JP6919359B2 - Electronic control device - Google Patents

Description

The present disclosure relates to an electronic control device.

Conventionally, as disclosed in Patent Document 1, there is an ECU including a microcomputer and an IC for monitoring the operation of the microcomputer.

Japanese Unexamined Patent Publication No. 2016-71635

By the way, in an electronic control device provided with a control unit, it is conceivable to reset the control unit when some abnormality occurs in the control unit. In this way, the electronic control device can suppress the continuation of the abnormal state of the control unit by resetting the control unit.

Further, the electronic control device may be required to be controlled by the control unit even when an abnormality occurs in the control unit. However, the electronic control device has a problem that when the control unit is reset due to some abnormality in the control unit, the control by the control unit is interrupted.

The present disclosure has been made in view of the above problems, and an object of the present invention is to provide an electronic control device capable of continuing control by the control unit even when an abnormality occurs in the control unit.

To achieve the above objectives, this disclosure is:
An electronic control device including a control unit (10) that controls an external device by outputting a control signal to the external device.
The control unit
An arithmetic unit (11) that performs arithmetic processing for outputting a control signal, and
A monitoring calculation unit (12) that monitors the operation of the calculation unit, and
It is provided with a state management unit (13) that manages the state in the control unit and determines whether or not the inside of the control unit is in an abnormal state.
When the state management unit determines that the inside of the control unit is in an abnormal state, the state management unit monitors while continuing the operation of the calculation unit, provided that the operation of the calculation unit is not determined to be abnormal by the monitoring calculation unit. It is characterized in that the operation of the arithmetic unit is stopped.

Thereby, in the present disclosure, even if it is determined that there is an abnormality in the control unit, the output of the control signal can be continued and the external device can be controlled. Further, in the present disclosure, when it is determined that there is an abnormality in the control unit, the operation of the monitoring calculation unit is stopped, so that the processing load of the control unit can be reduced.

The scope of claims and the reference numerals in parentheses described in this section indicate the correspondence with the specific means described in the embodiment described later as one embodiment, and the technical scope of the present disclosure. Is not limited to.

It is a block diagram which shows the schematic structure of the ECU in 1st Embodiment. It is a flowchart which shows the processing operation of the ECU in 1st Embodiment. It is a flowchart which shows the processing operation of the ECU in 2nd Embodiment. It is a flowchart which shows the processing operation of the ECU in 3rd Embodiment. It is a flowchart which shows the processing operation of the ECU in 4th Embodiment. It is a flowchart which shows the processing operation of the ECU in 5th Embodiment. It is a flowchart which shows the processing operation of the monitoring IC in 5th Embodiment.

Hereinafter, a plurality of modes for carrying out the present disclosure will be described with reference to the drawings. In each form, the same reference numerals may be given to the parts corresponding to the matters described in the preceding forms, and duplicate explanations may be omitted. In each form, when only a part of the configuration is described, the other parts of the configuration can be applied with reference to the other forms described above.

(First Embodiment)
In this embodiment, the electronic control device is applied to the ECU (Electronic Control Unit) 100. As shown in FIG. 1, the ECU 100 mainly includes a microcomputer 10 and a monitoring IC 20, and is electrically connected to a meter 200 and an electronic throttle device 300. Further, the ECU 100 is configured to be mounted on a vehicle and can be said to be an in-vehicle control device.

The microcomputer 10 corresponds to a control unit within the scope of claims. The microcomputer 10 controls the external device by outputting a control signal to an external device provided outside the ECU 100. In this embodiment, a meter 200 and an electronic throttle device 300 are used as external devices. The microcomputer 10 mainly includes a microcomputer core 11, a lock step core 12, an abnormality management mechanism 13, a storage unit 14, a temperature sensor 15, a power supply management unit 16, an I / O unit 17, and the like. The microcomputer 10 is electrically connected to the monitoring IC 20 via the I / O unit 17 and the IC side port 21 of the monitoring IC 20.

The microcomputer core 11 corresponds to a calculation unit within the scope of claims. The microcomputer core 11 performs arithmetic processing for outputting a control signal. That is, the microcomputer core 11 performs various calculations by executing the program stored in the storage unit 14 described later, and performs various controls by outputting the calculation results.

