JP2014048070A - Electronic control device - Google Patents

Abstract

In an electronic control device, a microcomputer prevents a power supply means from erroneously determining that it is abnormal.
In an electronic control device, when an IGSW (ignition switch) is turned on, a power supply voltage is supplied to start a microcomputer, and the microcomputer outputs a signal for turning on a power supply relay to a drive circuit. Thus, even after the IGSW is turned off, the relay is kept on so that the power supply continues. Then, after detecting that IGSW is turned off, the microcomputer turns on the determination flag in the flash memory. When the other processing is completed, the microcomputer stops outputting the signal and stops the operation. When the microcomputer is activated, it determines that the relay is abnormal on the condition that the determination flag is not on (S330: NO) (S360), but if the microcomputer determines that the relay is reset while the IGSW is on, Turn on reset history. When the microcomputer is activated and the reset history is on (S345: YES), the microcomputer does not determine that the relay is abnormal.
[Selection] Figure 4

Description

  The present invention relates to an electronic control device having a function of detecting an abnormality of a power supply unit that supplies a power supply voltage.

  For example, as an electronic control device that controls a vehicle engine, a power supply relay that supplies a power supply voltage from a battery to the device when an ignition switch (hereinafter referred to as IGSW) is turned on by a vehicle user. In some cases, a power supply voltage from a battery is supplied by either a logic unit in the device outputting a relay-on signal for turning on the power. That is, in this type of electronic control device, when the power supply condition for starting that IGSW is turned on is satisfied, the power supply voltage from the battery is supplied, the logic unit starts operating, and the logic unit starts operating. The output of the relay on signal is started and the power supply state to the device is maintained. When the logic unit detects that the IGSW is turned off, the logic unit performs a specific process to be performed after the IGSW is turned off until the operation is stopped (for example, a process for saving data in a predetermined memory). When the processing is completed, the output of the relay-on signal is stopped and the power supply relay is turned off to cut off the power supply to the device (see, for example, Patent Document 1).

  Here, when the power supply means for supplying the power supply voltage to the electronic control device is broken even after the IGSW is turned off, such as the power feeding relay and the circuit for driving the power feeding relay, the IGSW is turned off. Then, since the power supply to the electronic control device is immediately stopped, the logic unit cannot perform a specific process to be performed after the IGSW is turned off. For this reason, it is preferable to detect an abnormality (failure) in the power supply means and take some measures.

Therefore, Patent Document 1 describes a method including the following steps (1) to (3) as a method for detecting an abnormality of the power feeding means by the logic unit.
(1) The logic unit stores data in the backup RAM that is always supplied with power until it stops outputting the relay-on signal after detecting that the IGSW is turned off (and until the operation is stopped). Write processing for writing A is performed.

  (2) When the logic unit starts operating, it determines whether or not data A is written in the backup RAM. If the data A is written, the logic unit determines that the power supply means is normal and stores the data in the backup RAM. Write processing for rewriting data A to data B is performed.

(3) When the logic unit determines in the determination of (2) above that the data A is not written in the backup RAM, the logic unit determines that the power supply unit is abnormal.
That is, when data A is not written in the backup RAM at the time when the logic unit is activated, the logic unit did not perform the writing process (1) before the previous operation stop. This is because the power supply means is broken and the power supply to the electronic control device is stopped immediately after the IGSW is turned off.

JP-A-1-129133

  By the way, in the abnormality detection method described in Patent Document 1, the logic unit is reset for some reason while the IGSW is on (specifically, during the period when the IGSW is on) even if the power supply means is normal. In this case, the logic unit stops and restarts the operation without performing the writing process (1), and data B is written in the backup RAM at the time of the activation. (That is, data A is not written). Therefore, the activated logic unit determines that the data A is not written in the backup RAM in the determinations of (2) and (3) above, and as a result, the power supply unit erroneously determines that it is abnormal. .

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to prevent a microcomputer as a logic unit that has been reset when an activation power supply condition is satisfied in an electronic control device from erroneously determining that the power supply means is abnormal. It is said.

  The electronic control device according to the present invention includes a power supply unit to which a power supply voltage from an external power supply is supplied and a power supply voltage to the power supply unit when either the start-up power supply condition or the operation continuation power supply condition is satisfied. And a microcomputer that operates using the power supply voltage as a power source. The operation continuation power supply condition is that a power supply request signal is output from an operating microcomputer.

  Then, when the microcomputer starts operation, it starts outputting the power supply request signal to the power supply means that supplies the power supply voltage to the power supply unit by inputting the power supply request signal from the microcomputer, and starts up. When the specific process is finished after detecting that the power supply condition is not established, the output of the power supply request signal is stopped and the operation is stopped.

  In such an electronic control device, when the power supply condition for activation is satisfied and the power supply voltage is supplied to the power supply unit, the microcomputer starts its operation and outputs a power supply request signal. Therefore, if the power supply means is normal, the power supply voltage is continuously supplied to the power supply unit by the power supply means even if the start-up power supply condition is not satisfied. Then, the microcomputer performs a specific process after detecting that the activation power supply condition is not established, and stops the output of the power supply request signal when the specific process ends. Then, the supply of power supply voltage to the power supply unit by the power supply means is stopped, and the microcomputer stops operating.

  Still further, this electronic control device is a data storage unit for storing determination information used to determine whether or not there is an abnormality in the power supply means, regardless of whether or not a power supply voltage is supplied to the power supply unit. Is stored.

Then, the microcomputer performs a first writing process, an abnormality detection process, and a second writing process as processes for detecting an abnormality in the power supply means.
That is, the microcomputer detects that “the first write for writing the determination information in the determination information storage unit” is performed after detecting that the start-up power supply condition is not established until the output of the power supply request signal is stopped. Process. Then, after starting the operation, the microcomputer determines that “the determination unit stores whether or not determination information is stored in the determination information storage unit, and the power supply unit is abnormal on the condition that the determination information is not stored. If it is determined that there is an abnormality detection process and at least determination information is stored in the determination information storage unit, the information different from the determination information is stored in the determination information storage unit. The second writing process for writing "is also performed.

  For this reason, even if an abnormality occurs in the power supply means and the microcomputer outputs a power supply request signal, the supply of power supply voltage to the power supply unit is stopped as soon as the start power supply condition is not satisfied. If the activation power supply condition is not established, the microcomputer stops the operation without performing the first writing process. Then, when the microcomputer is next started up, the determination information storage unit does not store the determination information, and as a result, the microcomputer determines that the power feeding unit is abnormal by the abnormality detection process. It becomes. In this way, the abnormality of the power supply means is detected by the microcomputer.

  Here, even if the power supply means is normal, if the microcomputer is reset when the start-up power supply condition is satisfied, the microcomputer stops operation and restarts without performing the first writing process. Thus, even at the time of starting that time, determination information is not stored in the determination information storage unit. Therefore, the activated microcomputer determines that the determination information is not stored in the determination information storage unit in the abnormality detection process, and as a result, erroneously determines that the power supply unit is abnormal. Become.

  Therefore, the electronic control device of the present invention is provided with a reset detecting means, and the reset detecting means detects the reset of the microcomputer when the power supply condition for activation is satisfied, and the microcomputer is reset. The reset generation information indicating that is stored in the reset storage unit.

