage K2, the power supply circuit appropriately generates the voltage by inputting the voltage boosted by the booster circuit to the power supply circuit. The operation of ECU_A10, ECU_E14, ECU_F15 is guaranteed.

  The battery unit 20 includes a connection terminal Pb used to connect to the lead storage battery 30. Moreover, the output terminal Li used in order to output electric power to the electric load 52 and ECU_A10-ECU_C12 is provided. The connection terminal Pb and the output terminal Li are connected by internal wiring inside the battery unit 20. The internal wiring that connects the connection terminal Pb and the output terminal Li is provided with a first switch SW1, and the connection / disconnection between the connection terminal Pb and the output terminal Li is performed according to the opening / closing of the first switch SW1. Can be switched.

  Further, a branch point 23 is provided between the first switch SW1 and the output terminal Li. The branch point 23 and the lithium ion storage battery 21 are connected by a branch line. The branch line is provided with a second switch SW2, and switching between energization / cutoff of the branch point 23 and the lithium ion storage battery 21 is switched according to the opening / closing of the second switch SW2.

  Further, the battery unit 20 includes a controller 22 for controlling the inside of the battery unit 20. The controller 22 is connected to the network 40, and controls the open / closed states of the first switch SW1 and the second switch SW2 based on information obtained through the network 40. When the controller 22 closes the first switch SW1, the power generated in the alternator 50 can be stored in the lithium ion storage battery 21. In addition, the controller 22 controls the open / close state of the second switch SW2 in accordance with the storage state of the lithium ion storage battery 21, so that overcharge / overdischarge of the lithium ion storage battery 21 can be prevented.

  An alternator 50, a starter 51, and an electric load (not shown) are connected to the lead storage battery 30. The alternator 50 generates electric power by the rotational energy of the output shaft of the engine. Further, when the starter 51 is driven by the power supply from the lead storage battery 30, initial rotation is applied to the engine.

  The power supplied to the starter 51 is larger than the power supplied to other electrical loads. Therefore, when power is supplied to the starter 51, the output voltage VB2 of the lead storage battery 30 is drastically reduced. However, the lithium ion storage battery 21 is provided with the first switch SW1 that switches between energization and disconnection from the lithium ion storage battery 21 to the starter 51, thereby avoiding a rapid drop in the output voltage VB1.

  Specifically, during the period in which power is supplied from the lead storage battery 30 to the starter 51, the controller 22 opens the first switch SW1, thereby avoiding current from flowing from the lithium ion storage battery 21 to the starter 51. Thus, a drop in voltage VB1 is avoided. Therefore, stable electric power with small voltage fluctuation can be supplied from the lithium ion storage battery 21 to the ECU_A10 to ECU_C12 and the electric load 52.

  However, regarding ECU_D13 to ECU_F15, the voltage VB2 that is the power supply voltage drops during the period in which power is supplied from the lead storage battery 30 to the starter 51. During this period, it is not guaranteed that a power supply voltage equal to or higher than the boost lower limit voltage K2 is input, and the ECU_D13 to ECU_F15 may temporarily become inoperable, causing a reset of a process being executed and the like. For this reason, the ECU_D13 to ECU_F15 may not be able to transmit the heartbeat signal to the network 40 even though no abnormality has occurred in the ECU_D13 to ECU_F15 itself. Therefore, ECU_A10 cannot receive a heartbeat signal from ECU_D13 to ECU_F15 when the engine is started, and thus may erroneously determine that an abnormality has occurred in network 40.

  ECU_A10, which is an idling stop ECU, sets one of the automatic stop conditions that the voltage VB2 is equal to or higher than a voltage that is assumed not to be lower than the boost lower limit voltage K2 when the starter 51 is driven to restart the engine. By performing the automatic stop when the automatic stop condition regarding the voltage VB2 is satisfied, the ECU_E14 and the ECU_F15 including the booster circuits 141 and 151 can continue to operate during the restart by the idling stop control.

  At the time of restart in idling stop control, ECU_E14 and ECU_F15 continue to transmit heartbeat signals. Therefore, the ECU_A 10 can make an abnormality determination of the network 40 based on the heartbeat signal. However, the ECU_D 13 may become inoperable unless a voltage equal to or higher than the operation guarantee voltage K1 is input. For this reason, at the time of restart by idling stop control, ECU_A10 cannot receive a heartbeat signal from ECU_D13, and thus may erroneously determine that an abnormality has occurred in network 40.

