JP5913971B2 - Microcomputer monitoring device, electronic control device for controlling electric load of vehicle, and microcomputer monitoring method - Google Patents

Description

  The present invention relates to a microcomputer monitoring device, an electronic control device for controlling an electric load of a vehicle, and a microcomputer monitoring method.

  In an electronic control unit (ECU) mounted on a vehicle, various electric loads are controlled by output signals output from a microcomputer (hereinafter referred to as “microcomputer”). An appropriate range of the power supply voltage is determined for the microcomputer, and if the power supply voltage is out of the appropriate range, the microcomputer may run out of control and the electric load may malfunction.

  In-vehicle electronic control devices are required to have high fail-safe performance. In connection with this, an electronic device equipped with a microcomputer monitoring device (monitoring circuit) that monitors the operation of the microcomputer and the power supply voltage applied to the microcomputer. Control devices are known (see, for example, Patent Documents 1 to 4). For example, a watchdog (hereinafter referred to as “WDC”) signal output in a pulse form from a microcomputer is monitored, and if the WDC signal is not continuously detected for a certain period of time, it is determined that the microcomputer has runaway and a reset signal There is known a microcomputer monitoring device that outputs the signal to the reset terminal of the microcomputer. Even when an overvoltage or undervoltage of the power supply voltage supplied to the microcomputer is detected, there is a case where control for returning the microcomputer to a normal state is performed by resetting the microcomputer.

JP 2009-138841 A JP 2001-257573 A JP 2002-235598 A JP 2005-244334 A

  However, when an excessive voltage (overvoltage) is applied to the microcomputer, the microcomputer may be destroyed. In such a case, even if an attempt is made to perform a reset operation of the microcomputer, the microcomputer does not accept the reset signal, and there is a possibility that an electric load malfunctions. The present invention has been made in view of the above circumstances, and provides a technique related to a microcomputer monitoring device capable of suppressing malfunction of an electric load controlled by a microcomputer even when an excessive voltage is applied to the microcomputer. With the goal.

  The present invention employs the following means in order to solve the above-described problems. That is, the microcomputer monitoring apparatus according to the present invention is a microcomputer monitoring apparatus for monitoring a microcomputer that is supplied with a power supply voltage from a power supply and outputs (supplies) operating power (driving power) to an electric load. A switching signal that outputs a switching signal to a voltage monitoring unit that monitors the power supply voltage applied to the microcomputer from, and a switching unit that switches between cutting off and releasing the operating power output by the microcomputer toward the electric load An output unit, and the switching signal output unit causes the switching unit to cut off the operating power output by the microcomputer when the power supply voltage monitored by the voltage monitoring unit is higher than a predetermined first voltage. A shut-off signal is output.

  When the power supply voltage applied to the microcomputer is an excessive voltage, the microcomputer may be destroyed by the overvoltage. An excessive voltage is a voltage value higher than the upper limit voltage at which the microcomputer is determined to perform normal operation. Here, the first voltage may be the excessive voltage, or may be a voltage value set to a value lower than the excessive voltage by providing a predetermined margin for the excessive voltage. When an excessive voltage is applied to the microcomputer, the microcomputer may be destroyed even if an attempt is made to restore the microcomputer to a normal state by a reset operation of the microcomputer or the reset operation command may not be accepted. If it does so, the operating electric power output toward the electric load from a microcomputer will be maintained in an ON state, and there exists a possibility that an electric load may cause a malfunction.

  On the other hand, according to the microcomputer monitoring device according to the present invention, when a power supply voltage higher than the predetermined first voltage is applied to the microcomputer, the cutoff signal from the switching signal output unit is output to the switching unit. . Therefore, it is possible to forcibly cut off the operating power output from the microcomputer toward the electric load. As a result, the operating power output from the microcomputer to the electrical load can be forcibly cut off when there is a possibility that the microcomputer will fail, such as when a power supply voltage higher than the first voltage is applied to the microcomputer. Therefore, it is possible to avoid malfunction of the electric load.

  The microcomputer monitoring apparatus according to the present invention further includes a watchdog signal monitoring unit that monitors a watchdog signal periodically output from the microcomputer during normal operation of the microcomputer, and the switching signal output unit outputs the cutoff signal. In this state, when the watchdog signal monitoring unit detects the output of the watchdog signal from the microcomputer, the switching signal output unit causes the switching unit to release the cutoff of the operating power. A signal may be output.

  Here, even if the microcomputer is overvoltage, if the microcomputer is not destroyed, the output of the watchdog signal from the microcomputer may be resumed. As described above, when the output of the watchdog signal is restored, the cut-off state of the operating power output from the microcomputer toward the electric load is released, so that the operation of the electric load can be resumed.

