JPH1173203A - Electronic control unit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control unit(ECU) for realizing back-up control by a sub-microcomputer (sub-micon) for an actuator at the time of the generation of abnormality in a main microcomputer (main micon) with a simple constitution. SOLUTION: The device is provided with a main microcomputer 3 whose input and output ports P00-P03 connected with a signal inputting part 41 of a driving circuit 7 for driving a motor M are set as output ports for outputting the driving signals of the motor M to the driving circuit 7 in a normal time, and whose input and output ports P00-P03 are set as input ports when a reset signal is applied to a reset terminal INT, and a sub-micon 5 whose own input and output ports P10-P13 are connected with the ports P00-P03 in a wired OR form. At the time of detecting the abnormality of a main micon 3, the sub-micon 5 continues to apply the reset signal to the reset terminal INT of the main micon 3, and switches the input and output ports P10-P13 to output ports for outputting the driving signals to the driving circuit 7.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a backup control system comprising a main microcomputer and a sub-microcomputer, wherein the sub-microcomputer drives an actuator in place of the main microcomputer when an abnormality occurs in the main microcomputer. The present invention relates to an electronic control device having functions.

[0002]

2. Description of the Related Art Conventionally, for example, an electronic control unit for controlling a vehicle mounted on an automobile has a microcontroller having a CPU, a ROM, a RAM, an input port, an output port, and the like. A computer (hereinafter, also referred to as a microcomputer) is mounted, and the microcomputer outputs a drive signal to a drive circuit that drives the actuator according to a program stored in the ROM.

In this type of electronic control device, in order to prevent abnormal operation of the microcomputer due to runaway of the program, as shown in FIG. 6, the microcomputer 51 periodically sends a so-called watchdog pulse WD with the execution of the program. And a monitoring circuit 53 for monitoring the watchdog pulse WD from the microcomputer 51 is provided.
When the watchdog pulse WD is no longer output from the microcomputer 51, the monitoring circuit 53 determines that the operation of the microcomputer 51 is abnormal and gives a reset signal RST to the reset terminal of the microcomputer 51 for a predetermined time. Operation is returned to normal.

[0004] By the way, even if the application of the reset signal RST to the microcomputer 51 is canceled, a malfunction that the operation of the microcomputer 51 does not return to a normal state (for example, a hardware failure other than a program runaway) may be considered. In recent years, higher control safety has been required for this type of electronic control device.

Therefore, in order to further enhance the control safety, a microcomputer which is the center of control is provided as a main microcomputer, and another microcomputer is added as a sub-microcomputer. It has been considered that the sub-microcomputer performs so-called backup control in which an actuator is driven in place of the main microcomputer.

As a specific configuration, for example, the configuration shown in FIG. 6 can be considered. That is, first, one of the drive signal output port PM of the main microcomputer (main microcomputer) 51 and the drive signal output port PS of the sub microcomputer (sub microcomputer) 55 is connected to the actuator (in this example, the coil of the actuator). L1-L
4) An output switching circuit 59 for switching to and connecting to the signal input unit 57a of the driving circuit 57 for driving is provided.

Then, for example, the sub microcomputer 55 monitors the watchdog pulse WD from the main microcomputer 51,
When the output of the watchdog pulse WD is stopped, it is determined that the operation of the main microcomputer 51 is abnormal, and its own output port PS is replaced with the signal input section 57a of the drive circuit 57 instead of the output port PM of the main microcomputer 51. A switching signal is output to the output switching circuit 59 so as to be connected. Further, in this state, the sub-microcomputer 55 outputs a drive signal for driving the actuator from its own output port PS to the drive circuit 57.

However, in the configuration as shown in FIG. 6, the output switching circuit 59 is indispensable, so that high control safety can be achieved, but it is disadvantageous for realizing miniaturization and cost reduction of the device. It is. The present invention has been made in view of such a problem, and provides an electronic control device that can realize, with a simple configuration, backup control of an actuator by a sub microcomputer when an abnormality occurs in a main microcomputer. It is intended to be.

[0009]

Means for Solving the Problems and Effects of the Invention In order to achieve the above object, the electronic control device of the present invention according to the first aspect is capable of switching between an input port and an output port by software. It has a main microcomputer and a sub microcomputer each having an input / output port.

An input / output port of the main microcomputer is connected to the signal input section of the drive circuit for driving the actuator in accordance with a drive signal input to the signal input section. Are connected in a wired-OR manner to a signal path between an input / output port of the main microcomputer and a signal input section of the drive circuit. Further, among the two microcomputers, at least the main microcomputer has its own input / output port becoming an input port when a reset signal is given to its reset terminal and initialized (reset).

Here, during normal operation, the main microcomputer sets its own input / output port as an output port, and sends a drive signal for driving the actuator from the input / output port as the output port to the drive circuit. Output. Then, the monitoring means monitors whether or not the operation of the main microcomputer is normal, and when the monitoring means determines that the operation of the main microcomputer is abnormal, the initialization means causes the initialization of the main microcomputer to proceed. A reset signal is continuously applied to the reset terminal.

