CN112141121A

CN112141121A - Electronic control device and vehicle control system

Info

Publication number: CN112141121A
Application number: CN202010597002.9A
Authority: CN
Inventors: 伊藤澄信
Original assignee: Nidec Corp
Current assignee: Nidec Corp
Priority date: 2019-06-27
Filing date: 2020-06-28
Publication date: 2020-12-29
Also published as: JP2021004587A

Abstract

The invention provides an electronic control device and a vehicle control system. An electronic control device according to an aspect of the present invention includes: a processor capable of stopping an action of a subject; a monitor timer for outputting an abnormality detection signal when an abnormality occurs in a monitor signal output from the processor; a 1 st flip-flop, an output signal of the 1 st flip-flop being maintained in a 1 st state when the processor is started; a signal output circuit capable of outputting an operation stop signal to a subject in a state where an output signal of the 1 st flip-flop is held in the 1 st state; the 2 nd trigger is connected with the signal output circuit; and a reset circuit capable of resetting the processor.

Description

Electronic control device and vehicle control system

Technical Field

The invention relates to an electronic control device and a vehicle control system.

Background

An electronic control device having a microprocessor that is reset when an abnormality occurs is known. In such an electronic control device, when the microprocessor is reset, the operation of a communication unit or the like that can communicate with a control target of the electronic control device or another electronic control device is stopped, and the influence of the reset of the microprocessor on the control target, the communication unit, or the like is suppressed. For example, patent document 1 describes a vehicle control device that stops power supply to a vehicle-mounted load when a microprocessor is restarted.

Patent document 1: japanese laid-open patent publication No. 2002-235598

In patent document 1, when the supply of electric power to the vehicle-mounted load is stopped, the supply of electric power to the vehicle-mounted load is kept stopped until the vehicle-mounted load is restarted after the operation of the vehicle control device is stopped. However, for example, when an abnormality generated in the electronic control device is serious, it is preferable to stop the supply of electric power to the vehicle-mounted load, but when the abnormality generated in the electronic control device is slight, it is preferable to restart the supply of electric power to the vehicle-mounted load after resetting the microprocessor from the viewpoint of convenience. In the electronic control device, it is desired to realize such control of the object corresponding to the degree of abnormality or the like by a simple circuit configuration.

Disclosure of Invention

In view of the above circumstances, an object of the present invention is to provide an electronic control device capable of controlling an object according to the degree of an abnormality that has occurred by a simple circuit structure, and a vehicle control system including the electronic control device.

An electronic control device according to an aspect of the present invention includes: a processor capable of stopping an action of a subject; a monitor timer that outputs an abnormality detection signal when an abnormality occurs in the monitor signal output from the processor; a 1 st flip-flop, an output signal of which 1 st flip-flop is held in a 1 st state when the processor is started; a signal output circuit capable of outputting an operation stop signal to the object in a state where the output signal of the 1 st flip-flop is held in the 1 st state; a 2 nd flip-flop connected to the signal output circuit; and a reset circuit capable of resetting the processor. The processor can output a latch signal that maintains a state of an output signal of the 2 nd flip-flop to be a 2 nd state. The signal output circuit outputs the operation stop signal to the object when the abnormality detection signal is output and when the output signal of the 2 nd flip-flop is held in the 2 nd state. The reset circuit resets the processor in a state where the object is stopped by the operation stop signal.

A vehicle control system according to an aspect of the present invention includes: an in-vehicle electronic control device, which is the electronic control device described above; and another in-vehicle electronic control device connected to the in-vehicle electronic control device in a data-communicable manner. The in-vehicle electronic control device has a communication unit for performing data communication between the processor and the other in-vehicle electronic control device.

According to one aspect of the present invention, it is possible to provide an electronic control device capable of controlling an object according to the degree of an abnormality that has occurred by a simple circuit structure, and a vehicle control system including the electronic control device.

Drawings

Fig. 1 is a diagram showing a circuit configuration of an electronic control device according to the present embodiment.

Fig. 2 is a timing chart showing the operation of the electronic control device according to the present embodiment.

Fig. 3 is a diagram showing a circuit configuration of an electronic control device according to a modification.

Fig. 4 is a block diagram showing a vehicle control system of the present embodiment.

Description of the reference symbols

1. 1A: an electronic control device; 10: a power supply output section; 20. 20A: a processor; 30: a storage unit; 40: a communication unit (target); 50: monitoring a timer; 60: 1, a trigger; 70: a 2 nd flip-flop; 80. 80A: a signal output circuit; 81: a 1 st tri-state buffer; 82: or a circuit; 90: a reset circuit; 91: a power supply monitoring circuit; 92: a 2 nd tri-state buffer; 100: a vehicle control system; 200: ADAS-ECU (electronic control unit for vehicle); 300: an EPS-ECU (other in-vehicle electronic control device); 400: ABS-ECU (other onboard electronic control device); 500: an instrument ECU (other in-vehicle electronic control device).

Detailed Description

Hereinafter, one embodiment of the present invention will be described in detail with reference to the drawings.

[ electronic control device ]

First, the electronic control device 1 of the present embodiment will be explained. Fig. 1 is a diagram showing a circuit configuration of an electronic control device 1 of the present embodiment. The electronic control device 1 is, for example, an in-vehicle electronic control device mounted on a vehicle. As shown in fig. 1, the electronic control device 1 includes a power supply output unit 10, a processor 20, a storage unit 30, a communication unit 40, a monitoring timer 50, a 1 st flip-flop 60, a 2 nd flip-flop 70, a signal output circuit 80, and a reset circuit 90.

The power output unit 10 is, for example, a DC/DC converter. The power output unit 10 converts a dc voltage VB input from an external power source such as an in-vehicle battery into a dc voltage V1 for an internal power source. Hereinafter, the dc voltage V1 is referred to as an internal power supply voltage V1. The internal power supply voltage V1 is, for example, + 3.3V. The power supply output unit 10 outputs the internal power supply voltage V1 to each electronic circuit via a power supply line not shown.

The processor 20 is, for example, a CPU (Central Processing Unit). The processor 20 is connected to the storage section 30 and the communication section 40 via a communication bus B1 in data communication. The processor 20 executes processing necessary for vehicle control in accordance with a program stored in the storage unit 30. The processor 20 can perform data communication with other in-vehicle electronic control devices by controlling the communication unit 40.

