JP6683104B2 - Electronic control unit - Google Patents

Description

  The present invention relates to an electronic control device mounted on a vehicle, which executes predetermined fail-safe processing when a power supply circuit provided in the electronic control device fails.

  A device for controlling a predetermined actuator mounted on a vehicle (a so-called electronic control device) is a microcomputer (hereinafter, control microcomputer) or a power supply circuit that executes various arithmetic processes based on data input from an in-vehicle sensor. Equipped with. The power supply circuit is a circuit that generates electric power suitable for the operation of the control microcomputer or the like based on the electric power provided from the in-vehicle power source such as the in-vehicle battery.

  In addition, this type of electronic control device generally has an abnormality detection function of monitoring whether or not the control microcomputer, the power supply circuit, and the like are operating normally. If the abnormality detection function detects a predetermined abnormal event, the control microcomputer or the like executes fail-safe processing according to the abnormal event.

  For example, if an abnormality in the power supply circuit is detected by the abnormality monitoring function, the control microcomputer, etc. may perform fail-safe processing to stop the operation of the actuator to be controlled or limit the output of the actuator to below a predetermined level. To do.

  In addition, Patent Document 1 proposes a configuration in which the power supply circuit, the microcomputer, and the like are duplicated in order to prevent the function provided by the electronic control device from being suddenly stopped due to the failure of the power supply circuit. .

JP, 2016-128308, A

  Since the power supply circuit handles the electric power supplied from the vehicle-mounted power supply, many parts capable of withstanding the large electric power (hereinafter, large power parts) are required. In general, high power components are more susceptible to failure than components handling relatively low power (hereinafter, small power components). Therefore, when the power supply circuit is duplicated as disclosed in Patent Document 1, there is a concern that the failure rate may increase due to an increase in power supply circuit components (particularly high power components).

  When the failure rate of the power supply circuit increases, the frequency of fail-safe processing associated with abnormality detection also increases. If the frequency of execution of the fail-safe processing that limits the function of the vehicle (for example, the output torque of the drive source) increases, the user may feel uncomfortable and annoyed.

  The present invention has been made based on this situation, and an object thereof is to provide an electronic control device capable of reducing the frequency of execution of fail-safe processing due to a failure of a power supply circuit.

The present invention for achieving the object is a control microcomputer (11, 12) which is a microcomputer for controlling the operation of a predetermined actuator mounted on a vehicle based on data input from a sensor mounted on the vehicle. A first power supply circuit (15) as a power supply circuit for generating a voltage for driving the control microcomputer from a voltage supplied from a power supply device mounted on the vehicle and supplying the voltage to the control microcomputer; An abnormality detection unit (20) for detecting an abnormal operation of the first power supply circuit based on the voltage output by the first power supply circuit, and a power supply circuit different from the first power supply circuit, which is activated according to the detection result of the abnormality detection unit, a second power supply circuit for supplying power to the control microcomputer (16), the power supply line der connecting the output terminal and the power supply terminal of the output terminal and the control microcomputer of the second power source circuit of the first power supply circuit An internal power supply line (Ln), comprising a first power supply circuit starts supplying power to the control microcomputer as a trigger that the activation signal is a signal for starting the control from a given signal source is input When the abnormal operation of the first power supply circuit is not detected, the abnormality detection unit outputs a signal for stopping the second power supply circuit, and when the abnormal operation of the first power supply circuit is detected, the abnormality detection unit Outputs a signal for activating the second power supply circuit .

  In the above configuration, when the abnormality detecting unit has not detected the abnormal operation of the first power supply circuit (hereinafter, normal time), the second power supply circuit is not operating. Therefore, even if the second power supply circuit fails in normal time, the failure does not appear as a defect (in other words, detected). Therefore, it is possible to reduce the execution frequency of the fail-safe processing due to the failure of the power supply circuit.

  The reference numerals in parentheses in the claims indicate the correspondence with the specific means described in the embodiments described below as one aspect, and limit the technical scope of the present invention. is not.

It is a figure which shows the structure of the vehicle system containing ECU1 which concerns on this embodiment. It is a block diagram showing a schematic structure of ECU1 concerning this embodiment. 3 is a diagram showing an example of a configuration of a first power supply circuit 15. FIG. It is a figure which shows an example of a structure of the 2nd power supply circuit 16. As shown in FIG. 4 is a time chart showing the operation of each unit when the ECU 1 is started. 5 is a time chart showing the operation of each part when the first power supply circuit 15 fails. 6 is a time chart showing an operation when the IGSW 8 is off when a failure of the first power supply circuit 15 occurs. 6 is a time chart showing the operation when the IGSW 8 is off when the first power supply circuit 15 is operating normally. It is a figure showing a modification of ECU1. It is a figure showing a modification of ECU1. It is a figure showing a modification of ECU1.

  Hereinafter, an electronic control unit (hereinafter, ECU: Electronic Control Unit) 1 to which the present invention is applied will be described with reference to the drawings. The ECU 1 in the present embodiment controls the output of a drive source (for example, an engine) of the vehicle based on data input from a sensor (that is, an in-vehicle sensor) mounted on the vehicle.

  Of course, as another aspect, the ECU 1 may control a steering actuator or a braking system. Further, the ECU 1 may control the operation of the motor as a drive source and the charge / discharge of the battery. The control target of the ECU 1 and the service of the ECU 1 may be appropriately designed. Further, the ECU 1 may be used in a vehicle including both an engine and a motor as a drive source (that is, a hybrid car) or a vehicle including only a motor as a drive source (that is, an electric vehicle).

  The ECU 1 according to the present embodiment is mounted on a vehicle equipped with an engine as a drive source, and is electrically connected to the vehicle-mounted battery 2. In addition, as shown in FIG. 1, the ECU 1 includes an electronic throttle 3, an accelerator sensor 4, a throttle sensor 5, and a warning light 6, and a communication network (hereinafter, LAN: Local Area Network) built in the vehicle. It is connected via 7.

  The vehicle-mounted battery 2 is a secondary battery that supplies a predetermined battery voltage Vb to the ECU 1. The vehicle-mounted battery 2 corresponds to the power supply device described in the claims. In addition, the power supply line (hereinafter, B line) to which the output voltage of the vehicle-mounted battery 2 (hereinafter, battery voltage Vb) is always applied to the vehicle, and the ignition switch (hereinafter, IGSW) 8 are turned on by the user. In some cases, there is a power supply line to which the battery voltage Vb is applied (hereinafter, IG power supply line). The ECU 1 is connected to each of the B line and the IG power line.

  The electronic throttle 3 is a product in which a throttle valve 31 for adjusting the amount of intake air to the engine and a motor (hereinafter, throttle motor) 32 as an actuator for moving the throttle valve 31 are integrated into one product. The output torque of the throttle motor 32 is controlled by the ECU 1. The electronic throttle 3 may be electrically connected to the ECU 1 so that the control signal of the ECU 1 is input, not via the LAN 7.

