JP2023122184A - electronic controller - Google Patents

Abstract

To provide an electronic controller which can appropriately diagnose a reset signal line, even with a configuration that there are two circuits which monitor operation of a microcomputer.SOLUTION: A main microcomputer 2 diagnoses a first reset signal line 7 by using the change of an ignition switch of a vehicle to an OFF state as a trigger. A monitoring IC 4 and a sub microcomputer 3 drive the first reset signal line 7 to first and second low levels different from each other by first and second low level driving circuits 15 and 32, respectively, when an anomaly occurs in the main microcomputer 2. The main microcomputer 2 causes the monitoring IC 4 to recognize occurrence of the anomaly during a diagnosis period of the first reset signal line 7, and when an own reset state is cancelled, diagnoses the first reset signal line 7 depending on a low level value held in a first storage unit 18.SELECTED DRAWING: Figure 1

Description

The present invention relates to an electronic control device comprising a microcomputer and first and second monitoring circuits for diagnosing a reset signal line connected to the microcomputer.

For example, in an electronic control device such as an ECU (Electronic Control Unit) that controls a vehicle, a microcomputer inside the device; Patent Document 1 discloses an example of diagnosing a reset signal line connected to the microcomputer. . In this patent document 1, during normal operation, when a pulse signal output by a microcomputer deviates from a predetermined cycle, a watchdog timer; Input the reset signal. During failure diagnosis, the microcomputer outputs a pseudo-abnormality signal to the monitoring IC, drives the reset signal to a level at which the microcomputer does not reset, and diagnoses the operation of the reset signal line.

JP-A-2003-140779

Here, in a configuration having a monitor IC in addition to a main microcomputer and a sub-microcomputer, it is assumed that the reset signal line is diagnosed while the main microcomputer is being monitored by both the sub-microcomputer and the monitor IC. Then, when the monitoring IC diagnoses the reset signal line of the microcomputer, it is assumed that the sub-microcomputer may detect some trouble and issue a set signal at the timing at which the reset signal is to be issued. In this case, even if the reset signal cannot be issued because the reset output of the monitoring IC is faulty, the reset signal issued by the sub-microcomputer is input to the main microcomputer, so the main microcomputer seems to be operating correctly. It looks like Therefore, there is a problem that the failure of the reset output function on the monitoring IC side cannot be known. Since Patent Document 1 assumes that there is one IC that monitors the microcomputer, the same problem occurs when applied to the configuration assumed as described above.

As a countermeasure for the above problem, there is a method of intentionally stopping the issuance of the reset signal by the sub-microcomputer and issuing the reset signal from the monitoring IC for diagnosis. However, in the electronic control unit mounted on the vehicle, if the issuance of the reset signal is stopped during non-diagnosis due to the influence of vehicle noise or the like while the vehicle is running, the sub-microcomputer cannot reset the main microcomputer during that time.

Further, in the case of Patent Document 1, a circuit such as a switch is mounted in the middle to perform diagnosis while disconnecting from the reset signal line in order to perform control so that the reset is not applied at the time of diagnosis. Since it is necessary to separately check whether there is a failure, it is necessary to add diagnostics.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and its object is to provide an electronic control device capable of appropriately diagnosing a reset signal line even in a configuration having two circuits for monitoring the operation of a microcomputer. to do.

According to the electronic control device of claim 1, the first monitoring circuit monitors the operation of the microcomputer, and the second monitoring circuit mutually monitors the operation of the microcomputer. The reset signal line is commonly connected to reset terminals of the microcomputer and the first monitoring circuit, and is pulled up by a pull-up element.

The first and second monitoring circuits drive the reset signal line to first and second low levels different from each other by the first and second low level driving circuits, respectively, when an abnormality occurs in the microcomputer. The microcomputer causes the first monitoring circuit to recognize the occurrence of an abnormality during the diagnostic period of the reset signal line, and resets according to the low level value held in the level holding circuit when the reset state of the microcomputer is released. Diagnose the signal line. Both the first and second low levels are levels below the threshold at which the microcomputer enters a reset state.

