JP6334436B2 - Mutual monitoring module for vehicles - Google Patents

Description

The present invention relates to a repro method for a low-order electronic control unit using a mutual monitoring module in a vehicular electronic control unit, the program area is destroyed due to a repro failure at a dealer, and even if an attempt is made to re-repro- It is intended to prevent the control device from being judged abnormal and shutting off the power relay.

  Due to the acceleration of the electronic control of the vehicle control device, a large number of electronic control devices are mounted on each vehicle today (see Patent Document 1). These electronic control devices are supplied with driving power from a power source such as a battery. Further, a power supply relay is usually inserted between the power supply and the electronic control as a drive power supply / cutoff means. Further, a power relay or a circuit for supplying / cutting off the power is generally inserted in the target device controlled by the electronic control device.

  Each electronic control device needs to control the controlled device in a safe direction when any abnormality occurs. For example, in Patent Document 2, an abnormality is detected by a main microcomputer or a sub-microcomputer in the same electronic control unit that monitors the main microcomputer, and the power supply relay or the power supply circuit upstream of the control target apparatus is shut off, thereby entering a fail-safe state. The technology to be transferred is disclosed.

  With such a configuration, even if there is no guarantee that the control target can be shifted to the fail-safe state due to a main microcomputer abnormality, the monitoring device such as the sub-microcomputer can shift to the fail-safe state.

JP 2009-196453 A JP 2008-88885 A

  However, the method proposed in Patent Document 1 is based on the premise that a monitoring device such as a sub-microcomputer is mounted in the electronic control device. If the device is newly mounted, the cost of the electronic control device is increased.

  In addition, if a monitoring device is not installed in the electronic control unit, there is a possibility that a functional failure can be detected by self-diagnosis, but a failure may occur depending on the failure part (for example, an arithmetic unit or an output unit) in the microcomputer. Since it is not possible to shift to the safe state, there is a safety problem.

  Also, there are cases where the monitoring device cannot be installed due to hardware restrictions such as the mounting area of the electronic control device. Even in this case, even if a functional failure can be detected by self-diagnosis, depending on the failure location, the fail-safe state can be ensured. There is no guarantee that you can move to.

  About the above, the method of detecting an abnormality reliably by utilizing the fact that it is connected by CAN communication and performing mutual monitoring between a plurality of electronic control units is already known.

Since Patent Document 2 is a method of detecting by communication with an in-vehicle electronic device connected to a power source via another relay, which is different from a relay that is a failure detection target, an electronic device that connects the monitoring device and the target relay. In addition to the control device, an electronic control device connected to another power supply relay for comparison is required, and the total system cost increases.
Further, this document focuses on an abnormality detection method and does not describe a behavior (fail-safe process) as a system after the abnormality is detected.

  Regarding the above, a technique is known in which an abnormality is detected by the host electronic control unit, and when it is determined to be abnormal, the transition to the fail-safe state is safely performed without depending on the electronic control unit of the vehicle automatic transmission. .

  However, in the above configuration, in repro work at a dealer, etc., equipment is connected by personnel, and there are scenes where repro fails due to dropping or vibration of the connector connecting the vehicle and equipment during repro. It can often be imagined, and if it fails, the program area will be destroyed, so the lower-level electronic control unit detects an abnormality in the initial diagnosis after startup, so the higher-level control unit shuts off the power relay as a fail-safe process. There is a problem that repro is impossible.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a repro technique for a vehicular mutual monitoring module. When the repro of the lower electronic control apparatus fails due to various factors, the upper electronic control apparatus Then, an abnormality is detected and the state is once shifted to the fail-safe state. However, when repro is necessary again, the repro mode is preferably shifted without depending on the state of the lower electronic control unit.

  In order to achieve the above object, the present invention has the following means.

A vehicle electronic control device (for example, ATCU) monitoring system according to claim 1 includes a host electronic control device (hereinafter referred to as a monitoring device) independent as hardware for detecting an abnormality of the ATCU, and drive power to the ATCU and the monitoring device. A power supply means for supplying drive power to the monitoring device when the IGNSW is at an active level by an activation switch signal (hereinafter referred to as IGNSW) input from the outside to the monitoring device; A first relay (hereinafter referred to as IGN relay) that is inserted between the power supply means and the monitoring device to supply / shut off power to the monitoring device, and the monitoring device determines whether or not drive power can be supplied to the ATCU. In the second relay (hereinafter referred to as ATCU relay) installed downstream of the IGN relay that controls the supply / cutoff of power, the ATCU and the monitoring device, Equipped with a communication line for performing the cross-sectional,
When the monitoring device determines that the ATCU has failed based on information from the communication line, in the mutual monitoring module configured to turn off the ATCU relay as a fail-safe process and cut off the power supply to the ATCU.
When the ATCU relay is turned off as a fail-safe process due to an ATCU failure, the monitoring device detects a repro request to the ATCU from the outside, that is, from the repro device to the ATCU. It is characterized by enabling ATCU repro by controlling the relay on.