  And when the microcomputer starts the operation, if the reset generation information is stored in the reset storage unit, it is prohibited to determine that the power supply means is abnormal by the abnormality detection process. .

  For this reason, it is possible to prevent the reset microcomputer from erroneously determining that the power supply means is abnormal by the abnormality detection process when the power supply condition for startup is satisfied. The failure detection accuracy can be improved.

  Note that it is conceivable that the microcomputer performs a reset process for resetting the microcomputer when a predetermined reset execution condition is satisfied when the activation power supply condition is satisfied. In this case, the reset detection means can be configured to detect that the reset processing has been performed by the microcomputer as a reset of the microcomputer. With this configuration, it is possible to detect a reset of the microcomputer caused by the microcomputer itself (that is, a reset intentionally performed by software) and prevent an erroneous determination due to the reset.

  Further, in that case, the reset detection means can be realized by a microcomputer. Specifically, the microcomputer stores reset generation information in the reset storage unit when performing the reset processing. It ’s fine. In other words, when the microcomputer performs reset processing, if the reset generation information is stored in the reset storage unit, the microcomputer itself detects that the reset processing has been performed and stores the reset generation information in the reset storage unit. It will be.

It is a lineblock diagram of the electronic control unit (ECU) of a 1st embodiment. It is a flowchart showing the process performed after starting a microcomputer until it complete | finishes operation | movement. It is a flowchart showing a time synchronous process. It is a flowchart showing an initial process. It is a flowchart showing a replog request time process. It is a flowchart showing a process at the time of microcomputer abnormality detection. It is a flowchart showing NMI processing. It is a flowchart showing an idle process. It is a 1st time chart for demonstrating an effect | action of an electronic control apparatus. It is a 2nd time chart for demonstrating an effect | action of an electronic control apparatus. It is a 3rd time chart for demonstrating an effect | action of an electronic controller. It is a block diagram of the electronic controller (ECU) of 2nd Embodiment.

  An electronic control device (hereinafter referred to as ECU) according to an embodiment to which the present invention is applied will be described. The ECU of this embodiment is mounted on a vehicle and controls the engine of the vehicle, for example, but the control target may be other than the engine, and the use may be other than for the vehicle.

[First Embodiment]
As shown in FIG. 1, the ECU 11 of the first embodiment has a voltage Vbat (usually around 12 V, hereinafter referred to as a battery voltage) Vbat as an external power supply via a main relay 15 that is a power supply relay. A terminal 17 supplied as the power supply voltage VB is provided. The battery voltage Vbat is supplied to the terminal 17 as the power supply voltage VB via the vehicle IGSW (ignition switch) 19 and the diode 21.

  Further, in the ECU 11, the terminal 23 to which the battery voltage Vbat is constantly supplied as a backup power source, the terminal 25 to which the other end of the coil 15a of the main relay 15 to which the battery voltage Vbat is applied is connected, and the IGSW 19 are turned on. Thus, the terminal 27 to which the voltage of the line 26 to which the battery voltage Vbat is supplied is input as an IGSW signal indicating on / off of the IGSW 19, a terminal 29 connected to the communication line 28 disposed in the vehicle, It has.

The ECU 11 includes a microcomputer 31 that controls the operation of the ECU 11, a power supply control IC 33, an input circuit 35, and a communication circuit 37.
The power supply control IC 33 generates a constant operation voltage Vd (for example, 5 V in the present embodiment) for operating the microcomputer 31 from the power supply voltage VB supplied to the terminal 17, and uses the operation voltage Vd for the microcomputer 31. A constant standby voltage Vs (for example, 3 V in this embodiment) is generated from the main power supply circuit 41 that outputs to the battery 23 and the battery voltage Vbat as a backup power supply supplied to the terminal 23, and the standby voltage Vs is supplied to the microcomputer 31. A sub power supply circuit 43 that outputs, a drive circuit 45 for turning on the main relay 15, a reset control circuit 47 that performs control to reset the microcomputer 31, and a watch dog timer (WDT) 49 that monitors the operation of the microcomputer 31 It is equipped with.

  When the IGSW signal input from the terminal 27 is high (= Vbat) or when the power supply request signal SD input from the microcomputer 31 is high (= Vd), the drive circuit 45 sets the terminal 25 to the ground line ( The main relay 15 is turned on by connecting the current to the coil 15a and connecting it to the 0V line.

  The watchdog timer 49 is a timer whose timer value is cleared (reset) by a clear signal WDC output from the microcomputer 31 every predetermined time when the microcomputer 31 is normal. If it is not output for a specified time longer than the predetermined time, a reset request is output to the reset control circuit 47.

The reset control circuit 47 has the following << Function 1 >> to << Function 4 >> as its functions.
<< Function 1 >> When a reset request is output from the watchdog timer 49, the microcomputer 31 is reset by outputting a reset signal SR to the reset terminal of the microcomputer 31 (described as "RES" in FIG. 1) for a predetermined time. And reboot. This is a reset function for attempting to return the microcomputer 31 to normal.

  << Function 2 >> Until the operating voltage Vd from the main power supply circuit 41 rises from 0V and reaches the minimum value in the normal range (for example, 4.5V to 5.5V) that is considered in design when the microcomputer 31 operates reliably During this period, the reset signal SR is output to the reset terminal of the microcomputer 31. This is a function (so-called power-on reset function) that resets the microcomputer 31 until the operating voltage Vd rises to a normal range when the ECU 11 is powered on.

  << Function 3 >> The operating voltage Vd from the main power supply circuit 41 drops from the normal range, and the reset execution threshold (for example, 4V) is higher than a voltage value (for example, 3.5V) at which the microcomputer 31 becomes inoperable. When a decrease is detected, a reset signal SR is output to the reset terminal of the microcomputer 31 from that point in time until the operating voltage Vd rises to a reset release threshold (for example, 4.5 V) higher than the reset execution threshold. To do. This is a function (so-called voltage drop reset function) for preventing a malfunction of the microcomputer 31 due to a drop in the operating voltage Vd.

  << Function 4 >> Detecting that the operating voltage Vd has dropped to a reset notice threshold (for example, 4.3 V) higher than the reset execution threshold before the reset signal SR is output by the above "Function 3". At this point, the reset notice signal SN is output to the non-maskable interrupt terminal (described as “NMI” in FIG. 1) of the microcomputer 31. This is a function for notifying the microcomputer 31 that the reset according to << Function 3 >> will be performed soon. When the reset notice signal SN is input to the non-maskable interrupt terminal, the microcomputer 31 performs the NMI process that is a non-maskable interrupt process, and then waits for the reset by the reset signal SR.

  The input circuit 35 is a voltage signal (high is the operating voltage Vd) that allows the microcomputer 31 to input the IGSW signal (high is the battery voltage Vbat and low is the 0V signal) input from the terminal 27. Then, the signal is converted into a level of low (0V signal) and output. The level-converted IGSW signal output from the input circuit 35 is input to an input terminal with a falling edge capture function among the terminals of the microcomputer 31.