  The accelerator sensor 4 is a sensor that detects the operation position of the accelerator pedal by the driver as an accelerator operation amount. The throttle sensor 5 is a sensor that detects the position of the throttle valve 31 (in other words, the rotation angle) as the throttle opening. The detection results of the accelerator sensor 4 and the throttle sensor 5 are sequentially provided to the ECU 1.

  The warning light 6 is a device for notifying an occupant that a predetermined malfunction has occurred in the power supply circuit of the ECU 1, and is realized by using, for example, an LED or the like. The warning light 6 operates (that is, lights up or blinks) based on an instruction from the ECU 1.

  The ECU 1 controls the throttle motor 32 based on the data input from the accelerator sensor 4 and the throttle sensor 5. This indirectly controls the output torque of the engine. As shown in FIG. 2, the ECU 1 includes a main microcomputer 11, a sub-microcomputer 12, a first communication driver 13, a second communication driver 14, a first power supply circuit 15, a second power supply circuit 16, a drive maintaining unit 17, a first power supply. The activation unit 18, the second power supply activation unit 19, the abnormality detection unit 20, the stabilization filter 21, and the delay filter 22 are provided.

  The main microcomputer 11 and the sub-microcomputer 12 are a microcomputer (hereinafter referred to as a microcomputer) realized by using a CPU as a central processing unit, a ROM which is a non-volatile storage medium, a RAM which is a volatile storage medium, a register and the like. Is. The main microcomputer 11 is configured to operate in a predetermined voltage range. That is, the lower limit and the upper limit of the operating voltage are specified.

  Here, as an example, it is assumed that the main microcomputer 11 is configured to operate at a voltage of 4.0V to 5.5V. Similarly, the sub-microcomputer 12 is also configured to operate at a voltage of 4.0V to 5.5V. For convenience, the voltage range in which the main microcomputer 11 and the sub-microcomputer 12 operate is hereinafter referred to as the microcomputer operation range. The microcomputer operating range corresponds to the operating voltage range described in the claims.

  The main microcomputer 11 and the sub-microcomputer 12 are connected so that bidirectional communication is possible. Further, the main microcomputer 11 is connected to the first communication driver 13 so as to be capable of bidirectional communication. The sub-microcomputer 12 is connected to the second communication driver 14 so as to be capable of bidirectional communication. The main microcomputer 11 has a reset input terminal as an input terminal for a reset signal.

  The sub-microcomputer 12 has an input terminal to which the output signal of the abnormality detection unit 20 is input. Further, the sub-microcomputer 12 includes a first power source holding terminal, a second power source holding terminal, and a clear signal output terminal as signal output terminals. The sub-microcomputer 12 includes a non-volatile memory 121 which is a rewritable non-volatile storage medium. The operation of the main microcomputer 11 and the sub-microcomputer 12 will be described later separately.

  Each of the main microcomputer 11 and the sub-microcomputer 12 corresponds to the control microcomputer described in the claims. In particular, the main microcomputer 11 corresponds to the first microcomputer described in the claims, and the sub-microcomputer 12 corresponds to the second microcomputer described in the claims.

  Hereinafter, as an example, it is assumed that each unit included in the ECU 1 is configured to operate in positive logic. Of course, as another aspect, each unit included in the ECU 1 may be configured to operate in negative logic. The drive maintaining unit 17, the first power supply starting unit 18, the second power supply starting unit 19, the abnormality detection unit 20, and the like are configured to output signals of low level, high level, and two levels.

  The first communication driver 13 is a driver circuit for the main microcomputer 11 to communicate with other devices connected to the LAN 7 (for example, an ECU and a sensor). The second communication driver 14 is a driver circuit for the sub-microcomputer 12 to communicate with other devices (for example, an ECU and a sensor) connected to the LAN 7. In this embodiment, the communication driver for the main microcomputer 11 and the communication driver for the sub microcomputer 12 are separately provided, but the configuration is not limited to this. One communication driver may be shared by the main microcomputer 11 and the sub-microcomputer 12.

  The first power supply circuit 15 is a circuit module that converts the battery voltage Vb input from the vehicle-mounted battery 2 into a predetermined voltage suitable for the operation of the main microcomputer 11 and outputs the voltage. Here, as an example, it is assumed that the target value of the voltage input to the main microcomputer 11 and the sub-microcomputer 12 (hereinafter, target applied voltage) is set to 5V. That is, the first power supply circuit 15 of the present embodiment converts the battery voltage Vb = 12V into 5V as the target applied voltage and outputs it.

  Further, the first power supply circuit 15 is configured to be able to output a current of 550 mA based on the electric power input from the vehicle-mounted battery 2. That is, the first power supply circuit 15 functions as an internal power supply that supplies electric power of 5 V and 550 mA to the main microcomputer 11 and the like. V1 shown in FIG. 2 represents the output voltage of the first power supply circuit 15 (hereinafter, the first output voltage). The first power supply circuit 15 is configured so that the first output voltage V1 falls within the range from 4.95V to 5.05V.

  FIG. 3 is a diagram showing an example of a specific circuit configuration of the first power supply circuit 15. As shown in FIG. 3, the first power supply circuit 15 includes a first power supply IC 151 in which a power conversion circuit 151a and a voltage control circuit 151b are mounted, a conversion additional circuit 152, and a control additional circuit 153.

  The battery voltage Vb = 12V is input to the conversion additional circuit 152. The conversion additional circuit 152 cooperates with the power conversion circuit 151a to convert the battery voltage Vb so that the output voltage becomes the predetermined intermediate voltage V1a. The intermediate voltage V1a may be a value higher than 5V as the target applied voltage and lower than the battery voltage Vb. Here, as an example, the intermediate voltage V1a is set to 6V.

  The intermediate voltage V1a, which is the output voltage of the conversion additional circuit 152, is input to the control additional circuit 153. The above-mentioned first output voltage V1 is the output voltage of the additional control circuit 153. The additional control circuit 153 cooperates with the voltage control circuit 151b to convert the intermediate voltage V1a so that the first output voltage V1 becomes the target applied voltage.

  Since the power conversion circuit and the constant voltage circuit are well known, their detailed description will be omitted. Further, the first power supply circuit 15 may be realized by a configuration other than the configuration shown in FIG. The first power supply circuit 15 may be realized by using a known circuit configuration.

  The above-described first power supply circuit 15 includes, as a signal input terminal, a terminal connected to the output terminal of the first power supply starting unit 18 (hereinafter, first start input terminal). The first power supply circuit 15 is driven when a high level signal is input from the first power supply start-up unit 18, and outputs 5V as the output voltage V1. When the signal input from the first power supply activation unit 18 is not at the high level, that is, when the low level signal is input, the first power supply circuit 15 stops. The first output voltage V1 when the first power supply circuit 15 is stopped is 0V. The high-level signal output from the first power supply activation unit 18 functions as a drive signal for the first power supply circuit 15.