  When the IGNSW changes from the low level to the active level, the monitoring device according to claim 2 performs self-diagnosis of the microcomputer, and turns on the ATCU relay and supplies power to the ATCU only when the diagnosis result is normal It is characterized by.

The monitoring device according to claim 3 is characterized in that the diagnosis processing to the ATCU is stopped only when there is a repro request from the repro device to the ATCU. I
The monitoring apparatus according to claim 4 performs a self-diagnosis of the microcomputer when there is a repro request from the repro apparatus to the ATCU, and turns on the ATCU relay only when the diagnosis result is normal. It is characterized by supplying electric power to.

  The ATCU according to claim 5 performs self-diagnosis of the microcomputer after being started according to claim 2, and when the diagnosis result is abnormal, the communication on the communication line is stopped to promote abnormality detection in the monitoring device. At the same time, it is characterized by preventing erroneous operation of the controlled object by transitioning to the repro mode.

  After starting up according to claim 4, the ATCU according to claim 6 re-executes the self-diagnosis of the microcomputer, and starts communication with the external repro tool by shifting to the repro mode when the diagnosis result is abnormal. It is characterized by that.

  According to the present invention, not only an electronic control unit (ATCU) for an automatic transmission for a vehicle, but also other electronic control units can be used by using a network communication path such as CAN installed in most of the recent electronic control units. Can be regarded as an ATCU monitoring device, and the other electronic control device on the monitoring side controls the power supply relay of the ATCU.

  Also, in repro work at dealers etc., repro devices are connected by hand, and there are scenes where repro fails due to dropping or vibration of the connector connecting the vehicle and equipment during repro, If it fails, the program area will be destroyed, and the ATCU will detect an abnormality in the initial diagnosis after startup, so the monitoring device will shut off the power relay as a fail-safe process. However, in the present invention, the monitoring device detects an abnormality of the ATCU and temporarily controls the fail-safe state, that is, the ATCU relay to be turned off. Since the ATCU relay can be turned on by receiving the repro request, it is possible to shift to the repro mode regardless of the ATCU state.

  With the above configuration, the ATCU relay can be turned on only during repro operation, and an unintentional runaway due to an ATCU failure can be prevented, so that there is an advantage of improving reliability.

It is a figure which shows an example of the monitoring system which shows embodiment of this invention. It is a flowchart which shows the monitoring procedure between ELOP-ATCU at the time of first time starting. It is a flowchart which shows the monitoring procedure between ELOP-ATCU at the time of normal operation. It is a flowchart which shows the repro procedure at the time of ATCU repro failure. It is a flowchart which shows the repro procedure after a repro request | requirement is transmitted from a repro tool. It is a system block diagram which shows the relationship of conventional ELOP-ATCU.

  Embodiments of the present invention will be described below with reference to the drawings.

A first embodiment of the present invention will be described with reference to FIGS.
FIG. 1 shows an embodiment of the present invention in which a transmission control device (hereinafter referred to as ATCU) 1 for controlling an automatic transmission of a vehicle is monitored. The monitoring target may be an electronic control device that controls other electrical components mounted on the vehicle such as an engine, a seat belt, and a motor.

  FIG. 1 is a schematic diagram of a monitoring system of ATCU 1 using an electric oil pump control device (hereinafter referred to as ELOP) 2 as a monitoring device. The ATCU1 and ATCU1 to be monitored are independent of the hardware, and the ON / OFF control is performed by the ELGN2 and the ELOP2 that supply / shut off the driving power to the ELOP2 and ELOP2 to be monitored, and the driving power is supplied to the ATCU / The ATCU relay 4 to be shut off, the power source (which may be a battery or a generator not shown) 5 for supplying driving power to each electronic control unit, the ELOP 2 and each electronic control unit that are turned on / off by an operation from the driver IGNSW 6 for controlling whether or not to supply drive power to the motor, and a solenoid valve 7 for engaging / disengaging the clutch of the automatic transmission in response to a command from ATCU 1. The ATCU relay 4 only needs to have a switch function capable of supplying / cutting off current, and may be a mechanical relay that is turned on / off by contact movement or a semiconductor relay using a semiconductor switching element.