With this configuration, the microcomputer; if the first monitoring circuit appropriately recognizes an abnormality intentionally caused by the microcomputer during the diagnosis period, the reset signal line is set to the first low level to reset the microcomputer. drive. As a result, the level holding circuit holds the first low level value. Then, if the microcomputer is reset by the second monitoring circuit at the timing when the first monitoring circuit resets, the level holding circuit holds a value obtained by synthesizing the first and second low levels. Thereby, the microcomputer can confirm whether or not the first monitoring circuit is operating properly.

According to the electronic control device of claim 2, each of the first and second low-level drive circuits includes a series circuit of a switch circuit and a resistance element connected between the reset signal line and the ground. The resistance values of the elements are set to values different from each other. With this configuration, the first and second low levels can be easily set by selecting resistance values.

1 is a functional block diagram showing the configuration of an electronic control unit according to the first embodiment; FIG. Flowchart showing processing contents centered on the main microcomputer Timing chart showing when the function of the monitoring IC is normal and when the sub-microcomputer resets at the same timing and when it does not Timing chart showing a case where the function of the monitoring IC is abnormal and the sub-microcomputer resets at the timing when the monitoring IC wants to reset. Timing chart showing the case where the function of the monitoring IC is abnormal and the sub-microcomputer does not reset at the timing when the monitoring IC wants to reset. FIG. 2 is a functional block diagram showing the configuration of an electronic control unit according to a second embodiment; Flowchart showing processing contents centered on the main microcomputer Timing chart showing a case where the functions of the monitoring IC and the sub-microcomputer are both normal Timing chart showing when the function of the monitoring IC is normal and the function of the sub-microcomputer is abnormal Timing chart showing a case where the function of the monitoring IC is abnormal and the function of the sub-microcomputer is normal Timing chart showing a case where the functions of the monitoring IC and the sub-microcomputer are both abnormal

(First embodiment)
As shown in FIG. 1, an electronic control unit 1 mounted on a vehicle includes a main microcomputer 2, a sub-microcomputer 3, and a monitoring IC 4. As shown in FIG. It should be noted that only the parts related to the gist of the present embodiment are shown for these configurations. The main microcomputer 2, the sub-microcomputer 3, and the monitoring IC 4 each perform SPI (Serial Peripheral Interface) communication. A reset input terminal 5 of the main microcomputer 2 and a reset input/output terminal 6 of the monitor IC 4 are connected by a first reset signal line 7, and the first reset signal line 7 is pulled up to the power supply VDD by a resistance element 8. ing.

The monitoring IC 4 has a WD pulse detection & judgment section 9 which is a watchdog timer, and the main microcomputer 2 has a WD pulse output section 10 . The WD pulse output unit 10 periodically outputs a clear signal for clearing the timer of the WD pulse detection & determination unit 9 as a WD pulse to the monitor IC 4 . The WD pulse detection & determination unit 9 determines abnormality of the main microcomputer 2 when the timer counts up after the input of the WD pulse is stopped, and outputs an abnormality determination signal to the MOS control unit 11 .

Inside the monitoring IC 4, a series circuit of a resistance element 12, an N-channel MOSFET 13, and a resistance element 14 having a resistance value Ra is connected between the power supply VDD and the ground. A drain of the FET 13, which is an example of a switch circuit, is connected to the reset input/output terminal 6. FIG. The output terminal of the MOS control section 11 is connected to the gate of the FET 13, and the MOS control section 11 drives the gate to high level when the abnormality determination signal is input. The MOS control section 11 to the resistance element 14 constitute a first low level drive circuit 15 .

A voltage monitor terminal 16 of the monitor IC 4 is connected to the first reset signal line 7 and an internal voltage monitor section 17 . The voltage monitor unit 17 is composed of an A/D converter or a combination of a plurality of comparators, and detects the voltage when the potential of the first reset signal line 7 changes to low level. The detected voltage value is stored in the first storage section 18 corresponding to the level holding circuit.