  The microcomputer monitoring device further includes a reset signal output unit that outputs a reset signal to the microcomputer, and the reset signal output unit is configured such that the power supply voltage acquired by the voltage acquisition unit is lower than a predetermined second voltage, and The reset signal may be output to the microcomputer in at least one of cases where the watchdog signal is not continuously acquired by the operation signal acquisition unit for a predetermined time.

  Here, the second voltage may be, for example, an undervoltage that is a voltage lower than a lower limit voltage at which the microcomputer is determined to perform normal operation. Further, the second voltage may be a voltage value set to a value higher than the undervoltage by providing a predetermined margin for the undervoltage. If the power supply voltage applied to the microcomputer is lower than the second voltage, or if the watchdog signal is not acquired continuously for a certain period of time due to the microcomputer running out of control, the microcomputer goes into a failure state (destructive state). The possibility of falling is considered low. Therefore, in such a case, the microcomputer is returned to a normal state by performing a reset (restart) operation of the microcomputer. Thereby, after the microcomputer returns to the normal state, the supply of the operating power to the electric load can be resumed, which is highly convenient.

Further, the microcomputer monitoring device is a timer means for delaying a timing at which the switching signal output unit outputs the cut-off signal to the switching circuit by a predetermined time from an acquisition timing of a voltage value higher than the first voltage by the voltage acquisition unit. May be further provided. In this way, when a cut-off signal is output from the switching signal output unit, a delay time is provided to recognize instantaneous fluctuations in the power supply as an overvoltage and forcibly supply operating power to the electrical load. Can be suppressed.

  The present invention can be understood as an electronic control device that includes any microcomputer monitoring up to the above and controls the electric load of the device vehicle. That is, the present invention is an electronic control device for controlling an electric load of a vehicle, wherein a microcomputer is supplied with a power supply voltage from a power supply circuit and outputs operating power to the electric load, and a microcomputer for monitoring the microcomputer A monitoring device, and a switching unit that switches between cutting off and releasing the operating power output by the microcomputer toward the electric load, and the microcomputer monitoring device supplies a power supply voltage applied to the microcomputer from the power supply circuit. And a switching signal output unit that outputs a switching signal to the switching circuit, wherein the switching signal output unit has a power supply voltage acquired by the voltage acquisition unit that is higher than a predetermined first voltage. In this case, the switching unit outputs a cut-off signal for cutting off the operating power output from the microcomputer.

  The present invention can also be understood as a microcomputer monitoring method. That is, the present invention is a microcomputer monitoring method executed by a microcomputer monitoring device for monitoring a microcomputer that is supplied with a power supply voltage from a power supply and outputs operating power to an electric load, and is applied to the microcomputer from the power supply. A voltage monitoring step for monitoring the power supply voltage, and a switching signal output step for outputting a switching signal to a switching unit that switches between interruption and release of the operating power output by the microcomputer toward the electric load, In the switching signal output step, when the power supply voltage monitored in the voltage monitoring step is higher than a predetermined first voltage, the switching unit outputs a cutoff signal for cutting off the operating power output from the microcomputer. It is characterized by doing.

  The means for solving the problems in the present invention can be employed in combination as much as possible.

  ADVANTAGE OF THE INVENTION According to this invention, even when an excessive voltage is applied to a microcomputer, the microcomputer monitoring apparatus which can suppress malfunctioning of the electric load which a microcomputer controls can be provided.

1 is a block configuration diagram illustrating a schematic configuration of an electronic control device according to Embodiment 1. FIG. It is a figure which shows the circuit structural example of the switching part in an electronic controller. 3 is a timing chart illustrating an example of signal output in the electronic control device according to the first embodiment. It is a timing chart which shows the signal output example in the comparative example of an electronic control unit. It is a figure which shows schematic structure of the microcomputer monitoring apparatus which concerns on a modification. It is a timing chart for demonstrating a delay process.

  DETAILED DESCRIPTION Exemplary embodiments for carrying out the present invention will be described in detail below with reference to the drawings. It should be noted that the dimensions, materials, shapes, relative arrangements, and the like of the components described in this embodiment are intended to limit the technical scope of the invention only to those unless otherwise specified. is not.

<Example 1>
FIG. 1 is a block configuration diagram illustrating a schematic configuration of an electronic control device 1 according to the first embodiment. The electronic control device 1 is mounted on a vehicle and is a control unit that controls an electric load 2 of the vehicle. A vehicle on which the electronic control device 1 is mounted includes a battery (BATT) 3 that supplies electric power to an electric load of each part of the vehicle. A power supply line 4 is connected to the battery 3, and an ignition switch (IGSW) 5 is provided on the power supply line 4.

