JP7147532B2 - electronic controller - Google Patents

Description

The present disclosure relates to technology for an external device to obtain a response to a processing request from an in-vehicle electronic control device.

2. Description of the Related Art It is known that an in-vehicle electronic control unit detects by OBD that an abnormality has occurred in various on-vehicle sensors, actuators, etc., and records a diagnostic code corresponding to the abnormality as diagnostic information. OBD stands for On-board Diagnostics. The diagnostic code is hereinafter also referred to as DTC. DTC is an abbreviation for Diagnostic Trouble Code. Appropriate processing is performed on the vehicle based on the DTC recorded in the electronic control unit.

For example, Patent Literature 1 describes a technique for supporting vehicle maintenance work based on DTCs read from an in-vehicle electronic control device by an external device such as a scan tool.

JP 2005-081849 A

However, when an abnormality occurs in the electronic control unit that records diagnostic information, the electronic control unit no longer satisfies the performance requirements for recording appropriate diagnostic information.
In this case, as a result of detailed studies by the inventors of the present application, for example, if the external device transmits a processing request such as reading diagnostic information to the electronic control device, and receives and acquires a response to the processing request from the electronic control device , the external device cannot determine whether the response is from a normal electronic control unit that satisfies the performance requirements or from an abnormal electronic control unit that does not satisfy the performance requirements.

As a result, a problem was found that inappropriate processing may be executed based on the response received by the external device from the electronic control device.
One aspect of the present disclosure is to provide a technique for suppressing execution of inappropriate processing based on a response that an external device obtains from an abnormal electronic control device in response to a processing request from the external device. is desirable.

An in-vehicle electronic control device (10) according to one aspect of the present disclosure includes a microcomputer (20, S410 to S418), a communication section (32), an external abnormality detection section (34, S400 to S408, S420 to S430, S440-S446, S450-S464, S470-S482).

A microcomputer executes vehicle control. The communication unit communicably connects an external device outside the electronic control device that transmits a processing request to the electronic control device and the microcomputer. The external abnormality detection unit is installed outside the microcomputer, and when detecting an abnormality in the microcomputer, controls the communication unit so that the response to the processing request is not transmitted from the microcomputer to the external device.

According to this configuration, when the microcomputer that executes diagnostic processing and records diagnostic information is abnormal, the microcomputer does not send a response to the processing request to the external device. As a result, it is possible to prevent inappropriate processing from being executed based on a response that the external device receives and acquires from an abnormal electronic control device in response to a processing request from the external device.

1 is a block diagram showing a vehicle control system according to a first embodiment; FIG. 4 is a flowchart showing communication control processing; 4 is a flowchart showing abnormality detection processing inside the microcomputer; 4 is a flowchart showing abnormality detection processing outside the microcomputer; 9 is a flowchart showing communication control processing according to the second embodiment; 10 is a flowchart showing communication control processing according to the third embodiment; 10 is a flowchart showing communication control processing according to the fourth embodiment; 4 is a flowchart showing DTC storage processing in another electronic control unit; 4 is a flowchart showing lamp lighting processing in another electronic control unit;

Embodiments of the present disclosure will be described below with reference to the drawings.
[1. First Embodiment]
[1-1. Constitution]
The vehicle control system 2 shown in FIG. 1 includes an engine ECU 10, a brake ECU 40, and a meter ECU 42. The vehicle control system 2 includes various ECUs in addition to the ECU shown in FIG. ECU is an abbreviation for electronic control unit. The engine ECU 10, the brake ECU 40, the meter ECU 42, and the scan tool 60 are connected so as to be able to communicate with each other by CAN. CAN is an abbreviation for Controller Area Network. The scan tool 60 is connected to each ECU via a connector 50 at a repair shop or the like.

The engine ECU 10 controls the output torque of the engine, which is the drive source for the vehicle to run. The brake ECU 40 controls a braking device that applies braking force to the vehicle. The meter ECU 42 controls displays such as various meters and lamps installed on the front panel.

The scan tool 60 transmits to the engine ECU 10, the brake ECU 40, and the meter ECU 42 processing requests such as reading DTCs representing the results of OBD diagnostic processing performed by each ECU, and receives responses to the processing requests from the corresponding ECUs. to obtain.