  Note that an input terminal with a falling edge capture function means that when a falling edge (change from high to low) occurs in an input signal, history information indicating that is stored in a specific register in the microcomputer 31. Input terminal to be stored by the wearer. For this reason, when the IGSW 19 is turned off from on and a falling edge occurs in the IGSW signal input from the input circuit 35 to the microcomputer 31, the IGSW 19 is changed from on to off as history information in the specific register. Information indicating this (hereinafter referred to as IGSW off-edge history) is stored. Note that the stored IGSW off-edge history is, for example, a flag having a value of “1”.

  In addition, the microcomputer 31 includes a CPU 51 that executes a program, a flash memory 53 that is a non-volatile memory capable of rewriting data, a RAM 55 that stores calculation results and the like by the CPU 51, and a standby voltage Vs from the sub power supply circuit 43. Includes a standby RAM (SRAM: also referred to as a backup RAM) 57 that is constantly supplied as a voltage for data storage.

  The flash memory 53 has a storage area 61 for storing a program (execution target program) executed by the CPU 51 and an abnormality that prevents the main relay 15 from being turned on by the microcomputer 31 (hereinafter referred to as a main relay abnormality). A storage area 63 for storing a determination flag used for determining whether or not the storage has occurred, and a storage area 65 for storing a reset history that is a flag indicating whether or not the microcomputer 31 has been reset while the IGSW 19 is on. And a storage area 67 for storing an abnormality determination counter (specifically, the value of the abnormality determination counter) used to confirm the determination that a main relay abnormality has occurred.

  On the other hand, the communication circuit 37 is connected to a communication line 28 in the vehicle via a terminal 29 and exchanges communication data between the microcomputer 31 and another device connected to the communication line 28.

  Further, a tool 59 for rewriting a program of the microcomputer 31 (specifically, a program stored in the storage area 61 of the flash memory 53) can be connected to the communication line 28 as a device outside the vehicle. When the microcomputer 31 (specifically, the CPU 51 in the microcomputer 31) receives a reprogram request from the tool 59 connected to the communication line 28 (replog is an abbreviation of “reprogram” meaning program rewriting). In this case, reprogram processing is performed to rewrite the program stored in the storage area 61 of the flash memory 53 with a new program transmitted from the tool 59.

  Next, of the processes performed by the microcomputer 31, processes related to detecting a main relay abnormality will be mainly described with reference to the flowcharts of FIGS. Note that the processing performed by the microcomputer 31 is actually processing realized by the CPU 51 executing a program, in other words, processing performed by the CPU 51 according to the program.

  As shown in FIG. 2, when the microcomputer 31 starts operation, first, in S110, the power supply request signal SD to the drive circuit 45 is set to high so that the main relay 15 remains on even when the IGSW 19 is turned off. Thus, the power supply voltage VB is continuously supplied from the main relay 15 to the terminal 17.

Next, the microcomputer 31 performs an initial process in S120.
The initial process includes, for example, a register initialization process for clearing various internal registers including the specific register, a data initialization process for writing a set value determined by a program in a predetermined data storage area in the RAM 55, Data restoration processing is included in which data stored in the flash memory 53 from the RAM 55 during the previous operation (that is, saved) is stored again in the RAM 55 from the flash memory 53. Also included is processing associated with detecting a main relay abnormality. The initial process will be described later with reference to FIG. The determination flag, reset history, and abnormality determination counter stored in the storage areas 63, 65, and 67 of the flash memory 53 are copied to the RAM 55 by the data restoration process in the initial process, and the subsequent processes Then, it is updated on the RAM 55.

After completing the initial process, the microcomputer 31 performs a time synchronization process of FIG. 3 described later in S130, and further performs an idle process of FIG. 8 described later in S140.
The time synchronization process is performed every predetermined time (for example, 1 ms or 8 ms), and the idle process is performed in the idle time from the end of the time synchronization process to the next start. . In the idle process, a refresh process for writing the same set value as that written in the data initialization process to the predetermined data storage area in the RAM 55 is mainly performed. The refresh process is performed to return the set value to the original value even if the set value written in the RAM 55 in the data initialization process is changed to another value for some reason.

  Further, the microcomputer 31 determines whether or not a predetermined shutdown condition is satisfied within the time synchronization process (S150). In FIG. 2, the determination process of S150 for determining whether or not the shutdown condition is satisfied is given priority for ease of understanding, but is described as a process different from the time synchronization process. The processing is actually performed in time synchronization processing.

  In addition, the shutdown condition includes at least a condition that the IGSW 19 is off, and for example, includes a condition that a process for controlling the engine is not required. ing.

  If it is determined that the shutdown condition is satisfied (S150: YES), the microcomputer 31 proceeds to S160 to perform pre-shutdown processing, and then performs shutdown processing in S170.

  As the pre-shutdown process, for example, a memory check process for checking whether or not the data in the flash memory 53 is normal is performed at a time during engine control, such as a memory check process for checking whether or not data is normal. There are relatively time consuming processes that cannot. Further, as the shutdown process, for example, specific data such as a diagnosis code (diagnosis means “diagnosis” meaning diagnosis) indicating the occurrence of an abnormality or a learning value is copied from the RAM 55 to the flash memory 53. Data evacuation processing (processing for data storage).

When the microcomputer 31 finishes the shutdown process, the power supply request signal SD to the drive circuit 45 is changed from high to low in S180.
Then, since the IGSW 19 is turned off at that time, the main relay 15 is turned off when the power supply request signal SD becomes low, and the supply of the power supply voltage VB to the terminal 17 is stopped. As a result, the operation voltage Vd is not output from the main power supply circuit 41, and the microcomputer 31 stops operating.

  If a main relay abnormality has occurred, the supply of the power supply voltage VB to the terminal 17 is stopped when the IGSW 19 is turned off. Therefore, the microcomputer 31 performs pre-shutdown processing (S160) and shutdown processing (S170). ), The operation voltage Vd is not supplied and the operation is stopped.

Next, time synchronization processing will be described with reference to FIG.
As shown in FIG. 3, when the microcomputer 31 starts the time synchronization process in S <b> 130 of FIG. 2, first, in S <b> 210, it is determined whether or not the current process is an initial process after the initial process is performed. If it is an initial process, the process of S220-S240 is performed.

  First, in S220, the determination flag in the RAM 55 is turned off, and in the next S230, the reset history in the RAM 55 is turned off which indicates no reset. In the present embodiment, “turning off a flag” means that the flag is set to “0”, for example, and conversely “turning on the flag” means that the flag is set to, for example, “ 1 ”. In the next S240, the determination flag turned off in S220 is written in the storage area 63 of the flash memory 53, and the reset history turned off in S230 is written in the storage area 65 of the flash memory 53. Process.

That is, in S220 to S240, the determination flag and the reset history in the storage areas 63 and 65 are turned off so that the information in the previous operation is not taken over.
In S240, a process of writing the current value of the abnormality determination counter updated in the RAM 55 by the process of S340 or S350 in FIG. 4 (initial process) described later (that is, the storage area 67). The process of rewriting the abnormality determination counter in the table for the purpose of updating is also performed.