  When the ignition switch 5 is turned on, power is supplied from the battery 3 to the electronic control unit 1 through the power line 4. Examples of the electric load 2 include, but are not limited to, a drive motor for adjusting the opening of the electronic throttle, a starter motor related to an idling stop (eco-run) function, and the like. In this embodiment, the case where the electronic control device 1 controls the drive motor for adjusting the opening of the electronic throttle of the vehicle as the electric load 2 will be described as an example.

  The battery 3 is charged by an alternator 6 that is a generator. The alternator 6 converts mechanical kinetic energy transmitted from an engine (not shown) into AC power, and further rectifies it into DC power using a rectifier including a diode. The electric power generated by the alternator 6 is stored in the battery 3 via the power line 4. When the alternator 6 generates power, a target voltage (for example, 14.5 V) that is a target of power generation is set, and the alternator 6 generates power so that the voltage of the power supply line 4 becomes the target voltage.

The electronic control device 1 is configured as an ECU (Electronic Control Unit), for example, and includes a microcomputer (microcomputer) 10, a microcomputer monitoring device 20, a power supply 30, an output driver 40, and a switching unit 50 as main components. The microcomputer 10 includes a CPU, a RAM, a ROM, and the like. Various functions included in the microcomputer 10 are realized by the CPU performing arithmetic processing according to a program recorded in advance in the ROM. The functions of the microcomputer 10 include a function of outputting a pulsed watchdog (WDC) signal periodically when the microcomputer 10 is operating normally, and driving an electronic load (drive motor) 2. The function to perform is included.

  Hereinafter, the configuration of each part of the electronic control device 1 will be described in detail. The power supply 30 included in the electronic control device 1 is a power supply circuit that supplies operating power to the microcomputer 10. The power supply 30 is connected to the battery 3 via the power supply line 4 and functions as a regulator that steps down the input voltage to the microcomputer 10 to a constant voltage. The electric power supplied to the microcomputer 10 is supplied from the battery 3 of the vehicle. The ideal voltage supplied to the microcomputer 10 is 5V, whereas the normal voltage of the battery 3 is 12V, for example. For this reason, in the electronic control device 1, the voltage of the battery 3 is stepped down by the power supply 30 and then supplied to the microcomputer 10.

  In the electronic control unit 1, the power supply 30 and the microcomputer 10 are connected by the first power supply line 11, the microcomputer 10 and the output driver 40 are connected by the second power supply line 12, and the output driver 40 and the electrical load 2 are connected by the third power. Connected by a supply line 13. The power from the power supply 30 is supplied to the microcomputer 10 via the first power supply line 11. The operating (driving) power for operating (driving) the electric load 2 is output from the microcomputer 10 and supplied to the output driver 40 through the second power supply line 12, and the output driver 40 and the third power supply line 13 are To be supplied to the electric load 2.

  The output driver 40 is a drive circuit for driving the electric load 2, and supplies the operating power output from the microcomputer 10 to the electric load 2 through the second power supply line 12. The output driver 40 is, for example, a microcomputer so that power of a voltage suitable for the standard of the electric load 2 is supplied according to the type (type) of the electric load 2 connected via the third power supply line 13. The output from 10 can be appropriately amplified. The output driver 40 may drive the electrical load 2 by turning on / off a current flowing through the electrical load 2 by a control signal output from an output port (not shown) of the microcomputer 10.

  A microcomputer monitoring device 20 that monitors the microcomputer 10 is constructed by, for example, an integrated circuit (IC), and includes a voltage monitoring unit 21, a DEF signal output unit 22, a watchdog (WDC) signal monitoring unit 23, and a reset signal output unit 24. Etc. The voltage monitoring unit 21 is connected to the first power supply line 11 and is a circuit that monitors the power supply voltage VCC applied from the power supply 30 to the microcomputer 10.

  The voltage monitoring unit 21 determines whether or not the power supply voltage VCC is within a predetermined range in which the microcomputer 10 is determined to perform normal operation. Specifically, an overvoltage determination circuit 211 that determines whether or not the power supply voltage VCC is higher than an upper limit voltage VOV (first voltage) at which the microcomputer 10 is determined to perform normal operation, and a power supply An undervoltage determination circuit 212 is provided for determining whether the voltage VCC is an undervoltage lower than a lower limit voltage VUN (second voltage) at which the microcomputer 10 is determined to perform normal operation. For example, the excessive voltage determination circuit 211 outputs an abnormal signal (Hi level) when the value of the input power supply voltage VCC is larger than the upper limit voltage VOV. The undervoltage determination circuit 212 outputs an abnormal signal (Hi level) when the input voltage value is smaller than the threshold value VUN.