The sub-microcomputer is determined by the monitoring means to determine that the operation of the main microcomputer is abnormal, and while the reset signal is being supplied to the reset terminal of the main microcomputer by the initialization means, the sub-microcomputer has its own input. Set the output port as an output port, and output a drive signal to drive the actuator from the input / output port as the output port to the drive circuit; otherwise, set its own input / output port as the input port. Set.

For this reason, if the operation of the main microcomputer is not judged to be abnormal by the monitoring means (that is, normal), the input / output port of the sub-microcomputer is set to the input port, and the main microcomputer is set to the input port. The drive signal output from the input / output port of the microcomputer is input to the signal input section of the drive circuit without being affected by the input / output port of the sub-microcomputer. As a result, the actuator is driven by the drive circuit from the main microcomputer. It is driven according to the signal.

On the other hand, if the operation of the main microcomputer is judged to be abnormal by the monitoring means, the main microcomputer is continuously initialized (reset) by the initialization means, and during that time, the input / output ports of the main microcomputer are reset. Is forced to be an input port, and the sub-microcomputer sets its own input / output port as an output port and outputs a drive signal to the drive circuit.

Therefore, when an abnormality occurs in the main microcomputer, the drive signal output from the input / output port of the sub microcomputer is input to the signal input section of the drive circuit without being affected by the input / output port of the main microcomputer. As a result, the actuator is driven by the drive circuit in accordance with the drive signal from the sub-microcomputer.

As described above, in the electronic control unit of the present invention, when the main microcomputer is abnormal, the input / output port of the main microcomputer is forcibly input by continuously providing the reset signal to the reset terminal of the main microcomputer. In this state, the sub microcomputer switches its own input / output port to an output port, and outputs a drive signal for backup control from the port to the drive circuit.

Therefore, according to the electronic control device of the present invention,
Without providing the output switching circuit 59 as shown in FIG. 6, the input / output port of the main microcomputer and the input / output port of the sub-microcomputer are connected in a wired-OR manner, and drive signals from both microcomputers are connected. Since the switching can be provided to the drive circuit, backup control of the actuator by the sub-microcomputer when an abnormality occurs in the main microcomputer can be realized with a very simple configuration.
Therefore, according to the electronic control device of the present invention, both control safety and miniaturization and cost reduction of the device can be achieved at a high level.

A microcomputer having an input / output port that can be switched between an input port and an output port by software is well known as described in, for example, Japanese Patent Publication No. 60-54682. Specifically, this type of microcomputer has an input / output setting register for determining whether the input / output port is to be set to an input port or an output port. By rewriting the value of the input / output setting register, the input / output port can be arbitrarily set to any of the input port and the output port.

In general, a microcomputer having this type of switchable input / output port is generally configured such that when a reset signal is applied to a reset terminal and initialized, the value of the input / output setting register is changed to the input / output port. Is configured to be initialized to the value set for the input port.
Therefore, in such a microcomputer, when a reset signal is given to the reset terminal, the input / output port is forcibly (hardware) an input port, and therefore, as a main microcomputer in the electronic control device of the present invention. Can be used.

Next, in the electronic control device according to the second aspect, the sub-microcomputer has the drive system abnormality detecting means. When the operation of the main microcomputer is not determined to be abnormal by the monitoring means, the drive system abnormality detection means outputs the drive signal output from the main microcomputer to the drive circuit to the input of the sub microcomputer. Monitoring through the output port,
The voltage level of the current path from the drive circuit to the actuator is monitored via another input port of the sub-microcomputer, and further based on the monitor result of the drive signal and the monitor result of the voltage level, the drive circuit and its An abnormality in the current path from the drive circuit to the actuator is detected.

That is, in the electronic control device according to the second aspect, for example, the drive signal is output based on the drive signal output from the main microcomputer to the drive circuit and the voltage level of the current path from the drive circuit to the actuator. The abnormalities of the drive circuit and the current path from the drive circuit to the actuator are detected by a procedure such as whether or not the voltage level is changed in accordance with the above. Particularly, the abnormality is detected by the sub-microcomputer side. I'm trying to do it.

The electronic control unit according to the second aspect is advantageous in that the number of ports of the main microcomputer can be reduced. That is, as shown in FIG. 6, for example, the main microcomputer 51 sets the voltage level of the current path from the drive circuit 57 to the actuator (in FIG. 6, the voltage levels of the terminals J1 to J4 connecting the drive circuit 57 and the actuator). It is configured to detect an abnormality in the drive circuit 57 and the current path by monitoring via the input circuit 61 and comparing the voltage level of the current path with the drive signal output from its own output port PM. However, in general, the main microcomputer 51 needs to input various information from sensors, switches, and the like.

Therefore, with the configuration as shown in FIG. 6, the shortage of ports in the main microcomputer 51 is easily caused by the input port PK used by the main microcomputer 51 for monitoring the voltage level of the current path. With such a configuration, such a problem can be avoided.

Next, in the electronic control device according to the third aspect, when the initialization means determines that the operation of the main microcomputer is abnormal by the monitoring means, the power supply to the electronic control device is cut off. Until the reset, the reset signal is continuously supplied to the reset terminal of the main microcomputer.