The processor 20 has a monitor signal output terminal 21, a latch signal output terminal 22, a WD diagnosis terminal 23, and a reset terminal 24. In the block of the processor 20 shown in fig. 1, "WDO" is a symbol representing the monitor signal output terminal 21. "LATCH" is a symbol indicating the LATCH signal output terminal 22. "WD _ DIAG" is a symbol indicating the WD diagnostic terminal 23. "/RESET" is a symbol indicating the RESET terminal 24.

The processor 20 outputs a monitor signal S1 from the monitor signal output terminal 21 to the monitor timer 50. The monitor signal S1 is a pulse signal for detecting an abnormality of the processor 20 by the monitor timer 50. When operating normally, the processor 20 continuously outputs the monitor signal S1 at a constant cycle. On the other hand, when the processor 20 generates an abnormality, the output of the monitor signal S1 is stopped.

The processor 20 can output the latch signal S2 from the latch signal output terminal 22 to the 2 nd flip-flop 70. The latch signal S2 is a signal for holding the state of the output signal of the 2 nd flip-flop 70 at the 2 nd state (high level). As will be described in detail later, the processor 20 can stop the operation of the communication unit 40 as a target by outputting the latch signal S2. In the present specification, the phrase "the processor 20 outputs the latch signal S2" means that the latch signal S2 in an active state (high level in the present embodiment) is output from the processor 20.

The processor 20 can perform initial diagnosis of the watchdog timer 50 based on the potential of the WD diagnostic terminal 23. The details of the initial diagnostic process performed by the processor 20 are described later. When the potential of the reset terminal 24 is in the active state, the processor 20 is reset. The reset terminal 24 is a terminal corresponding to negative logic (active low). That is, when the potential of the reset terminal 24 is at a low level, the processor 20 is reset.

The storage unit 30 is, for example, an EEPROM (Electrically Erasable Programmable Read Only Memory). The storage unit 30 stores programs and data necessary for vehicle control in advance. In addition, the storage unit 30 stores the number of times the processor 20 is reset, which will be described in detail later.

The communication unit 40 is, for example, a CAN (Controller Area Network) transceiver. The communication unit 40 is connected to another in-vehicle electronic control device via a CAN communication bus, and performs data communication between the processor 20 and the other in-vehicle electronic control device. The communication unit 40 includes an enable terminal 41. In the block of the communication unit 40 shown in fig. 1, "EN" is a symbol indicating the enable terminal 41. When the potential of the enable terminal 41 is at a high level, the communication unit 40 is in an operation stop state. On the other hand, when the potential of the enable terminal 41 is at a low level, the communication unit 40 is in an operable state.

The Watchdog Timer 50 is, for example, a WDT-IC (Watchdog Timer-IC: Watchdog Timer-integrated circuit). The watchdog timer 50 has an input terminal 51 and an output terminal 52. In the block of the watchdog timer 50 shown in fig. 1, "WD _ RESET" is a symbol indicating the output terminal 52. The input terminal 51 of the monitoring timer 50 is electrically connected to the monitoring signal output terminal 21 of the processor 20. The output terminal 52 of the watchdog timer 50 is electrically connected to the 1 st flip-flop 60 and the signal output circuit 80. The watchdog timer 50 outputs an abnormality detection signal S3 when an abnormality occurs in the watchdog signal S1 output from the processor 20. In the present specification, the phrase "the monitoring timer 50 outputs the abnormality detection signal S3" means that the monitoring timer 50 outputs the abnormality detection signal S3 in an active state (low level in the present embodiment).

When the watchdog timer 50 detects a falling edge of the watchdog signal S1 within a preset timeout period, it resets the count value of the timeout period to the initial value and restarts counting the timeout period. When the processor 20 normally operates, the monitor signal S1, which is a pulse signal, is continuously output at a constant cycle, and therefore, the falling edge of the monitor signal S1 occurs at a constant cycle. The timeout period is longer than the period of continuously outputting the monitor signal S1. Therefore, as long as the processor 20 operates normally and the monitor signal S1 is output from the processor 20 at a normal timing, the count value of the timeout period does not overflow. The watchdog timer 50 keeps the potential of the output terminal 52 in an inactive state (high level) until the count value of the timeout time overflows. That is, as long as the monitor signal S1 is output from the processor 20 at a normal timing, the abnormality detection signal S3 output from the watchdog timer 50 is kept at a high level.

On the other hand, when the falling edge of the monitor signal S1 is not detected for the timeout period and the count value of the timeout period overflows, the watchdog timer 50 sets the potential of the output terminal 52 to the active state (low level). That is, when an abnormality occurs in the monitor signal S1 output from the processor 20, the abnormality detection signal S3 output from the watchdog timer 50 goes low. "the case where an abnormality occurs in monitor signal S1 output from processor 20" means, for example, a case where monitor signal S1 is not output any more.

The 1 st flip-flop 60 has a 1 st input terminal 61, a 2 nd input terminal 62, a 3 rd input terminal 63, a 4 th input terminal 64, and an output terminal 65. Similarly, the 2 nd flip-flop 70 has a 1 st input terminal 71, a 2 nd input terminal 72, a 3 rd input terminal 73, a 4 th input terminal 74, and an output terminal 75. In the block of the 1 st flip-flop 60 and the 2 nd flip-flop 70 shown in fig. 1, "CP" is a symbol indicating the 1 st input terminal 61 and the 1 st input terminal 71. "D" is a symbol indicating the 2 nd input terminal 62 and the 2 nd input terminal 72. "/PR" is a symbol indicating the 3 rd input terminal 63 and the 3 rd input terminal 73. "/CLR" is a symbol indicating the 4 th input terminal 64 and the 4 th input terminal 74. "Q" is a symbol indicating the output terminal 65 and the output terminal 75.

Table 1 is a truth table for the 1 st flip-flop 60 and the 2 nd flip-flop 70. As shown in table 1, when a rising edge occurs in the potential of "CP" in a state where the potential of "/PR" is at a high level and the potential of "/CLR" is at a high level, the potential of "Q" is maintained at the same level as the potential of "D". On the other hand, in the case where the "/PR" potential is high and the "/CLR" potential is low, the "Q" potential is cleared to low.