  The WDC signal monitoring unit 23 monitors a watchdog (WDC) signal periodically output in a pulse form from the CPU of the microcomputer 10. If the WDC signal cannot be received within a predetermined time, the microcomputer 10 runs out of control. It is determined that an abnormality such as a failure has occurred, and an abnormality signal (Hi level) is output.

  When at least one of the WDC signal monitoring unit 23, the overvoltage determination circuit 211, and the undervoltage determination circuit 212 outputs an abnormal signal (Hi level), the reset signal output unit 24 outputs a reset signal ( A logic circuit that outputs (Lo level). For example, the reset signal output unit 24 includes a NOR circuit that outputs a Hi level signal only when inputs from the WDC signal monitoring unit 23, the overvoltage determination circuit 211, and the undervoltage determination circuit 212 are all at the Lo level, for example. You may have. The microcomputer 10 has a reset terminal (not shown). When a reset signal is received from the reset signal output unit 24 from the reset terminal, the microcomputer 10 is reset (restarted). This reset operation makes it possible to restore the microcomputer 10 to a normal state even when the power supply voltage VCC decreases or when the microcomputer 10 runs away due to electrical noise, for example.

  The DEF signal output unit 22 (switching signal output unit) is an electronic circuit that outputs a switching signal (hereinafter referred to as “DEF (defect) signal”) to the switching unit 50. The DEF signal is set with two signals, a Hi level Hi signal and a Lo level Lo signal. When the DEF signal is at the Lo level, the output from the output driver 40 to the electric load 2 is fixed to the non-energized logic level. When the DEF signal is at the Hi level, the output from the output driver 40 to the electric load 2 is fixed to the logic level on the energization side. The DEF signal output unit 22 includes a logic circuit such as a NOR circuit that outputs a Hi level signal only when the inputs from the WDC signal monitoring unit 23 and the overvoltage determination circuit 211 are both at the Lo level, for example. Also good. In this case, if the output signal of at least one of the WDC signal monitoring unit 23 and the overvoltage determination circuit 211 is an abnormal signal (Hi level), a Lo level Lo signal is output to the switching unit 50, and both Only when the input is at the Lo level, a Hi level Hi signal is output to the switching unit 50.

The switching unit 50 is connected to the microcomputer monitoring device 20 and the second power supply line 12 and has a function of switching between cutting off and releasing the operating power (driving power) output from the microcomputer 10 toward the electric load 2. It is an electronic circuit. The switching unit 50 is connected to the microcomputer monitoring device 20 through the DEF signal line 14. Further, a cutoff line 15 is branched from the second power supply line 12, and the tip end side of the cutoff line 15 is grounded (grounded).
Further, the switching unit 50 described above is provided in the middle of the cutoff line 15.

  FIG. 2 is a diagram illustrating a circuit configuration example of the switching unit 50. The switching unit 50 includes two transistors Tr1 and Tr2 and a resistor R1. One terminal of the resistor R1 is connected to a branch line (not shown) that branches from the first power supply line 11, and the other side of the resistor R1 is connected to the collector of the transistor Tr1. A DEF signal line 14 is connected to the base of the transistor Tr1, and the emitter of the transistor Tr1 is grounded. The collector of the transistor Tr1 is connected to the base of the transistor Tr2. A cutoff line 15 is connected to the collector and emitter of the transistor Tr2, and the tip side of the cutoff line 15 is grounded. The operation content of the switching unit 50 will be described later.

  FIG. 3 is a timing chart illustrating an example of signal output in the electronic control device 1 according to the first embodiment. FIG. 3A shows a timing chart of the power supply voltage VCC input to the voltage monitoring unit 21, and FIG. 3B shows a timing chart of the reset signal output from the reset signal output unit 24 of the microcomputer monitoring device 20. . 3C shows a timing chart of the operating state (ON / OFF state) of the microcomputer 10, and FIG. 3D shows a timing chart of the WDC signal input to the WDC signal monitoring unit 23 of the microcomputer monitoring device 20. . FIG. 3E shows a timing chart of the DEF signal output from the DEF signal output unit 22 of the microcomputer monitoring device 20. FIG. 3F shows a timing chart of output from the microcomputer 10 to the output driver 40, and FIG. 3G shows a timing chart of output from the output driver 40 to the electric load 2. It is assumed that at the start of this timing chart, the ignition switch 5 is turned off and the vehicle engine is not started.