  The output terminal of the first power supply circuit 15 is connected to the internal power supply line Ln which is a power supply line. Therefore, when the first power supply circuit 15 is operating normally, 5V is applied to the internal power supply line Ln. The internal power supply line Ln is connected to the respective power supply terminals of the main microcomputer 11 and the sub-microcomputer 12. Further, the internal power supply line Ln is also connected to the abnormality detection unit 20. The output terminal of the second power supply circuit 16 is also connected to the internal power supply line Ln.

  The second power supply circuit 16 is a circuit module that converts the battery voltage Vb input from the vehicle-mounted battery 2 into a target applied voltage and outputs the target applied voltage. That is, the second power supply circuit 16 of the present embodiment converts the battery voltage Vb = 12V into 5V as the target applied voltage and outputs it.

  Further, the second power supply circuit 16 is configured to be able to output a current of up to 50 mA based on the electric power input from the vehicle-mounted battery 2. That is, the second power supply circuit 16 functions as an internal power supply that supplies electric power of 5V and 50mA. V2 shown in FIG. 2 represents the output voltage of the second power supply circuit 16 (hereinafter, the second output voltage).

  FIG. 4 is a diagram showing an example of a specific circuit configuration of the second power supply circuit 16. As shown in FIG. 4, the second power supply circuit 16 includes a second power supply IC 161 in which the voltage control circuit 161a is mounted and a control additional circuit 162.

  The battery voltage Vb is input to the additional control circuit 162. The second output voltage V2 described above is the output voltage of the additional control circuit 162. The additional control circuit 162 cooperates with the voltage control circuit 161a to convert the battery voltage Vb so that the second output voltage V2 becomes the target applied voltage. The second power supply circuit 16 may be realized by a configuration other than the configuration shown in FIG. The second power supply circuit 16 may be realized by using a known circuit configuration.

  The second power supply circuit 16 described above includes, as an input terminal, a terminal connected to the output terminal of the second power supply start-up unit 19 (hereinafter, second start-up input terminal). The second power supply circuit 16 is driven when a high level signal is input from the second power supply activation unit 19 and outputs 5V as the second output voltage V2. When the high level signal is not input from the second power supply starting unit 19, in other words, when the low level signal is output from the second power supply starting unit 19, the second power supply circuit 16 is stopped. When the second power supply circuit 16 is stopped, the second output voltage V2 is 0V. The high-level signal output by the second power supply activation unit 19 functions as a drive signal for the second power supply circuit 16.

  The output terminal of the second power supply circuit 16 is connected to the internal power supply line Ln. Therefore, when the second power supply circuit 16 is operating normally, 5V is applied to the internal power supply line Ln. However, as will be described later, the second power supply circuit 16 is configured not to operate while the first power supply circuit 15 is normally operating.

  The drive maintaining unit 17 has two input terminals and one output terminal, and one of the two input terminals is connected to the IG power line. The other input terminal is connected to the first power supply holding terminal included in the sub-microcomputer 12.

  The drive maintaining unit 17 is configured to output a logical sum of two input signals, and may be realized by using a well-known OR circuit. The known OR circuit includes a wired OR. When the IGSW 8 is set to ON, a voltage signal (that is, a high level signal) equal to or higher than a predetermined threshold is input to the IG power line.

  The drive maintaining unit 17 outputs a high level signal when the IGSW 8 is set to ON or when a high level signal is input from the sub-microcomputer 12. When the IGSW 8 is not set to ON and the first holding signal is not input from the sub-microcomputer 12, the low level signal is output. The output signal of the drive maintaining unit 17 is input to the first power supply starting unit 18 and the delay filter 22. A high level signal input from the IG power line to the drive maintaining unit 17 when the IGSW 8 is turned on corresponds to the activation signal described in the claims. Further, the IGSW 8 corresponds to the signal source described in the claims.

  The first power supply starting unit 18 includes two input terminals and one output terminal, and one of the two input terminals is connected to the output terminal of the drive maintaining unit 17. That is, the output signal of the drive maintaining unit 17 is input to the first power supply starting unit 18. Further, a signal obtained by inverting the output signal of the second power supply starting section 19 is input to the other input terminal. That is, a low level is input when the output signal of the second power supply activation unit 19 is at a high level, while a high level is input when the output signal of the second power supply activation unit 19 is at a low level. .

  The first power supply activation unit 18 is configured to output a logical product of two inputs and may be realized by using a well-known AND circuit. The first power supply starting unit 18 outputs a high level signal when the output of the drive maintaining unit 17 is at a high level and the output of the second power supply starting unit 19 is at a low level. In other cases, that is, when the output of the drive maintaining unit 17 is at the low level or the output of the second power supply starting unit 19 is at the high level, the low level signal is output.

  The second power supply activation unit 19 has two input terminals and one output terminal, and one of the two input terminals is connected to the output terminal of the abnormality detection unit 20. The other input terminal is connected to the second power supply holding terminal provided in the sub-microcomputer 12.

  The second power supply activation unit 19 is configured to output a logical sum of two input signals, and may be realized by using a well-known OR circuit. The second power supply activation unit 19 outputs the high level signal when the abnormality detection unit 20 outputs the high level signal or when the high level signal is input from the sub-microcomputer 12. The second power supply activation unit 19 outputs a low level signal when the abnormality detection unit 20 does not output a high level signal and the second power supply holding signal is not input from the sub-microcomputer 12. .

  The output signal of the second power supply activation unit 19 is input to the second power supply circuit 16. Further, the output terminal of the second power supply starting unit 19 is also connected to the reset input terminal provided in the main microcomputer 11. Therefore, while the second power supply activation unit 19 outputs the high level signal, the main microcomputer 11 is held in the reset state and the operation is stopped. Further, the output signal of the second power source activation unit 19 is inverted in high level / low level and input to the first power source activation unit 18.

  The abnormality detection unit 20 is connected to the internal power supply line Ln, and while the abnormality detection unit 20 is activated, it sequentially acquires the value of the voltage applied to the internal power supply line Ln. Then, when the voltage applied to the internal power supply line Ln becomes a value outside the predetermined normal range, the event is detected as an abnormal operation of the first power supply circuit 15. That is, when the voltage applied to the internal power supply line Ln becomes a value outside the predetermined normal range, the abnormality detection unit 20 does not normally operate the first power supply circuit 15 (in other words, the abnormality occurs). This is equivalent to the configuration for determining that (has occurred)

  As will be described later, until the abnormal operation of the first power supply circuit 15 is detected after the IGSW 8 is turned on, the second power supply circuit 16 is not operated and the output voltage of only the first power supply circuit 15 is the internal power supply. It is applied to the line Ln. Therefore, monitoring the voltage applied to the internal power supply line Ln corresponds to monitoring the output voltage of the first power supply circuit 15.