[ TABLE 1 ]

The 1 st input terminal 61 of the 1 st flip-flop 60 is electrically connected to the output terminal 52 of the watchdog timer 50. The 2 nd input terminal 62 and the 3 rd input terminal 63 of the 1 st flip-flop 60 are electrically connected to a power supply line to which an internal power supply voltage V1(+3.3V) is applied. The 4 th input terminal 64 of the 1 st flip-flop 60 is electrically connected to a reset circuit 90. The output terminal 65 of the 1 st flip-flop 60 is electrically connected to the 2 nd input terminal 72 of the 2 nd flip-flop 70, the WD diagnostic terminal 23 of the processor 20, and the signal output circuit 80. As will be described in detail later, the output signal of the 1 st flip-flop 60 is kept at a high level when the processor 20 is activated. The output signal of the 1 st flip-flop 60 is the potential of the output terminal 65. In the output signal of the 1 st flip-flop 60 of the present embodiment, the high level corresponds to the 1 st state. When the output signal of the 1 st flip-flop 60 becomes high level, the potential of the WD diagnosis terminal 23 of the processor 20 becomes high level. In this specification, "start" includes the first start as well as the 2 nd and subsequent starts (restarts).

The 1 st input 71 of the 2 nd flip-flop 70 is electrically connected to the latch signal output terminal 22 of the processor 20. The 2 nd input terminal 72 of the 2 nd flip-flop 70 is electrically connected to the output terminal 65 of the 1 st flip-flop 60, the WD diagnostic terminal 23 of the processor 20, and the signal output circuit 80. The 3 rd input terminal 73 of the 2 nd flip-flop 70 is electrically connected to a power supply line to which an internal power supply voltage V1(+3.3V) is applied. The 4 th input terminal 74 of the 2 nd flip-flop 70 is electrically connected to a reset circuit 90. The output terminal 75 of the 2 nd flip-flop 70 is electrically connected to the signal output circuit 80. In detail, as will be described later, when the latch signal S2 is output from the processor 20 in a state where the output signal of the 1 st flip-flop 60 is held at a high level, the output signal of the 2 nd flip-flop 70 is held at a high level. The output signal of the 2 nd flip-flop 70 is the potential of the output terminal 75. In the output signal of the 2 nd flip-flop 70 of the present embodiment, the high level corresponds to the 2 nd state.

The signal output circuit 80 has a 1 st tri-state buffer 81 and OR circuit (OR circuit) 82. The 1 st tri-state buffer 81 has an input terminal 81a, a control terminal 81b, and an inverting output terminal 81 c. The or circuit 82 has a 1 st input terminal 82a, a 2 nd input terminal 82b, and an output terminal 82 c.

The 1 st three-state buffer 81 operates as a NOT circuit (NOT circuit) when the potential of the control terminal 81b is at a high level. That is, when the potential of the control terminal 81b is at a high level, the potential level of the inverting output terminal 81c is inverted with respect to the potential level of the input terminal 81 a. On the other hand, when the potential of the control terminal 81b is at a low level, the potential of the inverting output terminal 81c is at a low level regardless of the potential level of the input terminal 81 a. In the or circuit 82, the potential level of the output terminal 82c is a level indicating the sum of the potential level of the 1 st input terminal 82a and the potential level of the 2 nd input terminal 82 b.

The input terminal 81a of the 1 st three-state buffer 81 is electrically connected to the output terminal 52 of the watchdog timer 50 and the 1 st input terminal 61 of the 1 st flip-flop 60. The control terminal 81b of the 1 st tri-state buffer 81 is electrically connected to the WD diagnostic terminal 23 of the processor 20, the output terminal 65 of the 1 st flip-flop 60, and the 2 nd input terminal 72 of the 2 nd flip-flop 70. The inverting output terminal 81c of the 1 st tri-state buffer 81 is electrically connected to the 2 nd input terminal 82b of the or circuit 82.

The 1 st input terminal 82a of the or circuit 82 is electrically connected to the output terminal 75 of the 2 nd flip-flop 70. The 2 nd input terminal 82b of the or circuit 82 is electrically connected to the inverting output terminal 81c of the 1 st tri-state buffer 81. The output terminal 82c of the or circuit 82 is electrically connected to the enable terminal 41 of the communication section 40 and the reset circuit 90.

The 1 st tri-state buffer 81 inverts the abnormality detection signal S3 input from the watchdog timer 50 and outputs the inverted signal to the or circuit 82 when the output signal of the 1 st flip-flop 60 is at a high level, that is, when the potential of the control terminal 81b is at a high level. The or circuit 82 outputs a signal indicating the or between the signal input from the 1 st tri-state buffer 81 and the output signal of the 2 nd flip-flop 70 as the operation stop signal S4. The signal input from the 1 st tri-state buffer 81 to the or circuit 82 contains an inverted signal of the abnormality detection signal S3.

The or circuit 82 outputs the high-level operation stop signal S4 to the communication unit 40 when the signal input from the 1 st tri-state buffer 81 is at a high level. Here, when the abnormality detection signal S3 at low level is output in a state where the output signal of the 1 st flip-flop 60 is kept at high level, the signal input from the 1 st tri-state buffer 81 becomes high level. That is, the signal output circuit 80 can output the operation stop signal S4 at a high level to the communication unit 40 in a state where the output signal of the 1 st flip-flop 60 is kept at a high level, and can output the operation stop signal S4 at a high level to the communication unit 40 in a case where the abnormality detection signal S3 at a low level is output.

When the signal input from the 2 nd flip-flop 70 is at the high level, the or circuit 82 outputs the operation stop signal S4 at the high level to the communication unit 40. That is, when the output signal of the 2 nd flip-flop 70 is kept at the high level, the signal output circuit 80 outputs the operation stop signal S4 at the high level to the communication unit 40. In the present specification, the phrase "the signal output circuit 80 outputs the operation stop signal S4" means that the signal output circuit 80 outputs the operation stop signal S4 in an active state (high level in the present embodiment).

In the present embodiment, the operation stop signal S4 is output to the enable terminal 41 of the communication unit 40. When the high-level operation stop signal S4 is output to the enable terminal 41 and the enable terminal 41 becomes high, the operation of the communication unit 40 is stopped.

