JP7614860B2 - Vehicle Electronic Control Unit - Google Patents

Description

The present invention relates to an electronic control device for a vehicle that is connected to a vehicle network and communicates between multiple electronic control devices.

Patent Document 1 describes a communication error determination device for a vehicle control system that uses a simple configuration to suppress erroneous determination of timeout errors. In the system disclosed in this patent document 1, multiple ECUs (Electronic Control Units) communicate over a CAN (Controller Area Network), each ECU transmits a trigger frame when it is started, and communication error determination is performed based on the trigger frame, thereby suppressing erroneous determination of communication errors due to differences in the start-up times of each ECU.

JP 2010-136544 A

However, in the ECU startup process, if there are multiple processing state transition routes from the startup trigger until the microcomputer's initial settings are completed and communication data can be sent and received, there may be a large difference in the time from the startup trigger to when communication data can be sent and received, depending on the transition route. For example, in an ECU1 started up via a transition route with the shortest startup time and an ECU2 started up via a transition route with the longest startup time, ECU2 does not return an ACK (ACKnowledgement) to the CAN transmission data from ECU1. This causes the transmission error counter of ECU1 to count up. Also, since no CAN transmission is performed from ECU2, ECU1 may determine that a CAN non-reception abnormality has occurred.

Furthermore, vehicle electronic control devices generally perform various self- and mutual diagnosis when the ignition is turned on. If communication is stopped for a long period of time during this diagnosis, the mutual communication between the electronic control devices mounted on the vehicle may be judged to be abnormal, and devices that are actually normal may be treated as being in an abnormal state. In particular, when diagnosing functions implemented by multiple CPUs, the overall confirmation is delayed, increasing the possibility of such problems occurring.

The present invention was made in consideration of the above circumstances, and its purpose is to provide an electronic control device for a vehicle that can suppress unintended communication abnormalities and misdiagnosis during startup.

A vehicle electronic control device according to one aspect of the present invention is an electronic control device for a vehicle having a communication function for communicating with other electronic control devices mounted on the vehicle and a judgment function for performing self-diagnosis when an ignition switch of the vehicle is turned on and judging that a communication error has occurred if there is no communication for a predetermined time, and when the ignition is turned on, a power-on reset is performed and then a startup process is executed, a wait time is set according to whether the startup route is a normal startup route or a shutdown recovery startup route, and normal control including communication is executed after the wait time has elapsed. Alternatively, when the ignition is turned on, a power-on reset is performed and then a startup process is executed, and when a compatibility value set for each startup path is Tinit, the time from the start of the power-on reset to the completion of the reset process is Th, and the startup time of the software is Ts, "Tinit = Th + Ts" is obtained to set the compatibility value, and communication is enabled after a predetermined time has elapsed since the start of normal control and adjusted by the compatibility value .

According to the present invention, the timing for starting intercommunication between electronic control devices is adjusted in advance based on the long startup time that can occur depending on the transition route (startup path), and the startup timings of multiple electronic control devices with different transition routes are brought closer together, thereby enabling intercommunication between devices while suppressing unintended communication abnormalities and misdiagnosis during startup.

1 is a block diagram showing a schematic configuration of a vehicle control system in which a vehicle electronic control device according to an embodiment of the present invention is used; 1 is a time chart of a reference example from a start trigger to when communication becomes possible in a conventional vehicle electronic control device. 4 is a time chart from a start-up trigger to when communication becomes possible in the electronic control device according to the first embodiment of the present invention. 4 is a flowchart showing a process from a start-up trigger to communication being enabled in the electronic control unit according to the first embodiment of the present invention. 10 is a time chart from a start-up trigger to when communication becomes possible in an electronic control device according to a second embodiment of the present invention. 10 is a flowchart showing a process from a start-up trigger to communication being enabled in an electronic control unit according to a second embodiment of the present invention.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
1 shows a schematic configuration of a vehicle control system in which a vehicle electronic control device according to an embodiment of the present invention is used. In this example, for the sake of simplicity, a configuration is shown in which two electronic control devices 100A and 100B communicate with each other to drive and control an actuator 502 of a vehicle, but the present invention can be applied to a vehicle control system in which a plurality of electronic control devices are connected to a vehicle network and communicate with each other to control the vehicle.