  The writing process for turning off the determination flag in the storage area 63 may be performed only when it is determined that the determination flag is on in S330 of FIG. 4 to be described later. That is, the writing process for turning off the determination flag in the storage area 63 may be performed only when the determination flag in the storage area 63 is on. This also applies to the writing process for turning off the reset history in the storage area 65. Further, the processes of S220 to S240 may be performed at the end of the initial process, for example.

Returning to the description of FIG. 3, the microcomputer 31 proceeds to S250 after performing the process of S240.
If the microcomputer 31 determines in S210 that the current process is not the initial process after the initial process, the microcomputer 31 proceeds to S250 without performing the processes of S220 to S240.

In S250, it is determined whether or not the IGSW 19 is off. If the IGSW 19 is not off (if it is on), the process proceeds to S255, and a periodic process to be performed at regular intervals is performed.
Whether the IGSW 19 is on or off can be determined based on the level-converted IGSW signal input from the input circuit 35. In addition to the process for controlling the engine, the regular process includes, for example, a self-diagnosis process for detecting an abnormality of the microcomputer 31 itself. As the self-diagnosis process, for example, the execution cycle of a task to be executed every predetermined time is monitored, and if the execution cycle is abnormal, it is determined that the microcomputer 31 is abnormal. A process such as performing a predetermined calculation on a known calculation target value and determining that the microcomputer 31 is abnormal if it is determined that the calculation result does not match a predetermined expected value. is there.

And the microcomputer 31 complete | finishes the said time synchronous process, after performing a regular process by said S255.
On the other hand, when the microcomputer 31 determines that the IGSW 19 is off in S250 (that is, when it is detected that the IGSW 19 has been turned off from the on state), the microcomputer 31 proceeds to S260, and the predetermined value is detected from the time when the IGSW 19 is turned off. It is determined whether or not the time Td has elapsed. If the predetermined time Td has not elapsed, the time synchronization processing is terminated as it is. If it is determined in S260 that the predetermined time Td has elapsed, the process proceeds to S270.

  Note that the predetermined time Td is longer than the longest time from when the IGSW 19 is turned off until the operation voltage Vd is not supplied to the microcomputer 31 until the operation of the microcomputer 31 stops when the main relay abnormality occurs. Even set for a long time. For this reason, the processing after S270 in FIG. 3 is executed in a state in which the main relay abnormality does not occur and the microcomputer 31 operates reliably even after the IGSW 31 is turned off. In other words, if a main relay abnormality has occurred, the processes after S270 are not executed.

  In S270, the determination flag in the RAM 55 is turned on. In the next S280, a writing process for writing the determination flag turned on in S270 to the storage area 63 of the flash memory 53 is performed.

That is, in S270 and S280, the determination flag in the storage area 63 is turned on.
This is because, when the microcomputer 31 is started next time, if the determination flag in the storage area 63 is on, no main relay abnormality has occurred (that is, the main relay 15 is operating normally). This is to make it possible to determine that it is functional.

  Conversely, if a main relay abnormality has occurred, the power supply voltage VB is cut off and the microcomputer 31 before the microcomputer 31 performs the writing process of S280 (the process of writing the ON determination flag in the storage area 63). Since the operation stops, the determination flag in the storage area 63 remains off written in the writing process of S240. Therefore, as will be described later, the microcomputer 31 refers to the determination flag stored in the storage area 63 in the initial process at the time of activation (FIG. 4). If the determination flag is off, the microcomputer 31 It can be determined that a relay abnormality has occurred.

Returning to the description of FIG. 3, the microcomputer 31 performs the process of S280 and then proceeds to S290.
In S290, the IGSW off-edge history in the specific register described above is cleared, and in the next S295, the fail-safe state, which is a flag in the RAM 55 referred to in idle processing in FIG. Thereafter, the time synchronization process is terminated. Note that the process of S290 may be omitted.

Next, the initial process will be described with reference to FIG.
As shown in FIG. 4, when the microcomputer 31 starts the initial process in S120 of FIG. 2, first, in S305, the data initialization process, the data restoration process, and the like are performed.

  In the next S310, the main relay diagnosis result, which is one of the failure diagnosis result information in the RAM 55, is set to a value indicating “not detected”, and in the next S315, the above-described fail-safe state is turned off. To.

  The main relay diagnosis result is set to one of three values: a value indicating “not detected”, a value indicating “normal”, and a value indicating “abnormal”. A value indicating “not detected” indicates that it is not determined whether a main relay abnormality has occurred or not, and a value indicating “normal” indicates that no main relay abnormality has occurred ( That is, the value indicating “abnormal” indicates that it is determined that a main relay abnormality has occurred.

Next, in S320, it is determined whether or not the IGSW 19 is off. If the IGSW 19 is not off (if on), the process proceeds to S325.
In S325, it is determined whether or not the flash memory 53 is in a normal state (specifically, a state where data can be normally read). If it is determined that the flash memory 53 is not in a normal state, the initial process is performed as it is. finish.

  That is, if the flash memory 53 is not in a normal state and data cannot be read from the flash memory 53, the presence or absence of the main relay abnormality cannot be determined based on the determination flag in the storage area 63. In this case, the initial process is terminated while the main relay diagnosis result is kept at the value “not detected”. The microcomputer 31 turns on the memory abnormality flag when, for example, data cannot be read from the flash memory 53 in the data restoration process in S305, and in S325, the flash memory is referred to by referring to the memory abnormality flag. It is determined whether 53 is in a normal state.

On the other hand, if it is determined in S325 that the flash memory 53 is in a normal state, the process proceeds to S330.
In S330, it is determined whether the determination flag copied from the storage area 63 to the RAM 55 by the data restoration process is on. In S330, the determination flag may be read from the storage area 63, and it may be determined whether or not the read determination flag is on.

  If it is determined in S330 that the determination flag is on, the processing of S270 and S280 in FIG. 3 has been performed after the IGSW 19 was turned off during the previous operation. Therefore, in this case, the process proceeds to S335, where it is determined that the main relay abnormality has not occurred (that is, it is determined that the main relay 15 functions normally), and the main relay diagnosis result is set to a value indicating “normal”. Set. Further, in the next S340, the abnormality determination counter copied from the storage area 63 to the RAM 55 by the data restoration process is cleared (the counter value is set to “0”), and then the initial process is terminated. Note that the abnormality determination counter cleared to 0 in S340 is written to the storage area 67 of the flash memory 53 in S240 of FIG. 3 executed thereafter, but the abnormality determination counter set to “0”. This storage area 67 may be written in this initial process.

If it is determined in S320 that the IGSW 19 is off, the process proceeds to S335.
That is, the fact that the microcomputer 31 is operating even when the IGSW 19 is off is considered that the power supply voltage VB is being supplied by the main relay 15, and in this case also, the main relay abnormality is detected. It is determined that no occurrence has occurred, the processes of S335 and S340 are performed, and then the initial process is terminated.

On the other hand, if it is determined in S330 that the determination flag is not ON (OFF), the process proceeds to S345.
In S345, it is determined whether or not the reset history copied from the storage area 65 to the RAM 55 by the data restoration process is ON. In S345, the reset history may be read from the storage area 65, and it may be determined whether or not the read reset history is ON.