The reset circuit 90 resets the processor 20 in a state where the communication unit 40 is stopped by the operation stop signal S4. In other words, the reset circuit 90 resets the processor 20 when the operation stop signal S4 is at the high level. In addition, the reset circuit 90 resets the processor 20 and clears the output signal of the 1 st flip-flop 60 and the output signal of the 2 nd flip-flop 70 to a low level when the power of the electronic control device 1 is turned on. The reset circuit 90 has a power supply monitoring circuit 91 and a 2 nd tri-state buffer 92.

The power supply monitoring circuit 91 is, for example, a reset IC. The power supply monitoring circuit 91 has an enable terminal 91a, a reset signal output terminal 91b, and a clear signal output terminal 91 c. In the block of the power supply monitoring circuit 91 shown in fig. 1, "EN" is a symbol indicating the enable terminal 91 a. "RESET" is a symbol indicating the RESET signal output terminal 91 b. "CD" is a symbol indicating the clear signal output terminal 91 c. The power supply monitoring circuit 91 sets the potential of the RESET signal output terminal 91b and the potential of the clear signal output terminal 91c to low levels when the potential of the enable terminal 91a becomes high level, and sets the potentials to high levels after a preset RESET time T _ RESET has elapsed.

The 2 nd tri-state buffer 92 has an input terminal 92a, an inverting control terminal 92b, and an output terminal 92 c. The 2 nd tri-state buffer 92 operates as a normal buffer when the potential of the inverting control terminal 92b is at a low level. That is, when the potential of the inverting control terminal 92b is at a low level, the potential level of the output terminal 92c is the same as the potential level of the input terminal 92 a. On the other hand, when the potential of the inverting control terminal 92b is at a high level, the potential of the output terminal 92c is at a low level regardless of the potential level of the input terminal 92 a.

The enable terminal 91a of the power supply monitoring circuit 91 is electrically connected to a power supply line to which the internal power supply voltage V1(+3.3V) is applied. The reset signal output terminal 91b of the power supply monitoring circuit 91 is electrically connected to the input terminal 92a of the 2 nd tri-state buffer 92. The clear signal output terminal 91c of the power supply monitoring circuit 91 is electrically connected to the 4 th input terminal 64 of the 1 st flip-flop 60 and the 4 th input terminal 74 of the 2 nd flip-flop 70.

The input terminal 92a of the 2 nd tri-state buffer 92 is electrically connected to the reset signal output terminal 91b of the power supply monitoring circuit 91. The inverting control terminal 92b of the 2 nd tri-state buffer 92 is electrically connected to the output terminal 82c of the or circuit 82. The output terminal 92c of the 2 nd tri-state buffer 92 is electrically connected to the reset terminal 24 of the processor 20.

In the reset circuit 90 configured as described above, the power supply monitoring circuit 91 outputs the low-level reset signal S5 for resetting the processor 20 to the 2 nd tri-state buffer 92 at the time of power-on, and also outputs the low-level clear signal S6 for clearing the 1 st flip-flop 60 and the 2 nd flip-flop 70. In a state where the communication unit 40 is stopped by the operation stop signal S4, that is, in a state where the operation stop signal S4 is at a high level, the 2 nd tri-state buffer 92 outputs the reset signal S5 at a low level to the processor 20. In this specification, the phrase "the reset circuit 90 outputs the reset signal S5" means that the reset circuit 90 outputs the reset signal S5 in an active state (low level in the present embodiment).

Next, the operation of the electronic control device 1 configured as described above will be described.

Fig. 2 is a timing chart showing the operation of the electronic control apparatus 1. In fig. 2, time t0 is when the ignition switch is turned on and the dc voltage VB is input from an external power supply such as an in-vehicle battery to the power supply output unit 10. That is, the time when the electronic control device 1 is powered on is t 0. At time t0, power output unit 10 outputs internal power supply voltage V1 of +3.3V to the power supply line. As a result, at time t0, the potential of each terminal connected to the power supply line also becomes high.

That is, at time t0, the enable terminal 91a of the power supply monitoring circuit 91 becomes high. At time t0, the potentials of the 2 nd input terminal 62(D) and the 3 rd input terminal 63(/ PR) of the 1 st flip-flop 60 become high. Then, at time t0, the potential of the 3 rd input terminal 73(/ PR) of the 2 nd flip-flop 70 becomes high level.

When the enable terminal 91a becomes high level at time t0, the power supply monitoring circuit 91 sets the potentials of the reset signal output terminal 91b (reset) and the clear signal output terminal 91c (cd) to low level. That is, at time t0, the clear signal S6 output from the power supply monitoring circuit 91 becomes low level. Thus, at time t0, the potentials of the 4 th input terminal 64(/ CLR) of the 1 st flip-flop 60 and the 4 th input terminal 74(/ CLR) of the 2 nd flip-flop 70 become low. As a result, at time t0, the output signals of flip-flop 1 60 and flip-flop 2 70 are cleared to low level, respectively.

When the output signals of the 1 st flip-flop 60 and the 2 nd flip-flop 70 are at the low level, the potential of the output terminal 82c (TX _ STOP) of the or circuit 82 is also at the low level. That is, at time t0, the operation stop signal S4 output from the signal output circuit 80 to the communication unit 40 and the reset circuit 90 is at a low level. As a result, the communication unit 40 becomes operable at time t0 and later.

When the operation stop signal S4 is at a low level, the potential of the output terminal 92c of the 2 nd tri-state buffer 92 is at a low level equal to the potential of the reset signal output terminal 91b (reset) of the power supply monitoring circuit 91. That is, at time t0, the reset signal S5 output from the reset circuit 90 is at a low level. As a result, at time t0, the potential of the RESET terminal 24(/ RESET) of the processor 20 becomes low, and the processor 20 is RESET.

At time t0 when the processor 20 is reset, the potential of the monitor signal output terminal 21(WDO) of the processor 20 becomes high level. That is, at time t0, the monitor signal S1 output from the processor 20 goes high. At time t0, the potential of the LATCH signal output terminal 22(LATCH) of the processor 20 is at a low level. That is, at time t0, the latch signal S2 output from the processor 20 is low. Since the output signal of the 1 st flip-flop 60 is at the low level at time t0, the potential of the WD diagnostic terminal 23(WD _ DIAG) of the processor 20 is also at the low level.

