JP6742192B2 - Electronic control unit - Google Patents

Description

The present invention relates to an electronic control device that electronically controls the operation of a load device mounted on a vehicle.

2. Description of the Related Art In an electronic control device that performs electronic control of a vehicle, functional safety such as rapid acceleration of the vehicle and ignition of the vehicle is strongly required even when some failure occurs in the electronic control device.

The functional safety control is also important in an engine control device that is a kind of electronic control device and controls the operation of the engine.

For example, Japanese Unexamined Patent Application Publication No. 2016-37862 discloses an invention that stops a load device such as a throttle device, a fuel injection device, and an ignition device when it is determined that the engine control device is not normal.

JP, 2016-37862, A

However, recently, functional safety control has become more complicated with the diversification of electronic control of vehicles. Therefore, as described in JP-A-2016-37862, it is determined that the engine control device is not normal. In this case, it is necessary to consider not only the throttle device, fuel injection device and ignition device but also other load devices.

However, conventionally, other load devices have not been considered in particular, and different load devices may have different countermeasures in the event of an abnormality, and there is a problem that it is not necessary to simply stop all of them.

It is an object of the present invention to provide an electronic control device that is suitable for each of the load devices and that can cope with an abnormality.

The present invention, in order to achieve the above object, a throttle valve, a fuel injection device, and a microcomputer that performs drive control of a plurality of load devices including other load devices, and a monitoring unit that monitors the operation of the microcomputer, An electronic control device comprising: a throttle valve driver that drives the throttle valve; a fuel injection device driver that drives the fuel injection device; and a driver that drives the other external load device , comprising: A setting storage unit that stores in advance, for each of the plurality of drivers , settings of whether to stop the driver or continue the operation of the driver when a monitoring unit detects an abnormality in the microcomputer, When the abnormality of the microcomputer is detected by the setting changing unit that changes the setting stored in the setting storage unit, the operation of the plurality of drivers is performed based on the setting stored in the setting storage unit. A control unit for controlling , the electronic control unit is an engine control unit, the other load unit is any one or more of a power relay, a solenoid load unit, and a heater, the control unit, A selector for selecting whether to output the load drive stop signal output from the monitoring unit to each driver when an abnormality is detected in the microcomputer is provided, and the selector is selected based on the setting of the setting storage unit. Is controlled to selectively perform stop or continue control for each of the plurality of drivers when the microcomputer is abnormal .

According to the present invention, it is possible to provide an electronic control device that is suitable for each of the load devices and is capable of coping with an abnormality.

Problems, configurations, and effects other than those described above will be clarified by the following description of the embodiments.

1 is a block diagram showing a configuration of an electronic control device according to a first embodiment of the present invention. 3 is a timing chart of the electronic control device shown in FIG. 1. 3 is a block diagram showing the configuration of an electronic control device according to a second embodiment of the present invention. FIG. 4 is a timing chart of the electronic control device shown in FIG. 3.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

In the present invention, for example, when a failure occurs in the engine control device, the throttle valve and the fuel injection device are stopped to stop the engine safely. According to the present invention, the load device driven by the power supply/driver ASIC stops all the load devices in case of failure, while the integration of electronic parts is progressing and the functional safety mechanism is also built in the ASIC. It is possible to selectively drive and control the load device instead of continuing the operation.

Considering the case where the microcomputer controlling the load drive fails, a normal drive control signal cannot be guaranteed. On the other hand, the load driving device may be a load device such as a power relay that needs to be continuously turned on, a solenoid load device that controls a current to be supplied by PWM control, or a failure may occur if the load driving device is further turned on. There are various O2 heaters. According to the present invention, these various load driving devices can be selectively stopped when the electronic control device cannot perform normal control due to a failure, and secondary failure and secondary function stop can be prevented. It is extremely effective.