  Here, the voltage that is assumed not to be lower than the boost lower limit voltage K2 when driving the starter 51 for restart is based on the boost lower limit voltage K2 and the power that is assumed to be consumed by the starter 51 during restart. Is set. The electric power assumed to be consumed by the starter 51 at the time of restart is set based on the engine coolant temperature, the past start history, and the like.

  Similarly to ECU_A10, ECU_B11 and ECU_C12 also determine whether communication with other ECUs can be performed normally by acquiring a heartbeat signal transmitted by the other ECUs. For this reason, when voltage VB2 falls, ECU_D13-ECU_F15 cannot transmit a heartbeat signal, and there is a possibility that an erroneous determination is made that an abnormality has occurred in network 40.

  The ECU_A10 in this embodiment includes a VB2 voltage detection terminal VB2 + that detects the voltage VB2, and a reference voltage detection terminal VB2-terminal that detects a reference voltage (ground). The ECU_A10 compares the voltage VB2 with the reference voltage, and determines that the abnormality determination based on the heartbeat signal transmitted from the ECU_D13 is invalidated when it is determined that the voltage VB2 is lower than the operation guarantee voltage K1. Set to ON. Further, when it is determined that the voltage VB2 has become lower than the boost lower limit voltage K2, the ECU_A10 turns on a determination invalidation flag that invalidates the abnormality determination based on the heartbeat signals transmitted from the ECU_D13 to the ECU_F15.

  While the determination invalidation flag is ON, ECU_A10 disables the abnormality determination, thereby invalidating the abnormality determination based on the heartbeat signal transmitted from ECU_D13 to ECU_F15. That is, even if the heartbeat signal cannot be received from the ECU whose determination invalidation flag is set to ON, the ECU_A 10 does not determine that an abnormality has occurred in the network 40.

  ECU_A10 notifies ECU_B11 and ECU_C12 of the determination invalidation flag through network 40. The ECU_B11 and ECU_C12 to which the determination invalidation flag is notified invalidate the abnormality determination based on the heartbeat signal transmitted from the ECU_D13 to the ECU_F15 while the invalidation flag is ON by the ECU_A10. That is, ECU_B11 and ECU_C12 do not determine that an abnormality has occurred in the network 40 even when a heartbeat signal is not sent from the ECU whose determination invalidation flag is turned on. As a result, it is possible to suppress erroneous determination that an abnormality has occurred in the network 40 for the ECU_B11 and ECU_C12 that do not have a means for detecting the voltage VB2.

  ECU_A10 detects output voltage VB1 of lithium ion storage battery 21, and compares voltage VB1 with a reference voltage. When it is determined that the voltage VB1 has become lower than the operation guarantee voltage K1, the controller 22 is notified to switch the first switch SW1 to the closed state, and the lead storage battery 30 or the alternator 50 is sent to the lithium ion storage battery 21. Electric power is supplied to store electricity. As a result, the output voltage VB1 of the lithium ion storage battery 21 can be quickly restored to a voltage equal to or higher than the operation guarantee voltage K1.

  FIG. 2 shows a flowchart of abnormality determination invalidation processing performed by the ECU_A10. The invalidation determination invalidation process is performed at a predetermined time period. The predetermined time period is set shorter than the period in which the ECU_D 13 to ECU_F 15 transmit the heartbeat signal to the network 40. For this reason, it is possible to invalidate the abnormality determination before the erroneous determination in the abnormality determination occurs.

  In step S01, voltage VB1 and voltage VB2 are detected. In step S02, the detected voltage VB2 is compared with the boost lower limit voltage K2. When voltage VB2 is lower than boost lower limit voltage K2 (S02: YES), each determination invalidation flag for ECU_D13 to ECU_F15 is turned ON in step S03. In step S04, a determination invalidation flag is notified to ECU_B11 and ECU_C12, and the process ends.