The electronic control device 100A includes a main unit 200, a sub-unit 300, and a CAN communication circuit 400. The other electronic control device 100B has a similar configuration to the electronic control device 100A.
The main unit 200 functions as a main processor, a control unit, or a main CPU, and is a unit that drives and controls an actuator 502 of the vehicle and performs CAN communication with another electronic control device 100B via a CAN communication circuit 400.

The subunit 300 functions as a subprocessor, a monitoring unit, a subCPU, or the like, and is a unit that monitors (diagnoses) the main unit 200. When the subunit 300 detects an abnormality in the main unit 200, it turns off a relay 501 that switches a power supply line to an actuator 502 controlled by the main unit 200 to stop driving the actuator 502, and also disables the CAN communication circuit 400 in synchronization with the stop of driving the actuator 502 to stop CAN communication.
Each of the main unit 200 and the sub unit 300 has a processor core including a ROM, a RAM, a CPU, and the like.

The CAN communication circuit (communication unit) 400 includes an OR circuit 401 and a CAN transceiver 402. The OR circuit (logic operation unit) 401 receives a CAN control signal NCS from the main unit 200 and a relay control signal RCS that controls the on/off state of the relay drive circuit 500. The CAN transceiver 402 is in an enabled state, i.e., a state in which CAN communication is possible, when the OR circuit 401 outputs a high-level signal (enable signal), and in a disabled state, i.e., a state in which CAN communication is stopped, when the OR circuit 401 outputs a low-level signal (disable signal).

The CAN control signal NCS is output as a high-level signal when it is a command to enable CAN communication (to enable the CAN transceiver 402), and the relay control signal RCS is output as a high-level signal when it is to turn on the relay 501 (to supply power to the actuator 502). The relay drive circuit 500 also turns on the relay 501 (closed state, power supply state) when the relay control signal RCS is a high-level signal.

When at least one of the CAN control signal NCS and the relay control signal RCS is a high-level signal, the OR circuit 401 outputs a high-level signal. This enables the CAN transceiver 402, allowing CAN communication by the CAN communication circuit 400. At this time, the CAN communication circuit 400 transmits a reception signal RX from the electronic control device 100B to the main unit 200, and transmits a transmission signal TX from the main unit 200 to the electronic control device 100B.

On the other hand, when the CAN control signal NCS and the relay control signal RCS are both low level signals, the OR circuit 401 outputs a low level signal. This disables the CAN transceiver 402 and stops CAN communication by the CAN communication circuit 400, so that the reception signal RX from the electronic control device 100B is not transmitted to the main unit 200, and the transmission signal TX from the main unit 200 is not transmitted to the electronic control device 100B.

In other words, even if the relay control signal RCS is set to a low level based on a command to turn off the relay 501, the main unit 200 outputs a high-level CAN control signal NCS, thereby invalidating the command to stop CAN communication by the relay control signal RCS and enabling CAN communication by the CAN communication circuit 400.

In addition, when a low-level CAN control signal NCS is output from the main unit 200, the CAN transceiver 402 is switched between a disabled state and an enabled state according to the relay control signal RCS, and when the relay control signal RCS goes low, the relay 501 (relay drive circuit 500) is turned off and the drive of the actuator 502 is stopped. In synchronization with the stop of the drive of the actuator 502, the CAN transceiver 402 is switched to a disabled state and CAN communication by the CAN communication circuit 400 is stopped.

As described below, the relay control signal RCS is configured to be set to a low level when an abnormality is detected in the processor of the main unit 200. When an abnormality occurs in the processor, the actuator 502 is stopped from being driven and CAN communication is stopped, thereby implementing a fail-safe that controls the vehicle to the safe side.

The subunit 300 includes an arithmetic function monitoring unit 301 which diagnoses (monitors) an abnormality in the arithmetic function of the main unit (processor) 200, for example by using an example arithmetic method; a relay output unit 302 which outputs a signal which controls the on/off of a relay 501 based on a signal which indicates the diagnosis result of the relay 501 in the main unit 200; a NOT circuit (inverter circuit) 304 which inputs the output of the arithmetic function monitoring unit 301; and an AND circuit 305 which inputs the output of the NOT circuit 304 and the output of the relay output unit 302.
The calculation function monitoring unit 301 outputs an example problem to the main unit 200, inputs answer data which is the result of calculation by the main unit 200 according to this example problem, and diagnoses whether the calculation function of the main unit 200 is normal or abnormal by comparing the answer data with an expected value.