  That is, the abnormality detection unit 20 is configured to detect the abnormal operation of the first power supply circuit 15 based on the output voltage of the first power supply circuit 15. It should be noted that detecting an abnormal operation of the first power supply circuit 15 corresponds to determining whether or not the first power supply circuit 15 is operating normally. It is assumed that the lower limit value of the normal range here is set higher than the lower limit value of the microcomputer operating range, and the upper limit value of the normal range is set lower than the upper limit value of the microcomputer operating range. For example, the normal range may be 4.5V to 5.2V. The normal range corresponds to the normal voltage range described in the claims.

  The abnormality detection unit 20 outputs a low level signal when the output voltage of the first power supply circuit 15 is within the normal range (including the boundary value). Further, the abnormality detection unit 20 outputs a high level signal when the output voltage of the first power supply circuit 15 is out of the normal range. The high level signal output from the abnormality detection unit 20 functions as a signal indicating that the first power supply circuit 15 has an abnormality. Therefore, the high level signal output by the abnormality detection unit 20 is also referred to as an abnormality detection signal. The abnormality detection unit 20 may be realized by using a comparator, an AND circuit, or the like. Of course, as another mode, the abnormality detection unit 20 may be realized by executing software by the CPU.

  The abnormality detection unit 20 includes an input terminal (hereinafter, a clear signal input terminal) to which a clear signal output from the sub-microcomputer 12 is input, in addition to the input terminals described above. When the abnormality detection unit 20 once detects an abnormal operation of the first power supply circuit 15, the abnormality detection unit 20 continues to output a high level signal until a clear signal is input from the sub-microcomputer 12. That is, when the high level signal is output once, the abnormality detection unit 20 holds (in other words, latches) the output level at the high level until the clear signal is input. The output signal of the abnormality detection unit 20 is input to the second power supply activation unit 19 and the sub-microcomputer 12. It should be noted that the fact that the abnormality detection unit 20 continues to output the high-level signal corresponds to holding the determination result that the first power supply circuit 15 is not operating normally.

  The abnormality detection unit 20 is connected to the output terminal of the drive maintaining unit 17 via the delay filter 22 and the stabilizing filter 21 as shown in FIG. That is, the output signal of the drive maintaining unit 17 is input to the abnormality detecting unit 20 via the stabilizing filter 21 and the delay filter 22. The abnormality detection unit 20 is activated when a high level signal is input from the delay filter 22 and starts monitoring the output voltage of the first power supply circuit 15.

  The stabilizing filter 21 is a filter for stabilizing the input level to the delay filter 22. The voltage applied to the IG power supply line is likely to fluctuate depending on the operation state of the alternator or another electronic device (for example, another ECU) connected to the IG power supply line. If the output level of the drive maintaining unit 17 vibrates due to such a voltage fluctuation, the abnormality detecting unit 20 may malfunction. By interposing the stabilizing filter 21 between the drive maintaining unit 17 and the abnormality detecting unit 20, it is possible to stabilize the output of the drive maintaining unit 17 and reduce the risk that the abnormality detecting unit 20 malfunctions.

  The delay filter 22 sets the activation timing of the abnormality detection unit 20 so that the abnormality detection unit 20 is activated after the first power supply circuit 15 is activated (in other words, after 5 V as the target applied voltage is started to be output). It is a filter for adjusting. Adjusting the activation timing of the abnormality detecting unit 20 corresponds to adjusting the timing of transmitting the high level signal input from the drive maintaining unit 17 via the stabilizing filter 21 to the abnormality detecting unit 20. The delay filter 22 may be realized by using a capacitor or a resistor.

  The significance of introducing the delay filter 22 is as follows. There is a delay of a predetermined time Ta between when the IGSW 8 is turned on and when the first output voltage V1 rises to 5V. If the delay filter 22 does not exist, the abnormality detection unit 20 is activated before the completion of the activation of the first power supply circuit 15, and as a result, the voltage drop state before the completion of the activation of the first power supply circuit 15 is changed to the first power supply circuit. There is a risk of false detection as the abnormal operation of No. 15. On the other hand, by providing the delay filter 22, the abnormality detection unit 20 is activated after the first power supply circuit 15 is activated. Therefore, it is possible to reduce the risk of the above malfunction.

  That is, the abnormality detection unit 20 is configured to be activated at a timing when a high-level signal is input to the ECU 1 from the IG power supply line as a start point and at a timing when a predetermined time has elapsed from the start point. The delay filter 22 plays a role of separating a voltage drop state before the completion of activation of the first power supply circuit 15 and a voltage drop state at the time of failure of the first power supply circuit 15.

  The main microcomputer 11 is a microcomputer that calculates a control target amount for a predetermined control target (here, the electronic throttle 3) based on data such as the accelerator depression amount provided from the first communication driver 13. For example, the main microcomputer 11 calculates the control amount of the throttle motor 32 from the accelerator operation amount detected by the accelerator sensor 4, and outputs the control amount to the electronic throttle 3 via the first communication driver 13 and the LAN 7. .

  Further, the main microcomputer 11 monitors whether or not the sub-microcomputer 12 is operating normally by bidirectional communication with the sub-microcomputer 12. Whether or not the sub-microcomputer 12 is operating normally can be determined by using a known method such as a watchdog timer method or a homework answer method. The watchdog timer method is a method of determining that the sub-microcomputer 12 is operating abnormally when the watchdog timer expires without being cleared by the watchdog pulse input from the sub-microcomputer 12.

  In addition, the homework answering method means that the main microcomputer 11 sends a predetermined monitoring signal to the sub-microcomputer 12 and the sub-microcomputer 12 operates normally depending on whether the answer returned from the sub-microcomputer 12 is correct. Is a method of determining whether or not In the homework answering method, the sub-microcomputer 12 generates a response signal according to the monitoring signal input from the main microcomputer 11 and sends it back to the main microcomputer 11. When the content of the response signal received from the sub-microcomputer 12 is different from the data corresponding to the transmitted monitoring signal, the main microcomputer 11 returns the response signal from the main microcomputer 11 within a predetermined time limit. The sub-microcomputer 12 determines that it is not operating normally (that is, it is operating abnormally). When the abnormal operation of the sub-microcomputer 12 is detected, the main microcomputer 11 executes a predetermined restoration process such as resetting the sub-microcomputer 12.