The monitor timer 50 sets the potential of the output terminal 52(WD _ RESET) to the low level at time t 0. That is, at time t0, the abnormality detection signal S3 output from the watchdog timer 50 is at a low level. The watchdog timer 50 sets the potential of the output terminal 52(WD _ RESET) to a high level and starts counting of the timeout time at time t1 when a predetermined WD RESET time trd has elapsed from time t 0. That is, at time t1, the abnormality detection signal S3 output from the monitoring timer 50 becomes high level. The WD reset time trd is a time required for the clock quartz resonator incorporated in the watchdog timer 50 to be in a stable state.

The power supply monitoring circuit 91 sets the potentials of the RESET signal output terminal 91b (RESET) and the clear signal output terminal 91c (cd) to the high level at time T2 when the RESET time T _ RESET has elapsed from time T0. As a result, at time t2, the potentials of RESET terminal 24(/ RESET) of

processor

20, 4 th input terminal 64(/ CLR) of 1 st flip-

flop

60, and 4 th input terminal 74(/ CLR) of 2 nd flip-flop 70 become high level, respectively.

Thus, the potential of the RESET terminal 24(/ RESET) of the processor 20 is kept at the low level for the RESET time T _ RESET from the time T0 to the time T2. That is, the processor 20 remains in the RESET state for the RESET time T _ RESET from the time T0 to the time T2.

When the potential of the RESET terminal 24(/ RESET) of the processor 20 changes to the high level at time t2, the processor 20 starts from the RESET state and executes the initialization process. The initialization process includes initialization of a program counter, initialization of an internal register, setting of an input/output port, and the like.

In addition, at the time of startup after reset, the processor 20 executes the initial diagnosis process of the watchdog timer 50 when the output signal of the 1 st flip-flop 60 is not at the high level (when the potential of the WD diagnosis terminal 23 is at the low level). As the initial diagnostic processing of the watchdog timer 50, the processor 20 executes processing for intentionally causing an abnormality in the watchdog signal S1 and processing for determining that the watchdog timer 50 is normal when the output signal of the 1 st flip-flop 60 remains at the high level.

When the monitoring timer 50 is normal, if an abnormality occurs in the monitoring signal S1, a rising edge occurs in the abnormality detection signal S3 output from the monitoring timer 50. As a result, the output signal of the 1 st flip-flop 60 is held at the high level. Therefore, after the monitoring signal S1 is intentionally abnormal, if the output signal of the 1 st flip-flop 60 is kept at the high level, it can be determined that the monitoring timer 50 is normal.

Specifically, the processor 20 sets the potential of the monitor signal output terminal 21(WDO) to a low level after the setting of the input/output port is completed. That is, at time t2, the monitor signal S1 output from the processor 20 goes low. When the monitoring timer 50 detects the falling edge of the monitoring signal S1 at time t2, the count value of the timeout time is reset to the initial value, and then counting of the timeout time is restarted.

The processor 20 intentionally sets the potential of the monitor signal output terminal 21(WDO) to the low level for a predetermined time from the time t 2. That is, no falling edge occurs in the monitor signal S1 output from the processor 20 within a predetermined time from the time t 2. In the case where the monitor timer 50 is normal, if the falling edge of the monitor signal S1 is not detected all the time within the timeout period tWl from the time t2 and the count value at the time t3 of the timeout period tWl overflows, the monitor timer 50 sets the potential of the output terminal 52(WD _ RESET) to the low level at the time t 3. That is, at time t3, the abnormality detection signal S3 output from the monitoring timer 50 becomes low.

The monitoring timer 50 sets the potential of the output terminal 52(WD _ RESET) to the high level at time t4 when a predetermined time tWO has elapsed from time t3, and restarts counting of the timeout time. That is, at time t4, the abnormality detection signal S3 output from the monitoring timer 50 becomes high level. Thus, when a rising edge is generated in the abnormality detection signal S3 at time t4, the output signal of the 1 st flip-flop 60 is held at a high level. As a result, at time t4, the potential of the processor 20WD diagnosis terminal 23 also becomes high.

As described above, when the watchdog timer 50 is normal, the output signal of the 1 st flip-flop 60 and the potential of the WD diagnostic terminal 23 of the processor 20 become high at time t 4. When detecting that the potential of the WD diagnosis terminal 23 has changed to the high level at time t4, the processor 20 determines that the watchdog timer 50 is normal, and ends the initial diagnosis process.

The processor 20 shifts to the normal operation mode when the initialization process and the initial diagnosis process of the watchdog timer 50 are completed as described above. The processor 20 executes processing required for vehicle control in the normal operation mode. For example, the processor 20 communicates data necessary for vehicle control with another in-vehicle electronic control device via the communication unit 40.

When the processor 20 shifts to the normal operation mode, the pulse-shaped monitor signal S1 is output at a predetermined cycle. In this way, at time t4 and later when the processor 20 shifts to the normal operation mode, the count value of the timeout period of the watchdog timer 50 is reset every time a falling edge occurs in the watchdog signal S1. As a result, at time t4 and later, the abnormality detection signal S3 output from the monitoring timer 50 is kept at a high level.

At time t4 and later, the operation stop signal S4 output from the signal output circuit 80 is held at a low level. That is, at time t4 and later, the potential of the reset terminal 24 of the processor 20 is kept at the high level, and the potential of the enable terminal 41 of the communication section 40 is kept at the low level. In this way, as long as the monitor signal S1 is normally output from the processor 20, the operation stop signal S4 is kept at a low level, and therefore the processor 20 and the communication unit 40 can continue the normal operation.

In fig. 2, an example of a case where the processor 20 generates an abnormality at time t5 and time t9 is shown. In the example of fig. 2, when an abnormality occurs in the processor 20, the monitor signal S1 is fixed to the low level. That is, in the example of fig. 2, the monitor signal S1 cannot be normally output from the processor 20 due to runaway of the processor 20, generation of noise, or the like.

When the falling edge of the monitor signal S1 is not detected for the timeout period tWl from the time t5 and the count value of the timeout period overflows at the time t6, the monitor timer 50 sets the potential (WD _ RESET) of the output terminal 52 to the low level. That is, at time t6, the abnormality detection signal S3 output from the watchdog timer 50 changes to the low level.

When the abnormality detection signal S3 goes low, the operation stop signal S4 output from the signal output circuit 80 goes high, and the reset signal S5 output from the reset circuit 90 goes low. As a result, at time t6, RESET terminal 24(/ RESET) of processor 20 becomes low level, and enable terminal 41 of communication unit 40 becomes high level. Therefore, at time t6, processor 20 is reset, and communication unit 40 enters the operation stop state.