Further, the microcomputer core 11 is electrically connected to the meter 200 via, for example, a microcomputer I / O and an ECU input / output unit. The microcomputer core 11 controls the display of the meter 200 by outputting a control signal indicating a lamp lighting instruction to the meter 200. In other words, the microcomputer core 11 requests the meter 200 to turn on the lamp. Further, the microcomputer core 11 is electrically connected to the throttle motor in the electronic throttle device 300 via, for example, the microcomputer I / O and the drive IC. The microcomputer I / O, the ECU input / output unit, and the drive IC are not shown.

The lock step core 12 corresponds to a monitoring calculation unit within the scope of claims. The lock step core 12 performs various operations by executing a program stored in the storage unit 14 described later. Further, the lock step core 12 monitors the operation of the microcomputer core 11. For example, the lock step core 12 performs the same arithmetic processing as the microcomputer core 11, and compares the arithmetic result of the lock step core 12 with the arithmetic result of the microcomputer core 11. Then, the lock step core 12 determines that the two calculation results are abnormal when they do not have a predetermined correspondence relationship, for example, when they do not match.

As described above, the microcomputer 10 includes two cores, a microcomputer core 11 and a lock step core 12, and both cores 11 and 12 perform the same arithmetic processing. However, it is the microcomputer core 11 that outputs the control signal. The lock step core 12 is provided to monitor the operation of the microcomputer core 11.

The abnormality management mechanism 13 corresponds to a state management unit within the scope of claims. The abnormality management mechanism 13 manages the state in the microcomputer 10 and determines whether or not the inside of the microcomputer 10 is in an abnormal state. As will be described in detail later, when the abnormality management mechanism 13 determines that the inside of the microcomputer 10 is in an abnormal state, the abnormality management mechanism 13 stops the operation of the lock step core 12 while continuing the operation of the microcomputer core 11.

The abnormality management mechanism 13 determines whether or not the microcomputer 10 is in an abnormal state based on at least one of the temperature of the microcomputer 10, the current consumption of the microcomputer 10, and the power consumption of the microcomputer 10. For example, the abnormality management mechanism 13 can determine whether or not the inside of the microcomputer 10 is in an abnormal state based on the temperature of the microcomputer 10, so that the microcomputer 10 can determine the high temperature abnormality. Further, the abnormality management mechanism 13 can determine a circuit abnormality in the microcomputer 10 by determining whether or not the inside of the microcomputer 10 is in an abnormal state based on the current consumption and the power consumption of the microcomputer 10.

For example, the abnormality management mechanism 13 compares the temperature of the microcomputer 10 with the temperature abnormality threshold value, determines that the temperature of the microcomputer 10 reaches the temperature abnormality threshold value, determines that the temperature is abnormal, and if the temperature does not reach the temperature abnormality threshold value, determines that the temperature is abnormal. Do not judge. The abnormality management mechanism 13 is configured to be able to acquire the temperature of the microcomputer 10 from the temperature sensor 15 described later.

When the temperature of the microcomputer 10 reaches the temperature abnormality threshold value, the power consumption of the microcomputer 10 can be regarded as excessive. Therefore, when the abnormality management mechanism 13 determines that the abnormal state is determined based on the temperature of the microcomputer 10, the operation of the lock step core 12 is stopped to reduce the power consumption of the microcomputer 10 and lower the temperature of the microcomputer 10. An abnormal state in which the temperature reaches the temperature abnormality threshold can be rephrased as a high temperature abnormality or a high temperature state.

Further, the abnormality management mechanism 13 compares the current consumption of the microcomputer 10 with the current abnormality threshold value, determines that the current consumption of the microcomputer 10 reaches the current abnormality threshold value, determines that it is in an abnormal state, and if it does not reach the current abnormality threshold value, it is abnormal. It is not judged as a state. The abnormality management mechanism 13 is configured to be able to acquire the current consumption of the microcomputer 10 from the power supply management unit 16.

When the current consumption of the microcomputer 10 has reached the current abnormality threshold value, it can be considered that the temperature of the microcomputer 10 is high. Therefore, when the abnormality management mechanism 13 determines that the abnormal state is determined based on the current consumption of the microcomputer 10, the operation of the lock step core 12 is stopped and the temperature of the microcomputer 10 is lowered.