Therefore, in the electronic control device according to the third aspect, when an abnormality occurs in the operation of the main microcomputer, the main microcomputer is thereafter operated until the power supply to the electronic control device is cut off. Continues to be reset, the input / output port of the main microcomputer is forcibly changed to the input port, and the sub-microcomputer sets its own input / output port as the output port and sends a drive signal for backup control to the drive circuit. Output will continue.

Therefore, according to the electronic control apparatus of the third aspect, a failure such that the main microcomputer does not return to normal even if reset (initialization) is performed by a reset signal (for example, hardware other than program runaway) This is advantageous in that abnormal operation of the actuator can be reliably prevented by the drive signal from the sub-microcomputer even when the above-mentioned failure occurs.

On the other hand, in the electronic control device according to the fourth aspect, when the initializing means determines that the operation of the main microcomputer is abnormal by the monitoring means, the initializing means sets the main microcomputer for a predetermined time. The computer is configured to continuously supply a reset signal to a reset terminal of the computer.

Therefore, in the electronic control device according to the fourth aspect, if an abnormality occurs in the operation of the main microcomputer, the main microcomputer is continuously reset for a predetermined period of time, and the main microcomputer is reset. The input / output port of the computer is forcibly changed to the input port, and only during this time, the sub-microcomputer sets its own input / output port as the output port and outputs a drive signal to the drive circuit.

Therefore, according to the electronic control device of the fourth aspect, the abnormality that has occurred in the main microcomputer is an abnormality (program runaway) that returns to normal if the reset by the reset signal is released. In this case, the actuator is controlled by the drive signal from the sub-microcomputer only during the reset of the main microcomputer, and is controlled by the drive signal from the main microcomputer after the reset is released. This is advantageous in that the normal recovery of the entire system can be promptly performed.

By the way, in the electronic control device according to the first to fourth aspects, the monitoring means and the initialization means can be configured to be provided in the sub-microcomputer as described in the fifth aspect. . That is, in the electronic control device according to claim 5, the sub-microcomputer includes:
The functions of the monitoring means and the initialization means are performed by executing the program.

According to the fifth aspect of the present invention, the electronic control unit can be made smaller and less expensive than when the monitoring means and the initialization means are provided separately from the sub microcomputer. be able to.

[0032]

Embodiments of the present invention will be described below with reference to the drawings. It is needless to say that the present invention is not limited to the embodiments described below, and can take various forms as long as it belongs to the technical scope of the present invention.

[First Embodiment] First, FIG. 1 shows an electronic control unit (hereinafter, referred to as an electronic control unit) of a first embodiment for controlling an engine of an automobile.
FIG. 2 is a configuration diagram illustrating a configuration of an ECU (referred to as ECU). The ECU 1 of the present embodiment controls the fuel injection amount and ignition timing for the engine, a throttle valve provided in the intake path of the engine (and the intake air amount of the engine), and the like. A description will be mainly given of a portion related to control of the throttle valve.

As shown in FIG. 1, the ECU 1 includes a main microcomputer 3 as a main microcomputer for executing various control processes for controlling the engine, and a main microcomputer 3 when an abnormality occurs in the main microcomputer 3. Instead, at least the sub-microcomputer 5 as a sub-microcomputer for controlling the throttle valve and the opening degree of the throttle valve in accordance with a drive signal output from one of the main microcomputer 3 and the sub-microcomputer 5 A drive circuit 7 for driving a stepping motor M as an actuator for adjustment, and a battery voltage VB (normally 12 V) of a battery BT mounted on an automobile are input via an ignition switch IGS, and the ECU 1 operates the battery voltage VB. To a power supply voltage (5 V in the present embodiment) Serial both the microcomputer 3 and 5 and the driving circuit 7
And the like, and a power supply circuit 9 for supplying power to the power supply.

In the present embodiment, the four exciting coils L1, L2, L
3, one end of L4 is connected to the battery voltage VB outside the ECU 1.
The end of each of the exciting coils L1 to L4 opposite to the battery voltage VB is connected to a drive circuit 7 via four connector terminals J1, J2, J3, and J4 provided in the ECU 1, respectively. Is connected to a signal output unit 43 described later.

The ECU 1 is connected to the connector terminal J1.
To J4, one end of which is connected to the ground potential (= 0V) which is the negative side of the battery BT.
The two pull-down resistors R1, R2, R3, and R4 and the voltage levels of the connector terminals J1 to J4 (that is, the four exciting coils L of the stepping motor M from the drive circuit 7).
And an input circuit 11 for converting the voltage level of each current path from 1 to L4 into a logic signal level of 0 V to 5 V and inputting the logic signal level to the sub-microcomputer 5.

When the exciting coils L1 to L4 are disconnected or when the exciting coils L1 to L4 are disengaged from the connector terminals J1 to J4, the pull-down resistors R1 to R4 are connected to the respective connector terminals J1 to J4. This is for stabilizing the voltage level at 0V. Further, when the voltage level of each of the connector terminals J1 to J4 is higher than 5V, the input circuit 11 clamps the voltage level to 5V and outputs it to the sub-microcomputer 5.