  At time t1, the ignition switch 5 of the vehicle is turned on. As a result, operating power is supplied to the microcomputer 10 via the battery 3 and the power source 30. As a result, the microcomputer 10 is activated and enters an operating state. When the microcomputer 10 is started, the initial value of the DEF signal output from the DEF signal output unit 22 of the microcomputer monitoring device 20 is set so that a Hi level Hi signal is output. During the normal operation of the microcomputer 10, the WDC signal described above is output in a pulse form from the microcomputer 10, and this WDC signal is monitored by the WDC signal monitoring unit 23 of the microcomputer monitoring device 20.

  Here, an information signal indicating the traveling state of the vehicle is input to the microcomputer 10 from various sensors provided in the vehicle via an interface (not shown). The various sensors here include, for example, a vehicle speed sensor that detects the speed of the vehicle, a shift position sensor that detects the position of the shift lever, an accelerator opening sensor that detects the accelerator opening, and a brake sensor that detects the operating state of the brake. However, it is not limited to these.

  The microcomputer 10 acquires information indicating the running state of the vehicle based on signals input from various sensors, and outputs operating power to be supplied to the electric load 2 to the output driver 40 at an appropriate timing. In FIG. 3F, operating power is output from the microcomputer 10 to the output driver 40 when the output signal is ON, and output of operating power from the microcomputer 10 is stopped when the output signal is OFF.

  At time t1, the DEF signal from the DEF signal output unit 22 is initially set to the Hi signal at the Hi level. When the Hi level DEF signal is input to the switching unit 50 through the DEF signal line 14, the transistor Tr1 is turned on. As a result, the voltage at the base of the transistor Tr2 becomes low and the transistor Tr2 is turned off, so that no current flows through the cutoff line 15. That is, the operating power output from the microcomputer 10 to the second power supply line 12 is supplied to the output driver 40 without flowing to the cutoff line 15.

  The output driver 40 amplifies the power received from the microcomputer 10 and outputs the operating power, and the operating power is supplied to the electric load 2 through the third power supply line 13. Driven. In FIG. 3G, the operating power is output from the output driver 40 to the electric load 2 when the output signal is ON, and the operating power is output from the output driver 40 when the output signal is OFF. Is stopped.

  At time t2, for example, when the microcomputer 10 runs away due to electrical noise or the like, the WDC signal indicating the normal state of the microcomputer 10 is not input to the WDC signal monitoring unit 23. The WDC signal monitoring unit 23 counts the time during which the pulsed WDC signal from the microcomputer 10 is interrupted, and refreshes the time when a new WDC signal is input. When the counted time reaches a predetermined time (time t3), it is determined that the microcomputer 10 is out of control. In this case, an abnormal signal is output from the WDC signal monitoring unit 23, and the reset signal output unit 24 that has received the abnormal signal outputs a reset signal to the microcomputer 10. When the reset signal is input to the microcomputer 10, the reset operation of the microcomputer 10 is performed.

  When an abnormal signal is output from the WDC signal monitoring unit 23, a Lo level Lo signal is output from the DEF signal output unit 22. When the Lo level DEF signal is input to the switching unit 50 through the DEF signal line 14 in this way, the transistor Tr1 is turned off, and the voltage at the base of the transistor Tr2 rises. As a result, the transistor Tr2 is turned on. Can be switched to. As a result, the operating power output from the microcomputer 10 to the second power supply line 12 is not input to the output driver 40 and flows to the ground through the cutoff line 15 branched from the second power supply line 12. As a result, the supply of the operating power output from the microcomputer 10 toward the electric load 2 is forcibly cut off (cut).

  When the microcomputer 10 returns to the normal state by the reset operation of the microcomputer 10, the output of the WDC signal by the microcomputer 10 is restored. The example of FIG. 3B shows a case where the normal state is restored by the reset operation corresponding to the second reset signal output from the reset signal output unit 24. When the WDC signal returns to the normal state, the DEF signal output unit 22 switches the DEF signal from the Lo signal to the Hi signal again (time t4). After confirming that the microcomputer 10 has returned to a normal state, the operating power output from the microcomputer 10 toward the electric load 2 is released by setting the DEF signal to Hi level. Although the output of the microcomputer 10 is temporarily turned on between the times t3 and t4 (FIG. 3 (f)), the microcomputer 10 is in a runaway state during the above period, and the DEF signal is at the Lo level. Therefore, the output of the output driver 40 is kept off (FIG. 3 (g)).