Since the configurations of the engine ECU 10, the brake ECU 40, and the meter ECU 42 are substantially the same, the configurations of the engine ECU 10 will be described as an example.
The engine ECU 10 has a microcomputer 20 and an ASIC 30 . Hereinafter, the microcomputer is also referred to as a microcomputer. ASIC is an abbreviation for Application Specific Integrated Circuit. The engine ECU 10 may have one microcomputer 20 or may have a plurality of microcomputers 20 .

The microcomputer 20 includes a CPU 22 , a RAM 24 , a ROM 26 and an internal abnormality detector 28 . The microcomputer 20 executes diagnostic processing for diagnosing whether or not an abnormality has occurred in various sensors, actuators, etc. mounted on the vehicle. records the DTC corresponding to the anomaly.

The internal abnormality detection unit 28 executes, for example, the same processing as the vehicle control processing executed by the CPU 22, and determines that the microcomputer 20 is abnormal when the execution result of the CPU 22 and the execution result of the internal abnormality detection unit 28 do not match.

The ASIC 30 includes a CAN driver 32 and an external abnormality detector 34 . That is, the CAN driver 32 and the external abnormality detector 34 are configured by one IC. The CAN driver 32 connects the microcomputer 20 and the brake ECU 40, the meter ECU 42, and the scan tool 60 as devices external to the engine ECU 10 so as to be able to communicate with each other.

When the external abnormality detection unit 34 detects that an abnormality has occurred in the microcomputer 20 based on the abnormality detection result of the internal abnormality detection unit 28 of the microcomputer 20 and the communication state with the internal abnormality detection unit 28, the CAN driver 32 to prevent the microcomputer 20 from sending a response to the processing request to the scan tool 60. - 特許庁

[1-2. process]
(1) Communication Control Processing Communication control processing executed by the external abnormality detection unit 34 will be described based on the flowchart of FIG. The flowchart of FIG. 2 is always executed at predetermined time intervals.

In S<b>400 , the external abnormality detection unit 34 acquires the communication state from the CAN driver 32 and determines whether or not a specific DTC reading request has been received from the scan tool 60 . Incidentally, the specific DTC is proposed as, for example, among DTCs, a DTC that indicates that a vehicle inspection fails to meet the safety standards of the vehicle.

The external abnormality detection unit 34 detects that the specific DTC read request has been received from the scan tool 60, that the CAN ID of the CAN frame indicates the scan tool 60, and that the data field of the CAN frame indicates the specific DTC read request. Judge by what is shown.

If the determination in S400 is No, that is, if the read request for the specific DTC has not been received from the scan tool 60, this process ends.
If the determination in S400 is Yes, that is, if the CAN driver 32 receives the read request for the specific DTC from the scan tool 60, the external abnormality detection unit 34 determines in S402 whether the communication with the microcomputer 20 is abnormal. It is determined whether communication with the internal abnormality detection unit 28 is abnormal. If the determination in S402 is Yes, that is, if the communication with the microcomputer 20 is abnormal, the process proceeds to S408.

If the determination in S402 is No, that is, if the communication with the microcomputer 20 is normal, in S404 the external abnormality detection unit 34 determines whether an abnormality has been notified from the microcomputer 20. Determine whether or not an abnormality has been notified. If the determination in S404 is Yes, that is, if the microcomputer 20 notifies of an abnormality, the process proceeds to S408.

If the determination in S404 is No, that is, the communication between the microcomputer 20 and the external abnormality detection unit 34 is normal, and no abnormality is notified from the microcomputer 20, the external abnormality detection unit 34 determines in S406 that the microcomputer 20 is normal. It determines that there is, and causes the CAN driver 32 to transmit a read request for the specific DTC from the scan tool 60 to the microcomputer 20 .

When receiving a read request for the specific DTC from the scan tool 60, the microcomputer 20 transmits the recorded specific DTC from the CAN driver 32 to the scan tool 60, so the scan tool 60 can acquire the specific DTC from the engine ECU 10. .