Here, each of the main microcomputer 3 and the sub-microcomputer 5 includes a CPU, a ROM, and a RAM, an input-only input port (input-only port), an output-only output port (output-only port), A well-known single unit including an input / output port that can be switched between an input port and an output port by software, and an input / output setting register for determining whether the input / output port is set to an input port or an output port. Chip microcomputer,
By rewriting the value of the input / output setting register by software (by executing a program), the input / output port can be arbitrarily set to any of the input port and the output port.

More specifically, as shown in FIG. 2, the input / output ports of both microcomputers 3 and 5 are set when the input / output switching signal SC corresponding to the value of the input / output setting register is at a high level (that is, When the value of the input / output setting register is "1"), the output buffer 21 for outputting the output signal So generated inside the microcomputer to the terminal P of the port, and the input / output switching signal SC having the low level At the time (that is, when the value of the input / output setting register is “0”), the signal input to the terminal P of the port is input to the microcomputer by the input signal SI.
And an input protection resistor 2 provided in series between the input buffer 23 and the terminal P.
And 5. Therefore, if "0" is written to the I / O setting register by software, the I / O port corresponding to that register can be set as an input port, and "1" can be written to the I / O setting register. For example, an input / output port corresponding to the register can be set as an output port.

At least the main microcomputer 3 supplies a low-level reset signal R to its reset terminal INIT.
When the ST is given and initialized (reset), the value of the input / output setting register is initialized to “0” which sets the input / output port as the input port. Therefore, in the main microcomputer 3, when a low-level reset signal RST is supplied to the reset terminal INIT, all the input / output ports are forcibly (hardware) input ports.

In the ECU 1 of the present embodiment, among the input / output ports of the main microcomputer 3, four input / output ports P00, P01, P02, and P03 are connected to a signal input section 41 of the drive circuit 7, which will be described later. ing. And furthermore
Of the input / output ports of the sub-microcomputer 5, four input / output ports P10, P11, P12 and P13 are respectively connected to four resistors R
5, R6, R7, and R8 are connected to the input / output ports P00, P01, P02, and P03 of the main microcomputer 3. That is, the input / output ports P10, P1 of the sub-microcomputer 5
1, P12 and P13 are input / output ports P0 of the main microcomputer 3.
A signal path between 0, P01, P02, P03 and the signal input section 41 of the drive circuit 7 is connected in a wired-OR manner. The signals from the input circuit 11 are input to the other four input / output ports P20, P21, P22, and P23 of the input / output ports of the sub-microcomputer 5.

On the other hand, as shown in FIG.
PNP transistor 31 whose emitter is connected to power supply line LV of power supply voltage (5 V) supplied from power supply circuit 9
A resistor 33 for preventing malfunction which is connected between the power supply line LV and the base of the PNP transistor 31;
A current limiting resistor 35 having one end connected to the base of P transistor 31; an output NPN transistor 37 having an emitter connected to the ground potential;
A unit composed of a malfunction preventing resistor 38 connected between the base of the transistor 37 and a current limiting resistor 39 connected between the collector of the PNP transistor 31 and the base of the NPN transistor 37. Four drive circuits are provided corresponding to the respective excitation coils L1 to L4 of the stepping motor M. FIG. 3 shows only one unit drive circuit.

Then, in the drive circuit 7, the P of the resistor 35
An end opposite to the NP transistor 31 is a signal input unit 41 connected to any of the input / output ports P00, P01, P02, and P03 of the main microcomputer 3.
The collector of the N transistor 37 is connected to each of the exciting coils L
The signal output unit 43 is connected to any one of the ends of the battery terminals 1 to L4 opposite to the battery voltage VB (that is, any one of the connector terminals J1 to J4).

That is, in the drive circuit 7, the signal input section 41
When a low-level drive signal is input to the PNP transistor 31 and the NPN transistor 37, the drive current flows through the corresponding excitation coils L1 to L4 via the NPN transistor 37, and conversely, the signal input section 41 When a high-level drive signal is input, the PNP transistor 3
1 and the NPN transistor 37 are turned off, and the energization to the corresponding exciting coils L1 to L4 is stopped.

Next, although not shown in FIG. 1, the main microcomputer 3 includes a rotation speed sensor for detecting the rotation speed of the engine, a pedal opening sensor for detecting the opening of the accelerator pedal, and Signals from various sensors necessary for controlling the engine, such as a water temperature sensor for detecting a cooling water temperature, are input.

In a normal operation in which the low-level reset signal RST is not supplied to the reset terminal INIT of the main microcomputer 3 (ie, the main microcomputer 3 is not input), the main microcomputer 3 first stores the low-level reset signal RST in its own ROM immediately after the operation starts. A program for initialization processing is executed to set the input / output ports P00 to P03 as output ports in the above-described procedure. Thereafter, an engine control program (hereinafter referred to as a control program) stored in its own ROM. ) Is repeatedly executed to calculate the control opening of the throttle valve based on the signal from each of the sensors, and drive signals corresponding to the calculated control opening are input / output ports P00 to P03 as output ports. To the drive circuit 7.