According to the present invention, for example, in an electronic control device such as an engine control device including a microcomputer and a power supply/driver ASIC, various loads driven by the power supply/driver ASIC when a microcomputer malfunctions or a system malfunction occurs in engine control. By setting in advance whether or not to stop the device when a failure occurs, it is possible to selectively stop the load device or to continue driving when a failure occurs.

According to the present invention, it is possible to safely control each load device by selecting whether to stop or continue driving each load drive device. For example, when the power relay is continuously turned on, it is possible to prevent the secondary function of the electronic control device connected to the subsequent stage from being stopped. Further, in the solenoid load device, by stopping the driving, it is possible to prevent abnormal operation of the solenoid due to excessive current driving. Further, by stopping the driving of the O2 heater, it is possible to prevent a secondary failure of the heater due to excessive current driving.

Embodiments of the present invention will be described below with reference to the drawings.

1 is a block diagram showing a configuration of an electronic control device according to a first embodiment of the present invention.

The first embodiment is an example in which the electronic control unit 1 is an engine control unit. The electronic control unit 1 includes a main microcomputer (for example, a microcontroller IC) 3 that controls the overall operation, a driver 14 for driving the throttle valve 4, a driver 15 for driving the fuel injection device 5, and a power supply/driver. An ASIC (for example, power supply/driver IC) 2 is mainly included and configured.

The power supply/driver ASIC 2 is a driver 16 a for driving the load device 6, a driver 16 b for driving the load device 7, a driver 16 c for driving the load device 8, and a microcomputer that mutually monitors the operation of the main microcomputer 3. It mainly includes a mutual monitoring unit 9, a selection setting register unit 10 that stores a selection setting corresponding to an abnormality, and a load drive control unit 11 that performs load drive control of the drivers 16a, 16b, and 16c. ..

The electronic control unit 1 controls the drive of the external throttle valve 4, the fuel injection device 5, and the other load devices 6, 7 and 8 by the main microcomputer 3. As the load device 6, the load device 7, and the load device 8, for example, a load device such as a power supply relay that needs to be continuously turned on, a solenoid load device that controls a current to flow by PWM control, or the like. It is possible to target all the load devices mounted on the vehicle and performing drive control, such as a load device such as an O2 (O2) heater, which may cause a failure if continued.

In the present embodiment, as the load device to be drive-controlled, three load devices, load devices 6, 7 and 8 are illustrated in addition to the throttle valve 4 and the fuel injection device 5, but the present invention is not limited to this. However, the number of load devices of less than three may be drive-controlled, or the number of load devices of four or more may be drive-controlled.

The driver 14 and the driver 15 are controlled by a drive control signal 17 and a drive control signal 18, respectively. Further, the driver 14 and the driver 15 are stopped by the load drive prohibition signal 32 from the main microcomputer 3.

The drivers 16a, 16b, 16c of the power supply/driver ASIC 2 are controlled by the load drive signals 29, 30, 31 from the load drive control unit 11 which receives the drive control signal 22 which is a serial signal from the main microcomputer 3.

The main microcomputer 3 outputs a microcomputer monitoring signal 24 to the power supply/driver ASIC 2, and the microcomputer mutual monitoring unit 9 of the power supply/driver ASIC 2 outputs an ASIC monitoring signal 25 to the main microcomputer 3. When a failure occurs in the main microcomputer 3, the microcomputer monitoring signal 24 becomes abnormal (for example, it is not output or a value different from the normal value is output), and the microcomputer mutual monitoring unit 9 determines that the microcomputer monitoring signal 24 The failure of the main microcomputer 3 can be detected by monitoring the. When a failure occurs in the microcomputer mutual monitoring section 9 of the power supply/driver ASIC 2, the ASIC monitoring signal 25 becomes abnormal (for example, not output or a value different from normal is output), and the main microcomputer 3 By monitoring the ASIC monitoring signal 25, the failure of the power supply/driver ASIC 2 can be detected. As described above, in the present embodiment, the microcomputer mutual monitoring unit 9 is provided, and the main microcomputer 3 and the power supply/driver ASIC 2 monitor each other by using the microcomputer monitoring signal 24 and the ASIC monitoring signal 25, so that the mutual monitoring is performed. It has the function of confirming normal operation. The microcomputer monitoring signal 24 and the ASIC monitoring signal 25 are transmitted and received by serial communication.