  The ATCU 1 calculates a drive amount to a plurality of solenoid valves 7 and a control circuit that performs output switching, and a power supply circuit that converts a supply voltage from the power source 5 into a drive voltage of the microcomputer 8 and supplies the converted voltage. 9, a communication I / F circuit 10 for communicating with ELOP 2, and a driver circuit 11 that converts the drive amount to the solenoid valve 7 calculated by the microcomputer 8 into a voltage.

  ELOP2 calculates and supplies the drive amount to the oil pump that pressurizes the hydraulic oil of the automatic transmission, and converts the supply voltage from the power source 5 into the drive voltage of the microcomputer 12 and supplies it. A power supply circuit 14 that performs communication with the ATCU 1 and an ATCU that controls ON / OFF of the ATCU relay 4 and controls the power supplied to the ATCU that is an external electronic control unit A relay control circuit 15 is provided. As the ATCU relay control circuit 15, a transistor is illustrated in FIG. When the voltage required for driving the ATCU relay 4 is sufficient by the output voltage of the microcomputer 12, or when the transistor is provided outside the ELOP2, the transistor is not necessarily required in the ELOP2. In that case, the ATCU relay control circuit 15 corresponds to an output signal line for the microcomputer 12 to drive the ATCU relay 4.

  The communication I / F circuit 10 and the driver circuit 11 mounted on the ATCU 1 are directly connected to the power source of the ATCU relay 4. The microcomputer 8 is also provided downstream of the ATCU relay 4 via the power supply circuit 9.

  The power supply circuit 9 is supplied with power from the power source 5 without passing through the IGN relay 3 or ATCU relay 4 and power from the power source 5 through the IGN relay 3 or ATCU relay 4. Are connected to each other. From the route via various relays, the IGNSW 6 is turned on by the driver and the IGN relay 3 is turned on, and then the ATCU relay 4 is turned on by the ELOP 2 to supply power. Thereafter, the power supply circuit 9 supplies a predetermined drive voltage to electronic components such as the microcomputer 8. The microcomputer 8 receives the drive voltage from the power supply circuit 9 and starts controlling the solenoid valve 7 after a predetermined reset process.

When the IGNSW 6 is turned off by the driver, the IGN relay 3 is turned off, and the power supply to the power supply circuit 9 is cut off from the route through various relays. Here, the power supply circuit 9 shifts to a self-shut-off period after a predetermined self-shut-off delay period, and the microcomputer 8 is instructed by the voltage supplied from the power source 5 without passing through various relays until an instruction from the microcomputer 8 is received. Supply drive voltage to The microcomputer 8 performs processing such as storing various learning values during the self-shutoff period, instructs the power supply circuit 9 to stop driving voltage supply, and ends the self-shutoff period.
Here, during the self-shut delay period, the system is in a standby state and nothing is functioning as the ATCU.

The power supply circuit 14 is similarly connected to two types of power supply paths.
The above-described monitoring system in FIG. 1 detects an abnormality of the ATCU 1 at the time of system startup and at a steady time, and when abnormal, the monitoring device turns off the ATCU relay 4 as fail-safe processing.

FIG. 6 is a schematic diagram of a conventional system. Unlike FIG. 1, the conventional system does not include the ATCU relay 4, the ATCU relay control circuit 15, and its peripheral circuits.
FIG. 2 is a diagram showing a processing flow of ATCU1 and ELOP2 at the time of system startup. First, when the IGNSW 6 is turned on, the IGN relay 3 is turned on, power is supplied to the power supply circuit 14 of the ELOP 2 and the microcomputer 12 is activated.

Next, the activated microcomputer 12 performs a self-diagnosis to determine whether there is a failure in the internal function (S21). Specifically, the diagnosis here includes ROM / RAM diagnosis and register diagnosis. In the case of diagnosis NG, the state shifts to the fail safe state (S22). If the diagnosis is OK, the voltage state of the IGNSW 6 is acquired by the microcomputer 12 (S23).
Next, when the acquired voltage of the IGNSW 6 is 0 V (OFF state) and the ELOP 6 is activated, it is determined that the IGN relay 3 is in an ON failure because power should not have been supplied. (S24), the process proceeds to fail-safe processing (S25).
If the diagnosis is OK, the ATCU relay 4 is turned ON to start the ATCU 1 (S26).

