JP2018161927A - Electronic control unit for automobile - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control device for an automobile capable of writing at least information that an abnormality has occurred in a computer to a non-volatile memory as backup data even if initialization is performed due to an abnormality in the computer. SOLUTION: A sub-microcomputer monitors the functional state of a main microcomputer having a built-in ROM that controls an engine, and when it detects that an abnormality has occurred in the main microcomputer, the main microcomputer is stopped and initialized (time t1). ~ T2). After stopping and initializing the main microcomputer, the sub-microcomputer forcibly starts the main microcomputer (see time t3), and the information of the RAM functional status flag indicates that an error has occurred in the main microcomputer. It is automatically rewritten to the set value and written to EEPROM as backup data (see time t3 to t4). [Selection diagram] Fig. 3

Description

  The present invention relates to an automotive electronic control device.

  In conventional automotive electronic control devices, as disclosed in, for example, Patent Document 1, in a steady process in which a computer controls an in-vehicle device with an ignition switch turned on, various types of information obtained by failure diagnosis of the in-vehicle device, etc. Some information is temporarily stored in an accompanying volatile memory. In such an electronic control device for an automobile, after the ignition switch is turned off, the power supply is continued by the self-shutoff function (self-shutoff). During the period, various information temporarily stored in the volatile memory is written as backup data in the electrically rewritable nonvolatile memory.

JP 2008-140373 A

  However, in the electronic control device for automobiles of Patent Document 1, even if abnormality information indicating that an abnormality has occurred in the computer is temporarily stored in the volatile memory, it is diagnosed and compulsory that an abnormality has occurred in the computer during steady processing. When the reset process (initialization) is performed automatically, the abnormal information may be erased together with the various information already stored, and the information is stored in the nonvolatile memory as backup data during the self-shut period. The possibility of not being able to write arises.

  Therefore, in view of the above problems, the present invention provides an electronic control for automobiles that can write at least information that an abnormality has occurred in a computer as backup data to a nonvolatile memory even if initialization is performed due to an abnormality in the computer. An object is to provide an apparatus.

  For this reason, the automotive electronic control device according to the present invention has a volatile memory, monitors the on-vehicle equipment, and monitors the control means, and stops the control means when an abnormality occurs in the control means. Monitoring means for performing initialization, power control means for continuing power supply to the control means and the monitoring means until a predetermined time elapses after detecting the ignition switch OFF operation, and volatilization during the predetermined time A rewritable non-volatile memory in which stored information of the volatile memory is written, and the monitoring means forcibly starts the control means after stopping the control means and performing initialization, and at least the control means Information that an abnormality has occurred is written into a nonvolatile memory.

  According to the automobile electronic control device of the present invention, even if initialization is performed due to a computer abnormality, at least information indicating that the abnormality has occurred in the computer can be written in the nonvolatile memory as backup data.

1 is a circuit block diagram illustrating an example of an automotive electronic control device according to a first embodiment of the present invention. It is a flowchart which shows the monitoring process of the electronic controller for motor vehicles. It is a time chart which shows the operation state of the electronic controller for vehicles. It is a flowchart which shows the process at the time of the steady state and abnormality of the electronic controller for vehicles. It is a flowchart which shows the self-diagnosis process of the electronic controller for motor vehicles. It is a flowchart which shows the writing process at the time of abnormality of the electronic controller for vehicles. It is a circuit block diagram which shows an example of the electronic control apparatus for motor vehicles based on 2nd Embodiment of this invention.

Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings.
[First Embodiment]
FIG. 1 shows an example of an automotive electronic control device according to a first embodiment of the present invention.

  The vehicle electronic control device 1 has a built-in computer, and controls vehicle equipment by receiving power supply from the vehicle battery 2 via an ignition switch 3 (abbreviated as “IGNSW” in the figure, the same applies hereinafter) 3. It is. Although the engine 4 will be described as an example of the in-vehicle device, the automotive electronic control device of the present invention can be applied to other vehicle systems such as a transmission, a braking device, and a steering device.