Further, the abnormality management mechanism 13 compares the power consumption of the microcomputer 10 with the power abnormality threshold value, determines that if the power consumption of the microcomputer 10 reaches the power abnormality threshold value, it determines that it is in an abnormal state, and if it does not reach it, it determines that it is in an abnormal state. It is not judged as a state. The abnormality management mechanism 13 is configured to be able to acquire the power consumption of the microcomputer 10 from the power supply management unit 16.

When the power consumption of the microcomputer 10 reaches the current abnormality threshold value, it can be considered that the temperature of the microcomputer 10 is high. Therefore, when the abnormality management mechanism 13 determines that the abnormality state is determined based on the power consumption of the microcomputer 10, the operation of the lock step core 12 is stopped and the temperature of the microcomputer 10 is lowered. An abnormal state in which the current consumption reaches the current abnormality threshold value or an abnormal state in which the power consumption reaches the power abnormality threshold value can be rephrased as a circuit abnormality, a high temperature abnormality, or a high temperature state.

Further, the abnormality management mechanism 13 may determine whether or not it is in an abnormal state by using, for example, two pieces of information, the temperature and the current consumption of the microcomputer 10. In this case, the abnormality management mechanism 13 determines that the temperature of the microcomputer 10 has reached the temperature abnormality threshold value and the current consumption of the microcomputer 10 has reached the current abnormality threshold value, and determines that the temperature and the current consumption are abnormal. If either one does not reach the abnormal threshold value, it is not judged as an abnormal state. As a result, the abnormality management mechanism 13 can improve the determination accuracy rather than determining whether or not it is in an abnormal state based on one piece of information.

In the present embodiment, an abnormality management mechanism 13 for determining whether or not the inside of the microcomputer 10 is in an abnormal state is adopted based on the temperature of the microcomputer 10.

When the abnormality management mechanism 13 determines that the condition is abnormal, the abnormality management mechanism 13 may notify the monitoring IC 20 that the condition is abnormal. In this case, the abnormality management mechanism 13 outputs a signal indicating an abnormal state to the IC side port 21 via the I / O unit 17. In other words, when the abnormality management mechanism 13 determines that it is abnormal, it notifies the monitoring IC 20 of an error. For example, when the abnormality management mechanism 13 determines that it is abnormal, the IC side port 21 is turned from off to on via the I / O unit 17.

The abnormality management mechanism 13 operates independently of the microcomputer core 11. As a result, the abnormality management mechanism 13 can reliably notify the monitoring IC 20 of an error. Further, the microcomputer 10 can reduce the processing load of the microcomputer core 11 as compared with having the microcomputer core 11 perform the processing performed by the abnormality management mechanism 13.

When the abnormality management mechanism 13 determines that it is in an abnormal state and stops the operation of the lock step core 12, it notifies the microcomputer core 11. In this case, the abnormality management mechanism 13 outputs a signal to the microcomputer core 11 indicating that the lock step core 12 is in the stopped operation state.

The storage unit 14 is a non-transitional substantive storage medium that non-temporarily stores programs and data that can be read by the microcomputer core 11 or the lock step core 12. This storage medium is realized by a semiconductor memory, a magnetic disk, or the like. The storage unit 14 also stores an abnormal threshold value such as a temperature abnormal threshold value. The microcomputer 10 may be provided with a volatile memory for temporarily storing data.

The program is executed by the microcomputer core 11 or the lock step core 12 to cause the microcomputer core 11 or the lock step core 12 to function as the device described in this specification, and executes the method described in this specification. To make the control device work. The microcomputer core 11 and the lock step core 12 provide various elements. At least some of those elements can be called means for performing a function. From another point of view, at least a part of those elements can be called a constructive block or module.

The means and / or functions provided by the ECU 100 can be provided by software recorded in a substantive memory device and a computer, software only, hardware only, or a combination thereof that executes the software. For example, if the ECU 100 is provided by an electronic circuit that is hardware, it can be provided by a digital circuit or an analog circuit that includes a large number of logic circuits.

The temperature sensor 15 measures the temperature inside the microcomputer 10 and outputs the measurement result to the abnormality management mechanism 13. That is, the temperature sensor 15 outputs an electric signal corresponding to the temperature in the microcomputer 10 to the abnormality management mechanism 13 as a measurement result.