In the main microcomputer 2, the abnormality determination section 21 can read the contents of the first storage section 18 of the monitoring IC 4 through SPI communication. The WD pulse stop instruction section 22 outputs a “WD pulse stop instruction” to the WD pulse output section 10 . Although not shown, the WD pulse output unit 10 outputs a WD pulse via, for example, an AND gate, and enables output when the "WD pulse stop instruction" is at low level. When the "WD pulse stop instruction" changes to a valid high level, the output of the WD pulse is stopped.

The event that the “WD pulse stop instruction” is output is stored in the second storage unit 23 . The second storage unit 23 is a 1-bit storage element configured by, for example, a flip-flop, and is triggered by the rising edge of the "WD pulse stop instruction". Abnormality determination unit 21 reads the contents of second storage unit 23 .

A reset output terminal 24 of the main microcomputer 2 and a reset input terminal 25 of the sub-microcomputer 3 are connected by a second reset signal line 26 , and the main microcomputer 2 outputs a reset signal to the sub-microcomputer 3 . A reset control terminal 27 of the sub-microcomputer 3 is connected via a resistance element 28 to the base of an NPN transistor 29, which is an example of a switch circuit. The transistor 29 has a collector connected to the first reset signal line 7 and an emitter connected to the ground via a resistance element 30 having a resistance value Rb. A resistance element 31 is connected between the base and the emitter. Resistive elements 28 to 31 constitute a second low-level drive circuit 32 .

The sub-microcomputer 3 monitors the operation of the main microcomputer 2 based on the content of the SPI communication performed with the main microcomputer 2, and when it determines that the operation is abnormal, it sets the reset control terminal 27 to a high level and sets the transistor 29 to a high level. to ON. Thereby, the main microcomputer 2 is reset. Although not shown, the main microcomputer 2 also incorporates a watchdog timer that monitors the operation of the sub-microcomputer 3, and the sub-microcomputer 3 outputs a WD pulse to the main microcomputer 2 to clear the watchdog timer. When the watchdog timer overflows, the main microcomputer 2 drives the reset output terminal 24 to low level to reset the sub-main 3 .

Here, assuming that the resistance values of the pull-up resistor elements 8 and 12 are equal, the potential of the first reset signal line 7 when the MOS control unit 11 of the monitoring IC 4 turns on the FET 13 has a value corresponding to the resistance value Ra. VRa. The potential VRa corresponds to the first low level. Also, the potential of the first reset signal line 7 when the sub-microcomputer 3 turns on the transistor 29 becomes a value VRb corresponding to the resistance value Rb. The potential VRb corresponds to the second low level. The first and second low levels are set below the level at which the active low reset of the main microcomputer 2 is enabled.

Next, the operation of this embodiment will be described. As shown in FIGS. 3 to 5, the state of the main microcomputer 2 is the ignition switch of the vehicle; while the IG-SW is ON, it is in the normal operation mode, and when the IG-SW is OFF, it shifts to the diagnosis mode. . 3 corresponds to the case where the monitoring IC 4 is normal, and FIGS. 4 and 5 correspond to the cases where the monitoring IC 4 is abnormal and the behavior of the sub-microcomputer 3 is different.

As shown in FIG. 2, when the IG-SW is turned off (S1), the WD pulse stop instructing section 22 of the main microcomputer 2 outputs "WD pulse stop instruction". This operation is referred to as "abnormal injection" in FIGS. Then, the output of the WD pulse is stopped, and the above output information is stored in the second storage section 23 (S2). As a result, when the timer of the WD pulse detection & determination unit 9 overflows, the MOS control unit 11 turns on the FET 13 for a certain period of time. At this time, the monitoring result of the voltage monitor section 17 is stored in the first storage section 18 (S3). If necessary, the first storage unit 18 may store the abnormality determination signal as a trigger.