The monitor timer 50 sets the potential of the output terminal 52(WD _ RESET) to a high level at a time t7 when a predetermined time tWO has elapsed from the time t6, and restarts counting of the timeout time tWl. That is, at time t7, the abnormality detection signal S3 output from the monitoring timer 50 becomes high level.

When the abnormality detection signal S3 goes high, the operation stop signal S4 output from the signal output circuit 80 goes low, and the reset signal S5 output from the reset circuit 90 goes high. As a result, at time t7, RESET terminal 24(/ RESET) of processor 20 becomes high, and enable terminal 41 of communication unit 40 becomes low. Therefore, at time t7, processor 20 is started from the reset state, and communication unit 40 becomes operable.

At time t7, processor 20 is started from the reset state and performs initialization processing. In addition, at the time of start after reset, the processor 20 executes the abnormality degree determination process when the output signal of the 1 st flip-flop 60 is at a high level, that is, when the potential of the WD diagnosis terminal 23 is at a high level. As the abnormality degree determination process, the processor 20 executes a process of updating the number of resets stored in the storage unit 30 and a process of outputting the latch signal S2 when the number of resets after the update is equal to or more than a predetermined number.

Specifically, the processor 20 reads the number of resets stored in the storage unit 30. In the storage unit 30, "0" is stored in advance as an initial value of the number of resets. The processor 20 updates the reset count by adding "1" to the reset count read out from the storage section 30. That is, at this time, the reset count after the update becomes "1".

The processor 20 outputs the latch signal S2 when the updated reset count is equal to or more than the predetermined count, and stores the updated reset count in the storage unit 30 when the updated reset count is less than the predetermined count. For example, when the predetermined number of times is set to 5 times, the processor 20 stores "1" which is the updated reset number in the storage unit and then terminates the abnormality degree determination process because the updated reset number at time t7 is less than the predetermined number of times.

When the initialization process and the abnormality degree determination process are completed as described above, the processor 20 again shifts to the normal operation mode. After shifting to the normal operation mode at time t8, processor 20 outputs pulse-like monitor signal S1 in a predetermined cycle. At time t8 and later, the count value of the timeout time of the watchdog timer 50 is reset every time a falling edge occurs in the watchdog signal S1. As a result, at time t8 and later, the abnormality detection signal S3 output from the monitoring timer 50 is kept at a high level.

At time t8 and thereafter, the operation stop signal S4 output from the signal output circuit 80 is kept at the low level. That is, at time t8 and thereafter, the potential of the reset terminal 24 of the processor 20 is kept at the high level, and the potential of the enable terminal 41 of the communication unit 40 is kept at the low level. As described above, as long as the monitor signal S1 is normally output from the processor 20, the operation stop signal S4 is kept at a low level, and thus the processor 20 and the communication unit 40 can continue the normal operation.

When an abnormality occurs in the processor 20 at time t9, the same processing as that in the case where an abnormality occurs in the processor 20 at time t5 described above is performed. That is, from time t9 to time t11, the same processing as that from time t5 to time t7 is performed. Here, it is assumed that the reset count after the update becomes equal to or more than a predetermined count at time t 11. Since the reset count after the update becomes equal to or more than the predetermined count, the processor 20 sets the potential of the LATCH signal output terminal 22(LATCH) to the high level at time t 12. That is, at time t12, the latch signal S2 output from the processor 20 becomes high level.

At time t12, when a rising edge is generated in the latch signal S2, the output signal of the 2 nd flip-flop 70 is held at a high level. When the output signal of the 2 nd flip-flop 70 is held at the high level at time t12, the operation stop signal S4 output from the signal output circuit 80 becomes the high level, and the reset signal S5 output from the reset circuit 90 becomes the low level. As a result, at time t12, RESET terminal 24(/ RESET) of processor 20 becomes low level, and enable terminal 41 of communication unit 40 becomes high level. Therefore, at time t12, processor 20 is reset, and communication unit 40 enters the operation stop state.

The state of the output signal of the 2 nd flip-flop 70 is not cleared before the power is turned back on. Therefore, after the output signal of the 2 nd flip-flop 70 is held at the high level at time t12, the processor 20 is held in the reset state and the communication unit 40 is held in the operation stop state until the power is turned on again.

As described above, in the electronic control device 1 according to the present embodiment, when the number of times of resetting the processor 20 is less than the predetermined number of times, each time the monitoring timer 50 detects an abnormality of the processor 20, the processor 20 is reset, and then the communication unit 40 returns to the operable state. On the other hand, when the number of times of resetting of the processor 20 becomes equal to or greater than the predetermined number of times, the communication unit 40 is kept in the operation-stopped state until the power is turned on again.

According to the present embodiment, even if the abnormality detection signal S3 is output from the monitoring timer 50 and the operation of the communication unit 40 is stopped, the communication unit 40 can be operated again as long as the output signal of the 2 nd flip-flop 70 is not kept at the high level. On the other hand, if the output signal of the 2 nd flip-flop 70 is held at the high level by the latch signal S2 from the processor 20, the communication unit 40 stops operating regardless of the abnormality detection signal S3 from the watchdog timer 50, and the communication unit 40 does not restart until the power supply of the electronic control device 1 is turned on again. Therefore, for example, when the abnormality is relatively slight, the processor 20 does not output the latch signal S2, and can restart the communication unit 40 after temporarily stopping the operation of the communication unit 40. This enables the processor 20 to be reset and then the communication unit 40 to be returned to the operable state when the generated abnormality is slight, thereby improving convenience.

On the other hand, for example, when the generated abnormality is serious, the processor 20 can output the latch signal S2 to stop the communication unit 40. Thus, when the abnormality is serious, the communication from the communication unit 40 to the other in-vehicle electronic control device can be cut off, and the adverse effect on the other in-vehicle electronic control device can be suppressed.

As described above, in the electronic control device 1 of the present embodiment, the communication unit 40 can be controlled to the state suitable for the slight abnormality and the serious abnormality by the simple circuit configuration using the two flip-flops. That is, according to the present embodiment, the electronic control device 1 can be realized as follows: the control of the communication unit 40 according to the degree of the abnormality can be performed by a simple circuit configuration.