Here, when a failure occurs in the main microcomputer 3 and an abnormality occurs in the microcomputer monitoring signal 24, the microcomputer mutual monitoring unit 9 determines that the main microcomputer 3 is abnormal. In the microcomputer mutual monitoring unit 9 that has determined that the main microcomputer 3 is abnormal, the main microcomputer 3 is reset by the microcomputer reset signal 20 according to the content of the abnormality, or the monitoring NG signal 21 (normal high level, abnormal time) The load drive stop signal 19 is set to a low level to stop the throttle valve 4, each driver 14 of the fuel injection device 5, and the driver 15 which are functional safety control for engine control. At the same time, the load drive stop signal 19 is used as a signal for controlling the drivers 16a, 16b, 16c of the power supply/driver ASIC2. The load drive stop signal 19 also becomes a low level by the load drive stop signal 12 output by the self-diagnosis function of the main microcomputer 3 when a failure occurs in the main microcomputer 3, thereby stopping each driver 14 and driver 15. It is possible to control each driver 16a, 16b, 16c.

The selection setting register unit 10 stores, for each of the drivers 16a, 16b, 16c, a setting of whether to stop the driving by the load driving stop signal 19 or to continue the driving when a failure occurs. During normal operation, the main microcomputer 3 sends a selection setting control signal 23, which is a serial signal, to the selection setting register unit 10 in advance, and the selection setting control signal 23 causes the load driving stop signal 19 to stop the driving at the time of failure, or Alternatively, set whether to continue driving. The selection setting register unit 10 outputs the selection control signals 26, 27, 28 based on this setting. The selection control signals 26, 27, 28 are input to the selectors 13a, 13b, 13c, respectively.

Among the drivers 16a, 16b, 16c, the driver whose setting stored in the selection setting register unit 10 is "drive stopped when abnormal" is the load drive stop signal 19 generated by the failure of the main microcomputer 3, and the load device 6, The drive of 7 and 8 is stopped. In addition, even if the load drive stop signal 19 is generated due to a failure of the main microcomputer 3, the driver whose selection setting register unit 10 is set to “continue driving even when there is an abnormality” is selected. The load drive stop signal 19 is not output from the selectors 13a, 13b, 13c by the control signals 26, 27, 28, and the driver continues the load drive.

As the setting of the selection setting register unit 10, by setting “stop driving when abnormal” and “stop driving when abnormal” are set, “stop driving when abnormal” and “when abnormal” occur. However, it is possible to set "continue driving".

FIG. 2 is a diagram showing a timing chart of the electronic control device shown in FIG. In Figure 2, the driver 16b for driving the driver 16a and the load device 7 for driving the load device 6 performs setting of "abnormal to driving stop" in the selection setting register unit 10, to drive the load device 8 driver 16 c In the above, an example is shown in which the selection setting register unit 10 is set to “continue driving even when there is an abnormality”.

When the microcomputer monitoring signal 24 is normal, the throttle valve 4 is normally driven by the driver 14, and the fuel injection device 5 is normally driven by the driver 15.

When the microcomputer monitoring signal 24 is normal, the load device 6 is normally driven by the driver 16a receiving the load drive signal 29, and the load device 7 is normally driven by the driver 16b receiving the load drive signal 30. Then, the load device 8 is normally driven by the driver 16c that receives the load drive signal 31.

When the selection setting is performed on the selection setting register unit 10 by the selection setting control signal 23 from the main microcomputer 3, the selection control signal 26 becomes "selection ON" (setting of "stop driving when abnormal"), and the selection control signal 27 is set to "selection ON" (setting of "stop driving when abnormal"), and the selection control signal 26 is set to "selection OFF" (setting of "continue driving even when abnormal").