The power management unit 16 supplies power to the microcomputer core 11 and the lock step core 12. Further, the power supply management unit 16 stops the power supply to the lock step core 12 in response to an instruction from the abnormality management mechanism 13. That is, when the abnormality management mechanism 13 determines that it is in an abnormal state, it outputs a stop signal indicating that the power supply is stopped to the power management unit 16. In this way, the abnormality management mechanism 13 stops the operation of the lock step core 12 by stopping the power supply to the lock step core 12. Stopping the power supply can be rephrased as shutting off the power supply.

Since the ECU 100 stops the operation of the lock step core 12 by stopping the supply of power to the lock step core 12, the lock step core 12 can be easily put into the operation stop state. The power management unit 16 restarts the power supply to the lock step core 12 by resetting the microcomputer 10 after stopping the power supply to the lock step core 12.

The monitoring IC 20 is electrically connected to the throttle motor in the electronic throttle device 300 via, for example, the drive IC. The monitoring IC 20 resets the microcomputer 10 and stops the power supply to the electronic throttle device 300. Further, the monitoring IC 20 stops the throttle motor by stopping the drive IC.

The meter 200 corresponds to a display device in the claims. The meter 200 is provided in the vehicle interior and is configured to be visible to occupants such as drivers. The meter 200 is displayed and controlled according to a control signal from the ECU 100. For example, the meter 200 turns on the lamp when a control signal indicating a lamp lighting instruction is input from the ECU 100. The ECU 100 may output not only a control signal indicating a lamp lighting instruction but also a control signal indicating characters and images to be displayed by the meter 200. In this case, the meter 200 displays characters and images indicated by the control signal. In this embodiment, even the ECU 100 to which the meter 200 is not electrically connected can be adopted.

The electronic throttle device 300 includes a throttle motor, a throttle valve, and the like as actuators. In the electronic throttle device 300, the opening degree of the throttle valve is controlled according to the control signal from the ECU 100 while the power is being supplied to the throttle motor. In the electronic throttle device 300, when the power supply to the throttle motor is stopped, the throttle valve is not completely closed (fully closed position), and the throttle valve is slightly opened from the fully closed position. It becomes a degree. Therefore, the electronic throttle device 300 is configured so that a small amount of air is sent to the engine even when the power supply to the throttle motor is stopped. It can be said that the throttle valve has an opening degree that enables limp home running when the power supply to the throttle motor is stopped. In this embodiment, even the ECU 100 to which the electronic throttle device 300 is not electrically connected can be adopted.

In this embodiment, the meter 200 and the electronic throttle device 300 are adopted as an example of the external device. However, the present disclosure is not limited to this, and an electronic device different from the meter 200 and the electronic throttle device 300 can be adopted as an external device.

Here, the processing operation of the ECU 100 will be described with reference to FIG. More specifically, the flowchart of FIG. 2 is a processing operation executed by the microcomputer 10. When the power is supplied, the microcomputer 10 starts executing the flowchart of FIG.

In step S10, the temperature is measured. The microcomputer 10 measures the temperature of the microcomputer 10 by the temperature sensor 15. Then, the abnormality management mechanism 13 acquires the measurement result of the temperature sensor 15.

In step S11, it is determined whether or not the temperature is high. The abnormality management mechanism 13 determines whether or not the microcomputer 10 is in a high temperature state by comparing the temperature of the microcomputer 10 which is the measurement result of the temperature sensor 15 with the temperature abnormality threshold value. The abnormality management mechanism 13 determines that the temperature of the microcomputer 10 has reached the temperature abnormality threshold value and proceeds to step S12. If the temperature of the microcomputer 10 has not reached the temperature abnormality threshold value, the abnormality management mechanism 13 is in a high temperature state. The process returns to step S10 without determining the existence. In this way, when the microcomputer 10 determines that the temperature of the microcomputer 10 is not in a high temperature state, the microcomputer 10 repeatedly executes steps S10 and S11.