  If the voltage VB2 is equal to or higher than the boost lower limit voltage K2 in step S02 (S02: NO), the voltage VB2 is compared with the operation guarantee voltage K1 in step S05. When the voltage VB2 is lower than the operation guarantee voltage K1 (S05: YES), the judgment invalidation flag for ECU_D13 is turned on in step S06, and the judgment invalidation flags for ECU_E14 and ECU_F15 are turned off in step S07. Then, the process of step S04 is performed, and the abnormality determination invalidation process ends.

  If the voltage VB2 is equal to or higher than the operation guarantee voltage K1 in step S05 (S05: NO), the voltage VB1 is compared with the operation guarantee voltage K1 in step S08. When the voltage VB1 is lower than the operation guarantee voltage K1 (S08: YES), in step S09, the controller 22 is notified to close the first switch SW1. In step S10, the judgment invalidation flags of ECU_D13 to ECU_F15 are turned OFF, the process in step S04 is performed, and the abnormality judgment invalidation process is terminated. If the voltage VB1 is equal to or higher than the operation guarantee voltage K1 in step S08 (S08: NO), the process of step S10 is performed without performing the process of step S09, and then the process of step S04 is performed to invalidate the abnormality determination. Exit.

  FIG. 3 shows a timing chart of the abnormality determination invalidation process performed when the engine is started by the driver's key operation. At time T0, power is supplied from the lead storage battery 30 to the starter 51 by the key operation of the driver, and the engine is started. At this time, in the illustrated example, a surge current flows from the lead storage battery 30 to the starter 51 with the start of power supply to the starter 51. Due to the generation of the surge current, the output voltage VB2 of the lead storage battery 30 drops and becomes a voltage lower than the operation guarantee voltage K1 and the boost lower limit voltage K2. For this reason, each determination invalidation flag of ECU_D13-ECU_F15 is turned ON.

  Thereafter, as the current flowing through starter 51 stabilizes, voltage VB2 begins to rise. At time T1, the voltage VB2 becomes equal to or higher than the boost lower limit voltage K2, and the determination invalidation flags of the ECU_E14 and ECU_F15 are turned off. Then, after the voltage VB2 fluctuates due to power consumption by the starter 51, the engine is in a complete explosion state. Then, the power supply to the starter 51 is stopped by the key operation of the driver. Thereafter, the lead storage battery 30 is charged by the power generation in the alternator 50, and the voltage VB2 rises. At time T2, the voltage VB2 becomes equal to or higher than the operation guarantee voltage K1, and the judgment invalidation flag of the ECU_D13 is turned OFF.

  At times T0 to T1, the determination invalidation flags of ECU_E14 and ECU_F15 are turned ON, so that determination of abnormality of network 40 based on the heartbeat signal transmitted from ECU_E14 and ECU_F15 is performed by ECU_A10 during that period. It is invalidated. In addition, at time T0 to T2, the judgment invalidation flag of ECU_D13 is turned ON, so that judgment on abnormality of network 40 based on the heartbeat signal transmitted from ECU_D13 performed by ECU_A10 in the relevant period is invalidated. The

  FIG. 4 shows a timing chart of the invalidation determination invalidation process performed in the restart after the idling stop. At time T10, regenerative power generation is performed in the alternator 50 on the condition that the injection cut is performed in the engine. Here, in order to store the electric power generated in the alternator 50 in the lithium ion storage battery 21, the controller 22 closes the first switch SW1.

  Further, when a predetermined automatic stop condition is satisfied at time T11, the engine is stopped. Further, since the regenerative power generation in the alternator 50 is also stopped as the engine is stopped, the controller 22 opens the first switch SW1.

  At a time T12, when a predetermined restart condition such as the driver depressing the accelerator pedal is satisfied, the starter 51 is driven and the engine is restarted. Since the lead storage battery 30 supplies power to the starter 51, the output voltage VB2 is a voltage equal to or lower than the operation guarantee voltage K1. Here, since the automatic stop condition includes that the voltage VB2 is equal to or higher than a voltage that is assumed not to be lower than the boost lower limit voltage K2 when the starter 51 is restarted, the voltage VB2 is higher than the boost lower limit voltage K2. It wo n’t go down. For this reason, only the judgment invalidation flag of ECU_D13 is turned ON.