  The automotive electronic control device 1 includes a control microcomputer (hereinafter referred to as “main microcomputer”) 10 as a control means for controlling the engine 4 and a monitoring microcomputer as a monitoring means for monitoring the functional state of the main microcomputer 10. (Hereinafter referred to as “sub-microcomputer”) 20, a power supply circuit 30 that adjusts the power supply voltage supplied from the in-vehicle battery 2 via the ignition switch 3 to the control voltage and supplies the control voltage to the main microcomputer 10 and the sub-microcomputer 20; And a relay switch (abbreviated as “relay SW” in the figure, the same applies hereinafter) 40 provided in parallel with the ignition switch 3 between the in-vehicle battery 2 and the power supply circuit 30.

(Main microcomputer)
The main microcomputer 10 includes an I / O (Input / Output) port 11 that is an interface for inputting and outputting signals, a CPU (Central Processing Unit) 12 that performs various arithmetic processes, and a RAM (Random Access Memory) that is a volatile memory. ) 13, a communication I / F 14 that is an interface for communicating with the sub-microcomputer 20 via the communication line CL, and a non-volatile memory that is electrically rewritable and retains stored information even when the power is shut off An EEPROM (Electrically Erasable Programmable Read-Only Memory) 15 is interconnected by an internal bus 16.

  The I / O port 11 receives, for example, a detection signal Sei regarding the operating state of the engine 4 such as a crank angle, a water temperature, an intake air amount, and a detection signal Svi of the output voltage Vign of the ignition switch 3, while a fuel injection valve, an ignition A control signal Seo to various actuators attached to the engine 4 such as a plug and a control signal Sro to the relay switch 40 are output. The detection signals Sei and Svi are converted into digital values by A / D (Analog / Digital) conversion before or after the I / O port 11 or the I / O port 11, and the control signals Seo and Sro are converted to D / A. It may be converted into an analog value by (Digital / Analog) conversion.

  Based on the detection signal Sei from the engine 4 input via the I / O port 11, the CPU 12 calculates control amounts of various actuators such as a fuel injection amount, a fuel injection timing, an ignition timing, and the like. A control signal Seo corresponding to the above is output to various actuators of the engine 4 via the I / O port 11 to perform engine control processing.

  Further, the CPU 12 performs failure diagnosis processing and learning control processing of the engine 4 and temporarily stores failure diagnosis information as a result of failure diagnosis and learning data as a result of learning control to the RAM 13 via the internal bus 16. To remember.

  In the CPU 12 of the main microcomputer 10, engine control processing, and failure diagnosis processing and learning control processing of the engine 4 performed at a predetermined timing in the engine control processing are performed as steady processing corresponding to the ON state of the ignition switch 3. .

  The electronic control device 1 for an automobile continues to supply power to the main microcomputer 10 and the sub-microcomputer 20 even after the ignition switch 3 is turned off, and self-shuts off the power supply when a predetermined time has elapsed since the turning-off operation. A self-shutoff function (power control means) is provided.

  Specifically, in the main microcomputer 10, when the CPU 12 detects an off operation of the ignition switch 3 based on the detection signal Svi of the output voltage Vign of the ignition switch 3 input via the I / O port 11. In addition, a control signal Sro for turning on the relay switch 40 is output via the I / O port 11, thereby bypassing the ignition switch 3 and supplying power from the in-vehicle battery 2 to the power supply circuit 30. When the CPU 12 detects that the ignition switch 3 is turned off and determines that the time counted by a built-in timer (not shown) has reached a predetermined time, the CPU 12 turns the relay switch 40 off. By outputting the control signal Sro to be performed, the power supply to the power supply circuit 30 and the power supply to the main microcomputer 10 and the sub-microcomputer 20 are cut off by itself.

  The CPU 12 performs a self-diagnosis process on whether or not the function state of the main microcomputer 10 is abnormal at a predetermined timing during the execution of the steady process, and transmits self-diagnosis information as a result of the self-diagnosis process to the communication I / F 14. And transmitted to the sub-microcomputer 20 via the communication line CL and temporarily stored in the RAM 13 via the internal bus 16.

  In the self-diagnosis process, when the CPU 12 performs a self-diagnosis that the function state of the main microcomputer 10 is normal, the relay switch 40 is turned off by the self-shut off function after the off operation of the ignition switch 3 is detected. In the self-shutoff period until the time, the failure diagnosis information and learning data of the engine 4 and the self-diagnosis information of the main microcomputer 10 temporarily stored in the RAM 13 are written as backup data in the EEPROM 15 (normal writing).