In S408, the external abnormality detection unit 34 detects whether communication between the internal abnormality detection unit 28 of the microcomputer 20 and the external abnormality detection unit 34 is abnormal, or the internal abnormality detection unit 28 notifies the microcomputer 20 of an abnormality. is abnormal, it is determined that an appropriate specific DTC cannot be sent from the microcomputer 20 to the scan tool 60 . In this case, the external abnormality detection unit 34 controls the CAN driver 32 so as not to transmit the specific DTC readout request from the scan tool 60 to the microcomputer 20 .

In this case, the microcomputer 20 does not respond to the specific DTC read request from the scan tool 60 .
(2) Internal Abnormality Detection Processing Abnormality detection processing by the internal abnormality detection unit 28, which is the basis for the external abnormality detection unit 34 to determine whether the microcomputer 20 is abnormal in S404 of FIG. 2, is based on the flowchart of FIG. to explain. The flowchart of FIG. 3 is always executed at predetermined time intervals.

In S410, the internal abnormality detection unit 28 compares, for example, the execution result of the vehicle control process by the CPU 22 and the execution result of the vehicle control process by the internal abnormality detection unit 28, and determines whether the CPU 22 is operating normally.

If the determination in S410 is No, that is, if the CPU 22 is not operating normally, the process proceeds to S418.
If the determination in S410 is Yes, that is, if the CPU 22 is operating normally, the internal abnormality detection unit 28 executes memory diagnosis for the ROM 26 and RAM 24 in S412 and S414 respectively, Determine whether the diagnosis is normal. There are various well-known techniques for memory diagnosis, so the details are omitted. If the determination in S412 or S414 is No, that is, if the memory diagnosis result of either the RAM 24 or the ROM 26 is abnormal, the process proceeds to S418. do.

If the determinations in S412 and S414 are both Yes, that is, if the results of the memory diagnosis for both the RAM 24 and the ROM 26 are normal, the internal abnormality detection unit 28 detects that the microcomputer 20 is normal in S416. 34.

If the determination in any of S410, S412, or S414 is No, that is, if some sort of abnormality has occurred in the microcomputer 20, the internal abnormality detection unit 28 detects that the microcomputer 20 has an abnormality in the external abnormality detection unit 34 in S418. Send to

(3) External Anomaly Detection Processing The anomaly detection processing that serves as the basis for the determinations made in S402 and S404 of FIG. 2 by the external anomaly detection unit 34 will be described based on the flowchart of FIG. The flowchart of FIG. 4 is always executed at predetermined time intervals.

In S<b>420 , the external abnormality detection unit 34 determines whether or not an abnormality detection result for the microcomputer 20 has been received from the internal abnormality detection unit 28 of the microcomputer 20 . If the determination in S420 is Yes, that is, if an abnormality detection result for the microcomputer 20 has been received from the internal abnormality detection unit 28, the process proceeds to S424.

If the determination in S420 is No, that is, if the abnormality detection result for the microcomputer 20 has not been received from the internal abnormality detection section 28, the external abnormality detection section 34 has not received the abnormality detection result from the internal abnormality detection section 28 in S422. It is determined whether or not the non-existing state has passed for a predetermined time.

If the determination in S422 is No, that is, if the state in which no abnormality detection result has been received from the internal abnormality detection unit 28 has not elapsed for a predetermined period of time, the process proceeds to S420. If the determination in S422 is Yes, that is, if the state in which no abnormality detection result has been received from the internal abnormality detection unit 28 has passed for a predetermined period of time, the process proceeds to S430.

In S<b>424 , the external abnormality detection unit 34 determines whether or not an abnormality detection result indicating that the microcomputer 20 is normal has been received from the internal abnormality detection unit 28 . If the determination in S424 is Yes, that is, if an abnormality detection result indicating that the microcomputer 20 is normal has been received from the internal abnormality detection unit 28, the process proceeds to S428.

If the determination in S424 is No, that is, if an abnormality detection result indicating that the microcomputer 20 It is determined whether or not the state in which the received abnormality detection result is abnormal continues for a predetermined time after receiving the abnormality detection result indicating that 20 is abnormal.

If the determination in S426 is No, that is, if the received abnormality detection result has not continued for a predetermined period of time, the process proceeds to S420.
If the determination in S426 is Yes, that is, if the received abnormality detection result is abnormal and has continued for a predetermined period of time, the process proceeds to S430.

