JP6984438B2 - Electronic control device - Google Patents

Description

The present invention relates to an electronic control device.

When the monitoring IC that monitors the watchdog signal (hereinafter referred to as WDC signal) output from the microcomputer detects that the WDC signal is no longer output, it determines that an abnormality such as runaway has occurred in the microcomputer. Output a reset signal to reset the microcomputer.

Japanese Unexamined Patent Publication No. 2004-362139

In the case of the above-mentioned conventional configuration, the monitoring IC outputs the reset signal for a set time, then stops the output of the reset signal to release the reset. As a result, the microcomputer is automatically restarted, and the monitoring IC is configured to resume monitoring the WDC signal. However, in the situation where the abnormality of the microcomputer continues to occur, a malfunction occurs due to the abnormality of the microcomputer after the reset is released and before the abnormality is detected and the reset signal is output again. There is a risk of doing so. Therefore, it is not desirable to release the reset when the microcomputer abnormality continues to occur.

An object of the present invention is a configuration in which a microcomputer is reset when a microcomputer abnormality occurs and then automatically reset and released, but the reset is not released when a microcomputer abnormality continues to occur. It is an object of the present invention to provide an electronic control device which can be used.

The invention of claim 1 is an electronic control device 1 including a microcomputer 2 and a monitoring unit 3 for monitoring the microcomputer 2, and the monitoring unit 3 is based on a monitoring signal output from the microcomputer 2. When a microcomputer abnormality is detected, the state is reset, and from the time when the reset state is set, the abnormality detection unit 5 that releases the reset state when the setting condition is satisfied, and the detection of the microcomputer abnormality. It is configured to have an abnormality counting unit 6 that counts the number of times and continues the reset state when the number of times of detection becomes equal to or higher than the determination threshold value.
Then, when the microcomputer 2 executes an instruction to stop the output of the monitoring signal, the abnormality counting unit 6 is configured to be in an invalid state in which the number of detections is not counted up even if the microcomputer abnormality is detected. Moreover, it is configured to be in the invalid state before the output of the monitoring signal is stopped.

Electrical configuration diagram of the electronic control device showing the first embodiment Time chart of each part when the microcomputer is operating normally Time chart of each part when the microcomputer operates abnormally

(First Embodiment)
Hereinafter, the first embodiment will be described with reference to FIGS. 1 to 3. FIG. 1 shows that the electronic control device 1 of the present embodiment is configured to include a microcomputer 2, a monitoring IC 3, another IC (hereinafter referred to as another IC) 4, and the like, as shown in FIG.

The microcomputer 2 has a function of controlling the entire electronic control device 1, and has an output terminal 2a for outputting a WDC signal S1, an output terminal 2b for outputting a communication command S2, and an input terminal 2c for inputting a reset signal. .. Further, the microcomputer 2 has a large number of output terminals and input terminals (not shown) in addition to the terminals 2a, 2b, and 2c described above.

The monitoring IC 3 has a function as a monitoring unit for monitoring the microcomputer 2. The monitoring IC 3 has an input terminal 3a, an input terminal 3b, an output terminal 3c, and an output terminal 3d. The input terminal 3a of the monitoring IC 3 is connected to the output terminal 2a of the microcomputer 2, and the input terminal 3b of the monitoring IC 3 is connected to the output terminal 2b of the microcomputer 2. The output terminal 3c of the monitoring IC 3 is connected to the input terminal 2c of the microcomputer 2 and the input terminal 4a of another IC 4 or the like. The output terminal 3d of the monitoring IC 3 is connected to an input terminal of an engine control ECU (not shown).

The monitoring IC 3 has a WDC signal monitor 5, an abnormality counter 6, a first MOSFET 7, and a second MOSFET 8. The WDC signal monitor 5 has a function as an abnormality detection unit, and has an input terminal 5a and an output terminal 5b. The input terminal 5a of the WDC signal monitor 5 is connected to the output terminal 2a of the microcomputer 2 via the input terminal 3a of the monitoring IC 3, and the WDC signal S1 is input.

When the WDC signal monitor 5 determines that the WDC signal S1 is normal, for example, it outputs a low first signal Sa, and when it determines that the WDC signal S1 is abnormal, it outputs, for example, a high first signal Sa. The high first signal Sa is output only during the predetermined set time T1, that is, the one-shot time. In this case, the WDC signal monitor 5 determines that the WDC signal S1 is normal when, for example, one or more rising edges of the pulsed WDC signal S1 are input within the predetermined abnormality determination time T2. When no one is input within the abnormality determination time T2, the WDC signal S1 is determined to be abnormal.