  On the other hand, in the self-diagnosis process, when the CPU 12 diagnoses that the function state of the main microcomputer 10 is abnormal, the CPU 12 stops and initializes the main microcomputer 10 according to the signal from the sub-microcomputer 20. Then, after initialization, the main microcomputer 10 is forcibly activated in accordance with a signal from the sub-microcomputer 20, and performs an abnormal time process that restricts the operation of various actuators attached to the engine 4 without performing a steady process. Further, the main microcomputer 10 performs an abnormal time writing process in which the information temporarily stored in the RAM 13 is written into the EEPROM 15 at a timing different from the normal time writing during the time during which the main microcomputer 10 is forcibly operating (forced operating time). .

  The EEPROM 15 stores in advance a control processing program for performing various control processes including a steady process, an abnormal process, a self-diagnosis process, and an abnormal write process, and the CPU 12 appropriately reads the control process program from the EEPROM 15 to the RAM 13. Various control processes are performed by executing. Note that the control processing program may be stored in a ROM (Read Only Memory) different from the EEPROM 15.

(Sub microcomputer)
As with the main microcomputer 10, the sub-microcomputer 20 includes a CPU 21, a RAM 22, a ROM 23, and a communication I / F 24 that are interconnected by an internal bus 25.

  The ROM 23 stores a monitoring program for monitoring the functional state of the main microcomputer 10 in advance, and the CPU 21 reads the monitoring program from the ROM 23 to the RAM 22 via the internal bus 25 and executes it to execute the communication I / F 24. The function status of the main microcomputer 10 is monitored based on the self-diagnosis information of the main microcomputer 10 received via When the CPU 21 detects that an abnormality has occurred in the functional state of the main microcomputer 10, the CPU 21 stops the main microcomputer 10 to perform initialization, and then causes the main microcomputer 10 to perform a writing process to the EEPROM 15 when there is an abnormality. In order to perform this, various signals are transmitted to the main microcomputer 10 via the communication I / F 24.

(Supervisor microcomputer monitoring process)
2 is executed when the sub-microcomputer 20 is activated (see time t1 in FIG. 3) when the CPU 21 of the sub-microcomputer 20 is activated according to the monitoring program by turning on the ignition switch 3 (see time t0 in FIG. 3). It is a flowchart of the monitoring process to start.

  In step S101 (abbreviated as “S101” in the figure, the same applies hereinafter), whether or not an abnormality has occurred in the main microcomputer 10 is detected based on self-diagnosis information obtained by self-diagnosis processing of the main microcomputer 10. If it is detected that an abnormality has occurred in the main microcomputer 10, the process proceeds to step S102 (Yes). On the other hand, if it is detected that no abnormality has occurred in the main microcomputer 10, the process proceeds to step S106 (No).

  In step S102, a stop request signal for requesting stop of the main microcomputer 10 is transmitted (see times t3 to t8 in FIG. 3). This signal is continuously transmitted until the power supply to the sub-microcomputer 20 is cut off (see time t8 in FIG. 3).

  In step S103, the sub-microcomputer 20 is configured to forcibly start the main microcomputer 10 when a time elapses from when the stop request signal is transmitted until it can be determined that the initialization of the main microcomputer 10 has ended. A forced activation command signal is transmitted to the main microcomputer 10 (see time t5 in FIG. 3).

  In step S104, it is determined whether or not the time elapsed since the transmission of the forced activation command signal, that is, the forced operation time has reached the set time T.

  The set time T is a time necessary for writing the function status flag information stored in the RAM 13 in step S305 of FIG. 5 to be described later to the EEPROM 15 as backup data. In addition, in step S305 of FIG. 5 described later, in addition to writing the function state flag information to the EEPROM 15, the failure diagnosis processing and learning control processing of the engine 4 in the steady processing is executed, and the failure diagnosis information and learning data are obtained. When the data is stored in the RAM 13 or when self-diagnosis is performed, the set time T is set longer depending on the execution time of each process, the time for writing information and data, the time required for self-diagnosis, and the like. .

  If it is determined in step S104 that the forced operation time has reached the set time T, the process proceeds to step S105 (Yes), while if the forced operation time has not reached the set time T, step S104 is repeated. (No).

  In step S105, a forced stop command signal for forcibly stopping the main microcomputer 10 is transmitted (see time t6 in FIG. 3).