The main microcomputer 3 outputs a watchdog pulse WD1 periodically (in this embodiment, every 16 ms or less) in accordance with the execution of the control program. On the other hand, as shown in FIG.
The sub-microcomputer 5 receives a watchdog pulse WD1 from the main microcomputer 3 and a starter signal STA indicating whether a starter switch for starting the engine is turned on.

Then, the sub-microcomputer 5 executes a fail-safe process (FIG. 4) described later, so that the drive circuit 7 and the current paths from the drive circuit 7 to the respective exciting coils L1 to L4 of the stepping motor M are normal. In addition to determining whether or not there is, the watchdog pulse WD1 from the main microcomputer 3 is monitored to determine whether or not the operation of the main microcomputer 3 is normal. Further, when the sub-microcomputer 5 determines that the operation of the main microcomputer 3 is abnormal by executing the fail-safe processing, the reset signal RST is input to the reset terminal INIT of the main microcomputer 3.
-Level reset command signal RST2 for applying
Is output from the port PR, and a drive signal for backup control is output from the input / output ports P10 to P13 to the drive circuit 7 in place of the main microcomputer 3.

For this reason, as shown in FIG. 1, the ECU 1 is connected to a reset terminal INIT of the main microcomputer 3 as a circuit for resetting the main microcomputer 3 in response to the reset command signal RST2. The emitter is connected to the ground potential, and the base is connected to the port P of the sub-microcomputer 5 via a current limiting resistor R9.
The NPN transistor Tr1 connected to R and its NP
A level inversion circuit 13 including a malfunction prevention resistor R10 connected between the base of the N transistor Tr1 and the ground potential is provided.

That is, in the level inversion circuit 13, when the high-level reset command signal RST2 is output from the port PR of the sub-microcomputer 5, the NPN transistor Tr1
Is turned on, whereby a low-level reset signal RST is given to the reset terminal INIT of the main microcomputer 3, and the main microcomputer 3 is reset.

The power supply circuit 9 provided in the ECU 1
Means that after the ignition switch IGS is turned on,
A so-called power-on reset function for resetting the main microcomputer 3 and the sub-microcomputer 5 until the power supply voltage of 5 V supplied by itself becomes stable, and whether the watchdog pulse WD1 is periodically output from the main microcomputer 3 When the output of the watchdog pulse WD1 is stopped, the reset terminal INI of the main microcomputer 3 is monitored.
A monitoring function for outputting a low-level reset signal RST to T for a very short time (for example, 100 ms) is provided. That is, in the present embodiment, the operation of the main microcomputer 3 is as follows.
It is monitored by both the sub microcomputer 5 and the power supply circuit 9.

On the other hand, in the ECU 1 of this embodiment, the sub-microcomputer 5 also executes the program stored in its own ROM, thereby causing the watchdog pulse WD2
Is output periodically. Then, the main microcomputer 3 monitors whether the watchdog pulse WD2 is periodically output from the sub-microcomputer 5, and
When the output of the watchdog pulse WD2 is stopped, it is determined that an abnormality has occurred in the sub-microcomputer 5. That is, the main microcomputer 3 and the sub-microcomputer 5 monitor each other's operations.

In this embodiment, the port for outputting the watchdog pulse WD1 in the main microcomputer 3 is an output-only port, and the port for inputting a signal from the sensor and the port for outputting the watch A port for inputting the dock pulse WD2, and a notification signal CMP output from the sub-microcomputer 5 as described later.
Is an input-only port. In the sub-microcomputer 5, the reset command signal RST
, A port for outputting a watchdog pulse WD2, and a port PR for outputting a watchdog pulse WD2.
The port for outputting P is an output-only port,
The port for inputting the watchdog pulse WD1 from the main microcomputer 3 and the port for inputting the starter signal STA are input-only ports.

Next, the fail-safe processing executed by the sub-microcomputer 5 will be described with reference to the flowchart shown in FIG. When the ignition switch IGS is turned on and the power supply voltage (5 V) from the power supply circuit 9 is received, the sub-microcomputer 5 starts operation. Port P10
ＰP13 and P20〜P23 are set as input ports. And
Thereafter, the fail-safe processing of FIG. 4 is performed at predetermined time intervals (for example, every 1 ms) shorter than the maximum cycle (16 ms) at which the main microcomputer 3 outputs the watchdog pulse WD1.
Execute repeatedly. Further, the sub-microcomputer 5 executes a time measurement process for measuring a time interval during which the watchdog pulse WD1 is output from the main microcomputer 3 in parallel with the fail-safe process of FIG.

As shown in FIG. 4, when the sub-microcomputer 5 starts executing the fail-safe processing, first, in step (hereinafter simply referred to as "S") 100, an abnormality detection operation for the main microcomputer 3 (S110 to be described later). It is determined whether or not an abnormality detection condition, which is a condition for performing the above operation, is satisfied. The abnormality detection condition is that the starter switch is detected to change from the on state to the off state based on the above-described starter signal STA, and furthermore, if the power supply voltage supplied by the power supply circuit 9 becomes sufficiently stable from that time. It is established when the time to be considered has elapsed. That is, the abnormality detection operation for the main microcomputer 3 is not performed immediately after the start of the engine in which the battery voltage VB and the power supply voltage from the power supply circuit 9 are unstable.