In S428, the external abnormality detection unit 34 determines that the microcomputer 20 is normal. Based on the determination of S428, the external abnormality detection unit 34 determines No in S402 and S404 of FIG.

In S430, the external abnormality detection unit 34 determines that the microcomputer 20 is abnormal. Based on the determination of S430, the external abnormality detection unit 34 determines Yes in S402 or S404 of FIG.

[1-3. effect]
In the first embodiment, when the external abnormality detection unit 34 is notified of a communication abnormality with the internal abnormality detection unit 28 of the microcomputer 20 or an abnormality is notified from the microcomputer 20, the scan tool 60 specifies a processing request to the engine ECU 10. Even if there is a DTC read request, a specific DTC read request is not sent to the microcomputer 20. - 特許庁

As a result, the external abnormality detection unit 34 prevents the microcomputer 20 from sending a response to the read request for the specific DTC to the scan tool 60 . As a result, the following effects can be obtained in the first embodiment.

(1a) Since the scan tool 60 does not acquire inappropriate specific DTCs from the abnormal engine ECU 10, execution of inappropriate processing based on the inappropriate specific DTCs acquired by the scan tool 60 can be suppressed.

In the first embodiment, the scan tool 60 corresponds to the external device, the engine ECU 10 corresponds to the electronic control device, and the CAN driver 32 corresponds to the communication unit.

Also, S400 to S408 and S420 to S430 correspond to the processing of the external abnormality detection section, and S410 to S418 correspond to the processing of the microcomputer 20. FIG.
[2. Second Embodiment]
[2-1. Differences from First Embodiment]
Differences between the second embodiment and the first embodiment will be described below. Note that the same reference numerals as in the first embodiment indicate the same configurations, and refer to the preceding description.

Communication control processing executed by the external abnormality detection unit 34 will be described based on the flowchart of FIG. The flowchart of FIG. 5 is always executed at predetermined time intervals. The flowchart of FIG. 5 differs from the first embodiment in that the processing request transmitted from the scan tool 60 to the engine ECU 10 is not limited to a specific DTC reading request.

Since the processing of S440 and S442 is substantially the same as the processing of S402 and S404 in FIG. 2, the description thereof is omitted.
If the determinations in S440 and S442 are both No, that is, the communication between the external abnormality detection unit 34 and the internal abnormality detection unit 28 of the microcomputer 20 is normal, and the microcomputer 20 has not notified of an abnormality, an external abnormality is detected in S444. The detection unit 34 controls the CAN driver 32 to permit communication between the scan tool 60 and the microcomputer 20.

In this case, all processing requests including a specific DTC read request are transmitted from the scan tool 60 to the microcomputer 20 via the CAN driver 32, and the response of the microcomputer 20 to the processing request is transmitted from the CAN driver 32 to the scan tool 60. be.

If the determination in either S440 or S442 is YesS, that is, if the communication between the external abnormality detection unit 34 and the internal abnormality detection unit 28 of the microcomputer 20 is abnormal, or if the microcomputer 20 has notified an abnormality, S446 , the external abnormality detection unit 34 controls the CAN driver 32 to cut off communication between the scan tool 60 and the microcomputer 20 .

In this case, none of the processing requests including the specific DTC read request are sent from the CAN driver 32 to the microcomputer 20 .
[2-2. effect]
In the second embodiment, the following effects can be obtained in addition to the effect (1a) of the first embodiment.

(2a) An inappropriate response is not sent to the scan tool 60 from the abnormal engine ECU 10 in response to the processing request of the scan tool 60, not limited to the specific DTC reading request. Therefore, it is possible to prevent erroneous processing from being executed based on an inappropriate response that scan tool 60 receives and acquires from engine ECU 10 .

In the above-described second embodiment, S440 to S446 correspond to the processing of the external abnormality detection section .
[3. Third Embodiment]
[3-1. Differences from First Embodiment]
Differences between the third embodiment and the first embodiment will be described below. Note that the same reference numerals as in the first embodiment indicate the same configurations, and refer to the preceding description.