  Thereafter, after the voltage VB2 fluctuates due to power generation by the alternator 50 and power consumption by the starter 51, the engine is in a complete explosion state. Then, the power supply to the starter 51 is stopped under the control of the ECU_A10. Thereafter, as the current flowing through the starter 51 becomes a steady current, the lead storage battery 30 is charged and the voltage VB2 rises. Then, power supply to the starter 51 is stopped. Thereafter, the lead storage battery 30 is charged by the power generation in the alternator 50, and the voltage VB2 rises. At time T13, the voltage VB2 becomes equal to or higher than the operation guarantee voltage K1, and the judgment invalidation flag of the ECU_D13 is turned off.

  At times T12 to T13, the determination invalidation flag of the ECU_D13 is turned ON, so that the abnormality determination regarding the network 40 based on the heartbeat signal transmitted from the ECU_D13 performed by the ECU_A10 during the period is invalidated.

  In the following, operational effects of the present embodiment will be described.

  (1) The ECU_A10 supplied with power from the lithium ion storage battery 21 detects the output voltage VB2 of the lead storage battery 30 that is the power source of the ECU_D13 to ECU_F15. If the ECU_A10 determines that the network 40 is abnormal because it cannot receive the heartbeat signal from the ECU_D13 to the ECU_F15, and the voltage VB2 is lower than the predetermined value, the abnormality is caused by a decrease in the output voltage of the lead storage battery 30. It has only occurred, and the network 40 does not have an abnormality. Therefore, when the output voltage VB2 of the lead storage battery 30 is lower than a predetermined value, it is possible to suppress erroneous determination that the network 40 has an abnormality by invalidating the abnormality determination by the ECU_A10.

  (2) The ECU_E14 and ECU_F15 including the booster circuits 141 and 151 can operate normally when the output voltage VB2 of the lead storage battery 30 as the power supply voltage is between the operation guarantee voltage K1 and the boost lower limit voltage K2. Therefore, when the voltage VB2 is equal to or higher than the boost lower limit voltage K2, the ECU_A10 determines the abnormality of the network 40 based on the heartbeat signal transmitted from the ECU_E14 and ECU_F15. As a result, it is possible to increase the chances of abnormality determination.

  (3) ECU_D13 that does not include a booster circuit, and ECU_E14 and ECU_F15 that include booster circuits 141 and 151 coexist in the ECU that is supplied with electric power from the lead storage battery 30. Therefore, when the voltage VB2 is lower than the operation guarantee voltage K1, the abnormality determination based on the heartbeat signal of the ECU_D13 that does not include the booster circuit is invalidated. When the voltage VB2 is lower than the boost lower limit voltage K2, the booster circuit 141 is used. , 151 including ECU_E14 and ECU_F15, the abnormality determination is invalidated based on the heartbeat signal. As a result, it is possible to increase the chance of performing abnormality determination according to the presence or absence of the booster circuit of each ECU.

  (4) When the engine is restarted in the idle stop control, the output voltage VB2 of the lead storage battery 30 is controlled so as not to be lower than the boost lower limit voltage K2. For this reason, ECU_A10, ECU_E14, and ECU_F15 become communicable, and it becomes possible to increase the implementation opportunity of the abnormality determination of the network 40.

  (5) The ECU_A10 transmits information on the determination invalidation flag to the ECU_B11 and ECU_C12 that are not monitoring the output voltage VB2 of the lead storage battery 30. The ECU_B11 and ECU_C12 that have received the determination invalidation flag determine that an abnormality has occurred in the network 40 even when the heartbeat signal is not received from the ECU for which the determination invalidation flag is ON. Not performed. Thereby, it is possible to suppress errors in determination when ECU_B11 and ECU_C12 make an abnormality determination of network 40 based on the heartbeat signal received from ECU_D13 to ECU_F15.

(Other embodiments)
The present invention is not limited to the description of the above embodiment, and may be implemented as follows, for example.

  -When the output voltage VB2 of the lead storage battery 30 decreases with the power supply to the starter 51, there is a possibility that the operation of the ECU_D13 to ECU_F15 using the lead storage battery 30 as a power source may be temporarily stopped. When the ECU_D13 to ECU_F15 stop operating, when the voltage VB2 increases and the operation is restarted, abnormal data may be transmitted to the network 40 immediately after the operation is restarted. The ECU_A 10 that has received the abnormal data may erroneously determine that an abnormality has occurred in the network 40.