  The power supply terminal of the main microcomputer 11 is connected to the internal power supply line Ln and operates based on the power supplied from the first power supply circuit 15 or the second power supply circuit 16. Further, the reset input terminal of the main microcomputer 11 is connected to the output terminal of the second power supply starting section 19. The reset input terminal is an input terminal for stopping the operation of the main microcomputer 11 and returning it to the initial state when a high level signal as a reset signal is input.

  Therefore, when the output signal of the second power supply activation unit 19 is at the high level, the main microcomputer 11 stops its operation. The case where the output signal of the second power supply activation unit 19 becomes high level is a case where the second power supply circuit 16 is driven due to an abnormal operation of the first power supply circuit 15, for example. Therefore, when the second power supply circuit 16 operates, the main microcomputer 11 is stopped.

  The sub-microcomputer 12 performs bidirectional communication with the main microcomputer 11 to monitor whether the main microcomputer 11 is operating normally (that is, state monitoring). Whether or not the main microcomputer 11 is normally operating can be determined by applying a well-known method as described above. When detecting an abnormal operation of the main microcomputer 11, the sub-microcomputer 12 executes a predetermined process such as resetting the main microcomputer 11.

  The sub-microcomputer 12 also includes an input terminal (hereinafter, monitor terminal) to which the output signal of the abnormality detection unit 20 is input. The sub-microcomputer 12 performs a predetermined fail-safe process when a high level signal is input from the abnormality detection unit 20 to the monitor terminal, in other words, when the abnormality detection unit 20 detects an abnormal operation of the first power supply circuit 15. Run.

  For example, the sub-microcomputer 12 shifts the operation of the engine to the escape travel mode by stopping the driving of the throttle motor 32 as a fail-safe process. The escape travel mode is an operation mode in which the output torque of the engine is limited to a predetermined suppression level or less. The evacuation traveling mode allows the user to evacuate the vehicle to a safe place. When the sub-microcomputer 12 is connected to the throttle motor 32 via a drive circuit, the evacuation traveling may be realized by cutting off the output of the drive circuit.

  Further, the sub-microcomputer 12 notifies other ECUs connected to the LAN 7 that a defect has occurred in the ECU 1 as a fail-safe process. In addition, the sub-microcomputer 12 may turn on the warning light 6 as a fail-safe process. By turning on the warning light 6, the user can be notified that a malfunction has occurred in the ECU 1. In addition, the information (for example, date and time) indicating the situation when the abnormality occurs in the first power supply circuit 15 may be recorded in the nonvolatile memory 121.

  The sub-microcomputer 12 executes a predetermined shutdown process when the IGSW 8 is turned off. For example, the sub-microcomputer 12 writes data necessary for the next startup to the non-volatile memory 121 or clears the RAM as a shutdown process.

  In addition, the sub-microcomputer 12 performs a process of checking whether the second power supply circuit 16 operates normally as a shutdown process when the IGSW 8 is turned off while the first power supply circuit 15 operates normally (hereinafter, Inspection process), and the inspection result is written in a non-volatile memory. The inspection procedure of the second power supply circuit 16 will be described later. As a result of the inspection process, when it is confirmed that the second power supply circuit 16 is operating normally, it is written in the nonvolatile memory 121 that the second power supply circuit 16 is normal. For convenience, the data indicating that the second power supply circuit 16 is normal is referred to as operation confirmation data.

  Further, after starting, the sub-microcomputer 12 outputs a high level signal from the first power supply holding terminal until the abnormality detection unit 20 detects an abnormality in the first power supply circuit 15. When the abnormal operation of the first power supply circuit 15 is detected by the abnormality detection unit 20, the output level from the first power supply holding terminal is shifted to the low level.

  While the high level signal is output from the first power supply holding terminal, the output of the drive maintaining unit 17 is also maintained at the high level. Therefore, even when the user suddenly switches to the IGSW 8 while the vehicle is traveling, the vehicle control by the main microcomputer 11 and the sub-microcomputer 12 can be continued. The high level signal output from the first power supply holding terminal functions as a signal for maintaining the state in which the first power supply circuit 15 is driven. Therefore, the high level signal output from the first power supply holding terminal is also referred to as a first power supply holding signal.

  Further, the sub-microcomputer 12 outputs a low level signal from the second power supply holding terminal when the abnormality detection unit 20 does not detect the abnormal operation of the first power supply circuit 15. When the abnormality detecting unit 20 detects an abnormal operation of the first power supply circuit 15, it starts outputting a high level signal from the second power supply holding terminal. Once a high level signal is started to be output from the second power supply holding terminal, the IGSW 8 is turned off and maintained in that state until a predetermined shutdown process is completed.

  While the high level signal is output from the second power source holding terminal, the output of the second power source starting unit 19 is also maintained at the high level. Therefore, while the second power supply circuit 16 continues to operate, the first power supply circuit 15 stops. This is because when the output of the second power supply activation unit 19 is at the high level, the output of the first power supply activation unit 18 is at the low level.

  The high level signal output from the second power supply holding terminal functions as a signal that maintains the state in which the second power supply circuit 16 is being driven. Therefore, the high level signal output from the second power supply holding terminal is also referred to as a second power supply holding signal.

  Further, the sub-microcomputer 12 outputs a high level signal as a clear signal from the clear signal output terminal when the IGSW 8 is turned off while the high power level signal is being output from the second power source holding terminal. As a result, the output level of the abnormality detection unit 20 shifts to the low level.

  It should be noted that the sub-microcomputer 12 is designed to have less arithmetic processing to be executed than the main microcomputer 11. Therefore, the current required to drive the sub-microcomputer 12 is smaller than the current required to drive the main microcomputer 11. Moreover, since the main microcomputer 11 stops its operation when the first power supply circuit 15 fails, the main microcomputer 11 does not consume current. Therefore, the current supply capacity of the second power supply circuit 16 can be designed to be lower than the current supply capacity of the first power supply circuit 15. In the present embodiment, the IGSW 8 being turned off is adopted as the condition for ending the control processing by the ECU 1 (hereinafter, the ending condition), but the condition is not limited to this. The termination condition may be appropriately designed according to the service of the ECU 1.

<Activation when the ECU 1 is started>
Next, the operation of each component when the IGSW 8 is turned on and the ECU 1 is started will be described using the time chart shown in FIG. T10 shown in FIG. 5 represents the timing when the IGSW 8 is turned on.

  (A) in FIG. 5 represents the applied voltage of the IG power supply line. (B) to (H) are outputs of the drive maintaining unit 17, the first power supply starting unit 18, the first power supply circuit 15, the delay filter 22, the abnormality detecting unit 20, the second power supply starting unit 19, and the second power supply circuit 16. Is represented. (I) represents the voltage applied to the internal power supply line Ln, and (J) and (K) represent the operating states of the main microcomputer 11 and the sub-microcomputer 12.