  In step S106, it is determined whether or not the ignition switch 3 is turned off. If it is determined that the ignition switch 3 is turned off, the monitoring process is terminated (Yes). On the other hand, if it is determined that the ignition switch 3 is not turned off, the process returns to step S101. It is detected whether or not an abnormality has occurred in the main microcomputer 10 (No).

(Steady processing and abnormal processing in the main microcomputer)
FIG. 4 is a flowchart of a steady process and an abnormal process in which the CPU 12 of the main microcomputer 10 starts execution in response to the activation of the main microcomputer 10 (time t1 or t5 in FIG. 3) according to the control processing program.

  In step S201, it is determined whether or not a stop request signal transmitted from the sub-microcomputer 20 is received via the communication I / F 14. By determining whether or not the stop request signal has been received, as will be described later, the main microcomputer 10 is initialized by performing a self-diagnosis that makes the functional state abnormal, and is forced by the sub-microcomputer 20 after the initialization. It can be determined whether or not If it is determined that the stop request signal has not been received, the function state of the main microcomputer 10 is normal, and thus the process proceeds to step S202 to perform self-diagnosis processing (No), while the stop request signal has been received. If it is determined, the function state of the main microcomputer 10 may be abnormal, so the process proceeds to step S204 (Yes).

  In step S202, the above-described steady process is performed. That is, the CPU 12 performs an engine control process, and performs a failure diagnosis process and a learning control process for the engine 4 at a predetermined timing in the engine control process. Failure diagnosis information and learning data obtained by the failure diagnosis processing and learning control processing of the engine 4 are temporarily stored in the RAM 13.

  In step S203, it is determined whether or not the ignition switch 3 is turned off (see time t7 in FIG. 3). Specifically, the output voltage Vign is compared with the threshold voltage based on the detection signal of the output voltage Vign of the ignition switch 3 input via the I / O port 11, whereby the ignition switch 3 is switched. It is determined whether or not an off operation has been performed.

  When it is determined that the ignition switch 3 is turned off, the steady process is terminated (Yes). On the other hand, when it is determined that the ignition switch 3 is not turned off, the process returns to step S202 to continue the steady process (No).

  In step S204, the process at the time of abnormality which restrict | limits operation | movement of the various actuators accompanying the engine 4 is performed without performing a steady process (refer the time t5-t6 of FIG. 3). The operation of the various actuators associated with the engine 4 is limited because the main microcomputer 10 detects the occurrence of an abnormality by the self-diagnosis process. This is because the actuator may cause an unstable operation and affect the vehicle operation.

  As a mode for restricting the operations of the various actuators, the operations of the various actuators can be stopped, for example, by forcibly ending the steady process.

  As another mode for restricting the operation of various actuators, for example, the output of a control signal according to a control amount calculated by a calculation method different from a steady process when the main microcomputer 10 is normal or a control amount limited to a predetermined value Thus, the operation of various actuators can be suppressed.

  For example, the control amount of the fuel injection valve (solenoid valve) is calculated by a calculation method different from that when the main microcomputer 10 is normal or limited to a predetermined value, and a control signal corresponding to the control amount is output, thereby generating fuel. The fuel injection amount injected from the injection valve may be suppressed. For example, when the engine 4 includes a variable compression ratio system (VCR), an electric actuator that changes the top dead center position of the piston is fixed at an initial position, or the electric actuator The amount of change may be intentionally limited. Furthermore, for example, when the main microcomputer 10 is communicating with an actuator controller (EDU) that controls the electric actuator, the communication is stopped or a value determined to be a communication abnormality is transmitted to the EDU side. You may make it recognize that it became abnormal.

  In step S205, when the forced stop command signal transmitted from the sub-microcomputer 20 is received via the communication I / F 14 (see time t6 in FIG. 3), the abnormality process is terminated (Yes). On the other hand, if the forced stop command signal has not been received, the process returns to step S204 to continue the abnormal process (No).

(Main microcomputer self-diagnosis processing)
FIG. 5 is a flowchart of the self-diagnosis process in which the CPU 12 of the main microcomputer 10 starts execution in response to the activation of the main microcomputer 10 (time t1 or t5 in FIG. 3) according to the control processing program.