  After starting ATCU1, ATCU1 performs a self-diagnosis to determine whether there is a failure in the internal function of microcomputer 8 (S27). Specifically, the diagnosis here includes ROM / RAM diagnosis and register diagnosis. In the case of diagnosis NG, the process shifts to the fail safe state (S28). If the diagnosis is OK, the ATCU monitoring system is determined to be normal, and the routine proceeds to normal control (S29). Note that fail-safe control in this flowchart is control in which the microcomputer 12 itself shifts to a standby state or a reprogramming waiting state and does not operate until the IGNSW 6 is turned off.

  FIG. 3 is a diagram showing a processing flow of ATCU1 and ELOP2 during normal control after system startup. The ELOP 2 receives the self-diagnosis result of the ATCU 1 from the ATCU 1 using communication means (here, CAN communication using the communication I / F circuits 10 and 13 as an example) (S 31). The self-diagnosis here is a diagnosis performed by the ATCU 1 itself, including not only functional diagnosis inside the microcomputer, such as ROM / RAM diagnosis and register diagnosis, but also functional failure of the ATCU 1 main body.

  ELOP2 makes an OK / NG determination from the self-diagnosis result from ATCU1 (S32), and in the case of diagnosis NG, ELOP2 shifts to fail-safe control, operates ATCU relay 4 OFF, and cuts off power to ATCU1 ( S33). In such a case, since ATCU 1 can determine its own abnormal state, it may be wired so that ATCU 1 itself can be operated to turn OFF instead of ELOP 2. If the diagnosis at S32 is OK, ELOP2 transmits problem data for detecting a malfunction of the microcomputer of ATCU1, specifically, a malfunction of the arithmetic unit of the microcomputer, to ATCU1 by CAN communication (S34).

  The ATCU 1 generates answer data using the computing unit of the microcomputer 8 based on the problem data received from the ELOP 2 (S35), and returns it to the ELOP 2 (S36). ELOP2 makes an OK / NG determination based on the response data received from ATCU1 (S37). In the case of diagnosis NG, ELOP2 shifts to fail-safe control, operates ATCU relay 4 OFF, and cuts off power to ATCU1. (S38).

  If the diagnosis is OK, the ATCU 1 determines that it is normal and continues normal control (S39). With the above diagnosis, ELOP2 can diagnose an abnormal state that cannot be determined by ATCU1 itself. In this flowchart, the example in which ELOP2 monitors ATCU1 by exchanging question data and answer data has been described. However, as another monitoring method, ELOP2 monitors signals periodically transmitted from ATCU1 via CAN communication. In addition, a watchdog timer method may be adopted.

  The fail-safe control in this flowchart is that the microcomputer 12 of the ELOP2 operates the ATCU relay control circuit 15 to control the ATCU relay 4 to be turned off.

  By performing the above diagnosis, even when no monitoring device is mounted on the ATCU1, a failure / functional failure of the microcomputer of the ATCU1 can be detected by using the electronic control device connected via the network as the monitoring device. I can do it. That is, it is possible to provide a monitoring system that can accurately detect a failure of the electronic control device without changing the current configuration of the electronic control device and with minimal system change, and can reliably enter the fail-safe state.

  Further, with the system configuration of the present invention, even if the ATCU1 microcomputer runs away and the system power supply cannot be stopped even if the ATCU relay 4 is turned off, the ATCU relay 4 is turned off on the ELOP2 side which is a monitoring device. It is possible to stop the function of the ATCU1, that is, the operation of the solenoid valve 7 / network communication. As a result, the automatic transmission is driven by the directly connected gear, so that the power relay can be turned OFF by the ATCU1 runaway. It is possible to prevent serious damage such as interlocking.

  Further, by using the other electronic control device mounted on the vehicle as the monitoring device, there is no need to mount the monitoring device on the ATCU 1 itself, and there is an advantage that the system cost can be reduced. Further, when the ATCU 1 is mounted integrally with the automatic transmission, there are severe restrictions on the size and mounting area of the ATCU, and according to the present invention, the restrictions can be satisfied.