If it is determined in S100 that the abnormality detection condition is satisfied, the process proceeds to the next S110,
It is determined whether the operation of the main microcomputer 3 is normal by determining whether the output time interval of the watchdog pulse WD1 clocked by the execution of the above-described clock processing is within 16 ms. If the output time interval of the dock pulse WD1 is within 16 ms, it is determined that the operation of the main microcomputer 3 is normal (not abnormal), and the process proceeds to S120.

If it is determined in S100 that the abnormality detection condition is not satisfied, the flow directly proceeds to S120. In S120, the input state of the input / output ports P10 to P13 set as the input ports, that is, the respective drive signals output to the drive circuit 7 from the input / output ports P00 to P03 of the main microcomputer 3 are read. And the following S1
At 30, the input state of the input / output ports P20 to P23 set as the input ports, that is, the connector terminals J1 to J
4 voltage level (from the drive circuit 7 to the excitation coils L1 to L4
, The signals from the input circuit 11 in which the voltage level of each current path leading to the current path is converted to a logic signal level of 0 V to 5 V are read. In step S140, the input states of the input / output ports P10 to P13 are compared with the input states of the corresponding input / output ports P20 to P23. Determine whether or not.

Here, if the input states of the input / output ports P10-P13 and the input states of the input / output ports P20-P23 match, the drive circuit 7 and the drive circuits 7 supply the respective exciting coils L1-P3 of the stepping motor M. The current path to L4 (hereinafter referred to as L4)
These are also referred to as drive systems), and S
Proceeding to 160, the above-described notification signal CMP is output in pulses of a fixed period (for example, 8 ms) to notify the main microcomputer 3 that the drive system is normal. And
After that, the fail-safe process is temporarily ended.

On the other hand, if the input states of the input / output ports P10 to P13 and the input states of the input / output ports P20 to P23 do not match, it is determined that an abnormality has occurred in the drive system, and S170 Then, the above-described notification signal CMP is output at a high level (5 V) to notify the main microcomputer 3 that the drive system is abnormal. Then, thereafter, the fail-safe process is temporarily ended.

That is, in this embodiment, if the drive system is normal, a low-level drive signal is output to the signal input unit 41 of the drive circuit 7, and the signal from the input circuit 11 corresponding to the signal input unit 41 is also output. Low level,
When a high-level drive signal is output to the signal input section 41 of the drive circuit 7, the input circuit 1 corresponding to the signal input section 41 is output.
The signal from 1 also goes high. Therefore, the above S15
At 0, it is determined whether or not each drive signal from the main microcomputer 3 to the drive circuit 7 matches each signal from the input circuit 11 corresponding thereto. It is determined that an abnormality has occurred in the system, and S17
By the process of 0, a high-level notification signal CMP indicating the occurrence of an abnormality is output to the main microcomputer 3.

The main microcomputer 3 which has received the high-level notification signal CMP output in S170 stops control of fuel injection or ignition to the engine, and stops the engine quickly and smoothly. Further, a warning lamp for notifying the driver of the vehicle of an abnormality is turned on, and a backup RAM (RAM capable of retaining stored contents even when supply of power supply voltage is stopped) provided in the main microcomputer 3 is provided. ) Stores a code indicating that an abnormality has occurred in the drive system.

On the other hand, if it is determined in S110 that the output time interval of the watchdog pulse WD1 from the main microcomputer 3 is not within 16 ms and the operation of the main microcomputer 3 is abnormal, the process proceeds to S180. At S180, a high-level reset command signal RST2 is output from the port PR, and a low-level reset signal RST is applied to the reset terminal INIT of the main microcomputer 3.

Then, the main microcomputer 3 is reset, and the input / output ports P00 to P03 of the main microcomputer 3 are forcibly set as input ports.
To set their own input / output ports P10 to P13 from input ports to output ports. Then, in the following S200,
A fail-safe output for outputting a drive signal for backup control for promptly and smoothly closing the throttle valve from the input / output ports P10 to P13 switched to the output port to the drive circuit 7 is implemented.

After that, the ignition switch IGS
Until the power supply circuit 9 is turned off and the supply of the power supply voltage by the power supply circuit 9 is cut off, the processes of S180 to S200 are repeated. That is, in the ECU 1 of the first embodiment, the sub-microcomputer 5 monitors whether or not the operation of the main microcomputer 3 is normal (S110), and determines that the operation of the main microcomputer 3 is abnormal (S110: NO), a high-level reset command signal RST2 is output to the level inversion circuit 13, and a reset signal RST is given to a reset terminal INIT of the main microcomputer 3, whereby the main microcomputer 3
Are forcedly set as input ports (S180). Further, while outputting the reset command signal RST2, the sub-microcomputer 5 sets its own input / output ports P10 to P13 as output ports (S190), and from the input / output ports P10 to P13 to the drive circuit 7 To output a drive signal for performing backup control of the stepping motor M (S20).
0). In cases other than the above (S100: NO, S110: YES), the sub-microcomputer 5 sets its own input / output ports P10 to P13 as input ports, and switches the input / output ports P00 to P03 of the main microcomputer 3 from the input / output ports P00 to P03. The output drive signal is input to the signal input unit 41 of the drive circuit 7 without being affected by the input / output ports P10 to P13 of the sub-microcomputer 5.