Communication control processing executed by the external abnormality detection unit 34 will be described based on the flowchart of FIG. The flowchart of FIG. 6 is always executed at predetermined time intervals. In the flowchart of FIG. 6, the scan tool 60 sends a specific DTC read request to the microcomputer 20 regardless of whether the microcomputer 20 is normal or abnormal.

On the other hand, when the microcomputer 20 is normal, the specific DTC is transmitted from the microcomputer 20 to the scan tool 60 as a response to the specific DTC read request. When the microcomputer 20 is abnormal, the response from the microcomputer 20 is not sent to the scan tool 60 in response to the specific DTC read request.

Since the processes of S450, S458 and S460 are substantially the same as the processes of S400 to S404 in FIG. 2, description thereof is omitted.
The determination of S450 is Yes, the determination of S454 is Yes, and the determinations of both S458 and S460 are No. If the response is received, the communication between the external abnormality detector 34 and the internal abnormality detector 28 of the microcomputer 20 is normal, and the microcomputer 20 has not notified of an abnormality, the process proceeds to S462.

Even if the determination in S450 is Yes and the determination in S454 is No, that is, even if the CAN driver 32 transmits to the microcomputer 20 the read request for the specific DTC received from the scan tool 60, the CAN driver 32 does not receive the response from the microcomputer 20. has not been received, in S456 the external abnormality detection unit 34 determines whether or not the CAN driver 32 has not received a response from the microcomputer 20 for a predetermined period of time.

If the determination in S456 is Yes, that is, if the CAN driver 32 has not received a response from the microcomputer 20 for a predetermined period of time, the external abnormality detection unit 34 determines that there is a communication abnormality in the CPU 22 of the microcomputer 20. and the process proceeds to S464. If the determination in S456 is No, the process proceeds to S454.

The judgments of S450 and S454 are Yes, and the judgment of either S456 or S458 is Yes, that is, the CAN driver 32 has received a response from the microcomputer 20 in response to the specific DTC readout request, but an external abnormality has occurred. If the communication between the detection unit 34 and the internal abnormality detection unit 28 of the microcomputer 20 is abnormal, or the abnormality is notified from the microcomputer 20, the process proceeds to S464.

In S<b>462 , the external abnormality detection unit 34 transmits the specific DTC sent from the microcomputer 20 to the CAN driver 32 as a response to the read request for the specific DTC from the CAN driver 32 to the scan tool 60 .

In S464, even if the specific DTC is transmitted from the microcomputer 20 to the CAN driver 32 as a response to the read request for the specific DTC, the external abnormality detection unit 34 controls the CAN driver 32 to transmit the specific DTC from the CAN driver 32 to the scan tool 60. Don't send.

[3-2. effect]
In the third embodiment, when communication with the CPU 22 of the microcomputer 20 or the internal abnormality detection unit 28 is abnormal, or when an abnormality is notified from the microcomputer 20, the external abnormality detection unit 34 sends the scan tool 60 to the engine ECU 10. The response of the microcomputer 20 is not sent to the scan tool 60 in response to the specific DTC readout request.

Thereby, in the third embodiment, substantially the same effect as the effect (1a) of the first embodiment can be obtained.
In the third embodiment, S450-S464 correspond to the processing of the external abnormality detection section.

[4. Fourth Embodiment]
[4-1. Differences from First Embodiment]
Differences between the fourth embodiment and the first embodiment will be described below. Note that the same reference numerals as in the first embodiment indicate the same configurations, and refer to the preceding description.

[4-2. process]
(1) Communication Control Processing Communication control processing executed by the external abnormality detection unit 34 will be described based on the flowchart of FIG. The flowchart of FIG. 7 is always executed at predetermined time intervals. In the flow chart of FIG. 7, when the microcomputer 20 is abnormal, the specific DTC reading request from the scan tool 60 is not transmitted to the microcomputer 20, and the fact that the engine ECU 10 is abnormal is transmitted to the brake ECU 40, and the lamp is turned on. The ECU 42 is turned on.

In the flow chart of FIG. 7, the processing of S470-S478 is substantially the same as the processing of S400-S408 of FIG. 2, so description thereof will be omitted.
If the determination in either S472 or S474 is Yes, that is, if the communication between the external abnormality detection unit 34 and the internal abnormality detection unit 28 of the microcomputer 20 is abnormal, or if the microcomputer 20 has notified of an abnormality, the process of S478 is performed. , the process proceeds to S480.