In step S12, the power supply to the lock step core 12 is cut off. The abnormality management mechanism 13 outputs a stop signal to the power supply management unit 16. When the power management unit 16 acquires the stop signal, the power management unit 16 cuts off the power supply to the lock step core 12. In this way, the abnormality management mechanism 13 stops the operation of the lock step core 12 by shutting off the power supply of the lock step core 12.

At this time, the power management unit 16 cuts off the power supply to the lock step core 12 while continuing the power supply to the microcomputer core 11. As a result, in the microcomputer 10, the lock step core 12 becomes inoperable while the microcomputer core 11 can operate. Further, the abnormality management mechanism 13 outputs a signal to the microcomputer core 11 indicating that the lock step core 12 is in the operation stopped state.

The abnormality management mechanism 13 may output a signal indicating that the microcomputer 10 is in a high temperature state to the microcomputer core 11. Further, the abnormality management mechanism 13 stops the operation of the lock step core 12 when the microcomputer 10 has a high temperature abnormality. Therefore, the signal indicating that the lock step core 12 is in the stopped operation state and the signal indicating that the microcomputer 10 is in a high temperature abnormality can be regarded as agreeing.

In step S13, a lamp lighting request is made to the meter 200. The microcomputer core 11 outputs a control signal indicating a lamp lighting instruction to indicate on the meter 200 that the microcomputer 10 has a high temperature abnormality. Further, it can be said that the microcomputer core 11 displays on the meter 200 that the lock step core 12 is in the operation stopped state by outputting a control signal indicating a lamp lighting instruction. As a matter of course, the microcomputer core 11 may output a control signal indicating a lamp lighting instruction to indicate to the meter 200 that the lock step core 12 is in the stopped operation state because the microcomputer 10 has a high temperature abnormality. ..

The meter 200 is provided outside the microcomputer 10 and outside the ECU 100. That is, the meter 200 is provided at a position where an occupant such as a driver can see it. Therefore, the ECU 100 can notify an occupant such as a driver that the microcomputer 10 has a high temperature abnormality and that the lock step core 12 is in an operation stopped state.

In this way, when the ECU 100 determines that there is an abnormality in the microcomputer 10, that is, when the microcomputer 10 is determined to be in a high temperature state, the operation of the lock step core 12 is stopped while continuing the operation of the microcomputer core 11. .. As a result, the ECU 100 can continue to output the control signal by the microcomputer core 11 even if it is determined that there is an abnormality in the microcomputer 10, and the meter 200 can be displayed and controlled. Further, the ECU 100 stops the operation of the lock step core 12 when the microcomputer 10 determines that the temperature is high, so that the temperature of the microcomputer 10 can be lowered.

Further, when the microcomputer 10 controls the engine, the ECU 100 may stop the engine by resetting the microcomputer 10. However, since the ECU 100 continues the operation of the microcomputer core 11 even when the microcomputer 10 is in a high temperature state, it is possible to prevent the engine from being stopped against the intention of the driver.

The preferred embodiments of the present disclosure have been described above. However, the present disclosure is not limited to the above-described embodiment, and various modifications can be made without departing from the spirit of the present disclosure. The second to fifth embodiments will be described below as other embodiments of the present disclosure. The above-described embodiment and the second to fifth embodiments can be carried out individually, or can be carried out in combination as appropriate. The present disclosure is not limited to the combinations shown in the embodiments, but can be implemented in various combinations.

(Second Embodiment)
The second embodiment will be described with reference to FIG. The ECU of the second embodiment has the same configuration as the ECU 100, and the processing operation is different from that of the ECU 100. Therefore, in the present embodiment, for convenience, the same reference numerals as those of the ECU 100 will be used for description. In the flowchart of FIG. 3, the same step number is assigned to the same process as that of the flowchart of FIG. Therefore, the same step numbers as those in the flowchart of FIG. 2 can be applied with reference to the above embodiment.

When the power is supplied, the microcomputer 10 starts executing the flowchart of FIG. In step S20, it is determined whether or not an abnormality has been detected. The abnormality management mechanism 13 determines whether or not the lock step core 12 has detected an abnormality in the microcomputer core 11, that is, whether or not the lock step core 12 has determined that the microcomputer core 11 is abnormal. The abnormality management mechanism 13 proceeds to step S21 when the lock step core 12 determines that the microcomputer core 11 is abnormal, and proceeds to step S10 when it does not determine that the microcomputer core 11 is abnormal.