In the first embodiment, S in FIG.
110 corresponds to processing as monitoring means, and S180 in FIG. 4 corresponds to processing as initialization means. Further, S120 to S150 in FIG. 4 correspond to the processing as the drive system abnormality detecting means. As described in detail above, the ECU 1 of the first embodiment continuously supplies the reset signal RST to the reset terminal INIT of the main microcomputer 3 when the main microcomputer 3 is in an abnormal state. .. P03 are forcibly set as input ports, and in this state, the sub-microcomputer 5 switches its own input / output ports P10 to P13 to output ports, and from the ports P10 to P13 to the drive circuit 7 for backup control. A drive signal is output.

Therefore, according to the ECU 1, the input / output ports P00 to P03 of the main microcomputer 3 and the sub-microcomputer 5 are provided without providing the output switching circuit 59 as shown in FIG.
The input / output ports P10 to P13 can be connected in a wired-OR manner, and the drive signals from the microcomputers 3 and 5 can be switched to the drive circuit 7 to be applied. Backup control of the stepping motor M by the sub-microcomputer 5 can be realized with a very simple configuration. So this EC
According to U1, both control safety and miniaturization and cost reduction of the device can be achieved at a high level.

In the ECU 1 of the first embodiment, when the sub-microcomputer 5 does not determine that the operation of the main microcomputer 3 is abnormal (S100: NO, S110:
YES), the drive signal output from the main microcomputer 3 to the drive circuit 7 is input / output port P10 as an input port.
And P13 (S120), and monitor the voltage level of each current path from the drive circuit 7 to the exciting coils L1 to L4 of the stepping motor M via the other input / output ports P20 to P23 as input ports. (S130),
Based on the monitoring result, an abnormality in the drive system of the stepping motor M (the drive circuit 7 and the current path from the drive circuit 7 to each of the excitation coils L1 to L4 of the stepping motor M) is detected (S140, S150). ).

Therefore, according to the ECU 1, the main microcomputer 3 is connected to the input circuit 11 to detect an abnormality in the drive system.
There is no need to monitor the voltage level of each of the current paths by inputting a signal from the main microcomputer 3, which is very advantageous in that the number of ports of the main microcomputer 3 can be reduced. In other words, the main microcomputer 3 needs to input signals from various sensors, which tends to cause a shortage of ports. However, such a problem can be avoided by configuring the ECU 1 as in the present embodiment. You can.

Further, in the ECU 1 of the first embodiment, when it is determined that the operation of the main microcomputer 3 is abnormal, the ignition switch IGS is turned off and the supply of the power supply voltage by the power supply circuit 9 is interrupted. And a reset signal R to the reset terminal INIT of the main microcomputer 3.
ST is continuously provided, and during this time, a drive signal for backup control is continuously output from the sub-microcomputer 5 to the drive circuit 7 (S180 to S20).
0).

Therefore, even if a failure (for example, a hardware failure other than a program runaway) that does not return to a normal state occurs even when the main microcomputer 3 is reset by the reset signal RST, the drive signal from the sub-microcomputer 5 This is advantageous in that abnormal operation of the stepping motor M (and thus the throttle valve) can be reliably prevented.

Further, in the ECU 1 of the first embodiment, the sub-microcomputer 5 for outputting a drive signal for backup control is provided.
However, since the operation of the main microcomputer 3 is monitored and the reset signal RST is given to the main microcomputer 3 when an abnormality is detected, the ECU 1 can be made smaller and less costly. it can.

[Second Embodiment] Next, E of the second embodiment will be described.
The CU will be described. The ECU of the second embodiment differs from the ECU 1 of the first embodiment only in the fail-safe processing executed by the sub-microcomputer 5.

That is, as shown in FIG. 5, in the fail-safe processing executed by the sub microcomputer 5 of the second embodiment,
With respect to the fail-safe processing (FIG. 4) of the first embodiment,
The processing of S210 to S230 is added, and S200
To start the fail-safe output (output of the drive signal for backup control to the drive circuit 7) at
At 10, a predetermined period of time t (for example, 5 seconds)
Is determined. If the predetermined time t has not elapsed, the process returns to S180.

If it is determined in S210 that the predetermined time t has elapsed, the process proceeds to S220, in which the output of the high-level reset command signal RST2 from the port PR is stopped, and the reset for the main microcomputer 3 is released.
At S230, the input / output ports P10 to P13 are returned from the output ports to the input ports. Then, thereafter, the fail-safe process is temporarily ended.

That is, in the ECU of the second embodiment, when the sub-microcomputer 5 determines that the operation of the main microcomputer 3 is abnormal, the sub-microcomputer 5 operates only for a predetermined time t.
The reset signal RST is continuously supplied to the reset terminal INIT of the main microcomputer 3 so that the input / output ports P00 to P03 of the main microcomputer 3 are forcibly set as the input ports.
However, the input / output ports P10 to P13 are set as output ports to output a drive signal to the drive circuit 7.