The load drive stop signals 19 and 1 (high level) signals are input to the selectors 13a, 13b, and 13c, respectively, and are input based on the selection control signals 26, 27, and 28 from the selection setting register unit 10, respectively. Either of the two signals thus output is output. According to each of the selection control signals 26, 27, and 28 in the case where the “drive stop at abnormal time” is set, each of the selectors 13 a, 13 b, and 13 c causes the load drive stop signal 19 (monitoring NG signal 21 or load drive). If either of the stop signals 12 is low level, the load drive stop signal 19 is low level, and if both the monitoring NG signal 21 and the load drive stop signal 12 are high level, the load drive stop signal 19 is high level. Is output) and each of the selectors 13a, 13b, 13c is set to 1 according to each of the selection control signals 26, 27, 28 in the case where "continue driving even in an abnormal condition" is set. Outputs a (high level) signal.

When the output of each of the selectors 13a, 13b, 13c is low level, the low level is input to each of the drivers 16a, 16b, 16c, and the driving of each of the load devices 6, 7, 8 is stopped.

When the outputs of the selectors 13a, 13b, 13c are at the high level, the load driving signals 29, 30, 31 are input to the drivers 16a, 16b, 16c, respectively, and the load devices 6, 7, 8 are input. Continue driving each.

The driver whose drive stop is not set in the selection setting register unit 10 continues the load drive. For example, as shown in the timing chart of FIG. 2, when the load device 6 and the load device 7 are set to stop by the selection setting control signal 23 and the load device 8 continues to operate, the monitor NG signal 21 causes the load device 6, The load device 7 stops. The load device 8 continues to operate. By these operations, when the main microcomputer 3 or the like fails, it is possible to selectively stop and continue each drive device driven by the power supply/driver ASIC 2, and it is possible to prevent a secondary failure or a functional stop. Become.

FIG. 3 is a block diagram showing the configuration of the electronic control device according to the second embodiment of the present invention.

In the first embodiment, an example in which the electronic control unit 1 is an engine control unit is shown, but the present invention is not limited to this, and is applicable to other electronic control units. For example, not only the engine control device but also the in-vehicle control device needs to stop the load drive device due to a failure to control the vehicle safely. In the second embodiment, an example in which the present invention is applied to an electronic control unit 34 which is an on-vehicle electronic control unit other than the engine control unit will be described. The electronic control unit 34 mainly includes a main microcomputer (for example, a microcontroller IC) 3 that controls the overall operation, and a driver ASIC (for example, a driver IC) 35. The same components as those in the first embodiment are designated by the same reference numerals and detailed description thereof will be omitted.

The drivers 16a, 16b, 16c of the driver ASIC 35 are driven by the drive control signal 22 which is a serial signal from the main microcomputer 3.

The main microcomputer 3 has a self-diagnosis function. When the main microcomputer 3 is diagnosed to be normal by this self-diagnosis function, the main microcomputer 3 outputs a high-level signal as the control signal 33, and the self-diagnosis function is provided. When the main microcomputer 3 is diagnosed as abnormal by the, the main microcomputer 3 outputs a low level signal as the control signal 33.

FIG. 4 is a diagram showing a timing chart of the electronic control device shown in FIG. In FIG. 4, with respect to the driver 16a that drives the load device 6 and the driver 16b that drives the load device 7, the driver 16a that drives the load device 8 is set in the selection setting register unit 10 by setting “stop driving when abnormal”. Shows an example of a case where "continue driving even in an abnormal state" is set in the selection setting register unit 10.

When the control signal 33 is normal (high level), the load device 6 is normally driven by the driver 16a receiving the load drive signal 29, and the load device 7 is normally driven by the driver 16b receiving the load drive signal 30. Then, the load device 8 is normally driven by the driver 16c that receives the load drive signal 31.