If the main microcomputer 2 is reset by the action of the monitor IC 4 (S4; No), the reset is canceled and the main microcomputer 2 is restored (S5). Then, the main microcomputer 2 confirms the contents stored in the first and second storage units 18 and 23 (S6). As a result, if the second storage unit 23 stores the “WD pulse stop instruction” and the first storage unit 18 stores the potential VRa (S7; No), The partial function is determined to be normal (S8). After that, when the main relay of the vehicle is turned off and the power supply to the electronic control unit 1 is cut off, the diagnosis mode is canceled and the operation is terminated (S10).

Here, as shown in FIG. 3, when the sub-microcomputer 3 resets the main microcomputer 2 at the same timing as the monitor IC 4 and the transistor 29 is turned on, the potential of the first reset signal line 7 changes to the resistance value Ra and It becomes a potential VRab corresponding to the parallel resistance value of Rb. This potential VRab is also set to a low level enabling resetting of the main microcomputer 2 . Also in this case, it is judged as "No" in step S7.

As shown in FIG. 4, even if the main microcomputer 2 stops outputting the WD pulse, if the monitor IC 4 does not turn on the FET 13 and the sub-microcomputer 3 turns on the transistor 29, the potential in the first storage unit 18 is Since VRb is stored (S7; Yes), it is determined that the function of the portion related to the first reset signal line 7 is abnormal (S9). Further, as shown in FIG. 5, unless the sub-microcomputer 3 turns on the transistor 29, the main microcomputer 2 is not reset (S4; Yes), and the process proceeds to step S9.

As described above, according to the present embodiment, in the electronic control unit 1, the monitoring IC 4 monitors the operation of the main microcomputer 2, and the sub-microcomputer 3 and the main microcomputer 2 monitor each other's operations. A first reset signal line 7 is commonly connected to reset terminals 5 and 6 of the main microcomputer 2 and the monitor IC 4 and pulled up to the power supply VDD. The main microcomputer 2 diagnoses the first reset signal line 7 when the ignition switch of the vehicle is turned off.

When an abnormality occurs in the main microcomputer 2, the monitoring IC 4 and the sub-microcomputer 3 drive the first reset signal line 7 to first and second low levels different from each other by the first and second low level drive circuits 15 and 32, respectively. do. The main microcomputer 2 causes the monitor IC 4 to recognize the occurrence of an abnormality during the diagnosis period of the first reset signal line 7, and when the reset state of the main microcomputer 2 is released, the low level value held in the first storage unit 18 is restored. Accordingly, the first reset signal line 7 is diagnosed.

With this configuration, if the monitoring IC 4 properly recognizes an intentional abnormality caused by the main microcomputer 2 during the diagnosis period, the main microcomputer 2 is reset by setting the first reset signal line 7 to the potential VRa. drive. Thereby, the potential VRa is held in the first storage unit 18 . Then, if the sub-microcomputer 3 is also reset at the timing when the monitoring IC 4 is reset, the potential VRab is held in the first storage section 18 . Thereby, the main microcomputer 2 can confirm whether the monitoring IC 4 is operating properly.

The first and second low-level drive circuits 15, 32 each include a series circuit of an FET 13, a transistor 29, and resistance elements 14, 30 connected between the first reset signal line 7 and the ground. 14 and 30 are set to different values. Thereby, the first and second low levels when the monitoring IC 4 and the sub-microcomputer 3 drive the first reset signal line 7 to low level can be easily set by selecting the resistance value.

Also, the monitoring IC 4 has a WD pulse detection & determination section 9, the main microcomputer 2 periodically outputs WD pulses to the WD pulse detection & determination section 9, and when the timer of the WD pulse detection & determination section 9 overflows, , the first low level drive circuit 15 drives the first reset signal line 7 to the first low level. Therefore, the operation of the main microcomputer 2 can be monitored using the WD pulse detection & determination section 9 .

Further, when the WD pulse stop instructing unit 22 instructs to stop the output of the WD pulse during the diagnosis period of the first reset signal line 7, the main microcomputer 2 can store that the instruction is issued by the second storage unit 23. . Then, when the reset is released, the main microcomputer 2 diagnoses the first reset signal line 7 also according to the operation information stored in the second storage unit 23 .