  In step S301, it is determined whether or not a stop request signal described later transmitted from the sub-microcomputer 20 has been received via the communication I / F 14. By determining whether or not the stop request signal has been received, after the main microcomputer 10 is self-diagnosed and initialized as abnormal, as in step S201 of FIG. It can be determined whether or not. If it is determined that the stop request signal has not been received, the main microcomputer 10 has not been forcibly activated, and the process proceeds to step S302 to perform self-diagnosis processing (No). On the other hand, if it is determined that the stop request signal has been received, the main microcomputer 10 has already performed a self-diagnosis that the abnormality has occurred, and thus the process ends without performing the self-diagnosis process (Yes).

  In step S302, a self-diagnosis process is performed for the functional state of the main microcomputer 10 at a predetermined timing. If it is diagnosed by the self-diagnosis process that there is no abnormality in the functional state of the main microcomputer 10, the process proceeds to step S303 (No), and if it is diagnosed that the function state of the main microcomputer 10 is abnormal, the process proceeds to step S306 (Yes). ).

  In step S <b> 303, self-diagnosis information indicating that the function state of the main microcomputer 10 is normal is transmitted to the sub-microcomputer 20 and written to the RAM 13. Of the self-diagnosis information written in the RAM 13, the function status flag indicating the function status of the main microcomputer 10 is held at an initial value (eg, 0) indicating normal.

  In step S304, it is determined whether or not the ignition switch 3 is turned off as in step S203 of FIG. If it is determined that the ignition switch 3 has been turned off, the process proceeds to step S305 to perform normal writing in the self-shutoff period (period t7 to t8 in FIG. 3) (Yes). On the other hand, if it is determined that the ignition switch 3 is not turned off, the process returns to step S302, and self-diagnosis processing is performed again at a predetermined timing (No).

  In step S305, the failure diagnosis information and learning data of the engine 4 and the self-diagnosis information of the main microcomputer 10 temporarily stored in the RAM 13 are written as backup data in the EEPROM 15 as normal writing during the self-shutoff period. The self-diagnosis process is terminated.

  In step S306, self-diagnosis information indicating that the function state of the main microcomputer 10 is abnormal is transmitted to the sub-microcomputer 20 and written in the RAM 13 (see times t2 to t3 in FIG. 3). Of the self-diagnosis information written in the RAM 13, the function status flag is rewritten to a set value (for example, 1) indicating abnormality.

  In step S307, as in step S201 of FIG. 4, it is determined whether or not a stop request signal described later transmitted from the sub-microcomputer 20 is received via the communication I / F 14. If it is determined that the stop request signal has been received, the process proceeds to step S308 (Yes). On the other hand, if it is determined that the stop request signal has not been received, step S307 is repeated (No).

  In step S308, the main microcomputer 10 is stopped and initialized in accordance with the stop request signal from the sub-microcomputer 20 in order to return to the normal state (see time t4 in FIG. 3). However, the main microcomputer 10 stopped by the execution of this step is in a communicable state so that a forced start command signal described later can be received from the sub-microcomputer 20.

  By the initialization of step S308, the failure diagnosis information and learning data of the engine 4 written in the RAM 13 by the steady process in step S202 of FIG. 4 described above, and the self-diagnosis information written in the RAM 13 in steps S303 and S306 are as follows. It will be erased. In particular, since the function state flag once rewritten to the set value indicating abnormality in step S306 is rewritten to the initial value (eg, 0) again in step S308, the main microcomputer 10 indicates the function state flag to indicate abnormality. The set value cannot be held in the RAM 13, and information that an abnormality has occurred in the main microcomputer 10 cannot be held in the EEPROM 15 as backup data during the self-shutoff period. For this reason, at least information indicating that an abnormality has occurred in the main microcomputer 10 can be written into the EEPROM 15 as backup data by executing the following writing process at the time of abnormality.

(Write processing when the main microcomputer is abnormal)
FIG. 6 shows an abnormality in which the CPU 12 of the main microcomputer 10 starts executing according to the control processing program when the main microcomputer 10 receives the above-described forced activation command signal from the sub-microcomputer 20 (see time t5 in FIG. 3). It is a flowchart of a time writing process.

  In step S401, the main microcomputer 10 is activated according to the forced activation command signal (see time t5 in FIG. 3). Since the main microcomputer 10 is activated by the sub-microcomputer 20 in step S401, when the execution of the process of FIG. 4 is started, not the steady process (step S202) but the abnormal process (step S204). Is done. As a result, when writing to the EEPROM 15 is performed as will be described later, the possibility that various actuators associated with the engine 4 perform unstable operations and affect vehicle operation is reduced.