The ECU according to the second embodiment is
According to the above, when the abnormality that has occurred in the main microcomputer 3 is an abnormality (program runaway) that returns to normal if the reset by the reset signal RST is released, the stepping motor is only activated while the main microcomputer 3 is reset. M
Is controlled by the drive signal from the sub-microcomputer 5, and after the reset is released, the stepping motor M
Is controlled by the drive signal from the main microcomputer 3 which has returned to the normal state, which is advantageous in that the normal state of the entire system can be promptly restored.

[Others] In the first and second embodiments, the port for outputting the watchdog pulse WD1 in the main microcomputer 3 is an output-only port, and the port for inputting a signal from a sensor. And the watchdog pulse WD2 from the sub-microcomputer 5
Although the port for inputting the command and the port for inputting the notification signal CMP from the sub-microcomputer 5 are input-only ports, switchable input / output ports may be used as those ports.

Similarly, in the first and second embodiments,
In the sub-microcomputer 5, the port PR for outputting the reset command signal RST2 and the watchdog pulse W
The port for outputting D2 and the port for outputting the notification signal CMP are output-only ports, and are used for inputting the watchdog pulse WD1 from the main microcomputer 3 and inputting the starter signal STA. Are input-only ports, but switchable input / output ports may be used as those ports.

In the first and second embodiments, the ports for inputting signals from the input circuit 11 in the sub-microcomputer 5 are the input / output ports P20 to P23. Instead of P23, a non-switchable input-only port may be used.

[Brief description of the drawings]

FIG. 1 is a configuration diagram illustrating a configuration of an electronic control unit (ECU) according to a first embodiment.

FIG. 2 is a circuit diagram illustrating a configuration of an input / output port.

FIG. 3 is a circuit diagram illustrating a driving circuit.

FIG. 4 is a flowchart illustrating a fail-safe process executed by a sub-microcomputer of the electronic control unit (ECU) according to the first embodiment.

FIG. 5 is a flowchart illustrating a fail-safe process executed by a sub-microcomputer of an electronic control unit (ECU) according to a second embodiment.

FIG. 6 is a configuration diagram illustrating a configuration of a conventional electronic control device.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Electronic control device (ECU) M ... Stepping motor L1-L4 ... Exciting coil 3 ... Main microcomputer (main microcomputer) 5 ... Sub microcomputer (sub microcomputer) IN
IT reset terminals P00 to P03, P10 to P13 input / output ports 7 drive circuits 9 power supply circuits 11 input circuits 13 level inverting circuits 41 signal input sections 43 signal output sections BT batteries IGS ignition switches J1 ~ J4 ... Connector terminal

Claims (5)

[Claims] A drive circuit for driving an actuator in accordance with a drive signal input to a signal input unit; an input / output port switchable between an input port and an output port by software; Connected to the signal input of the drive circuit, during normal operation,
The input / output port is set as an output port, a drive signal for driving the actuator is output from the input / output port as the output port to the drive circuit, and a reset signal is given to a reset terminal to be initialized. Then, a main microcomputer configured so that the input / output port becomes an input port, monitoring means for monitoring whether or not the operation of the main microcomputer is normal, and Initial operation means for continuously applying the reset signal to a reset terminal of the main microcomputer when the operation is determined to be abnormal, and an input / output port switchable between an input port and an output port by software. The input / output port is connected to the input / output port of the main microcomputer and the signal input of the drive circuit. Connected to the signal path between the main microcomputer and the main microcomputer in a wired-OR manner, the monitoring means determines that the operation of the main microcomputer is abnormal, and the reset means outputs the reset signal to a reset terminal of the main microcomputer. While being given, the own input / output port is set as an output port, and a drive signal for driving the actuator is output from the input / output port as the output port to the drive circuit. A sub-microcomputer for setting the input / output port of the device as an input port. 2. The electronic control device according to claim 1, wherein the sub-microcomputer is connected to the main microcomputer when the operation of the main microcomputer is not judged to be abnormal by the monitoring means. The drive signal output to the drive circuit is monitored via the input / output port of the sub-microcomputer, and the voltage level of a current path from the drive circuit to the actuator is monitored at another input port of the sub-microcomputer. And a drive system abnormality detecting means for detecting an abnormality in the drive circuit and the current path based on the monitor result of the drive signal and the monitor result of the voltage level. Electronic control unit. 3. The electronic control device according to claim 1, wherein the initialization unit is configured to determine that the operation of the main microcomputer is abnormal by the monitoring unit. An electronic control unit configured to continuously supply the reset signal to a reset terminal of the main microcomputer until power supply to the main microcomputer is cut off. 4. The electronic control device according to claim 1, wherein the initialization means determines a predetermined value when the operation of the main microcomputer is determined to be abnormal by the monitoring means. An electronic control unit configured to continuously supply the reset signal to a reset terminal of the main microcomputer for a predetermined time. 5. The electronic control device according to claim 1, wherein said monitoring means and said initialization means are provided in said sub-microcomputer. apparatus.