The main microcomputer 2 has a watchdog timer, and the sub-microcomputer 3 periodically outputs a WD pulse, which is a clear signal for the watchdog timer. The main microcomputer 2 issues a reset signal to the sub-microcomputer 3 when the watchdog timer overflows. Thereby, the main microcomputer 2 can monitor the operation of the sub-microcomputer 3 .

(Second embodiment)
Hereinafter, the same parts as those in the first embodiment are denoted by the same reference numerals, and descriptions thereof are omitted, and different parts will be described. As shown in FIG. 6 , the electronic control unit 41 of the second embodiment includes a main microcomputer 42 and a sub-microcomputer 43 . The main microcomputer 42 is provided with an abnormality signal issuing section 44, and the abnormality signal issuing section 44 outputs the "WD pulse stop instruction" from the WD pulse stop instruction section 22 by SPI communication. to issue an abnormal signal. The information that the abnormality signal issuing section 44 has issued the abnormality signal is stored in the second storage section 23A, which is the issuance information storage section. Accordingly, in the second embodiment, the main microcomputer 42 also diagnoses the reset control function of the first reset signal line 7 by the sub-microcomputer 43 .

The sub-microcomputer 43 receives the abnormality signal at the abnormality determination section 45 . The abnormality determination unit 45 outputs a transistor drive command to the TR control unit 46 upon receiving the abnormality signal. When the drive command is input, the TR control unit 46 turns the reset control terminal 27 to high level, turns on the transistor 29, and turns the first reset signal line 7 to the second low level.

Next, operation of the second embodiment will be described. As shown in FIG. 7, in the second embodiment, step S11 is executed instead of step S2, and steps S12 to S17 are executed instead of steps S7 to S9 between steps S6 and S10. In step S11, the WD pulse stop instructing section 22 outputs a "WD pulse stop instruction" and the abnormal signal issuing section 44 issues an abnormal signal.

In step S12, it is determined whether or not the second storage unit 23 stores "WD pulse stop instruction" and "abnormal signal issue" and the first storage unit 18 stores the potential VRab or the potential VRa. . If "Yes" is determined here, the process moves to step S13, and it is determined whether or not the potential stored in the first storage unit 18 is VRab. If "Yes" is determined here, it indicates that the monitoring IC 4 and the sub-microcomputer 3 have operated as expected in response to the processing of the main microcomputer 42, so the functions of the portion related to the first reset signal line 7 and All reset functions between the main microcomputer 2 and the sub-microcomputer 3 are determined to be normal (S16). This corresponds to the case shown in FIG.

If "No" is determined in step S13, the potential stored in the first storage unit 18 is VRa, indicating that only the monitor IC 4 has driven the first reset signal line 7. FIG. Therefore, although the function of the part related to the first reset signal line 7 is normal, the reset function between the main microcomputer 2 and the sub-microcomputer 3 is determined to be abnormal (S15). This corresponds to the case shown in FIG.

If "No" is determined in step S12, the potential stored in the first storage unit 18 is VRb, indicating that only the sub-microcomputer 3 has driven the first reset signal line 7. FIG. Therefore, although the function related to the first reset signal line 7 is abnormal, the reset function between the main microcomputer 2 and the sub-microcomputer 3 is determined to be normal (S14). This corresponds to the case shown in FIG.

If "Yes" is determined in step S4, it means that neither the monitor IC 4 nor the sub-microcomputer 3 operated as expected. All of the reset functions between the microcomputers 3 are determined to be abnormal (S17). This corresponds to the case shown in FIG.

As described above, according to the second embodiment, in the electronic control unit 41, the abnormality signal issuing section 44 of the main microcomputer 42 issues an abnormality signal to the sub-microcomputer 43, and the abnormality determination section 45 of the sub-microcomputer 43 , the second low level driving circuit 32 drives the first reset signal line 7 to the second low level when it is determined that the abnormality signal has been issued. Then, the main microcomputer 42 stores that the abnormality signal is issued in the second storage section 23A, and diagnoses the first reset signal line 7 based on the stored content. This makes it possible to diagnose the reset control function of the sub-microcomputer 3 at the same time as the monitor IC 4 .