The lock step core 12 may store the monitoring result of the microcomputer core 11 by using, for example, a flag. For example, the lock step core 12 sets a flag when it is determined that the microcomputer core 11 is abnormal, and sets the flag when it is not determined that the microcomputer core 11 is abnormal. By confirming the stored contents, the abnormality management mechanism 13 can determine whether or not the lock step core 12 determines that the microcomputer core 11 is abnormal.

In step S21, the microcomputer 10 is reset. When the abnormality management mechanism 13 obtains a determination result that the microcomputer core 11 is abnormal, the abnormality management mechanism 13 requests the monitoring IC 20 to reset the microcomputer 10. When the monitoring IC 20 receives a reset request from the abnormality management mechanism 13, the monitoring IC 20 resets the microcomputer 10.

On the other hand, when the lock step core 12 does not determine that the operation of the microcomputer core 11 is abnormal, the abnormality management mechanism 13 proceeds to step S10 and performs the same process as in FIG. Therefore, when the abnormality management mechanism 13 determines YES in step S10, the lock step core 12 continues the operation of the microcomputer core 11 on the condition that the lock step core 12 does not determine the microcomputer core 11 as abnormal. The operation of 12 is stopped.

The ECU 100 of the present embodiment can achieve the effects described in the first embodiment. Further, when the ECU 100 continues the operation of the microcomputer core 11 in a situation where it is determined that the inside of the microcomputer 10 is in an abnormal state, the operation can be continued by the microcomputer core 11 in the normal state. Further, it can be said that the ECU 100 can maintain the reliability because the operation of the lock step core 12 is stopped on condition that the microcomputer core 11 is operating normally. In this way, the ECU 100 can lower the temperature of the microcomputer 10 while maintaining reliability.

(Third Embodiment)
The third embodiment will be described with reference to FIG. The ECU of the third embodiment has the same configuration as the ECU 100, and the processing operation is different from that of the ECU 100. Therefore, in the present embodiment, for convenience, the same reference numerals as those of the ECU 100 will be used for description. In the flowchart of FIG. 4, the same step number is assigned to the same process as that of the flowcharts of FIGS. 2 and 3. Therefore, the same step numbers as those in the flowcharts of FIGS. 2 and 3 can be applied with reference to the above embodiment.

As shown in FIG. 4, the third embodiment is an embodiment in which the first embodiment and the second embodiment are combined. Therefore, the ECU 100 of the present embodiment can achieve the effects described in the first embodiment and the second embodiment.

(Fourth Embodiment)
The fourth embodiment will be described with reference to FIG. The ECU of the fourth embodiment has the same configuration as the ECU 100, and the processing operation is different from that of the ECU 100. Therefore, in the present embodiment, for convenience, the same reference numerals as those of the ECU 100 will be used for description. In the flowchart of FIG. 5, the same step number is assigned to the same process as that of the flowchart of FIG. Therefore, the same step numbers as those in the flowchart of FIG. 3 can be applied with reference to the above embodiment.

The microcomputer 10 proceeds to step S40 after step S12. In step S40, the microcomputer core 11 stores in the storage unit 14 that the lock step core 12 is in the stopped operation state. That is, the microcomputer core 11 stores the history in which the lock step core 12 has stopped operating in the storage unit 14. The storage unit 14 allows an operator to check the stored contents at a dealer, a repair shop, or the like.

The ECU 100 can achieve the effects described in the second embodiment. Further, the ECU 100 can notify the operator whether or not the lock step core 12 has stopped operating. The ECU 100 does not have to perform steps S20 and S21.

(Fifth Embodiment)
The fifth embodiment will be described with reference to FIGS. 6 and 7. The ECU of the fifth embodiment has the same configuration as the ECU 100, and the processing operation is different from that of the ECU 100. Therefore, in the present embodiment, for convenience, the same reference numerals as those of the ECU 100 will be used for description. In the flowchart of FIG. 6, the same step number is assigned to the same process as that of the flowchart of FIG. Therefore, the same step numbers as those in the flowchart of FIG. 3 can be applied with reference to the above embodiment. The ECU 100 is mounted on a vehicle equipped with an engine as a traveling drive source, and controls the throttle valve opening degree of the electronic throttle device 300.