When the selection setting is performed on the selection setting register unit 10 by the selection setting control signal 23 from the main microcomputer 3, the selection control signal 26 becomes "selection ON" (setting of "stop driving when abnormal"), and the selection control signal 27 is set to "selection ON" (setting of "stop driving when abnormal"), and the selection control signal 26 is set to "selection OFF" (setting of "continue driving even when abnormal").

The control signals 33 and 1 (high level) are input to the selectors 13a, 13b, and 13c, respectively, and are input based on the selection control signals 26, 27, and 28 from the selection setting register unit 10, respectively. Either of the two signals is output. According to each of the selection control signals 26, 27, and 28 in the case of setting “stop driving when abnormal”, each of the selectors 13a, 13b, and 13c has a control signal 33 (high level if normal, abnormal if abnormal). If it is set to “Continue driving even in abnormal state”, each of the selectors 13a, 13b, and 13c outputs the corresponding selection control signal 26, 27, or 28. 1 (high level) signal is output.

When the output of each of the selectors 13a, 13b, 13c is low level, the low level is input to each of the drivers 16a, 16b, 16c, and the driving of each of the load devices 6, 7, 8 is stopped.

When the outputs of the selectors 13a, 13b, 13c are at the high level, the load driving signals 29, 30, 31 are input to the drivers 16a, 16b, 16c, respectively, and the load devices 6, 7, 8 are input. Continue driving each.

In this embodiment, each load drive driver of the driver ASIC 35 is controlled by the control signal 33. For example, as shown in the timing chart of FIG. 4, when the selection setting control signal 23 sets the load device 6 and the load device 7 to stop and the load device 8 continues to operate, the control signal 33 controls the load device 6 and the load device. 7 stops. The load device 8 continues to operate. By these operations, when the main microcomputer 3 or the like fails, it is possible to selectively stop and continue the respective driving devices driven by the driver ASIC 35, and prevent secondary failures and functional failures.

<Appendix 1>
Further, the present invention described above may have the following configurations.

1.
An electronic control device having a microcontroller IC (for example, main microcomputer 3) and a power supply/driver IC (for example, power supply/driver ASIC2) as constituent elements, and having a serial communication function between the microcontroller IC and the power supply/driver IC. And has a function of monitoring the normal operation of the microcontroller IC, outputs a drive stop signal for stopping the load drive when the microcontroller IC fails, and sets the load drive stop function by serial communication from the microcontroller IC. An electronic control device having a function capable of stopping the set load drive when a drive stop signal is output at the time of failure.

2.
An electronic control device having a micro controller IC (for example, main microcomputer 3) and a driver IC (for example, driver ASIC 35) as constituent elements, which has a serial communication function between the micro controller IC and the power supply/driver IC. An electronic control device having a function capable of setting a load driving stop function by communication and capable of stopping the set load driving from a drive stop signal by self-diagnosis of the microcontroller IC when the microcontroller IC fails. ..

<Appendix 2>
Further, the present invention described above may have the following configurations.

1.
A microcomputer that controls the whole,
A monitoring unit (for example, the main microcomputer 3) for monitoring the operation of the microcomputer,
A driver that drives an external load device (for example, drivers 16a, 16b, 16c),
A setting storage unit (for example, a selection setting register unit 10) that stores in advance a setting for stopping the driver or continuing the operation of the driver when the monitoring unit detects an abnormality in the microcomputer;
When an abnormality of the microcomputer is detected by the monitoring unit, a control unit that controls the operation of the driver based on the setting stored in the setting storage unit (for example, the load drive control unit 11, the selectors 13a and 13b, 13c),
Since it is an electronic control device characterized by having
-It is possible to provide an electronic control device that is suitable for each of the load devices and that can respond to an abnormality.

The present invention also provides
2.
1. In the electronic control device described in
Since the electronic control device further comprises a setting changing unit for changing the setting stored in the setting storage unit,
It is possible to easily change the settings stored in the setting storage unit and provide a highly versatile device.