  If it is determined in S345 that the reset history is not ON (OFF), the microcomputer 31 has not been reset while the IGSW 19 is ON, and the determination flag is OFF. This is probably because the main relay abnormality has occurred, and when the IGSW 19 was turned off during the previous operation, the supply of the power supply voltage VB was interrupted before performing the processes of S270 and S280 in FIG. . Therefore, in this case, the process proceeds to S350, where it is determined that a main relay abnormality may have occurred, and the abnormality determination counter copied from the storage area 63 to the RAM 55 by the data restoration process is incremented. The abnormality determination counter incremented in S350 is written in the storage area 67 of the flash memory 53 in S240 of FIG. 3 executed thereafter, but the incremented abnormality determination counter storage area 67. The writing to may be performed in this initial process.

  Then, in next S355, it is determined whether or not the incremented abnormality determination counter is equal to or greater than a predetermined abnormality determination threshold. If the abnormality determination counter is not equal to or greater than the abnormality determination threshold, the initial process is terminated. . Therefore, in this case, the state in which it is determined that there is a possibility that the main relay abnormality has occurred remains substantially, and the state in which the main relay abnormality is not detected (that is, the main relay diagnosis result is “ State of “not detected”).

  If it is determined in S355 that the abnormality determination counter has become equal to or greater than the abnormality determination threshold, the process proceeds to S360, where it is formally determined that a main relay abnormality has occurred (determined determination), and main relay diagnosis is performed. The result is set to a value indicating “abnormal”. At this point, the main relay abnormality is detected.

  Then, in the next S365, the fail safe state is turned on. Further, in the next S370, for example, a diagnosis code indicating that a main relay abnormality has occurred is stored in the RAM 55 or the like. Diag processing is performed, such as turning on a warning light to notify the user or the like. Then, the initial process ends.

  On the other hand, if it is determined in S345 that the reset history is ON, it means that the microcomputer 31 has been reset while the IGSW 19 is ON. It is considered that the processes of S270 and S280 in FIG. 3 could not be performed. Therefore, in this case, even if the determination flag is OFF (determined as “NO” in S330), it is determined that the processing after S350 is not performed (that is, the main relay abnormality has occurred). The initial process is terminated as is.

Next, the case where the reset history is turned on will be described.
In the present embodiment, the reset history is turned on by each process of FIGS.
<Explanation of FIG. 5>
When the microcomputer 31 receives the replog request from the above-described tool 59 while the IGSW 19 is on, the microcomputer 31 performs the replog request processing shown in FIG.

  As shown in FIG. 5, when the microcomputer 31 starts the process for requesting relogging, first, in S410, the reset history in the RAM 55 is turned on, and in the next S420, the reset history turned on in S410 is flushed. A writing process for writing to the storage area 65 of the memory 53 is performed. That is, in S410 and S420, the reset history in the storage area 65 is turned on.

Next, in S430, the above repro processing (processing for rewriting the program in the storage area 61 with a new program transmitted from the tool 59) is performed.
Then, when the reprogram processing is completed, in the next S440, as the reset processing for resetting the microcomputer 31, processing for stopping the output of the clear signal WDC to the watchdog timer 49 is performed.

  Then, the clear signal WDC is not output from the microcomputer 31, and as a result, the reset control circuit 47 outputs the reset signal SR to the microcomputer 31 by the above-mentioned << Function 1 >>, so that the microcomputer 31 is reset. For this reason, the microcomputer 31 enters a state of waiting for reset in S450 following S440 (for example, a state in which execution of a non-operation instruction that does not substantially perform processing is repeated).

  As described above, when the microcomputer 31 performs the reprogramming process while the IGSW 19 is on, the microcomputer 31 performs the resetting process (S440) for resetting itself, assuming that the reset execution condition is satisfied, and then restarts and renews the new It is supposed to run a simple program. Then, when performing the self-reset for resetting itself as described above, the microcomputer 31 determines that it is naturally reset, and turns on the reset history in the storage area 65 (S410, S420).

<Explanation of FIG. 6>
Further, when the microcomputer 31 detects an abnormality of the microcomputer 31 by the above-described self-diagnosis process (when the microcomputer 31 determines that an abnormality has occurred), the microcomputer 31 performs the microcomputer abnormality detection process of FIG.

  As shown in FIG. 6, when the microcomputer 31 starts the microcomputer abnormality detection process, first, in S510, the abnormality log, which is information indicating the content and detection time of the abnormality detected in the self-diagnosis process, is stored in the RAM 55 or the like. The process to memorize is performed.

  Next, in S520, the reset history in the RAM 55 is turned on. In the next S530, the reset history turned on in S520 is written into the storage area 65 of the flash memory 53. That is, in S520 and S530, the reset history in the storage area 65 is turned on as in S410 and S420 of FIG.

  Then, in the next S540, as in S440 in FIG. 5, a process for stopping the output of the clear signal WDC to the watchdog timer 49 is performed as a reset process, and then in S550, the same as S450 in FIG. At the same time, a reset signal SR from the reset control circuit 47 waits for the reset.

  Thus, even when the microcomputer 31 detects an abnormality in the self-diagnosis process while the IGSW 19 is on, the microcomputer 31 performs the reset process (S540) to reset itself, assuming that the reset execution condition is satisfied. . Note that the reset in this case is a reset for attempting normal recovery. Then, the microcomputer 31 determines that the reset is naturally performed even when performing a self-reset for normal recovery accompanying such abnormality detection, and turns on the reset history in the storage area 65 (S520, S530).

<Explanation of FIG. 7>
Further, the microcomputer 31 performs the NMI process of FIG. 7 when the reset control circuit 47 outputs the reset notice signal SN by the above-mentioned << Function 4 >>.

  As shown in FIG. 7, when the NMI process is started, the microcomputer 31 first determines in S610 whether or not the IGSW off-edge history is stored in the specific register, and the IGSW off-edge history is not stored. If it is determined, the process proceeds to S620.

  In step S620, the reset history in the RAM 55 is turned on. In step S630, the reset history turned on in step S620 is written into the storage area 65 of the flash memory 53.

  In other words, when the IGSW off-edge history is not stored at the start of the NMI processing (S610: NO), the IGSW 19 is not turned off, but noise is generated in the power supply voltage VB line or the operation voltage Vd line, for example. It is considered that the operation voltage Vd is lowered to the reset notice threshold value and the reset notice signal SN is output from the reset control circuit 47. Therefore, in this case, the microcomputer 31 determines that the operation voltage Vd will soon drop to the reset execution threshold (<reset notice threshold) and is reset by the << function 3 >> of the reset control circuit 47, and S620, S630. As a result, the reset history in the storage area 65 is turned on.

  Then, the microcomputer 31 enters a state of waiting for reset by the reset control circuit 47 (for example, a state in which execution of a non-operation instruction is repeated) in S640 following S630.

  As described above, the microcomputer 31 also turns on the reset history in the storage area 65 when detecting that the operation voltage Vd is reduced due to noise and is reset by the reset control circuit 47 (S610: NO) (S620). , S630).