  Next, control when an overvoltage is applied to the microcomputer 10 will be described. As illustrated, in the illustrated timing chart, the power supply voltage VCC increases slightly before time t5, and the power supply voltage VCC exceeds the upper limit voltage VOV at time t5. In this case, an abnormal signal is output from the overvoltage determination circuit 211 in the voltage monitoring unit 21 of the microcomputer monitoring device 20. Then, triggered by the output of the abnormal signal (Hi level) by the overvoltage determination circuit 211, the reset signal is output from the reset signal output unit 24, and the Lo signal at the Lo level is output from the DEF signal output unit 22 as the DEF signal. (Time t5).

Here, as a comparative example, consider a case where only the reset operation of the microcomputer 10 is performed when the power supply voltage VCC becomes an excessive voltage at time t5 (that is, in this case, the DEF signal output unit 22 outputs a Hi signal as a DEF signal). Will continue to output). FIG. 4 is a timing chart showing signal output in a comparative example of the electronic control device 1. FIGS. 4A to 4G correspond to FIGS. 3A to 3G. In the signal output according to the comparative example of FIG. 4, when an abnormal signal is output from the overvoltage determination circuit 211 of the voltage monitoring unit 21 that monitors the power supply voltage VCC at time t5, a reset signal is output from the reset signal output unit 24. However, the DEF signal output from the DEF signal output unit 22 still outputs the Hi signal at the Hi level.

  By the way, if an excessive voltage is applied to the microcomputer 10, the microcomputer 10 may be destroyed. In that case, the microcomputer 10 may not accept the reset signal from the reset signal output unit 24, and the reset operation of the microcomputer 10 may not be performed. Then, even if the operation of the microcomputer 10 is stopped at the time t5 of the comparative example, the output of the microcomputer 10 is maintained in the ON state because the microcomputer 10 does not accept the reset signal (FIG. 4 (f )). At this time, if the DEF signal output from the DEF signal output unit 22 is maintained at the Hi level, the output from the output driver 40 is also maintained in the ON state (FIG. 4G), and the electric load 2 May cause malfunction.

  On the other hand, the microcomputer monitoring apparatus 20 according to the present embodiment is triggered by the output of the abnormal signal by the excessive voltage determination circuit 211, that is, when the voltage monitoring unit 21 detects the overvoltage of the power supply voltage VCC. The DEF signal output from the signal output unit 22 is switched to the Lo level (FIG. 3 (e), time t5). As a result, the supply of operating power from the microcomputer 10 toward the output drive 40 is forcibly cut off. Therefore, even when the microcomputer 10 is destroyed due to an overvoltage and the output is maintained in the on state without receiving the reset signal (FIG. 3 (f)), the output of the output driver 40 is forcibly set. Can be switched to the off state (FIG. 3G). As a result, the driving of the electric load 2 is stopped.

  As described above, in the microcomputer monitoring method according to the present embodiment, the voltage monitoring step for monitoring the power supply voltage VCC applied from the power supply 30 to the microcomputer 10, and the operating power output from the microcomputer 10 toward the electric load 2. A switching signal output step for outputting a DEF signal (switching signal) to the switching unit 50 for switching between blocking and release thereof. In this switching signal output step, the power supply voltage VCC monitored in the voltage monitoring step is the upper limit voltage VOV. When the voltage is higher than the (first voltage), the Lo signal is output from the DEF signal output unit 22 to the switching unit 50 so that the operating power output from the microcomputer 10 is cut off. As a result, it is possible to prevent malfunction of the electric load 2 even in a situation where the microcomputer 10 has failed due to application of overvoltage.

  In the above control example, when an excessive voltage is applied to the microcomputer 10, the reset signal is output from the reset signal output unit 24 to the microcomputer 10, but the DEF signal output from the DEF signal output unit 22 is output. It is only necessary to switch to the Lo level, and the reset operation can be omitted.

  Next, regarding the DEF signal output from the DEF signal output unit 22, the return timing from the Lo signal to the Hi signal will be described. Here, even when the power supply voltage VCC applied from the power supply 30 to the microcomputer 10 becomes an excessive voltage, the microcomputer 10 does not always fail, and the output of the WDC signal temporarily stops due to temporary runaway. However, there is a case where it returns to a normal state after that.

Therefore, the microcomputer monitoring apparatus 20 according to the present embodiment restores the DEF signal output from the DEF signal output unit 22 from the Lo level to the Hi level when the output of the WDC signal from the microcomputer 10 is resumed. Also good. That is, the DEF signal output unit 22 of the microcomputer monitoring device 20 cancels the abnormal signal from the WDC signal monitoring unit 23 when the WDC signal from the microcomputer 10 is restored in a state where the Lo level Lo signal is output. (W
When the DC signal monitoring unit 23 detects the output of the WDC signal by the microcomputer 10), the energization return control is performed in which the DEF signal is switched from the Lo signal to the Hi signal (interruption release signal) and output. As described above, when the microcomputer 10 returns to the normal state, the electric load is controlled according to the running state of the vehicle by performing the energization return control for releasing the cutoff state of the power supply from the microcomputer 10 to the electric load 2. 2 can be driven.