The abnormality counter 6 has a function as an abnormality counting unit, and has an input terminal 6a, an input terminal 6b, and an output terminal 6c. The input terminal 6a of the abnormality counter 6 is connected to the output terminal 5b of the WDC signal monitor 5, and the first signal Sa is input. The abnormality counter 6 counts up the count value, that is, +1 when the first signal Sa switches from low to high. The abnormality counter 6 outputs, for example, a low second signal Sb when the count value is smaller than the internally set threshold value, and outputs, for example, a high second signal Sb when the count value is equal to or higher than the above threshold value. Output. Then, the abnormality counter 6 is adapted to hold the high state of the second signal Sb after outputting the high second signal Sb.

Further, the input terminal 6b of the abnormality counter 6 is connected to the output terminal 2b of the microcomputer 2 via the input terminal 3b of the monitoring IC 3, and the command signal S2 is input. The command signal S2 output from the microcomputer 2 is, for example, a communication command instructing invalidation of the count-up of the abnormality counter 6, a communication command for setting the threshold value of the abnormality counter 6, and clearing the count value of the abnormality counter 6. There are communication commands, etc. When the communication command instructing the invalidation of the count-up is input, the abnormality counter 6 does not count up the count value even if the first signal Sa switches from low to high. When the abnormality counter 6 inputs a communication command for setting the threshold value, the abnormality counter 6 sets the threshold value instructed by the communication command. The abnormality counter 6 clears the count value when a communication command for clearing the count value is input. The communication command is preferably composed of, for example, a signal indicating a 4-bit hexadecimal number.

The drain of the first MOSFET 7 is connected to the output terminal 3c and the output terminal 3d of the monitoring IC 3, the source is connected to the ground, and the gate is connected to the output terminal 5b of the WDC signal monitor 5. The first MOSFET 7 turns off when the low first signal Sa is input from the WDC signal monitor 5 to the gate, and turns on when the high first signal Sa is input to the gate.

The drain of the second MOSFET 8 is connected to the drain of the first MOSFET 7, the output terminal 3c and the output terminal 3d of the monitoring IC 3, the source is connected to the ground, and the gate is connected to the output terminal 6c of the abnormality counter 6. .. The second MOSFET 8 turns off when the low second signal Sb is input to the gate from the abnormality counter 6, and turns on when the high second signal Sb is input to the gate.

In the above configuration, when both the first MOSFET 7 and the second MOSFET 8 are off, a high third signal Sc, that is, a reset release signal is output from the output terminal 3c of the monitoring IC 3. Further, when at least one of the first MOSFET 7 and the second MOSFET 8 is on, the low third signal Sc, that is, the reset signal is output from the output terminal 3c of the monitoring IC 3. Then, the third signal Sc, that is, the reset signal or the reset release signal is input to the input terminal 2c of the microcomputer 2 and is input to the input terminal 4a of the other IC 4.

Further, the fourth signal Sd output from the output terminal 3d of the monitoring IC 3 is the same signal as the third signal Sc, but the fourth signal Sd of the row is used as a fail-safe signal. When this fail-safe signal, that is, the fourth signal Sd of the row is input to, for example, an engine control ECU (not shown), the engine control ECU is configured to stop fuel injection by the injector. In the case of the present embodiment, the state in which the reset signal and the fail-safe signal are output corresponds to the reset state.

Next, the operation of each part of the electronic control device 1 when the microcomputer 2 is operating normally will be described with reference to the time chart of FIG. When the power supply voltage is off, that is, when it disappears, the third signal Sc from the output terminal 3c of the monitoring IC 3 is low, that is, a reset signal, the WDC signal is not output from the microcomputer 2, and the WDC signal monitor 5 The first signal Sa from is low, i.e. normal. The count value of the abnormality counter 6 is 0, and the second signal Sb from the abnormality counter 6 is low, that is, normal. Further, the communication command S2 is not output from the microcomputer 2, and the threshold value of the abnormality counter 6 is, for example, "16" which is an initial value. Further, the count-up of the abnormality counter 6, that is, the state of the abnormality count is "valid" which is an initial value.

Then, when the power is turned on and the power supply voltage exceeds a predetermined voltage value at time t1, a high third signal Sc, that is, a reset release signal is output from the output terminal 3c of the monitoring IC 3, and the WDC is output from the microcomputer 2. The signal S1 is output, that is, the WDC pulse is output at the set cycle, and one or more rising edges of the WDC signal S1 are input within the abnormality determination time T2. Therefore, the first signal Sa from the WDC signal monitor 5 remains low, i.e. normal. Then, the count value of the abnormality counter 6 remains 0, and the second signal Sb from the abnormality counter 6 remains low, that is, normal. Further, the communication command S2 is not output from the microcomputer 2, the threshold value of the abnormal unter 6 remains "16", and the count-up of the abnormal counter 6 remains "valid".

After that, when the power is turned off and the power supply voltage disappears at time t2, the low third signal Sc, that is, the reset signal is output from the output terminal 3c of the monitoring IC3, and the state returns to the above-mentioned power supply voltage disappearance state. ..