In addition, the output signal of the 1 st flip-flop 60 is held at a high level when the processor 20 is started. Therefore, when the processor 20 is started after reset, if the output signal of the 1 st flip-flop 60 is at a high level, it can be determined that the processor 20 is restarted after one start. On the other hand, when the processor 20 is started after reset, if the output signal of the 1 st flip-flop 60 is at a low level, it can be determined that the electronic control device 1 is started for the first time after power is turned on. Thus, according to the electronic control device 1 of the present embodiment, the processor 20 can be restarted appropriately.

In addition, according to the present embodiment, the processor 20 outputs the latch signal S2 when the number of resets stored in the storage unit 30 is equal to or greater than a predetermined number. Therefore, when the number of times of resetting of the processor 20 becomes equal to or greater than the predetermined number of times, the communication unit 40 is not restarted, and is kept in the stopped state until the power is turned on again. Here, when the number of times of reset of the processor 20 becomes equal to or greater than a predetermined number of times, it is estimated that a serious abnormality that cannot be eliminated by reset occurs in the processor 20. Therefore, the processor 20 outputs the latch signal S2 when the reset count stored in the storage unit 30 is equal to or more than the predetermined count, and thereby it is possible to suppress the data from being transmitted from the communication unit 40 to another in-vehicle electronic control device when a serious abnormality occurs.

In the electronic control device 1 of the present embodiment, at the time of startup after reset, when the output signal of the 1 st flip-flop 60 is not at the high level, the processor 20 executes, as the initial diagnosis processing of the watchdog timer 50, processing for intentionally causing an abnormality in the watchdog signal S1 and processing for determining that the watchdog timer 50 is normal when the output signal of the 1 st flip-flop 60 is held at the high level. In addition, at the time of activation after reset, when the output signal of the 1 st flip-flop 60 is at a high level, the processor 20 executes, as abnormality degree determination processing, processing of updating the number of reset times stored in the storage unit 30 and processing of outputting the latch signal S2 when the number of reset times after update is equal to or more than a predetermined number of times.

In this way, by adopting the following configuration, the number of resets due to an abnormality of the processor 20 can be accurately counted: on the assumption that the monitoring timer 50 is diagnosed as being normal by the initial diagnosis at the time of power-on based on the output signal of the 1 st flip-flop 60, the count of the reset count is started at the next restart.

In the electronic control device 1 of the present embodiment, the 2 nd flip-flop 70 outputs the output signal held at the high level when the latch signal S2 is output from the processor 20 in a state where the output signal of the 1 st flip-flop 60 is held at the high level.

As described above, on the premise that the monitoring timer 50 is diagnosed to be normal by the initial diagnosis at the time of power-on based on the output signal of the 1 st flip-flop 60, the output signal of the 2 nd flip-flop 70 is held at the high level when the latch signal S2 is output. Thus, even if the potential of the latch signal line is unintentionally instantaneously set to the high level due to noise or the like when the monitoring timer 50 is abnormal and it is not possible to determine whether or not the processor 20 is abnormal, the output signal of the 2 nd flip-flop 70 can be prevented from being held at the high level.

The electronic control device of the present invention is not limited to the above embodiment, and the following modifications can be given.

Fig. 3 is a diagram showing a circuit configuration of an electronic control device 1A of a modification. In fig. 3, the same components as those in fig. 1 are denoted by the same reference numerals. Hereinafter, the same components as those in fig. 1 will not be described. The processor 20A of the electronic control apparatus 1A performs lock-step (lock-step) type core diagnosis, and outputs a core diagnosis signal S7 indicating the result of the core diagnosis to the signal output circuit 80A. When the core diagnosis signal S7 is output from the processor 20A, the signal output circuit 80A of the electronic control device 1A outputs the operation stop signal S4 to the communication unit 40.

The processor 20A also has a core diagnosis signal output terminal 25. In fig. 3, "ERROROUTZ" is a symbol indicating the core diagnostic signal output terminal 25. The or circuit 82A of the signal output circuit 80A also has a 3 rd input terminal 82 d. The core diagnostic signal output terminal 25 of the processor 20A is electrically connected to the 3 rd input terminal 82d of the or circuit 82A.

The processor 20A sets the potential of the core diagnosis signal output terminal 25 to the high level in the case where the result of the core diagnosis in the lockstep mode is "abnormal". That is, when the result of the core diagnosis is "abnormal", the core diagnosis signal S7 output from the processor 20A becomes high level. When the nuclear diagnosis signal S7 goes high, the operation stop signal S4 output from the or circuit 82A also goes high.

According to the electronic control device 1A of the modification configured as described above, not only when the monitor signal S1 cannot be normally output from the processor 20A due to runaway of the processor 20A or generation of noise, but also when the result of the lock-step nuclear diagnosis is "abnormal", the processor 20A can be reset and the communication unit 40 can be temporarily set to the operation stop state.

The electronic control device 1 of the above embodiment has the following configuration: whether the processor 20 has generated a serious abnormality that cannot be eliminated by resetting is determined based on the number of times the processor 20 is reset. The present invention is not limited to this, and for example, the following functions may be provided in the processor 20: when it is detected that an abnormality for stopping the communication unit 40 has occurred based on a signal received from an external in-vehicle sensor or another in-vehicle electronic control device, the latch signal S2 is output.

The electronic control device 1 of the above embodiment has the communication unit 40 as an object to be controlled to a state suitable for each of the slight abnormality and the serious abnormality. However, the object to be controlled is not limited to the communication section 40. For example, in the case of an electronic control device having a drive circuit for supplying a drive current to a vehicle-mounted load such as a motor, the drive circuit may be controlled to a state suitable for a slight abnormality and a serious abnormality. Furthermore, the object to be controlled may be provided outside the electronic control device.

In the electronic control device 1 of the above embodiment, the signal output circuit 80 includes the 1 st tri-state buffer 81 and the or circuit 82, but the configuration of the signal output circuit is not particularly limited. In the electronic control device 1 according to the above-described embodiment, the reset circuit 90 includes the power supply monitoring circuit 91 and the 2 nd tri-state buffer 92, but the configuration of the reset circuit is not particularly limited. The respective structures described in this specification can be appropriately combined within a range not inconsistent with each other.

The electronic control device 1 of the above embodiment is a vehicle-mounted electronic control device, but the electronic control device of the present invention is not limited to the vehicle-mounted electronic control device. For example, the present invention can be applied to an electronic control device for a home electric appliance, an electronic control device for a ship, an electronic control device for an aircraft, and the like.