  (L) and (M) of FIG. 5 represent the output levels of the first power source holding terminal and the second power source holding terminal. (N) shows the recorded contents of the operation confirmation data. Here, as an example, it is assumed that data indicating that the second power supply circuit 16 is normal is recorded in the nonvolatile memory 121 as the operation confirmation data by the previous inspection process.

  When the IGSW 8 is set to ON, the battery voltage Vb is applied to the drive maintaining unit 17, so that the output level of the drive maintaining unit 17 becomes high level as shown in (B). Further, when the ECU 1 is started, the output level of the second power supply holding terminal and the output of the abnormality detection unit 20 are low level, so that the output level of the second power supply startup unit 19 is low level. Therefore, as shown in (C), the output level of the first power supply activation unit 18 also becomes high level, and the first power supply circuit 15 starts to be activated. That is, the first power supply circuit 15 starts power supply to the main microcomputer 11 and the like, triggered by turning on the IGSW 8.

  Ta shown in FIG. 5D represents a time (that is, a rising time) required for the output voltage to converge to the target applied voltage after the first power supply circuit 15 starts to be activated. Further, the time Tb shown in (E) represents the delay time from the input of the high level signal to the output of the high level signal in the delay filter 22. The delay filter 22 is configured such that the delay time Tb is longer than the rising time of the first power supply circuit 15.

  When the rise of the first power supply circuit 15 is completed, 5V is also applied to the internal power supply line Ln, so that the main microcomputer 11 and the sub-microcomputer 12 are activated. The sub-microcomputer 12 starts to output a high level signal from the first power supply holding terminal in the process of initialization processing associated with startup. When started, the sub-microcomputer 12 clears the operation confirmation data as shown in (N). That is, the data indicating that the second power supply circuit 16 is normal is deleted.

  When the first power supply circuit 15 is operating normally, in other words, when the first output voltage V1 is within the normal range, the output level of the abnormality detection unit 20 is low. The level of the signal output from the second power source holding terminal by the sub-microcomputer 12 is also low. Therefore, the 2nd power supply starting part 19 is maintained in the stopped state. Therefore, the second output voltage V2 is 0V.

<About operation when the first power supply circuit fails>
Next, the operation of each component when the first power supply circuit 15 performs an abnormal operation (for example, a voltage drop) will be described using the time chart shown in FIG. T20 shown in FIG. 6 represents the timing when the voltage of the first power supply circuit 15 falls below the lower limit value of the normal range.

  6A shows the applied voltage of the IG power supply line, in other words, the ON / OFF state of the IGSW 8. (B) to (F) represent outputs of the first power supply activation unit 18, the first power supply circuit 15, the abnormality detection unit 20, the second power supply activation unit 19, and the second power supply circuit 16. (G) represents the voltage applied to the internal power supply line Ln, and (H) and (I) represent the output levels of the first power supply holding terminal and the second power supply holding terminal. (J) and (K) represent operating states of the main microcomputer 11 and the sub microcomputer 12. The outputs of the drive maintaining unit 17 and the delay filter 22 are maintained at the high level at least as long as the IGSW 8 is on. Therefore, these outputs are not shown here.

  When the first power supply circuit 15 fails and the first output voltage V1 falls below the lower limit value of the normal range, the abnormality detection unit 20 detects the voltage behavior as an abnormal operation of the first power supply circuit 15. Therefore, as shown in (C), the abnormality detection unit 20 starts to output a high level signal from time T20.

  In addition, the output level of the second power supply activation unit 19 also changes to the high level as the output level of the abnormality detection unit 20 changes to the high level. Therefore, the first power supply activation unit 18 no longer satisfies the AND condition and starts outputting the low level signal.

  The second power supply circuit 16 is activated in response to the input of the high level signal from the second power supply activation unit 19, and starts to output 5V. Further, the first power supply circuit 15 stops its operation because the output level of the first power supply start-up unit 18 becomes low level. That is, when the first power supply circuit 15 fails, the second power supply circuit 16 replaces the first power supply circuit 15 and supplies 5V to the internal power supply line Ln. Therefore, as shown in FIG. 6, power supply to various microcomputers is maintained. Note that, as shown in (H) and (I), the sub-microcomputer 12 stops the output of the first power supply holding signal along with the output of the second power supply holding signal.

  In addition, in the present embodiment, when the first power supply circuit 15 has a failure, the reset signal remains input to the main microcomputer 11. As a result, when the first power supply circuit 15 fails, the main microcomputer 11 is substantially in a stopped state.

  According to such a configuration, the number of configurations that require electric power in the ECU 1 after the abnormality detection of the first power supply circuit 15 is reduced. Therefore, the current supply capacity of the second power supply circuit 16 can be designed to be lower than the current supply capacity of the first power supply circuit 15. As a result, the introduction cost of the second power supply circuit 16 can be reduced. Even if the main microcomputer 11 is stopped, various fail-safe processes are executed by the sub-microcomputer 12, so that it is possible to ensure the same safety as in the conventional case.

<Shutdown processing when the first power supply fails>
Next, the operation of each component when the IGSW 8 is turned off while the second power supply circuit 16 is being driven will be described using the time chart shown in FIG. Even after the IGSW 8 is set to OFF, the sub-microcomputer 12 continues to operate for a fixed time (for example, 1 second) and executes a predetermined shutdown process (for example, saving data). T30 shown in FIG. 7 represents the timing when the IGSW 8 is turned off, and T31 represents the timing when the shutdown processing of the sub-microcomputer 12 is completed.

  FIG. 7A shows the applied voltage of the IG power supply line. (B) shows the operating state of the sub-microcomputer 12. (C) to (H) represent outputs of the abnormality detection unit 20, the second power supply holding terminal, the second power supply activation unit 19, and the second power supply circuit 16. (G) represents the voltage applied to the internal power supply line Ln.

  The sub-microcomputer 12 outputs a clear signal to the abnormality detection unit 20 when the IGSW 8 is turned off. Therefore, as shown in (C), the output signal of the abnormality detection unit 20 becomes low level. On the other hand, the sub-microcomputer 12 continues to output the second power supply holding signal as shown in (D) until the shutdown process is completed at time T31. Therefore, the output level of the second power supply activation unit 19 is maintained at the high level until time T31. Therefore, the second power supply circuit 16 continues to operate for a predetermined time even after the IGSW 8 is turned off, and continues to output 5V.

  In this way, the sub-microcomputer 12 uses the power supplied from the second power supply circuit 16 to complete the shutdown process and finally stop the output of the second power supply holding signal.

<Shutdown processing when the first power source is healthy>
Next, with reference to the time chart shown in FIG. 8, the operation of each component when the IGSW 8 is turned off while the first power supply circuit 15 is operating normally (that is, without any abnormality) explain. Even after the IGSW 8 is set to OFF, the main microcomputer 11 and the sub-microcomputer 12 continue to operate for a fixed time (for example, 1 second) and perform a predetermined shutdown process (for example, saving data). If the IGSW 8 is turned off after the IGSW 8 is turned on and no abnormality has occurred in the first power supply circuit 15, the sub-microcomputer 12 executes the inspection process as part of the shutdown process.