  Therefore, after the voltage VB2 drops below the predetermined voltage (K1 or K2), when the voltage VB2 returns to the predetermined voltage or higher and it is determined that the ECU_D13 to ECU_F15 have restarted the operation, a predetermined delay after the operation restarts In the time (for example, 1 second), it is set as the structure which invalidates the abnormality determination of the network 40 based on the data transmitted from ECU_D13-ECU_F15. Then, after a predetermined delay time has elapsed, the ECU_A10 cancels the invalidation of the abnormality determination of the network 40 based on the data transmitted from the ECU_D13 to the ECU_F15. With such a configuration, it is possible to suppress the ECU_A 10 from erroneously determining that an abnormality has occurred in the network 40.

  FIG. 5 shows a flowchart of the abnormality determination invalidation process in this modification. In the flowchart shown in FIG. 5, the process of step S17 is performed instead of the process of step S07 of the flowchart shown in FIG. 2, and the process of step S20 is performed instead of the process of step S10. In step S17 and step S20, after the determination invalidation flag is turned off and a predetermined delay time is waited, the invalidation of abnormality determination by the ECU_A10 for the ECU in which the determination invalidation flag is turned off is canceled.

  In the above embodiment, the lithium ion storage battery 21 that is an example of the first power supply unit and the lead storage battery 30 that is an example of the second power supply unit are connected via the first switch SW1, but these lithium ion storage batteries 21 and the lead storage battery 30 may not be connected.

  In the above embodiment, one of the two different storage batteries (lithium ion storage battery 21 and lead storage battery 30) is the first power supply unit and the other is the second power supply unit. It may be one that supplies power to the power supply unit. Specifically, in a power supply device having one storage battery and a booster circuit that boosts the voltage, the first power supply unit is configured to supply power from the storage battery via the booster circuit, and the storage battery does not pass through the booster circuit. The configuration for supplying power is the second power supply unit. In the booster circuit, the voltage supplied from the storage battery is boosted to the operation guarantee voltage K1 or higher. In addition, since the starter 51 is configured to be supplied with power from the second power supply unit, the voltage of the power supplied from the first power supply unit is stabilized, and the ECU or electric load supplied with power from the first power supply unit Can operate stably.

  When the output voltage VB2 of the lead storage battery 30 becomes lower than the operation guarantee voltage K1, the processing may be simplified so as to invalidate the abnormality determination for all ECUs ECU_D13 to ECU_F15. If all the ECUs connected to the lead storage battery 30 have a booster circuit, the abnormality determination is invalidated for all ECUs when the output voltage VB2 of the lead storage battery 30 becomes lower than the boost lower limit voltage K2. May be.

  The ECU_E14 and the ECU_F15 are each configured to include the booster circuits 141 and 151. However, the ECU_E14 and the ECU_F15 may be configured to include one power supply device including the booster circuit and to be supplied with power from the power supply device.

  The ECU that performs communication abnormality determination and the ECU that performs idling stop control may be different. In this case, when the lead storage battery 30 supplies power to the starter 51, both ECUs need to be supplied with a stable power supply voltage from the lithium ion storage battery 21.

  -Regarding invalidation of abnormality determination, even when the invalidation flag is ON, ECU_A10 made an abnormality determination of the network 40, and after the invalidation flag was turned OFF, the invalidation flag was turned ON It is good also as a structure which deletes the log | history of the abnormality determination of a period.

  -Regarding the abnormality determination method of the communication means, the ECU_A10 has a countdown timer for each ECU. When the ECU_A10 receives a signal from the ECU, the countdown timer is reset, the signal cannot be received from the ECU for a certain time, and the countdown timer becomes zero. In such a case, a technique such as a watchdog timer may be used to determine that an abnormality has occurred.

  DESCRIPTION OF SYMBOLS 10 ... ECU_A (1st control unit, abnormality determination means, voltage detection means, invalidation means), 13-15 ... ECU_D-ECU_F (2nd control unit), 21 ... Lithium ion storage battery (1st power supply part), 30 ... Lead storage battery (second power supply unit), 40... Network (communication means).