(Other embodiments)
The second monitoring circuit is not limited to the sub-microcomputer.
Abnormality may be detected by a mechanism other than the watchdog timer.
The switch circuit is not limited to an N-channel MOSFET or an NPN transistor.
The configurations of the first and second low level drive circuits are not limited to those illustrated.
Although the present disclosure has been described with reference to examples, it is understood that the present disclosure is not limited to such examples or structures. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations and configurations, as well as other combinations and configurations, including single elements, more, or less, are within the scope and spirit of this disclosure.

In the drawing, 1 is an electronic control unit, 2 is a main microcomputer, 3 is a sub-microcomputer, 4 is a monitoring IC, 9 is a WD pulse detection & judgment section, 10 is a WD pulse output section, 15 is a first low level drive circuit, and 18. 21 denotes an abnormality determination portion; 22 denotes a WD pulse stop instructing portion; 23 denotes a second storage portion; and 32 denotes a second low level drive circuit.

Claims (10)

a microcomputer (2, 42);
a first monitoring circuit (4) for monitoring the operation of the microcomputer;
a second monitoring circuit (3, 43) for mutually monitoring mutual operations with the microcomputer;
a low-active reset signal line (7) commonly connected to reset terminals of the microcomputer and the first monitoring circuit;
a pull-up element (8) for pulling up the reset signal line;
a level holding circuit (18) that holds a low level value when the reset signal line is driven to a low level;
The first and second monitoring circuits are first and second low level drive circuits (15, 32) for driving the reset signal line to first and second low levels different from each other when an abnormality occurs in the microcomputer. each having
The microcomputer causes the first monitoring circuit to recognize the occurrence of an abnormality during the diagnosis period of the reset signal line, and when the reset state of the microcomputer is released, the low level value held in the level holding circuit an electronic controller for diagnosing the reset signal line in response to The first and second low-level drive circuits each include a series circuit of switch circuits (13, 32) and resistance elements (14, 30) connected between the reset signal line and the ground,
2. The electronic control unit according to claim 1, wherein the resistance values of said resistive elements are set to different values. the first monitoring circuit comprises a watchdog timer (9);
The microcomputer periodically outputs a clear signal for the watchdog timer,
3. The electronic control device according to claim 1, wherein when said watchdog timer overflows, said reset signal line is driven to a first low level by said first low level drive circuit. The microcomputer includes a stop instructing section (22) for instructing to stop outputting the clear signal during the diagnosis period of the reset signal line;
4. The electronic control device according to claim 3, further comprising an information storage section (23) for storing that the output stop instruction has been issued by the stop instruction section. The microcomputer stops the output of the clear signal during the diagnosis period, and when the reset state of the microcomputer is released, the reset signal line is switched according to the operation information stored in the information storage unit. 5. The electronic control unit according to claim 4, which performs diagnostics. The microcomputer (42) includes an anomaly signal issuing section (44) that issues an anomaly signal to the second monitoring circuit,
The second monitoring circuit (43) includes an abnormality determination section (45) that determines whether or not the abnormality signal has been issued,
6. The electronic control device according to any one of claims 1 to 5, wherein the reset signal line is driven to a second low level by the second low level drive circuit when it is determined that the abnormality signal is issued. 7. The electronic control unit according to claim 6, wherein said microcomputer has an issue information storage unit (23A) for storing information that said abnormality signal has been issued. 8. The electronic control device according to claim 7, wherein said microcomputer diagnoses said reset signal line also based on the contents stored in said issuing information storage unit. The microcomputer has a watchdog timer,
The second monitoring circuit periodically outputs a clear signal for the watchdog timer,
The electronic control device according to any one of claims 1 to 8, wherein the microcomputer issues a reset signal to the second monitoring circuit when the watchdog timer overflows. When mounted on a vehicle,
The electronic control device according to any one of claims 1 to 9, wherein the microcomputer diagnoses the reset signal line triggered by an ignition switch of the vehicle being turned off.

Images