  In step S402, as the main microcomputer 10 is activated, the function state flag indicating the function state of the main microcomputer 10 is automatically rewritten from the initial value to a set value indicating abnormality (see time t5 in FIG. 3).

  Since the CPU 12 of the main microcomputer 10 starts the main microcomputer 10 after receiving the forced start command signal transmitted from the sub-microcomputer 20 in step S401, the CPU 12 is not normally started by turning on the ignition switch 3. And the function status flag can be automatically rewritten from the initial value to a set value indicating abnormality.

  In step S403, the function status flag information automatically rewritten to the set value indicating abnormality in step S402 is written in the EEPROM 15 as backup data (see times t5 to t6 in FIG. 3). As a result, the main microcomputer 10 can retain at least information that an abnormality has occurred in the main microcomputer 10 as an abnormality history.

  In step S404, if a later-described forced stop command signal transmitted from the sub-microcomputer 20 is received, the process proceeds to step S405 (Yes). On the other hand, if the forced stop command signal has not been received, the process returns to step S403 (No).

  In step S405, the main microcomputer 10 stops according to the forced stop command signal, and ends the abnormal time writing process (see time t6 in FIG. 3). When the main microcomputer 10 is stopped, the setting value of the function state flag stored in the RAM 13 of the main microcomputer 10 is initialized again.

  In step 403, the RAM 13 stores information on the function state flag automatically rewritten to the set value indicating abnormality in step S402, and the failure of the engine 4 erased by the initialization in step S308 of FIG. Diagnostic information and learning data are not stored. However, in step S403, the failure diagnosis information and learning data may be stored in the RAM 13 by executing the failure diagnosis processing and learning control processing of the engine 4 in the steady operation during the forced operation time of the main microcomputer 10. . In this case, not only information that an abnormality has occurred in the main microcomputer 10 but also failure diagnosis information and learning data can be written from the RAM 13 to the EEPROM 15.

  In step S403, after the information that at least an abnormality has occurred in the main microcomputer 10 is written in the EEPROM 15 during the forced operation time of the main microcomputer 10, the self-diagnosis process of the main microcomputer 10 can be performed again.

  When the function status of the main microcomputer 10 is diagnosed again as abnormal by the self-diagnosis process, the main microcomputer 10 temporarily stores the self-diagnosis information including the function status flag information in the RAM 13 and then stores it in the EEPROM 15 as backup data. By writing, not only the presence / absence of abnormality of the main microcomputer 10 but also information regarding the abnormality mode can be held as an abnormality history.

  On the other hand, the main microcomputer 10 ends the abnormal writing process when the function state of the main microcomputer 10 is diagnosed as normal by the self-diagnosis process, and resumes the execution from step S303 in the self-diagnosis process of FIG. 4 can be terminated and the steady process of step S202 can be executed. The sub-microcomputer 20 receives the self-diagnosis information indicating that it is normal from the main microcomputer 10 and stops the transmission of the stop request signal.

(Processing when the ignition switch is turned on again)
After the ignition switch 3 is turned off at time t7 in FIG. 3, when the ignition switch 3 is turned on again at time t9, the main microcomputer 10 and the sub-microcomputer 20 are activated at time t10. Here, since the EEPROM 15 of the main microcomputer 10 holds the self-diagnosis information indicating that an abnormality has occurred in the main microcomputer 10 in step S403 of FIG. Based on the self-diagnosis information, the operation of various actuators attached to the engine 4 is stopped or limited without performing steady processing.

  Further, when the ignition switch 3 is turned on again at time t9 and is activated at time t10, the CPU 12 of the main microcomputer 10 refers to the self-diagnosis information held in the EEPROM 15 and analyzes the abnormality of the main microcomputer 10. .