The microcomputer 10 proceeds to step S50 after step S12. In step S50, the output is output to the monitoring IC 20. That is, when the abnormality management mechanism 13 determines that it is in an abnormal state, it notifies the monitoring IC 20 that it is in an abnormal state.

On the other hand, when the power is supplied, the monitoring IC 20 starts the process shown in the flowchart of FIG. 7. In step S60, it is determined whether or not the IC side port 21 is on.

The monitoring IC 20 determines whether or not the microcomputer 10 is in an abnormal state depending on whether or not the IC-side port 21 is on. When the monitoring IC 20 determines that the IC side port 21 is on, it considers that the microcomputer 10 is in an abnormal state and proceeds to step S61. If the monitoring IC 20 does not determine that the IC-side port 21 is on, it considers that the microcomputer 10 is not in an abnormal state and returns to step S60.

In step S61, the electronic throttle is shut off. The monitoring IC 20 outputs a control signal indicating that the power supply to the throttle motor is stopped to the electronic throttle device 300. In other words, the monitoring IC 20 stops the power supply to the throttle motor. For example, the monitoring IC 20 stops the power supply to the throttle motor by stopping the drive IC.

In the electronic throttle device 300, when the power supply to the throttle motor is stopped, the throttle valve opens to a minimum opening degree. This limits the output of the engine.

Therefore, the control signal indicating that the power supply to the throttle motor is stopped can be said to be a control signal for limiting the output of the engine. Further, the monitoring IC 20 corresponds to an output limiting unit within the scope of claims.

The ECU 100 can achieve the effects described in the second embodiment. Further, the ECU 100 can limit the output of the engine when it is determined that the microcomputer 10 is in an abnormal state, so that it is possible to suppress the vehicle from accelerating more than necessary. Therefore, the ECU 100 can enable evacuation running such as limp home running even when the microcomputer 10 is determined to be in an abnormal state. The ECU 100 does not have to perform steps S20 and S21.

10 ... Microcomputer, 11 ... Microcomputer core, 12 ... Lock step core, 13 ... Abnormality management mechanism, 14 ... Storage unit, 15 ... Temperature sensor, 16 ... Power supply management unit, 17 ... I / O unit, 20 ... Monitoring IC, 21 ... IC side port, 100 ... ECU, 200 ... meter, 300 ... electronic throttle device

Claims (7)

An electronic control device including a control unit (10) that controls an external device by outputting a control signal to the external device.
The control unit
An arithmetic unit (11) that performs arithmetic processing for outputting the control signal, and
A monitoring calculation unit (12) that monitors the operation of the calculation unit, and
It is provided with a state management unit (13) that manages the state in the control unit and determines whether or not the inside of the control unit is in an abnormal state.
When the state management unit determines that the inside of the control unit is in an abnormal state, the state management unit performs the operation of the calculation unit on condition that the operation of the calculation unit is not determined to be abnormal by the monitoring calculation unit. An electronic control device that stops the operation of the monitoring calculation unit while continuing the operation. Said state management unit, the temperature of the control unit, the current consumption of the arithmetic unit, based on at least one of the power consumption of the arithmetic unit, wherein the control portion determines claim whether the abnormal state 1 electronic control unit according to. Claim 1 or 2 that, when the state management unit stops the operation of the monitoring calculation unit, displays on the display device (200) as the external device that the monitoring calculation unit is in the stopped operation state. The electronic control device according to. The electronic control device according to any one of claims 1 to 3 , wherein the control unit includes a storage unit that stores that the monitoring calculation unit is in an operation stopped state. The electronic control device according to claim 3 or 4 , wherein the state management unit operates independently of the calculation unit. The electronic control device according to claim 3 or 4 , wherein the state management unit stops the operation of the monitoring calculation unit by stopping the power supply to the monitoring calculation unit. It is mounted on a vehicle equipped with an engine as a driving drive, and controls the throttle valve opening degree of the electronic throttle as the external device.
When the state management unit determines that the inside of the control unit is in an abnormal state, it further includes an output limiting unit (20) that outputs the control signal for limiting the output of the engine to the electronic throttle. The electronic control device according to any one of claims 1 to 6.

Images