  The configuration of one embodiment of the present invention has been described above. However, the present invention is not limited to such an ATCU monitoring system, and functions to work in a safe direction as a vehicle by stopping the operation of the electronic control device. The present invention can also be applied to an electronic control device having

Hereinafter, the second embodiment will be described with reference to FIGS. In the present embodiment, a repro technique in an ATCU inter-system where repro has failed will be described. As in the first embodiment, the system configuration described with reference to FIG. 1 is operable, and thus the description of the system configuration is omitted.
First, when the IGNSW 6 is turned on, the IGN relay 3 is turned on, power is supplied to the power supply circuit 14 of the ELOP 2 and the microcomputer 12 is activated. Next, the activated microcomputer 12 performs a self-diagnosis to determine whether there is a failure in the internal function (S201). Specifically, the diagnosis here includes ROM / RAM diagnosis and register diagnosis. In the case of diagnosis NG, the state shifts to the fail safe state (S202). If the diagnosis is OK, the voltage state of the IGNSW 6 is acquired by the microcomputer 12 (S203).

  Here, if the acquired voltage of the IGNSW 6 is 0 V (OFF state) and the ELOP 6 is activated, it is determined that the IGN relay 3 is in an ON failure since power should not have been supplied. (S204), the process proceeds to fail-safe processing (S205). Here, the fail safe control means that the microcomputer 12 itself shifts to a standby state or a reprogramming waiting state and performs control so that nothing operates until the IGNSW 6 is turned off. If the diagnosis is OK, the ATCU relay 1 is turned ON to start the ATCU 1 (S206).

  After the start-up, the ATCU 1 performs a self-diagnosis whether there is a failure in the internal function of the microcomputer 8 (S207). Specifically, the diagnosis here includes ROM / RAM diagnosis and register diagnosis. Since the ATCU in which repro failed has been assumed this time, the diagnosis result is naturally NG, and the state shifts to the fail safe state (S208).

  Since ATCU1 is in a fail-safe state, CAN transmission is also prohibited, and ELOP2 detects an abnormality of ATCU1 due to CAN interruption from ATCU1, shifts to fail-safe processing, and turns off ATCU relay 4 (S209). .

  Here, since the ATCU 1 power supply is cut off as a system, the ATCU relay 4 on the ELOP 2 side which is a monitoring device can be used even when the ATCU relay 4 is turned off and the system power supply cannot be stopped even if the ATCU relay 4 is turned off. By turning OFF, it is possible to stop the function of the ATCU1, that is, the operation of the solenoid valve 7 / network communication. As a result, the automatic transmission is driven by a directly connected gear. It cannot be turned off and can cause serious damage such as interlocking.

  Next, when the repro device is connected to the vehicle in the above state, the repro tool makes a system call. Normally, however, the ATCU1 power is cut off, resulting in a system error. A system call from the repro tool is received instead (S211), and it is determined that there is a repro request based on this signal, and the ATCU relay 4 is turned on (S212).

  Here, ELOP2 determines that ATCU1 has shifted to the repro mode, and stops the diagnosis to ATCU1 (S213). The restarted ATCU 1 performs a self-diagnosis again whether there is a failure in the internal function of the microcomputer 8 (S214). Here, since ATCU1 failed repro in the previous time, the abnormality is determined by the ROM diagnosis, and the process proceeds to failsafe processing, that is, repro mode (S215).

  The ATCU 1 that has shifted to the repro mode operates in the non-erasable program area in which the repro program is stored, establishes communication with the repro apparatus by the repro mode dedicated CANID, and receives a system call (S216). Thereafter, the ATCU 1 can shift to a repro process by returning a response to the system call (S217).

  Here, if the ATCU1 failure occurs not only in the ROM area but also in multiple branches, the repro processing does not end, so the timeout determination processing is performed on the ELOP2 side (S218), and even if a certain time has elapsed. If there is no notification of completion of repro, it is determined that repro has failed, and the ATCU relay is turned off (S219).

  As described in the above embodiment, the monitoring system for an electronic control device of the present invention provides a monitoring device independent as hardware for detecting an abnormality of the electronic control device to be monitored, and driving power to the electronic control device and the monitoring device. A power supply means for supplying, a power supply means for supplying drive power to the monitoring device when the activation switch signal is at an active level by an activation switch signal input from the outside to the monitoring device; and a power supply means The first relay for supplying / cutting off the power to the monitoring device, which is inserted between the monitoring device and the monitoring device, and the monitoring device judges whether or not the driving power can be supplied to the electronic control device, and the supply / cutoff of the power is performed. A second relay installed downstream of the first relay to be controlled, and a communication line for performing diagnosis by communication between the electronic control device and the monitoring device are provided.