In S480, the external abnormality detection unit 34 controls the CAN driver 32 to transmit to the brake ECU 40 a notification to record a diagnostic code indicating that the engine ECU 10 is abnormal.

In S482, the external abnormality detection unit 34 controls the CAN driver 32 and notifies the meter ECU 42 to turn on the lamp.
(2) Processing of Brake ECU 40 Processing of the brake ECU 40 when receiving from the engine ECU 10 a notification to record a diagnostic code indicating that the engine ECU 10 is abnormal will be described based on the flowchart of FIG. The flowchart of FIG. 8 is always executed at predetermined time intervals.

If the determination in S490 is No, that is, if the notification for recording the DTC indicating that the engine ECU 10 is abnormal has not been received from the engine ECU 10, this process ends.
When the determination in S490 is Yes, that is, when the engine ECU 10 receives a notification to record the DTC indicating that the engine ECU 10 is abnormal, the brake ECU 40 flashes the DTC indicating that the engine ECU 10 is abnormal in S492, for example. Record in a rewritable non-volatile memory such as a memory.

(3) Processing of Meter ECU 42 Processing of the meter ECU 42 when receiving a notification to turn on the lamp from the engine ECU 10 will be described based on the flowchart of FIG. The flowchart of FIG. 9 is always executed at predetermined time intervals.

If the determination in S500 is No, that is, if the notification to turn on the lamp has not been received from the engine ECU 10, this process ends.
When the determination in S500 is Yes, that is, when the notification to turn on the lamp is received from the engine ECU 10, the meter ECU 42 turns on the lamp in S502.
[4-3. effect]
In the fourth embodiment, the following effects can be obtained in addition to the effect (1a) of the first embodiment.

(4a) The operator recognizes that there is no response from the engine ECU 10 to the scan tool 60's request to read the specific DTC from the engine ECU 10, and that the lamp is lit. In this case, the worker operates the scan tool 60 to transmit a DTC read request to another ECU, so that the DTC indicating that the engine ECU 10 is abnormal can be read from the brake ECU 40 .

As a result, the operator can determine that the engine ECU 10 is abnormal because the engine ECU 10 does not respond to the specific DTC reading request from the scan tool 60 to the engine ECU 10 and the lamp is lit.

In the fourth embodiment, the brake ECU 40 and the meter ECU 42 correspond to other electronic control units.
Also, S470 to S482 correspond to the processing of the external abnormality detection section.
[5. Other embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments, and various modifications can be made.

(1) In the above embodiment, the external anomaly detector 34 determines from the data field of the CAN frame that the processing request from the scan tool 60 is a specific DTC readout request. On the other hand, when the CANID of the CAN frame indicates the scan tool 60 , the external anomaly detection unit 34 may determine that the read request for the specific DTC is from the scan tool 60 .

(2) In the third embodiment, when the microcomputer 20 is abnormal, in S464 of FIG. The fact that the engine ECU 10 is abnormal may be transmitted to the scan tool 60 .

(3) The scan tool 60 may transmit a processing request including a specific DTC readout request to the engine ECU 10, and may be the brake ECU 40, meter ECU 42, or other ECU shown in FIG.

(4) The engine ECU 10 and techniques thereof described in this disclosure can be performed by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. , may be implemented. Alternatively, the engine ECU 10 and techniques described in this disclosure may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the engine ECU 10 and techniques thereof described in this disclosure comprise a combination of a processor and memory programmed to perform one or more functions and a processor configured by one or more hardware logic circuits. may be implemented by one or more dedicated computers configured as The computer program may also be stored as computer-executable instructions on a computer-readable non-transitional tangible recording medium. The method of realizing the function of each part included in the engine ECU 10 does not necessarily include software, and all the functions may be realized using one or a plurality of pieces of hardware.

(5) A plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components, or a function possessed by one component may be realized by a plurality of components. . Also, a plurality of functions possessed by a plurality of components may be realized by a single component, or a function realized by a plurality of components may be realized by a single component. Also, part of the configuration of the above embodiment may be omitted. Also, at least part of the configuration of the above embodiment may be added or replaced with respect to the configuration of the other above embodiment.