<Modification>
Next, a modification of the electronic control device 1 will be described. As described above, the type of the electric load 2 that is controlled and supplied by the microcomputer 10 applied to the electronic control device 1 is not particularly limited. That is, in addition to the drive motor that adjusts the opening of the electronic throttle of the vehicle described in this embodiment, a starter motor related to an idling stop (eco-run) function, a motor that drives an airbag, a solenoid of an electronically controlled fuel injection valve, etc. Various electronic components can be applied as an electrical load.

  Further, in the control example related to the microcomputer monitoring device described above, immediately after the voltage monitoring unit 21 detects that the power supply voltage VCC to the microcomputer 10 is excessive, the microcomputer 10 outputs the output driver 40 and thus the electric load 2. Although power supply is forcibly cut off, a timer for delaying the cut-off timing may be provided to perform delay processing.

  In the above embodiment, the upper limit voltage VOV is set as the first voltage according to the present invention and the lower limit voltage VUN is set as the second voltage according to the present invention. However, the present invention is not limited to this. For example, the first voltage may be set to a voltage value lower than the upper limit voltage VOV, that is, a voltage value lower than the overvoltage, or the second voltage may be set to a voltage value higher than the lower limit voltage VUN. That is, various changes can be made in the setting of the first voltage and the second voltage.

  FIG. 5 is a diagram showing a schematic configuration of a microcomputer monitoring apparatus 20A according to a modification. In FIG. 5, the same reference numerals are given to configurations common to FIG. 1. As shown in FIG. 5, the microcomputer monitoring apparatus 20A according to the present modification includes a timer 25 (timer means). In the illustrated example, the timer 25 is provided in the DEF signal output unit 22. When at least one of the WDC signal monitoring unit 23 and the overvoltage determination circuit 211 outputs an abnormal signal, the timer 25 has a Lo level as a DEF signal after a predetermined time (hereinafter referred to as “delay time”) ΔTd has elapsed. Delay processing for outputting the Lo signal to the switching unit 50 is performed. FIG. 6 is a timing chart for explaining the delay processing. 6 shows a timing chart of the power supply voltage VCC input to the voltage monitoring unit 21, and a lower part shows a timing chart of the DEF signal output from the DEF signal output unit 22.

  When the value of the power supply voltage VCC applied to the microcomputer 10 at time t1 ′ becomes an excessive voltage higher than the upper limit voltage VOV, the voltage monitoring unit 21 of the microcomputer monitoring device 20A indicates that the power supply voltage VCC is an excessive voltage. To detect. For example, the timer 25 counts the elapsed time after the overvoltage determination circuit 211 outputs an abnormal signal, and at time t2 ′ when the elapsed time reaches the delay time ΔTd, the timer 25 changes the Lo signal from the Hi level to the Lo signal. Switch to level Lo signal. In this way, when the power supply voltage VCC becomes an overvoltage, by delaying the timing for switching the DEF signal from the Hi signal to the Lo signal, an instantaneous fluctuation of the power supply 30 is erroneously detected as an overvoltage, and the electric load Forcibly stopping the driving of 2 can be suppressed.

Further, for example, the setting of the delay time ΔTd may be changed according to the type of the electric load 2 connected to the microcomputer 10 (output driver 40) or the driving state of the vehicle. For example, when the electric load 2 is a solenoid of an electronically controlled fuel injection valve, an engine stall may occur if power supply from the microcomputer 10 to the electric load 2 is interrupted during traveling. Therefore, the delay processing may be performed during traveling, and the delay time ΔTd may not be substantially provided during non-traveling so that the delay processing is not performed. Further, when the electric load 2 is a motor for driving the airbag device, the delay time ΔTd is not substantially provided when the vehicle is traveling, and the delay time described above is provided by providing the delay time when not traveling. Processing may be performed. This is because the necessity of operating the airbag device is low when the vehicle is not traveling, and no inconvenience occurs even if the power supply to the motor that operates the airbag device is cut off. Further, as described above, even when the energization return control is performed, after the detection of the WDC signal from the microcomputer 10 is resumed by the WDC signal monitoring unit 23, the DEF signal is not immediately switched to the Hi signal, and the switching timing is set. Delay processing for delaying may be performed.