  Furthermore, when the second relay is turned on by a start request from the monitoring device, the electronic control device to be monitored operates with a power supply circuit that outputs a voltage for operating the microcomputer and a voltage output from the power supply circuit. A microcomputer to be activated, a communication circuit to be activated by an activation request signal from the monitoring device, and a solenoid valve drive circuit to be activated by an activation request signal from the monitoring device.

  Further, when the activation switch signal is at an active level, the monitoring device is supplied from a power supply circuit that outputs a voltage for operating the microcomputer of the monitoring device, a microcomputer that operates according to the voltage output from the power supply circuit, and the power supply circuit. A communication circuit that is activated by the generated power may be provided.

  Furthermore, the monitoring device operates the microcomputer of the monitoring device when the activation switch signal is at the active level, and performs a self-diagnosis of the microcomputer at the start-up and steady state to confirm that the microcomputer is operating normally. Then, the second relay may be turned on. Furthermore, the monitoring device operates the microcomputer of the monitoring circuit when the activation switch signal is at the active level, performs a self-diagnosis of the microcomputer at the start-up and normal times, and if the microcomputer determines that there is an abnormality, The circuit may transmit abnormality information to the monitoring target control device and turn off the second relay.

  Furthermore, the electronic control device to be monitored operates the microcomputer when the second relay is turned on by a start request from the monitoring device, performs a self-diagnosis of the microcomputer at the start, and determines that it is abnormal by itself. A transition to the standby state may be made so that the automatic transmission for a vehicle or the like (such as hydraulic control of a solenoid valve) is not performed.

  Furthermore, the electronic control unit to be monitored operates the microcomputer when the second relay is in the on state, and controls the automatic transmission for the vehicle (solenoid valve hydraulic control, etc.) in a steady state. Even if the microcomputer performs self-diagnosis at any time and determines that it is abnormal, it sends the abnormality information to the monitoring device via the communication circuit, then stops the output of the communication circuit, and then the microcomputer shifts to the standby state. The vehicle automatic transmission or the like may not be controlled.

  According to the present invention, not only an electronic control unit (ATCU) for an automatic transmission for a vehicle, but also other electronic control units can be used by using a network communication path such as CAN installed in most of the recent electronic control units. Can be regarded as an ATCU monitoring device.

  Further, a problem for diagnosing the function of the main microcomputer is transmitted from the monitoring-side electronic control device to the monitoring-target electronic control device, and the monitoring-target electronic control device calculates an answer to the problem, and the monitoring-side electronic control device By returning to the device, it is possible to detect a microcomputer failure on the electronic control device side to be monitored.

  In addition, when the monitoring electronic control device detects an abnormality in the electronic control device to be monitored, the operation of the electronic control device to be monitored is turned off by turning off the power relay of the electronic control device to be monitored on the monitoring side. In the case of automatic transmission control, the operation of the solenoid valve can be stopped. As a result, since the automatic transmission is driven by the directly connected gear, it is possible to prevent the power relay from being turned off due to the electronic control device runaway being monitored, and to prevent serious damage such as an interlock.

  In addition, when the power relay of the electronic control device to be monitored is fixed to ON, the monitoring device transmits a failure information to the electronic control device to be monitored, so that the electronic control device to be monitored itself is in a standby state. Fail-safe processing such as shifting to

  Further, by using the other electronic control device mounted on the vehicle as the monitoring device, there is an advantage that it is not necessary to mount the monitoring device on the electronic control device itself to be monitored, and the system cost can be reduced.

  Also, in repro work at dealers etc., repro devices are connected by hand, and there are scenes where repro fails due to dropping or vibration of the connector connecting the vehicle and equipment during repro, If it fails, the program area will be destroyed, and the ATCU will detect an abnormality in the initial diagnosis after startup, so the monitoring device will shut off the power relay as a fail-safe process. However, in the present invention, the monitoring device detects an abnormality of the ATCU and temporarily controls the fail safe state, that is, turns off the ATCU relay. However, if repro is necessary again, the monitoring device issues a repro request. Since the ATCU relay can be turned on and received, it is possible to shift to the repro mode without depending on the state of the ATCU.