  T40 shown in FIG. 7 represents the timing when the IGSW 8 is turned off, and T41 represents the timing when the shutdown processing of the main microcomputer 11 is completed. T42 represents the timing when the shutdown process in the sub-microcomputer 12 is completed.

  The sub-microcomputer 12 continues to output the first power supply holding signal as shown in (D) even after the IGSW 8 is turned off. Therefore, the output of the first power supply activation unit 18 is also maintained at the high level. As a result, the state where 5V generated by the first power supply circuit 15 is applied to the internal power supply line Ln continues. The main microcomputer 11 and the sub-microcomputer 12 each execute a shutdown process by the power supplied by the first power supply circuit 15.

  When the shutdown processing of the main microcomputer 11 is completed, the main microcomputer 11 outputs a signal to that effect (hereinafter, an end notification) to the sub-microcomputer 12. Upon receiving the end notification from the main microcomputer 11, the sub-microcomputer 12 outputs the second power supply holding signal and stops outputting the first power supply holding signal.

  As a result, the first power supply circuit 15 is stopped. Further, since the second power supply start-up unit 19 becomes high level by the second power supply hold signal, when the second power supply circuit 16 is healthy, the second power supply circuit 16 starts up and starts outputting 5V. If the sub-microcomputer 12 can operate at the timing when a predetermined time Tchk has elapsed after the second power-supply holding signal is output, the sub-microcomputer 12 indicates that the second power supply circuit 16 is normal, Is recorded in the nonvolatile memory 121 as Finally, the output of the second power supply holding signal is stopped to stop the second power supply circuit 16.

  When the sub-microcomputer 12 executes the inspection process after turning off the IGSW 8 in this way, and the second power supply circuit 16 operates normally, the non-volatile memory 121 indicates that the second power supply circuit 16 is normal. You can leave the data. Further, when the second power supply circuit 16 is out of order and the second power supply circuit 16 does not start up normally, the address at which the second power supply data should be recorded in the nonvolatile memory 121 (hereinafter, the inspection result recording Nothing is recorded in (Address). That is, the second power supply data remains cleared.

  Therefore, according to the above configuration, the sub-microcomputer 12 refers to the inspection result recording address of the non-volatile memory 121 when the IGSW 8 is turned on next time and is started, and thus whether the second power supply circuit 16 operates normally or not. Can be recognized. If the second power supply circuit 16 is out of order, the warning light 6 is turned on or other ECUs are notified that the ECU 1 is in trouble.

<Summary of Embodiments>
In the above configuration, when the abnormality detecting unit 20 does not detect the abnormal operation of the first power supply circuit 15 (hereinafter, normal time), the second power supply circuit 16 does not operate. Therefore, even if the second power supply circuit fails in normal time, the failure does not appear as a defect (in other words, detected). Therefore, it is possible to reduce the execution frequency of the fail-safe processing due to the failure of the power supply circuit.

  Further, the case where the second power supply circuit 16 operates is only when the inspection process is executed and when the first power supply circuit 15 fails. That is, the operating time of the second power supply circuit 16 is shorter than the operating time of the first power supply circuit 15. Therefore, the probability that the second power supply circuit 16 will fail due to the increase in the total operation time can be suppressed.

  Furthermore, when the first power supply circuit 15 fails, the second power supply circuit 16 is activated to supply power to the sub-microcomputer 12. The sub-microcomputer 12 operates by the electric power supplied from the second power supply circuit 16, and executes fail-safe processing such as realization of evacuation traveling. Therefore, it is possible to provide the same level of safety and convenience as the conventional technique disclosed in Patent Document 1.

  Further, in the above configuration, the normal range is set within the microcomputer operating range. With such a configuration, the power source can be switched to the second power supply circuit 16 before the various microcomputers are stopped.

  Further, in the above configuration, not only the lower limit value but also the upper limit value is specified as the normal range. Therefore, not only the voltage drop but also the abnormally high first output voltage V1 can be detected as an abnormal operation. When the output voltage of the first power supply circuit 15 exceeds the upper limit value of the normal range, the first power supply circuit 15 is stopped. With such a configuration, it is possible to reduce the risk of applying a voltage exceeding the upper limit of the microcomputer operating range (that is, an overvoltage) to the main microcomputer 11 and the sub-microcomputer 12. Therefore, it is possible to reduce the risk that the main microcomputer 11 and the sub-microcomputer 12 will fail due to the failure of the first power supply circuit 15.

  By the way, as another aspect, a configuration in which the second power supply circuit 16 is operated without stopping the first power supply circuit 15 after the abnormal operation of the first power supply circuit 15 is detected is also conceivable. In such a configuration, when a failure of a type that outputs a voltage higher than the output voltage of the second power supply circuit 16 (here, 5 V) occurs in the first power supply circuit 15, the second power supply circuit 16 substantially functions. Will not do. This is because the first power supply circuit 15 and the second power supply circuit 16 output the voltage to the common power supply line (that is, the internal power supply line Ln). In order to solve such a problem, in the above configuration, when the abnormal operation of the first power supply circuit 15 is detected, the first power supply circuit 15 is stopped, so that the output voltage of the second power supply circuit 16 can function. .

  Further, in the above configuration, the second power supply circuit 16 continues to operate when at least one of the output of the abnormality detection unit 20 and the output of the second power supply holding terminal of the sub-microcomputer 12 is at a high level. Therefore, even if the signal line through which the output signal of the abnormality detection unit 20 flows is disconnected, the power supply can be continued. That is, the vehicle control by the ECU 1 can be continued.

  Further, according to the above configuration, it is possible to prevent the power supply from being turned off and the control being stopped due to a failure of one signal line during execution of important control such as traveling. As a result, reliability can be improved.

  Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and various modifications described below are also included in the technical scope of the present invention. Also, various modifications can be implemented without departing from the scope of the invention.

  It should be noted that members having the same functions as the members described in the above-described embodiment are designated by the same reference numerals, and the description thereof will be omitted. When only a part of the configuration is mentioned, the configuration of the above-described embodiment can be applied to the other part.

[Modification 1]
In the above-described embodiment, the mode in which the normal range is set within the microcomputer operating range is disclosed, but the present invention is not limited to this. The normal range may be set larger than the microcomputer operation range so as to include the microcomputer operation range. For example, the normal range may be set to 3.9V to 5.6V with respect to the microcomputer operating range (4.0 to 5.5V).

[Modification 2]
In order to realize the second power supply circuit 16 at a lower cost, the control mode in which the main microcomputer 11 is stopped during the operation of the second power supply circuit 16 has been disclosed. This is because the current supply capacity required for the second power supply circuit 16 can be designed to be low if the main microcomputer 11 is stopped.