(6) In addition to the engine ECU 10 described above, a system having the engine ECU 10 as a component, a program for causing a computer to function as the engine ECU 10, a non-transitional actual recording medium such as a semiconductor memory recording this program, an electronic The present disclosure can also be implemented in various forms such as a control method.

10: engine ECU (electronic control unit), 20: microcomputer, 32: CAN driver (communication unit), 34: external abnormality detection unit, 40: brake ECU (other electronic control unit), 42: meter ECU (other electronic control device), 60: scan tool (external device)

Claims (8)

An in-vehicle electronic control device (10),
a microcomputer (20, S410 to S418) that executes vehicle control;
a communication unit (32) configured to communicably connect an external device outside the electronic control device that transmits a processing request to the electronic control device and the microcomputer;
An external abnormality detection device installed outside the microcomputer and configured to control the communication unit so as not to transmit a response to the processing request from the microcomputer to the external device when an abnormality of the microcomputer is detected. part (34, S400 to S408, S420 to S430, S440 to S446, S450 to S464, S470 to S482);
with
The microcomputer is configured to perform diagnostic processing and record diagnostic information,
When the microcomputer is abnormal and the communication unit receives a request to read the diagnostic information from the external device as the processing request, the external abnormality detection unit controls the communication unit to configured not to send a response to the processing request to an external device;
electronic controller. The electronic control device according to claim 1 ,
When the microcomputer is abnormal and the communication unit receives the processing request from the external device, the external abnormality detection unit (S408, S478) controls the communication unit to detect the processing from the external device. configured not to send requests to said microcomputer;
electronic controller. An in-vehicle electronic control device (10),
a microcomputer (20, S410 to S418) that executes vehicle control;
a communication unit (32) configured to communicably connect an external device outside the electronic control device that transmits a processing request to the electronic control device and the microcomputer;
An external abnormality detection device installed outside the microcomputer and configured to control the communication unit so as not to transmit a response to the processing request from the microcomputer to the external device when an abnormality of the microcomputer is detected. part (34, S400 to S408, S420 to S430, S440 to S446, S450 to S464, S470 to S482);
with
When the microcomputer is abnormal and the communication unit receives the processing request from the external device, the external abnormality detection unit (S408, S478) controls the communication unit to detect the processing from the external device. configured not to send requests to said microcomputer;
electronic controller. The electronic control device according to any one of claims 1 to 3,
When the microcomputer is abnormal and the communication unit receives the processing request from the external device, the external abnormality detection unit (S464) detects from the communication unit that the electronic control unit is abnormal. configured to send to
electronic controller. An in-vehicle electronic control device (10),
a microcomputer (20, S410 to S418) that executes vehicle control;
a communication unit (32) configured to communicably connect an external device outside the electronic control device that transmits a processing request to the electronic control device and the microcomputer;
An external abnormality detection device installed outside the microcomputer and configured to control the communication unit so as not to transmit a response to the processing request from the microcomputer to the external device when an abnormality of the microcomputer is detected. part (34, S400 to S408, S420 to S430, S440 to S446, S450 to S464, S470 to S482);
with
When the microcomputer is abnormal and the communication unit receives the processing request from the external device, the external abnormality detection unit (S464) detects from the communication unit that the electronic control unit is abnormal. configured to send to
electronic controller. The electronic control device according to any one of claims 1 to 5 ,
The communication unit is configured to communicably connect the electronic control unit and another vehicle-mounted electronic control unit (40),
When the microcomputer is abnormal, the external abnormality detection unit (S480) causes the communication unit to notify the other electronic control unit to record diagnostic information indicating that the electronic control unit is abnormal. configured to
electronic controller. The electronic control device according to any one of claims 1 to 6 ,
The communication unit is configured to communicably connect the electronic control unit and another vehicle-mounted electronic control unit (42),
The external abnormality detection unit (S482) is configured to notify the other electronic control device from the communication unit to turn on the lamp when the microcomputer is abnormal.
electronic controller. The electronic control device according to any one of claims 1 to 7 ,
The external abnormality detection unit and the communication unit are configured by one IC (30),
electronic controller.

Images