  With the above configuration, the ATCU relay can be turned on only during repro operation, and an unintentional runaway due to an ATCU failure can be prevented, so that there is an advantage of improving reliability.

  According to the present invention, even if a monitoring device cannot be mounted due to hardware restrictions such as the mounting area of the electronic control device, if a certain communication means is provided, the upper electronic control device can control the power relay. A mutual monitoring device can be constructed. In the above mutual monitoring system, the higher-level electronic control device monitors the contents of the external device that should be communicated with the lower-level electronic control device, and preferably controls the power supply relay so that the re-repro It is possible to provide a system with high expandability, including not only safety but also service.

  DESCRIPTION OF SYMBOLS 1 ... ATCU, 2 ... Electric oil pump control apparatus (ELOP), 3 ... IGN relay, 4 ... ATCU relay, 5 ... Power supply (battery or generator not shown), 6 ... IGNSW, 7 ... Solenoid valve, 8 ... Microcomputer , 9: power supply circuit, 10: communication I / F circuit, 11: driver circuit.

Claims (6)

An upper electronic control device independent as hardware for controlling the power supply means of the lower electronic control device;
Power supply means for supplying electric power necessary for driving the lower electronic control device and the upper electronic control device;
The power supply means and the high-order electronic device that supply driving power to the high-order electronic control device when the start-up switch signal is at an active level by a start-up switch signal input from the outside to the high-order electronic control device A first relay that is inserted between the control devices to supply power to or cut off power to the host electronic control device;
Installed downstream of the first relay that controls whether or not the higher-order electronic control device activated by the activation switch signal determines whether or not to supply drive power to the lower-order electronic control device. A second relay,
A communication line capable of transmitting and receiving data for performing diagnosis between the lower electronic control device and the upper electronic control device;
When the lower electronic control device determines that the lower electronic control device is out of order based on information from the communication line, the upper electronic control device controls the second relay to be turned off as a fail-safe process and supplies power to the lower electronic control device. In the vehicle mutual monitoring module configured to shut off,
If there is a repro request from the outside to the lower electronic control device after the second electronic control device has turned off the second relay as a fail-safe process due to an abnormality in the lower electronic control device, the upper control device Detecting a repro request to the lower electronic control device by the communication line and enabling the second relay to be turned on by enabling the second relay to be turned on,
A vehicle mutual monitoring module characterized by the above. In the mutual monitoring module for vehicles according to claim 1,
The host electronic control device
When the activation switch signal input from the outside changes from the low level to the active level , the microcomputer in the host electronic control unit performs self-diagnosis, and the second relay is turned on only when the diagnosis result is normal. Turning on and supplying power to the lower electronic control unit;
A vehicle mutual monitoring module characterized by the above. In the mutual monitoring module for vehicles according to claim 2,
The host electronic control device
Stopping diagnosis processing to the lower electronic control device only when there is a repro request to the lower electronic control device from the outside,
A vehicle mutual monitoring module characterized by the above. In the mutual monitoring module for vehicles according to claim 3,
The host electronic control device
When there is a repro request from the outside to the lower electronic control unit , the microcomputer in the upper electronic control unit is self-diagnosed, and the on-control of the second relay is permitted only when the diagnosis result is normal about,
A vehicle mutual monitoring module characterized by the above. In the mutual monitoring module for vehicles according to claim 1,
The host electronic control device
When the activation switch signal input from the outside changes from the low level to the active level , the microcomputer in the host electronic control unit performs self-diagnosis, and the second relay is turned on only when the diagnosis result is normal. Turn on and supply power to the lower electronic control unit, then
The lower electronic control device
Performs self-diagnosis of the microcomputer in the lower electronic control device, and when the diagnosis result is abnormal, stops communication on the communication line to promote abnormality detection in the upper electronic control device, To prevent erroneous operation of the control target,
A vehicle mutual monitoring module characterized by the above. In the mutual monitoring module for vehicles according to claim 1,
The host electronic control device
When there is a repro request from the outside to the lower electronic control unit , the microcomputer in the upper electronic control unit is self-diagnosed, and only when the diagnosis result is normal, the second relay ON control is permitted. Start the lower electronic control unit,
Then, the lower electronic control unit
Re-execute self-diagnosis of the microcomputer in the lower electronic control device, and start communication with an external repro tool by transitioning to the repro mode when the diagnosis result is abnormal,
A vehicle mutual monitoring module characterized by the above.