  Note that the main relay abnormality has not occurred and the IGSW 19 is turned off, and then the IGSW off-edge history is cleared in S290 in FIG. 3, and then the processing in S180 in FIG. Even when the NMI processing is performed due to a decrease, “NO” is determined in S610 of FIG. 7 and the reset history is turned on by the processing of S620 and S630. However, in that case, the determination flag in the storage area 63 has already been turned on by the processing of S270 and S280 of FIG. 3, and in the initial processing of FIG. Therefore, the process is not affected even if the reset history is turned on. Further, in the present embodiment, the microcomputer 31 detects that the reset notice signal has been input while the IGSW 19 is on, based on the determination in S610.

On the other hand, if the microcomputer 31 determines in S610 that the IGSW off-edge history is stored in the specific register, the microcomputer 31 proceeds to S640 as it is.
That is, in this case, immediately after the IGSW 19 is turned off, it is considered that the operating voltage Vd has dropped to the reset notice threshold and the reset notice signal SN is output from the reset control circuit 47, and the main relay abnormality has occurred. It may have occurred. Therefore, the microcomputer 31 waits for resetting by the reset control circuit 47 without turning on the reset history.

  As described above, the reset of the microcomputer 31 that occurs while the IGSW 19 is turned on includes a reset that occurs when the microcomputer 31 performs the reset process (S440, S540) (that is, a deliberate reset by software) and noise for operation. There is a reset that occurs when the voltage Vd drops instantaneously (that is, an unintended reset). 5 and FIG. 6, the occurrence of a deliberate reset is detected and the reset history is turned on. In the process of FIG. 7, the occurrence of an unintended reset is detected and the reset history is turned on. Yes.

Next, idle processing will be described with reference to FIG.
As shown in FIG. 8, when starting the idle process, the microcomputer 31 first performs a normal process such as the refresh process described above in S710.

  Then, in next S720, it is determined whether or not the fail safe state is on. If the fail safe state is not on (if off), the idle processing is terminated as it is.

  If it is determined in S720 that the fail-safe state is ON, it is determined that the main relay abnormality has occurred by the initial process in FIG. 4, and in that case, the process proceeds to S730. move on.

  In S730, as fail-safe processing when the main relay abnormality occurs, processing that is normally performed after the IGSW 19 is turned off (for example, pre-shutdown processing performed in S160 in FIG. 2 or S170 in FIG. 2). In particular, for example, the latter shutdown process). In S730, the processing that is normally performed after the IGSW 19 is turned off is divided into amounts that are processing times that do not affect the control of the control target, and is performed little by little. Thereafter, the idle process is terminated.

As described above, when the microcomputer 31 detects the occurrence of the main relay abnormality, the process that is normally performed after the IGSW 19 is turned off is performed by the idle process.
Therefore, even if the main relay abnormality has occurred and the supply of the power supply voltage VB to the terminal 17 is stopped immediately after the IGSW 19 is turned off, the processing that should be performed after the IGSW 19 is turned off is not performed at all. Can be prevented. That is, the influence due to the main relay abnormality can be reduced. For example, if shutdown processing (data saving processing) is performed as the fail-safe processing in S730, data such as diagnostic codes and learning values can be saved from the RAM 55 to the flash memory 53. The influence on can be suppressed.

  Next, the operation of the ECU 11 as described above will be described mainly with the microcomputer 31 as a main component, with reference to FIGS. 9 to 11 and the following description, “trip” means a period during which the microcomputer 31 (and thus the ECU 11) is continuously operating.

First, FIG. 9 shows an operation example of the microcomputer 31 when the main relay 15 functions normally.
As shown in FIG. 9, if the IGSW 19 is turned off from on at time t1 during trip 1, the microcomputer 31 detects this at S250 in FIG. 3, and time t2 when a predetermined time Td has elapsed from the detection time. Then, an ON determination flag is written in the storage area 63 of the flash memory 53 through S270 and S280 in FIG. When the microcomputer 31 is activated, the power supply request signal SD to the drive circuit 45 is made high by S110 in FIG. 2, so that even if the IGSW 19 is turned off, the main relay 15 continues to be turned on and the ECU 11 The supply of the power supply voltage VB is continued.

  Then, after that, the microcomputer 31 performs pre-shutdown processing (S160 in FIG. 2) and shutdown processing (S170 in FIG. 2). At time t3 when these processings are completed, the microcomputer 31 transfers to the drive circuit 45 through S180 in FIG. The power supply request signal SD is changed from high to low. Then, the main relay 15 is turned off and the power supply voltage VB to the ECU 11 is cut off. As a result, the microcomputer 31 stops its operation. At this point, Trip 1 ends.

  When the IGSW 19 is turned on at the subsequent time t4, the main relay 15 is turned on. Then, the power supply voltage VB is supplied to the ECU 11 via the main relay 15, the microcomputer 31 is activated, and the trip 2 starts from this point.

  Since there is almost no voltage drop at the main relay 15, no current flows through the diode 21 even if the IGSW 19 is on if the main relay 15 is on. That is, the supply of the power supply voltage VB via the diode 21 is performed when the IGSW 19 is on and the main relay 15 is not turned on due to a failure.

Then, the activated microcomputer 31 performs the initial process of FIG. 4, but at the time of activation of the microcomputer 31, the determination flag in the storage area 63 is on.
Therefore, the microcomputer 31 determines in S330 of FIG. 4 that the determination flag is on, determines in S335 of FIG. 4 that no main relay abnormality has occurred, and displays the main relay diagnosis result. , The value indicating “normal” is set.

  Thereafter, the microcomputer 31 writes an OFF determination flag in the storage area 63 as shown at time t5 in S220 and S240 of FIG. That is, the determination flag in the storage area 63 is rewritten from on to off to prepare for the next abnormality detection.

Next, FIG. 10 shows an operation example of the microcomputer 31 when the main relay abnormality occurs. In each example of FIGS. 10 and 11, the abnormality determination threshold is “2”.
In the example of FIG. 10, a main relay abnormality has occurred while the IGSW 19 is on in Trip 1.

  Therefore, as shown in FIG. 10, if the IGSW 19 is turned off from on at time t11 during trip 1, the power supply voltage VB to the ECU 11 is immediately cut off, the microcomputer 31 stops operating, and trip 1 Ends. In this case, the microcomputer 31 cannot perform the processes of S270 and S280 in FIG. 3 after the IGSW 19 is turned off. As a result, the microcomputer 31 cannot write the ON determination flag in the storage area 63. Therefore, the operation of the microcomputer 31 is stopped while the determination flag is off.

  If the main relay 15 cannot be turned on not only by the power supply request signal SD from the microcomputer 31 but also by the IGSW signal (that is, when the main relay 15 has an off failure that cannot be turned on), the IGSW 19 During the on-state, the power supply voltage VB is supplied to the ECU 11 via the IGSW 19 and the diode 21. Even if the main relay abnormality occurs, if the main relay 15 can be turned on with the IGSW signal (that is, the main relay 15 can be turned on with the IGSW signal, and cannot be turned on with the power supply request signal SD from the microcomputer 31. In this case, the power supply voltage VB is supplied to the ECU 11 via the main relay 15 while the IGSW 19 is on.

When the IGSW 19 is turned on at time t12 thereafter, the power supply voltage VB is supplied to the ECU 11, the microcomputer 31 is started, and the trip 2 starts from this point.
Then, the activated microcomputer 31 performs the initial process of FIG. 4. At the time of activation of the microcomputer 31, the determination flag in the storage area 63 is not turned on but turned off.