  According to such an automotive electronic control device 1, even when the main microcomputer 10 is stopped and initialized due to an abnormality of the main microcomputer 10, the sub-microcomputer 20 that monitors the abnormality of the main microcomputer 10 after the initialization is provided. While the main microcomputer 10 is forcibly activated, the function state flag stored in the RAM 13 is automatically rewritten to a set value indicating abnormality. Thereby, at least information that an abnormality has occurred in the main microcomputer 10 can be written in the EEPROM 15. Therefore, since the electronic control apparatus 1 for automobiles can hold at least information that an abnormality has occurred in the main microcomputer 10 in the EEPROM 15 as an abnormality history, the abnormality analysis accuracy of the main microcomputer 10 can be improved. Become.

  Further, during the forced operation time of the main microcomputer 10, when executing the failure diagnosis process and the learning control process of the engine 4 among the steady processes, or when performing the self-diagnosis, the main microcomputer 10 displays the failure diagnosis information. Further, learning data and information related to the abnormal state of the main microcomputer 10 can also be stored in the EEPROM 15 as a history.

  Further, after the initialization, when the sub microcomputer 20 forcibly starts the main microcomputer 10, the operation of various actuators by the steady process of the main microcomputer 10 is limited, so that writing to the EEPROM 15 is performed during the forced operation time. However, the possibility of affecting vehicle driving can be reduced.

  In the above-described embodiment, the present invention can be applied even if the sub-microcomputer 20 is replaced with an application specific integrated circuit (ASIC) for monitoring the functional state of the main microcomputer 10.

[Second Embodiment]
FIG. 7 shows an example of an automotive electronic control device according to the second embodiment of the present invention. In addition, about the structure which is common in 1st Embodiment, description is abbreviate | omitted or simplified by attaching | subjecting the same code | symbol.

  The automotive electronic control device 1 of the first embodiment includes the sub-microcomputer 20 that monitors the functional state of the main microcomputer 10, but instead of this, in the automotive electronic control device 1A of the second embodiment, the sub-microcomputer 20 One microcomputer 10A in which the microcomputer 20 is omitted is provided, and this μ computer is different in that it is a multi-core having a plurality of cores, for example, a first core 12a and a second core 12b.

  As with the main microcomputer 10, the first core 12a performs steady processing, self-diagnosis processing, and writing processing when power is supplied to the microcomputer 10A by turning on the ignition switch 3 (FIGS. 2 to 2). 5). Similar to the sub-microcomputer 20, the second core 12b starts a monitoring process for monitoring the functional state of the first core 12a when power is supplied to the microcomputer 10A by turning on the ignition switch 3 ( (See FIG. 5).

  That is, the first core 12a performs a self-diagnosis on the function state, and when it is diagnosed as abnormal, transmits to the second core via the internal bus 16, and the second core 12b stops the first core 12a and initializes it. To do. After initialization, the second core 12b forcibly activates the first core 12a and automatically rewrites the function state flag stored in the RAM 13 to a set value indicating abnormality. Thereby, information that an abnormality has occurred in at least the first core 12a can be written in the EEPROM 15.

  According to such an automotive electronic control device 1A, even when the first core 10a is stopped and initialized due to an abnormality in the first core 10a, information indicating that an abnormality has occurred in at least the first core 10a is stored in the EEPROM 15 Can be written to. Therefore, the electronic control apparatus for an automobile 1A can retain at least information that an abnormality has occurred in the first core 10a in the EEPROM 15 as an abnormality history, so that the abnormality analysis accuracy of the main microcomputer 10 can be improved. It becomes.

  Similarly to the first embodiment, when the failure diagnosis process and the learning control process of the engine 4 are executed during the forced operation time of the first core 10a, or when the self-diagnosis is performed. The microcomputer 10A can also store failure diagnosis information and learning data, and information related to the abnormal state of the microcomputer 10A in the EEPROM 15 as a history.

  Further, as in the first embodiment, after the initialization, when the second core 10b forcibly activates the first core 10a, the operation of various actuators by the steady process of the first core 10a is limited. Even if writing to the EEPROM 15 is performed during the operation time, the possibility of affecting the vehicle operation can be reduced.

  In the first and second embodiments, the EEPROM 15 has been described as an example of a nonvolatile memory that can be electrically rewritten and retains stored information even when the power is turned off. A memory may be used, and these EEPROM 15 or flash memory may be either built in or external to the main microcomputer 10.

  In the first and second embodiments, the CPUs 12 and 21 are a concept including a processor, a microprocessor, and an MPU (Micro Processing Unit), and the main microcomputer 10 and the sub-microcomputer 20 are a concept including an MCU (Microcontroller). is there.