Next, the operation of each part of the electronic control device 1 when the microcomputer 2 is operating abnormally will be described with reference to the time chart of FIG. First, when the power supply voltage is off, that is, when it disappears, it is in the same state as the power supply voltage disappearance state shown in FIG.

Then, when the power is turned on and the power supply voltage exceeds a predetermined voltage value at time t11, a high third signal Sc, that is, a reset release signal is output from the output terminal 3c of the monitoring IC 3. In this case, since the microcomputer 2 is abnormal, the WDC signal S1 is not output from the microcomputer 2. Therefore, at the time t12 when the abnormality determination time T2 has elapsed from the time t11, the first signal Sa from the WDC signal monitor 5 is switched from low to high.

When the first signal Sa is switched from low to high, the first MOSFET 7 of the monitoring IC 3 is turned on, and the third signal Sc of the low, that is, the reset signal is output from the output terminal 3c of the monitoring IC 3. As a result, the microcomputer 2 is reset. Further, at time t12, the count value of the abnormality counter 6 is counted up, and the count value becomes “1”.

Subsequently, at the time t13 when the set time T1 has elapsed from the time t12, the first signal Sa from the WDC signal monitor 5 is switched from high to low, the first MOSFET 7 of the monitoring IC 3 is turned off, and the output of the monitoring IC 3 is output. A high third signal Sc, that is, a reset release signal is output from the terminal 3c. As a result, the microcomputer 2 is reset and released, and the WDC signal S1 is output from the microcomputer 2, that is, the WDC pulse is output at the set cycle. In this case, the time t13 when the set time T1 has elapsed corresponds to the time when the set condition is satisfied.

Next, the control in which the microcomputer 2 sets the threshold value of the count value of the abnormality counter 6 to "2" and the control in which the microcomputer 2 stops the WDC signal, that is, the WDC pulse by its own control will be described.

In this case, for example, at time t14, when the microcomputer 2 outputs the communication command C1 that sets the threshold value of the count value to "2", the abnormality counter 6 receives the communication command C1 at the time when the communication command C1 is input, that is, at time t15. Set the threshold value of the count value to "2".

Subsequently, the microcomputer 2 gives an instruction to invalidate the count-up of the abnormality counter 6 when executing the control to stop the WDC pulse. Therefore, for example, when the microcomputer 2 outputs the communication command C2 that invalidates the count-up at the time t16, the abnormality counter 6 changes the state of the abnormality count to the time when the communication command C2 is input, that is, at the time t17. After that, even if the first signal Sa switches from low to high, the count value is not counted up.

Then, when the microcomputer 2 stops outputting the WDC signal S1 after the time t17, the WDC signal monitor is at the time when the abnormality determination time T2 elapses from the rising edge of the WDC signal S1 output last, that is, at the time t18. The first signal Sa from 5 switches from low to high. When the first signal Sa is switched from low to high, the first MOSFET 7 of the monitoring IC 3 is turned on, and the third signal Sc of the low, that is, the reset signal is output from the output terminal 3c of the monitoring IC 3.

Further, at time t18, since the abnormal count state is "invalid", the count value of the abnormal counter 6 is not counted up, and the count value remains "1". Further, at time t18, the abnormality counter 6 is configured so that the state of the abnormality count returns from "invalid" to "valid" in response to the output of the reset signal.

After that, at the time t19 when the set time T1 has elapsed from the time t18, the first signal Sa from the WDC signal monitor 5 is switched from high to low, the first MOSFET 7 of the monitoring IC 3 is turned off, and the output of the monitoring IC 3 is output. A high third signal Sc, that is, a reset release signal is output from the terminal 3c.

By the way, in this case, since the microcomputer 2 executes the control to stop the WDC signal S1 by software control, the WDC signal S1 is not output from the microcomputer 2. Therefore, at the time t20 when the abnormality determination time T2 has elapsed from the time t19, the first signal Sa from the WDC signal monitor 5 switches from low to high. In this way, when the first signal Sa switches from low to high, the first MOSFET 7 of the monitoring IC 3 is turned on, and the third signal Sc of the low, that is, the reset signal is output from the output terminal 3c of the monitoring IC 3. ..

Further, at time t20, since the abnormality count state has returned from "invalid" to "valid", the count value of the abnormality counter 6 is counted up and the count value becomes "2". Here, since the threshold value of the abnormality counter 6 is set to “2”, the count value ≧ threshold value, so that the abnormality counter 6 switches the second signal Sb from low to high. As a result, since the second MOSFET 8 is turned on, the low third signal Sc, that is, the reset signal is output from the output terminal 3c of the monitoring IC 3. In the case of the present embodiment, after switching the second signal Sb from low to high, the abnormality counter 6 is configured to continue to output the high second signal Sb until the power supply voltage disappears. Therefore, until the power supply voltage disappears, the low third signal Sc, that is, the reset signal is output from the output terminal 3c of the monitoring IC 3, and the reset is not released.