  On the other hand, as another mode, both the main microcomputer 11 and the sub-microcomputer 12 may be operated even when the second power supply circuit 16 is operating. In that case, it is assumed that the second power supply circuit 16 is configured to have a capability of supplying a current required to drive both the main microcomputer 11 and the sub-microcomputer 12. FIG. 9 shows an example of a circuit configuration in which the main microcomputer 11 can operate even when the second power supply circuit 16 is operating.

[Modification 3]
Although the configuration in which the first power supply circuit 15 is stopped when the abnormality detection unit 20 detects an abnormality in the first power supply circuit 15 has been disclosed above, the invention is not limited to this. For example, as shown in FIG. 10, a configuration may be adopted in which the first power supply circuit 15 continues to operate even after the abnormality detection unit 20 detects the abnormality of the first power supply circuit 15.

  In the configuration shown in FIG. 10, since the output terminal of the second power supply start-up unit 19 and the reset input terminal of the main microcomputer 11 are connected, after detecting the abnormality of the first power supply circuit 15, the main microcomputer 11 stops. FIG. 11 shows a configuration in which both the main microcomputer 11 and the first power supply circuit 15 continue to operate even after the abnormality of the first power supply circuit 15 is detected.

[Modification 4]
In the embodiment described above, the sub-microcomputer 12 has only a limited vehicle control function such as evacuation travel, but the present invention is not limited to this. The sub-microcomputer 12 may have a function of executing vehicle control similar to that of the main microcomputer 11. In addition, although the mode in which the ECU 1 is activated when the IGSW 8 is turned on is disclosed above, the activation trigger of the ECU 1 is not limited to this. The ECU 1 may be activated when a signal indicating that the charging plug is connected is input, or may be activated spontaneously due to expiration of an internal timer or the like. A signal that functions as a trigger for starting the power supply by the main microcomputer 11 and an output source (that is, a signal source) of the signal may be appropriately designed.

1 ECU (electronic control unit), 2 vehicle battery, 3 electronic throttle, 8 ignition switch, 11 main microcomputer, 12 sub-microcomputer, 13 first communication driver, 14 second communication driver, 15 first power supply circuit, 16 second power supply Circuit, 17 Drive Maintaining Section, 18 First Power Supply Starting Section, 19 Second Power Supply Starting Section, 20 Abnormality Detection Section, 21 Stabilizing Filter, 22 Delay Filter, Ln Internal Power Supply Line

Claims (10)

A control microcomputer (11, 12) which is a microcomputer for controlling the operation of a predetermined actuator mounted on the vehicle based on data input from a sensor mounted on the vehicle;
A first power supply circuit (15) as a power supply circuit that generates a voltage for driving the control microcomputer from a voltage supplied from a power supply device mounted on the vehicle and supplies the voltage to the control microcomputer.
An abnormality detection unit (20) for detecting an abnormal operation of the first power supply circuit based on the voltage output from the first power supply circuit;
A second power supply circuit (16) which is different from the first power supply circuit and which is activated in response to a detection result of the abnormality detection unit and supplies power to the control microcomputer;
An internal power supply line (Ln) which is a power supply line connecting the output terminal of the first power supply circuit, the output terminal of the second power supply circuit, and the power supply terminal of the control microcomputer ;
The first power supply circuit starts power supply to the control microcomputer triggered by an input of a start signal, which is a signal for starting the control, from a predetermined signal source,
When the abnormal operation of the first power supply circuit is not detected, the abnormality detection unit outputs a signal for stopping the second power supply circuit,
The electronic control device , wherein the abnormality detection unit outputs a signal for activating the second power supply circuit when detecting an abnormal operation of the first power supply circuit . In claim 1,
In the control microcomputer, the lower limit value and the upper limit value of the voltage at which the control microcomputer operates are set as the operating voltage range,
With respect to the output voltage of the first power supply circuit, a normal voltage range, which is a range in which the abnormality detection unit considers the output voltage of the first power supply circuit to be normal, is preset,
The normal voltage range is set to be included in the operating voltage range,
The electronic control device, wherein the abnormality detection unit detects that the output voltage of the first power supply circuit is a value outside the normal voltage range as an abnormal operation of the first power supply circuit. In claim 2,
The electronic control device, wherein the first power supply circuit stops the operation when the abnormal detection unit detects an abnormal operation of the first power supply circuit. In any one of Claim 1 to 3,
The control microcomputer includes a first microcomputer and a second microcomputer,
When the abnormal operation of the first power supply circuit is not detected by the abnormality detection unit, both the first microcomputer and the second microcomputer operate,
The electronic control unit, wherein the control microcomputer stops the operation when the abnormality detecting unit detects an abnormal operation of the first power supply circuit. In claim 4,
The second microcomputer is
A memory (121) capable of holding data even when power is not supplied from the first power supply circuit,
Controlling the operating states of the first power supply circuit and the second power supply circuit,
The second microcomputer is
An abnormal operation of the first power supply circuit is detected during the period from the input of a predetermined signal for starting the control from the signal source to the satisfaction of a predetermined end condition for ending the control. If not, the first power supply circuit is stopped and the second power supply circuit is started along with the satisfaction of the termination condition,
If the second microcomputer is still operating when a certain time has elapsed after the second power supply circuit was started, the operation confirmation data indicating that the second power supply circuit is normal is recorded in the memory. An electronic control device characterized by the above. In claim 5,
The electronic control unit, wherein the second microcomputer deletes the operation confirmation data recorded in the memory each time it is activated. In Claim 5 or 6,
When the abnormality detection unit once detects an abnormal operation of the first power supply circuit, a predetermined clear signal is input from the second microcomputer as a determination result that an abnormality has occurred in the first power supply circuit. Hold until
While it is determined that the first power supply circuit has an abnormality, an abnormality detection signal indicating that the first power supply circuit has an abnormality is output as a signal for activating the second power supply circuit. Is something
The second microcomputer operates the second power supply circuit by outputting a second power supply holding signal,
The second power supply circuit operates when the abnormality detection unit outputs the abnormality detection signal or the second microcomputer outputs the second power supply holding signal. Control device. In any one of Claims 4 to 7,
The electronic control device according to claim 2, wherein the second microcomputer executes a predetermined fail-safe process when the abnormal operation of the first power supply circuit is detected by the abnormality detection unit. In any one of Claims 4 to 8,
The electronic control device, wherein the second power supply circuit is configured to output electric power for driving both the first microcomputer and the second microcomputer. In any one of Claim 1 to 9,
The electronic control unit, wherein the abnormality detection unit is configured to start at a time point when the activation signal is input as a start time point and at a timing when a predetermined time has elapsed from the start time point.

Images