  In the first embodiment and the second embodiment, even if the ignition switch is turned off during the forced operation time, power is supplied to the main microcomputer 10 or the microcomputer 10A during the self-shutoff period. Therefore, writing to the EEPROM may be performed continuously during the self-shutoff period.

  In the first embodiment and the second embodiment, when writing is performed at the time of abnormality, it is not necessary to write to the EEPROM 15 during the self-shutoff period, so that the self-shutoff function can be invalidated.

  In the first embodiment, the diagnosis of the functional state of the main microcomputer 10 is not limited to the self-diagnosis process of the main microcomputer 10 as described above. For example, the result of a predetermined arithmetic process performed in the main microcomputer 10 and the sub-microcomputer 20 is performed. The main microcomputer 10 and the sub-microcomputer 20 can cooperate with each other, such as whether or not they match. Similarly, in the second embodiment, the diagnosis of the functional state of the first core 12a can be performed in cooperation with the first core 12a and the second core 12b.

  In the first embodiment, the self-shutoff function detects a detection signal Svi of the output voltage Vign of the ignition switch 3 to a device different from the main microcomputer 10 (for example, the sub-microcomputer 20). Even if it is configured to output a control signal Sro for turning on or off the relay switch 40 based on the signal Svi, the present invention can be realized.

  In the first embodiment, the main microcomputer 10 that has received the forced start command signal from the sub-microcomputer 20 is forcibly started at time t5 in FIG. 3 until the forced stop command signal is received and operation is stopped at time t6. During the forced operation time, self-diagnosis information indicating that an abnormality has occurred in the main microcomputer 10 was written in the EEPROM 15. However, when the main microcomputer 10 repeatedly performs the self-diagnosis process after the first forced operation time ends and the sub-microcomputer 20 transmits a stop request signal to the main microcomputer 10 every time it is diagnosed that an abnormality has occurred. In this case, self-diagnosis information indicating that an abnormality has occurred in the main microcomputer 10 is written in the EEPROM 15 every forced operation time.

  Therefore, when the main microcomputer 10 diagnoses that an abnormality has occurred by the self-diagnosis process and transmits the self-diagnosis information to that effect to the sub-microcomputer 20, the sub-microcomputer 20 stores the self-diagnosis information in the RAM 22 and provides an ignition. The main microcomputer 10 may write the self-diagnosis information in the EEPROM 15 by transmitting the self-diagnosis information stored in the RAM 22 of the sub-microcomputer 20 to the main microcomputer 10 during the self-shutoff period after the switch 3 is turned off. As a result, a stable write operation can be performed without affecting other in-vehicle devices.

  DESCRIPTION OF SYMBOLS 1 ... Electronic control apparatus for motor vehicles, 2 ... Vehicle-mounted battery, 3 ... Ignition switch, 4 ... Engine, 10, 10A ... Main microcomputer, 12 ... CPU, 12a ... 1st core, 12b ... 2nd core, 13 ... RAM, 15 ... EEPROM, 20 ... Sub-microcomputer, 30 ... Power supply circuit, 40 ... Relay switch

Claims (4)

A control means having a volatile memory and controlling the in-vehicle actuator;
Monitoring means for monitoring the control means, and stopping the control means to perform initialization when an abnormality occurs in the control means;
Power supply control means for continuing power supply to the control means and the monitoring means until a predetermined time elapses after detecting the ignition switch OFF operation;
A rewritable nonvolatile memory in which data of the volatile memory is written during the predetermined time;
With
The monitoring means, after stopping the control means and performing initialization, forcibly activates the control means, and writes at least information that an abnormality has occurred in the control means to the nonvolatile memory An electronic control device for automobiles.   2. The electronic control apparatus for an automobile according to claim 1, wherein the control means performs control for restricting the operation of the in-vehicle actuator when the monitoring means forcibly starts up.   The control means automatically writes the information in the volatile memory and writes the information from the volatile memory to the nonvolatile memory when the control means is forcibly activated by the monitoring means. The electronic control device for automobiles according to claim 1 or claim 2.   The control means performs a fault diagnosis of the in-vehicle actuator while being forcibly activated by the monitoring means, and writes diagnostic information based on the fault diagnosis in the nonvolatile memory. The electronic control apparatus for motor vehicles as described in any one of Claims 1-3.