  Therefore, the microcomputer 31 determines that the determination flag is off in S330 of FIG. In this example, the reset history in the storage area 65 is off, and the microcomputer 31 determines that the reset history is off in S345 of FIG. Therefore, the microcomputer 31 increments the abnormality determination counter in S350 of FIG. For this reason, the abnormality determination counter increases from “0” to “1”, but has not yet reached the abnormality determination threshold (= 2).

  In this case, since the microcomputer 31 does not change the main relay diagnosis result after setting the main relay diagnosis result to the value indicating “not detected” in S310 of FIG. 4, the main relay diagnosis result is set to the value indicating “not detected”. Become.

  After that, the microcomputer 31 writes an OFF determination flag in the storage area 63 as shown at time t13 by S220 and S240 in FIG. Therefore, the determination flag remains off.

  Thereafter, similarly to Trip 1, if IGSW 19 is turned off from on at time t14 during Trip 2, the power supply voltage VB to ECU 11 is immediately cut off in this case as well, and microcomputer 31 stops operating. Trip 2 ends. Also in this case, the microcomputer 31 cannot write the ON determination flag in the storage area 63.

Then, when the IGSW 19 is turned on at the subsequent time t15, the power supply voltage VB is supplied to the ECU 11, the microcomputer 31 is activated, and the trip 3 starts from this point.
Then, the activated microcomputer 31 determines that the determination flag is OFF in S330 of FIG. 4, and determines that the reset history is OFF in S345 of FIG. Therefore, the microcomputer 31 increments the abnormality determination counter in S350 of FIG. For this reason, the abnormality determination counter increases from “1” and reaches the abnormality determination threshold (= 2).

  Therefore, the microcomputer 31 determines in S355 in FIG. 4 that the abnormality determination counter has become equal to or greater than the abnormality determination threshold, determines in S360 in FIG. 4 that a main relay abnormality has occurred, and performs main relay diagnosis. The result is set to a value indicating “abnormal”. Further, the microcomputer 31 turns on the fail-safe state in S365 of FIG. 4, and thereafter performs processing that is normally performed after the IGSW 19 is turned off as idle processing.

  Next, FIG. 11 shows an operation example of the microcomputer 31 when the microcomputer 31 is reset while the IGSW 19 is on. In the example of FIG. 11 as well, as in FIG. 10, the main relay abnormality occurs while the IGSW 19 in the trip 1 is on.

First, in FIG. 11, the operation content before (left side) before time t13 is the same as that in FIG.
FIG. 11 shows a case where the microcomputer 31 is reset at time t24 during trip 2 (IGSW 19 remains on at this time).

  Here, if the reset generated at time t24 is a deliberate reset by the software of the microcomputer 31, an on-reset history is written in the storage area 65 by the processing of S410 and S420 in FIG. 5 or S520 and S530 in FIG. Will be. If the reset generated at time t24 is a reset that occurs due to a decrease in the operating voltage Vd due to noise, the ON reset history is written in the storage area 65 by the processing of S620 and S630 in FIG. .

  Therefore, the reset history in the storage area 65 is turned on when the reset generated at time t24 is canceled at time 25 and the microcomputer 31 is restarted (that is, at the start of trip 3). Then, the microcomputer 31 activated at time 25 determines that the determination flag is off in S330 of FIG. 4, and determines that the reset history is on in S345 of FIG.

  Therefore, in trip 3, the microcomputer 31 ends the initial process in FIG. 4 without incrementing the abnormality determination counter even if the determination flag is OFF. For this reason, the abnormality determination counter remains at the value (= 1) in the previous trip 2, and it is prohibited to determine in S360 of FIG. 4 that the main relay abnormality has occurred.

  Then, as shown at time t26, the microcomputer 31 rewrites the reset history in the storage area 65 from on to off by S230 and S240 in FIG. Further, the microcomputer 31 writes an OFF determination flag in the storage area 63 by S220 and S240 in FIG.

  Thereafter, if the IGSW 19 is turned off from on at time t27 during the trip 3, also in this case, the power supply voltage VB to the ECU 11 is immediately cut off, the microcomputer 31 stops operating, and the trip 3 ends.

Then, when the IGSW 19 is turned on at the subsequent time t28, the power supply voltage VB is supplied to the ECU 11, the microcomputer 31 is activated, and the trip 4 starts from this point.
Then, the activated microcomputer 31 determines that the determination flag is off in S330 of FIG. 4, and then determines that the reset history is off in S345 of FIG. Therefore, the microcomputer 31 increments the abnormality determination counter in S350 of FIG. 4, and as a result, the abnormality determination counter reaches the abnormality determination threshold (= 2). For this reason, the microcomputer 31 determines that a main relay abnormality has occurred in S360 of FIG. 4 and sets the main relay diagnosis result to a value indicating "abnormal". Furthermore, the microcomputer 31 turns on the fail-safe state in S365 of FIG. 4, and thereafter performs processing that is normally performed after the IGSW 19 is turned off as idle processing. That is, the operation of trip 4 after time t28 in FIG. 11 is the same as the operation of trip 3 after time t15 in FIG.

  According to the ECU 11 as described above, when the microcomputer 31 is reset while the IGSW 19 is on and the determination flag in the storage area 63 is not turned on, the occurrence of the reset is detected and the reset history is recorded. Turned on. Then, even if the determination flag is off, the microcomputer 31 activated by releasing the reset is prohibited from performing the processing after S350 in the initial processing of FIG. It is prohibited to judge that a main relay abnormality has occurred.

  Therefore, it is possible to prevent the microcomputer 31 reset while the IGSW 19 is turned on from being erroneously determined that a main relay abnormality has occurred when the microcomputer 31 is started next time. As a result, the main relay 15 The failure detection accuracy can be improved.

  In the present embodiment, the fact that the IGSW 19 is on corresponds to the start-up power supply condition. Further, the main relay 15 and the drive circuit 45 correspond to power supply means, and the main relay abnormality corresponds to abnormality of the power supply means. Further, setting the power supply request signal SD to high by the microcomputer 31 corresponds to “outputting a power supply request signal”, and changing the power supply request signal SD from high to low by the microcomputer 31 This corresponds to “stopping the output”. The ON determination flag corresponds to determination information, and the OFF determination flag corresponds to information different from the determination information. Further, the ON reset history corresponds to reset occurrence information.

[Second Embodiment]
The ECU 11 of the second embodiment shown in FIG. 12 is different from that of FIG. 1 in that a supply path for the power supply voltage VB via the diode 21 is not provided.

  In the case of this configuration, the microcomputer 31 includes, for example, a wiring failure (disconnection or ground short) for outputting the power supply request signal SD from the microcomputer 31 to the drive circuit 45 and an off failure of the main relay 15. The former wiring failure is detected as a main relay abnormality. If an off failure occurs in the main relay 15, even if the IGSW 19 is turned on, the power supply voltage VB is not supplied to the ECU 11, and the microcomputer 31 does not operate.