After that, when the power is turned off and the power supply voltage disappears at time t21, the count value of the abnormality counter 6 is cleared to "0", and the second signal Sb is switched from high to low. The threshold value "2" of the count value of the abnormality counter 6 is configured to return to the initial value, for example, "16" when the power supply voltage disappears.

In the present embodiment having such a configuration, a microcomputer abnormality is detected based on the WDC signal S1 output from the microcomputer 2, that is, a monitoring signal, and when the microcomputer abnormality is detected, the reset state is set and the reset state is set. A WDC signal monitor 5 for releasing the reset state is provided when the set time elapses from the time when the setting time has elapsed, that is, when the setting condition is satisfied, the number of times the microcomputer abnormality is detected is counted, and the number of times of detection is equal to or greater than the determination threshold value. An abnormality counter 6 for continuing the reset state is provided. According to this configuration, when a microcomputer abnormality occurs, the microcomputer 2 is reset and then automatically reset and released, but if the microcomputer abnormality continues to occur, the reset is not released. Can be configured as follows.

Further, in the above embodiment, when the microcomputer 2 executes an instruction to stop the output of the WDC signal S1 by the abnormality counter 6, even if the microcomputer abnormality is detected, the detection number is not counted up and the state is invalid. did. According to this configuration, even if the microcomputer is not abnormal, when the microcomputer trigger is reset, the microcomputer 2 may carry out the procedure of stopping the WDC signal S1 as in the case of the microcomputer abnormality. It is possible to realize a configuration in which the continuation abnormality of the microcomputer 2 is not determined.

In the above embodiment, when the count-up is disabled by the abnormality counter 6 and then reset by the WDC signal monitor 5, the number of detections of the microcomputer abnormality is returned to the enabled state. .. According to this configuration, after the reset state is reached, it is possible to automatically return to the control for determining the continuation abnormality of the microcomputer 2.

In the above embodiment, when the reset state is continued by the abnormality counter 6, the reset state is maintained until the power is turned off. According to this configuration, when a microcomputer abnormality continues to occur, it can be configured so that the reset is not released until the power is turned off.

In the above embodiment, the determination threshold value of the number of detections of the microcomputer abnormality of the abnormality counter 6 is configured to be changeable from the microcomputer 2 side. The determination level of the continuation abnormality of the microcomputer 2 can be easily adjusted.

In the above embodiment, the microcomputer 2 is configured to output, for example, a WDC signal S1 as a monitoring signal, but the present invention is not limited to this, and the microcomputer 2 is configured to output, for example, a command signal as a monitoring signal. It may be configured. Further, in the above embodiment, the reset state is set to be released when the set time elapses from the time when the reset state is set, but the setting condition is not limited to this, and the setting condition is set from the time when the reset state is set. It may be configured to release the reset state when it is established, for example, when the microcomputer 2 outputs a command for canceling the reset state.

The present disclosure has been described in accordance with the examples, but it is understood that the present disclosure is not limited to the examples and structures. The present disclosure also includes various variations and variations within a uniform range. In addition, various combinations and forms, as well as other combinations and forms that include only one element, more, or less, are within the scope and scope of the present disclosure.

In the drawing, 1 is an electronic control device, 2 is a microcomputer, 3 is a monitoring IC (monitoring unit), 4 is another IC, 5 is a WDC signal monitor (abnormality detecting unit), and 6 is an abnormality counter (abnormality counting unit). ..

Claims (3)

An electronic control device (1) including a microcomputer (2) and a monitoring unit (3) for monitoring the microcomputer.
The monitoring unit detects a microcomputer abnormality based on a monitoring signal output from the microcomputer, and when the microcomputer abnormality is detected, the state is reset, and from the time when the reset state is set to the time when the setting condition is satisfied, the above-mentioned The abnormality detection unit (5) that releases the reset state, and
It is configured to have an abnormality counting unit (6) that counts the number of detections of the microcomputer abnormality and continues the reset state when the detection number becomes equal to or higher than the determination threshold value .
The abnormality counting unit is configured to be in an invalid state in which the number of detections is not counted up even if the microcomputer abnormality is detected when the microcomputer executes an instruction to stop the output of the monitoring signal. An electronic control device configured to be in the invalid state before the output of the monitoring signal is stopped. The abnormality counting unit, when allowed to continue the reset state, configured claim 1 Symbol placement of the electronic control device to maintain the reset state until the power off. The electronic control device according to claim 1 or 2 , wherein the abnormality counting unit is configured so that the determination threshold value of the number of times of detection of a microcomputer abnormality can be changed from the microcomputer side.

Images