The present invention also provides
3.
1. In the electronic control device described in
Since the monitoring unit, the driver, and the setting storage unit are configured by one ASIC,
-The components can be integrated to reduce the size of the device.

The present invention also provides
4.
1. In the electronic control device described in
Since the monitoring section is provided in the microcomputer and is a self-diagnosis section that performs self-diagnosis of the microcomputer,
It is possible to provide an electronic control device that can cope with an abnormality suitable for each load device without providing a configuration for monitoring the microcomputer outside the microcomputer.

The present invention also provides
5.
1. In the electronic control device described in
The electronic control unit is an engine control unit,
A throttle valve driver that drives the throttle valve,
A fuel injection device driver for driving the fuel injection device;
Further equipped with,
The control unit stops the operations of the throttle valve driver and the fuel injection device driver when the monitoring unit detects an abnormality of the microcomputer,
Since it was an electronic control device characterized by that,
-When the electronic control device is an engine control device, it is possible to provide an electronic control device that is suitable for each of the load devices and that can cope with an abnormality.

It should be noted that the present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add/delete/replace other configurations with respect to a part of the configurations of the respective embodiments.

1... Electronic control device, 2... Power supply/driver ASIC, 3... Main microcomputer, 4... Throttle valve, 5... Fuel injection device, 6... Load device, 7... Load device, 8... Load device, 9... Microcomputer mutual monitoring unit 10... Selection setting register section, 11... Load drive control section, 12... Load drive stop signal, 13a... Selector, 13b... Selector, 13c... Selector, 14... Driver, 15... Driver, 16a... Driver, 16b... Driver, 16c: driver, 17... drive control signal, 18... drive control signal, 19... load drive stop signal, 20... microcomputer reset signal, 21... monitor NG signal, 22... drive control signal, 23... selection setting control signal, 24... Microcomputer monitoring signal, 25... ASIC monitoring signal, 26... Selection control signal, 27... Selection control signal, 28... Selection control signal, 29... Load drive signal, 30... Load drive signal, 31... Load drive signal, 32... Load drive prohibition signal, 33... Control signal, 34... Electronic control device, 35... Driver ASIC.

Claims (4)

A throttle valve, a fuel injection device, and a microcomputer that controls driving of a plurality of load devices including other load devices ,
A monitoring unit for monitoring the operation of the microcomputer,
A throttle valve driver for driving the throttle valve,
A fuel injection device driver for driving the fuel injection device;
A plurality of drivers for driving the other load device,
An electronic control device comprising:
A setting storage unit that stores, in advance for each of the plurality of drivers , a setting of whether to stop the driver or continue the operation of the driver when the monitoring unit detects an abnormality of the microcomputer; ,
A setting changing unit for changing the setting stored in the setting storage unit;
A control unit that controls the operation of the plurality of drivers based on the settings stored in the setting storage unit when an abnormality of the microcomputer is detected by the monitoring unit;
Equipped with
The electronic control unit is an engine control unit,
The other load device is any one or more of a power relay, a solenoid load device, and a heater,
The control unit is
A selector is provided for selecting whether to output a load drive stop signal output from the monitoring unit to each driver when detecting an abnormality of the microcomputer,
An electronic control device, characterized in that the selection of the selector is controlled based on the setting of the setting storage unit to selectively stop or continue the respective drivers when the microcomputer is abnormal. The electronic control unit according to claim 1,
An electronic control device, wherein the monitoring unit, the plurality of drivers, and the setting storage unit are configured by one ASIC. The electronic control unit according to claim 1,
An electronic control device, wherein the monitoring unit is a self-diagnosis unit provided in the microcomputer and performing self-diagnosis of the microcomputer. The electronic control unit according to claim 1,
When an abnormality of the microcomputer is detected by the monitoring unit, the load drive stop signal is configured to stop the operations of the throttle valve driver and the fuel injection device driver.
An electronic control device characterized by the above.

Images