Claims (7)

A first control unit (10) powered by a first power supply (21);
A second control unit (13-15) supplied with power from the second power supply unit (30);
A communication means (40) for communicating these two control units, and the two control units can communicate with each other by the communication means,
The first control unit includes:
An abnormality determining means for determining an abnormality of the communication means according to a transmission signal transmitted from the second control unit;
Voltage detection means for detecting a power supply voltage of the second power supply unit;
Invalidating means for invalidating abnormality determination by the abnormality determining means when the power supply voltage detected by the voltage detecting means is lower than a predetermined voltage, and
The second control unit (14, 15) includes a boosting unit (141 for boosting the unit internal voltage to the operation guarantee voltage or higher when the power supply voltage of the second power supply unit is lower than the operation guarantee voltage in the control unit. 151),
If the power supply voltage of the second power supply unit is equal to or higher than a predetermined boost lower limit voltage lower than the operation guarantee voltage, the boosting means can boost the unit internal voltage to the operation guarantee voltage or higher.
It said disabling means, vehicle control system characterized that you implement invalidation of the abnormality determining the boosted lower limit voltage as the predetermined voltage. A first control unit (10) powered by a first power supply (21);
A second control unit (13-15) supplied with power from the second power supply unit (30);
A communication means (40) for communicating these two control units, and the two control units can communicate with each other by the communication means,
The first control unit includes:
An abnormality determining means for determining an abnormality of the communication means according to a transmission signal transmitted from the second control unit;
Voltage detection means for detecting a power supply voltage of the second power supply unit;
Invalidating means for invalidating abnormality determination by the abnormality determining means when the power supply voltage detected by the voltage detecting means is lower than a predetermined voltage, and
The first power supply unit and the second power supply unit are connected via an opening / closing means (SW1),
The on-vehicle control system is characterized in that the open / close means is kept open during a period in which the output voltage of the second power supply unit drops, thereby avoiding a drop in the output voltage of the first power supply unit. The second control unit (14, 15) includes a boosting unit (141 for boosting the unit internal voltage to the operation guarantee voltage or higher when the power supply voltage of the second power supply unit is lower than the operation guarantee voltage in the control unit. 151),
If the power supply voltage of the second power supply unit is equal to or higher than a predetermined boost lower limit voltage lower than the operation guarantee voltage, the boosting means can boost the unit internal voltage to the operation guarantee voltage or higher.
The in-vehicle control system according to claim 2 , wherein the invalidating means invalidates the abnormality determination using the boost lower limit voltage as the predetermined voltage. A plurality of control units as the second control unit;
The plurality of control units include a unit with boost (14, 15) having the boosting unit and a unit without boosting (13) without the boosting unit,
The invalidation means invalidates the abnormality determination based on the transmission signal from the unit without boost when the power supply voltage detected by the voltage detection unit is lower than the operation guarantee voltage, and from the unit with boost The in-vehicle control system according to claim 1 or 3, wherein abnormality determination based on a transmission signal is not invalidated. The first control unit stops combustion of the in-vehicle engine when a predetermined automatic stop condition is satisfied, and automatically stops the engine, and when a predetermined restart condition is satisfied after the automatic stop condition is satisfied, The engine is restarted by driving the starter by supplying power from the second power supply unit,
The automatic stop condition includes that the power supply voltage of the second power supply unit is equal to or higher than a voltage that is assumed not to be lower than the boost lower limit voltage when the starter is driven for restarting the engine. The on-vehicle control system according to 1, 3, or 4 . A third control unit (11, 12) other than the first control unit as a control unit to which power is supplied from the first power supply unit;
The first control unit, the second control unit, and the third control unit are communicable by the communication means,
The third control unit includes an abnormality determination unit that determines an abnormality of the communication unit according to a transmission signal transmitted from the second control unit,
The first control unit invalidates the abnormality determination by the abnormality determination means in the third control unit with respect to the third control unit when the voltage of the second power supply unit is lower than the predetermined voltage. The in-vehicle control system according to any one of claims 1 to 5 , further comprising invalidation instruction means for instructing. The invalidation means, when the power supply voltage detected by the voltage detection means becomes lower than the predetermined voltage and then returns to the predetermined voltage or higher, the abnormality determination means after a predetermined time after returning to the predetermined voltage or higher. The in-vehicle control system according to any one of claims 1 to 6 , wherein the invalidation of abnormality determination by the control is canceled.

Images