[ vehicle control System ]

Fig. 4 is a block diagram showing the vehicle control system 100 of the present embodiment. The vehicle control System 100 according to the present embodiment is, for example, an Advanced Driver Assistance System (ADAS). The vehicle control system 100 includes, for example, an ADAS-ECU 200, an EPS-ECU 300, an ABS-ECU 400, and an instrument ECU 500.

The ADAS-ECU 200 is an in-vehicle electronic control device having the same configuration as the electronic control device 1 of the above-described embodiment or the electronic control device 1A of the modification. The EPS-ECU 300, the ABS-ECU 400, and the meter ECU500 are other onboard electronic control devices connected to the ADAS-ECU 200 via the CAN communication bus B2 so as to be capable of data communication. The ADAS-ECU 200 has the processor 20 and the communication unit 40, as in the

electronic control device

1 or 1A. The communication unit 40 is connected to other in-vehicle electronic control devices via the CAN communication bus B2, and performs data communication between the processor 20 and the other in-vehicle electronic control devices.

The EPS-ECU 300 is an in-vehicle electronic control device that controls an EPS (Electric Power Steering) system. The ABS-ECU 400 is an in-vehicle electronic control device that controls an ABS (Antilock Brake System) System. The meter ECU500 is an in-vehicle electronic control device that controls a meter device. The processor 20 of the ADAS-ECU 200 collectively controls the EPS-ECU 300, the ABS-ECU 400, and the meter ECU500 by performing data communication with the EPS-ECU 300, the ABS-ECU 400, and the meter ECU500 via the communication portion 40 to execute processing required for driving assistance.

According to the vehicle control system 100 as described above, when an abnormality occurs in the processor 20 of the ADAS-ECU 200, the communication unit 40 can be maintained in the operation stop state until the power supply of the ADAS-ECU 200 is turned on again, and therefore, adverse effects on the EPS-ECU 300, the ABS-ECU 400, and the meter ECU500 can be avoided. On the other hand, if the abnormality occurring in the processor 20 is slight, the communication unit 40 can be returned to the operable state after the processor 20 is reset, and therefore, the control necessary for the driving assistance can be continued.

In addition, the vehicle control system of the invention is not limited to the advanced driving assist system. For example, the present invention can also be applied to a hybrid system, a plug-in hybrid system, and the like.

Claims

1. An electronic control device, comprising:

a processor capable of stopping an action of a subject;

a monitor timer that outputs an abnormality detection signal when an abnormality occurs in the monitor signal output from the processor;

a 1 st flip-flop, an output signal of which 1 st flip-flop is held in a 1 st state when the processor is started;

a signal output circuit capable of outputting an operation stop signal to the object in a state where the output signal of the 1 st flip-flop is held in the 1 st state;

a 2 nd flip-flop connected to the signal output circuit; and

a reset circuit capable of resetting the processor,

the processor is capable of outputting a latch signal that maintains a state of an output signal of the 2 nd flip-flop to be a 2 nd state,

the signal output circuit outputs the operation stop signal to the object when the abnormality detection signal is output and when the output signal of the 2 nd flip-flop is held in the 2 nd state,

the reset circuit resets the processor in a state where the object is stopped by the operation stop signal.

2. The electronic control device according to claim 1,

the electronic control device further has a storage section capable of storing the number of times the processor is reset,

the processor outputs the latch signal when the reset count stored in the storage unit is equal to or more than a predetermined count.

3. The electronic control device according to claim 2,

the reset circuit resets the processor when power is turned on,

the processor executes a process of intentionally causing an abnormality in the monitor signal when the output signal of the 1 st flip-flop is not in the 1 st state and a process of determining that the monitor timer is normal when the output signal of the 1 st flip-flop is held in the 1 st state at the time of startup after reset,

the processor executes, at startup after reset, a process of updating the reset count stored in the storage unit when the output signal of the 1 st flip-flop is in the 1 st state, and a process of outputting the latch signal when the updated reset count is equal to or greater than the predetermined count.

4. The electronic control device according to claim 3,

the 2 nd flip-flop outputs the output signal held in the 2 nd state when the latch signal is output from the processor in a state where the output signal of the 1 st flip-flop is held in the 1 st state.

5. The electronic control device according to any one of claims 1 to 4,

the signal output circuit has a 1 st tri-state buffer and or circuit,

the 1 st tri-state buffer inverts the abnormality detection signal input from the watchdog timer and outputs the inverted signal to the or circuit when the output signal of the 1 st flip-flop is in the 1 st state,

the or circuit outputs a signal representing the or of the signal input from the 1 st tri-state buffer and the output signal of the 2 nd flip-flop as the action stop signal.

6. The electronic control device according to any one of claims 1 to 4,

the processor performs a lock-step mode of core diagnosis and outputs a core diagnosis signal representing a result of the core diagnosis to the signal output circuit,

when the nuclear diagnosis signal is output, the signal output circuit outputs the operation stop signal to the subject.

7. The electronic control device according to claim 6,

the signal output circuit has a 1 st tri-state buffer and or circuit,

the or circuit outputs, as the action stop signal, a signal representing an or of a signal input from the 1 st tri-state buffer, an output signal of the 2 nd flip-flop, and the core diagnostic signal input from the processor.

8. The electronic control device according to any one of claims 1 to 7,

the reset circuit has a power supply monitoring circuit and a 2 nd tri-state buffer,

the power supply monitoring circuit outputs a reset signal to the 2 nd tri-state buffer to reset the processor when power is turned on, and outputs a clear signal to clear the 1 st flip-flop and the 2 nd flip-flop,

the 2 nd tri-state buffer outputs the reset signal to the processor in a state where the object is stopped by the operation stop signal.

9. The electronic control device according to any one of claims 1 to 8,

the electronic control device is a vehicle-mounted electronic control device.

10. The electronic control device according to claim 9,

the electronic control device has a communication unit for performing data communication between the processor and another in-vehicle electronic control device.

11. A vehicle control system having:

an in-vehicle electronic control device according to any one of claims 1 to 8; and

another in-vehicle electronic control device connected to the in-vehicle electronic control device in a data communicable manner,

the in-vehicle electronic control device has a communication unit for performing data communication between the processor and the other in-vehicle electronic control device.