  Although the embodiments of the present invention have been described above, various changes can be made to the microcomputer monitoring device 20 and the electronic control device 1 according to the present invention without departing from the spirit of the present invention. The control content executed by the microcomputer monitoring device 20 described above may be realized by the CPU executing a control program stored in a RAM, a ROM, or the like. Further, the control program can be recorded on a computer-readable recording medium. The function can be provided by causing the computer to read and execute the program of the recording medium. Here, the computer-readable recording medium refers to a recording medium in which information such as data and programs is accumulated by electrical, magnetic, optical, mechanical, or chemical action and can be read from a computer. Examples of such a recording medium that can be removed from the computer include a flexible disk, a magneto-optical disk, a CD-ROM, a CD-R / W, a DVD, a DAT, an 8 mm tape, and a memory card. In addition, there are a hard disk, a ROM, and the like as a recording medium fixed to the computer.

DESCRIPTION OF SYMBOLS 1 ... Electronic control apparatus 2 ... Electric load 3 ... Battery 10 ... Microcomputer 11 ... 1st power supply line 12 ... 2nd power supply line 13 ... 3rd power supply line 14 ... DEF signal line 15 ... Cut-off line 20 ... Microcomputer monitoring device 21 ... Voltage monitoring unit 22 ... DEF signal output unit 23 ... WDC signal monitoring unit 24 ... Reset signal output Unit 30 ... Power source 40 ... Output driver 50 ... Switching unit

Claims (5)

A microcomputer monitoring device for monitoring a microcomputer that is supplied with power supply voltage from a power supply and outputs operating power to an electric load,
A voltage monitoring unit for monitoring a power supply voltage applied to the microcomputer from the power supply;
A switching signal output unit that outputs a switching signal to a switching unit that switches between cutoff and release of the operating power output by the microcomputer toward the electrical load, and
The switching signal output unit outputs a cut-off signal for cutting off the operating power output from the microcomputer when the power supply voltage monitored by the voltage monitoring unit is higher than a predetermined first voltage. And
It further comprises timer means for delaying the timing at which the switching signal output unit outputs the cutoff signal to the switching unit by a predetermined time from the acquisition timing of the voltage value higher than the first voltage by the voltage monitoring unit. A microcomputer monitoring device. A watchdog signal monitoring unit for monitoring a watchdog signal periodically output from the microcomputer during normal operation of the microcomputer;
When the watchdog signal monitoring unit detects the output of the watchdog signal from the microcomputer in a state where the switching signal output unit outputs the cutoff signal, the switching signal output unit The microcomputer monitoring apparatus according to claim 1, wherein a cutoff release signal for releasing the cutoff of the operating power is output to the microcomputer. A reset signal output unit for outputting a reset signal to the microcomputer;
In the reset signal output unit, when the power supply voltage acquired by the voltage monitoring unit is lower than a predetermined second voltage, the watchdog signal is not continuously acquired by the watchdog signal monitoring unit for a certain period of time. The microcomputer monitoring apparatus according to claim 2, wherein the reset signal is output to the microcomputer in at least one of cases. An electronic control device for controlling an electric load of a vehicle,
A microcomputer that is supplied with a power supply voltage from a power supply circuit and outputs operating power to the electric load;
A microcomputer monitoring device for monitoring the microcomputer;
A switching unit that switches between interruption and release of the operating power output by the microcomputer toward the electrical load,
The microcomputer monitoring device is
A voltage monitoring unit for monitoring a power supply voltage applied to the microcomputer from the power supply circuit;
And a switching signal output unit for outputting a switching signal to the switching unit,
The switching signal output unit, the power supply voltage by the voltage monitoring unit has acquired is higher than a predetermined first voltage, to the switching unit, and outputs a cutoff signal for blocking the operating power which the microcomputer has outputs ,
It further comprises timer means for delaying the timing at which the switching signal output unit outputs the cutoff signal to the switching unit by a predetermined time from the acquisition timing of the voltage value higher than the first voltage by the voltage monitoring unit. An electronic control device for controlling the electric load of the vehicle to be operated. A microcomputer monitoring method executed by a microcomputer monitoring device for monitoring a microcomputer that is supplied with power supply voltage from a power supply and outputs operating power to an electric load,
A voltage monitoring step for monitoring a power supply voltage applied to the microcomputer from the power supply;
A switching signal output step of outputting a switching signal to a switching unit that switches between cutoff and release of the operating power output by the microcomputer toward the electrical load, and
In the switching signal output step, when the power supply voltage monitored in the voltage monitoring step is higher than a predetermined first voltage, the switching signal output step is delayed for a predetermined time from the acquisition timing of the voltage value higher than the first voltage, The microcomputer monitoring method characterized by outputting the interruption | blocking signal for interrupting | blocking the operating electric power which the said microcomputer output to the switch part.

Images