  On the other hand, in the ECU 11 (FIG. 1) of the first embodiment, the microcomputer 31 operates while the IGSW 19 is on even when the main relay 15 is turned off. An off failure is detected as a main relay abnormality.

  As mentioned above, although one Embodiment of this invention was described, this invention is not limited to such Embodiment at all, Of course, in the range which does not deviate from the summary of this invention, it can implement in a various aspect. .

For example, a part or all of the drive circuit 45 may be outside the ECU 11.
Further, the power supply condition for activation may be other than the condition that the IGSW 19 is turned on, for example, the condition that the activation signal output from another control device becomes an active level. Further, the power supply condition for activation may be a condition that one of two or more conditions is satisfied, for example, at least one of a plurality of activation signals is at an active level. good.

  Further, a configuration in which any one of the processes in FIGS. 5 to 7 is not performed may be employed. In addition, if the microcomputer 31 performs the reset process in a predetermined case other than the case where the reprogram processing is performed or an abnormality is detected, the process of turning on the reset history is performed in the predetermined case. Just do it.

Further, the processes of S720 and S730 can be deleted from the idle process of FIG.
Further, the storage location of the determination flag, the reset history, and the abnormality determination counter may be the standby RAM 57.

  Further, if only a deliberate reset by software of the microcomputer 31 is detected without detecting a reset due to a decrease in the operating voltage Vd, the reset history storage destination (reset storage unit) may be, for example, the RAM 55.

Further, the nonvolatile memory capable of rewriting data is not limited to the flash memory, and may be, for example, an EEPROM.
The abnormality determination threshold value is not limited to “2” illustrated in FIGS. 10 and 11, and may be “3” or more, or “1”. If the abnormality determination threshold is set to “1”, processing relating to the abnormality determination counter, such as the processing of S350 and S355 in FIG. 4, is not necessary.

On the other hand, separately from the microcomputer 31, hardware as reset detection means may be provided.
For example, when the microcomputer 31 performs the reset process (S440, S540), a notification signal indicating that the reset process is performed is output to the reset detection unit and the latch circuit as the reset storage unit. When the notification signal is input, the notification signal may be latched and set. In this case, the fact that the latch circuit is in the set state corresponds to the fact that the reset generation information is stored in the reset storage unit. Similarly, the latch circuit may be configured such that when the reset signal SR is output from the reset control circuit 47 to the microcomputer 31 while the IGSW 19 is on, the reset signal SR is latched and set. it can. And the microcomputer 31 should just determine whether the said latch circuit is a set state in S345 of FIG.

  In addition, for example, a latch circuit that latches the notification signal and a latch circuit that latches the reset signal SR may be provided separately. In this case, the microcomputer 31 includes a plurality of latch circuits in S345 of FIG. What is necessary is just to determine whether at least one is a set state.

  DESCRIPTION OF SYMBOLS 11 ... ECU (electronic control apparatus), 13 ... Battery, 15 ... Main relay, 17 ... Terminal as electric power feeding part, 19 ... IGSW (ignition switch), 21 ... Diode, 31 ... Microcomputer, 33 ... Power supply control IC, 41 ... Main power supply circuit 45 ... Drive circuit 47 ... Reset control circuit 49 ... Watch dog timer 51 ... CPU 53 ... Flash memory 63 ... Storage area as determination information storage section 65 ... Storage as reset storage section region

Claims (6)

A power supply unit (17) to which a power supply voltage from an external power supply (13) is supplied when either the start-up power supply condition or the operation continuation power supply condition is satisfied;
When the power supply voltage is supplied to the power supply unit, the microcomputer (31) that operates using the power supply voltage as a power source,
The operation continuation power supply condition is that a power supply request signal is output from the microcomputer in an operation state,
When the microcomputer starts operation, the microcomputer starts outputting the power supply request signal to the power supply means (15, 45) that supplies the power supply voltage to the power supply unit when the power supply request signal is input. When the specific process is terminated after detecting that the start-up power supply condition is not established, the electronic control device is configured to stop the operation by stopping the output of the power supply request signal ( 11)
As a storage unit for storing determination information used for determining whether there is an abnormality in the power supply means, a determination unit capable of storing data regardless of whether the power supply voltage is supplied to the power supply unit An information storage unit (63),
The microcomputer writes the determination information to the determination information storage unit from when it detects that the start-up power supply condition is not satisfied until it stops outputting the power supply request signal. Write processing (S270, S280),
After starting the operation, the microcomputer determines whether or not the determination information is stored in the determination information storage unit, and the power supply unit is configured on the condition that the determination information is not stored. When the abnormality detection process (S330, S350 to S360) for determining that there is an abnormality is performed and it is determined that the determination information is stored in at least the determination information storage unit, the determination information A second writing process (S220, S240) for writing information different from the determination information to the storage unit is also performed.
Further, the electronic control unit detects reset of the microcomputer when the start-up power supply condition is satisfied, and stores reset generation information indicating that the microcomputer has been reset in the reset storage unit (65). Reset detecting means (31, S410, S420, S520, S530, S610 to S630) for
When the microcomputer has started the operation and the reset generation information is stored in the reset storage unit, the microcomputer prohibits the abnormality detection processing from determining that the power supply unit is abnormal (S345). )
An electronic control device. The electronic control device according to claim 1.
The microcomputer performs a reset process (S440, S540) for resetting the microcomputer when a predetermined reset execution condition is satisfied when the activation power supply condition is satisfied,
The reset detection means (31, S410, S420, S520, S530) detects that the reset processing has been performed by the microcomputer as a reset of the microcomputer;
An electronic control device. The electronic control device according to claim 2,
The reset detection means is realized by the microcomputer, and the microcomputer stores the reset generation information in the reset storage unit (S410, S420, S520, S530) when performing the reset processing (S440, S540). )about,
An electronic control device. The electronic control device according to claim 2 or claim 3,
The reset execution condition is at least one of a condition that the microcomputer has performed a process of rewriting a program to be executed and a condition that the microcomputer has detected an abnormality of the microcomputer.
An electronic control device. The electronic control device according to any one of claims 1 to 4,
A power supply circuit (41) for generating a constant operating voltage for operating the microcomputer from the power supply voltage supplied to the power supply unit and outputting the generated voltage to the microcomputer;
A reset control circuit (47) for resetting the microcomputer when detecting that the operating voltage output from the power supply circuit has dropped to a predetermined reset execution threshold value that is higher than a voltage value at which the microcomputer becomes inoperable; With
The reset storage unit (65) is a storage unit capable of storing data regardless of whether the power supply voltage is supplied to the power supply unit,
The reset detection means (31, S610 to S630) detects the reset of the microcomputer by the reset control circuit when the activation power supply condition is satisfied as the reset of the microcomputer.
An electronic control device. The electronic control device according to claim 5.
The reset control circuit (47) has detected that the operating voltage output from the power supply circuit has dropped to a reset notice threshold value higher than the reset execution threshold value at a time point before resetting the microcomputer. At that time, a reset warning signal is output to the microcomputer.
The reset detection means is realized by the microcomputer, and when the microcomputer detects that the reset notice signal is input when the activation power supply condition is satisfied, the reset generation unit stores the reset generation information. (S610 to S630),
An electronic control device.

Images