A signal indicating the diagnosis result of the main unit 200 in the arithmetic function monitoring section 301 is inverted by a NOT circuit 304 and input to one input terminal of an AND circuit 305 .
Here, the calculation function monitoring section 301 outputs a low level signal if the calculation function of the main unit 200 is normal, and outputs a high level signal if the calculation function of the main unit 200 is abnormal. Therefore, if the calculation function of the main unit 200 is normal, a high level signal is input to the AND circuit 305, and if the calculation function of the main unit 200 is abnormal, a low level signal is input to the AND circuit 305.

The relay output unit 302 receives a signal indicating the diagnosis result of the relay 501 in the main unit 200, and outputs a high-level signal if the diagnosis result is normal and the relay 501 is turned on, and outputs a low-level signal if the diagnosis result is abnormal and the relay 501 is turned off as a fail process. The relay output unit 302 then outputs a signal to the other input terminal of the AND circuit 305 according to whether the relay 501 is normal or abnormal.

Therefore, when the calculation function monitoring unit 301 of the subunit 300 diagnoses that the calculation function of the main unit 200 is normal, and the main unit 200 diagnoses that the relay 501 is normal and commands the relay 501 to be turned on, both inputs of the AND circuit 305 become high-level signals, and the AND circuit 305 outputs a high-level signal.

On the other hand, when the arithmetic function monitoring section 301 determines that the main unit 200 is in an abnormal state, one of the input signals to the AND circuit 305 becomes a low level signal, causing the AND circuit 305 to output a low level signal.
In addition, when the main unit 200 diagnoses that the relay 501 is abnormal and issues a command to turn off the relay 501, one of the input signals to the AND circuit 305 becomes a low level signal, causing the AND circuit 305 to output a low level signal.

The subunit 300 outputs the output of the AND circuit 305 to one input terminal of an external AND circuit 600 .
The output of the relay output section 700 is input to the other input terminal of the AND circuit 600. The output of the self-diagnosis section 203 of the main unit 200 is input to the relay output section 700.

The self-diagnosis section 203 outputs a low level signal to the relay output section 700 if the main unit 200 is normal, and outputs a high level signal to the relay output section 700 if the main unit 200 is abnormal.
The relay output section 700 outputs a high level signal to the AND circuit 600 when the output of the self-diagnosis section 203 is a low level signal, and outputs a low level signal to the AND circuit 600 when the output of the self-diagnosis section 203 is a high level signal.

In other words, the relay output section 700 outputs a high level signal when the result of the self-diagnosis in the main unit 200 is normal, and outputs a low level signal to turn off the relay 501 as a fail processing step when the result of the self-diagnosis in the main unit 200 is abnormal.
Since the output of the relay output unit 700 is input to the other input terminal of the AND circuit 600, even if the calculation function monitoring unit 301 diagnoses that the main unit 200 is normal and the diagnosis result of the relay 501 in the main unit 200 is normal and a high level signal is input to one input terminal of the AND circuit 600, if the self-diagnosis result of the main unit 200 is abnormal and the output of the relay output unit 700 is at a low level, the output of the AND circuit 600 (relay control signal RCS) will be at a low level.

In this way, when the calculation function monitoring unit 301 diagnoses whether the main unit 200 is normal, and the diagnosis result of the relay 501 in the main unit 200 is normal, and the self-diagnosis result of the main unit 200 is normal, the relay control signal RCS, which is the output of the AND circuit 600, becomes a high-level signal.
On the other hand, if the calculation function monitoring unit 301 diagnoses an abnormality in the main unit 200, if the main unit 200 diagnoses an abnormality in the relay 501, or if the self-diagnosis result of the main unit 200 is abnormal, the relay control signal RCS, which is the output of the AND circuit 600, becomes a low-level signal.

The relay drive circuit 500 drives the relay 501 on (closed state) when the output of the AND circuit 600 (relay control signal RCS) is a high level signal, and drives the relay 501 off (open state) when the output of the AND circuit 600 is a low level signal.
The relay 501 supplies power from the power source to the actuator 502 when it is on (closed state), and cuts off the supply of power from the power source to the actuator 502 when it is off (open state).
An electromagnetic relay or a semiconductor relay such as a MOSFET can be used as the relay 501. The actuator 502 is, for example, a solenoid or a motor.

With the above configuration, when the calculation function monitoring unit 301 diagnoses an abnormality in the main unit 200, when the main unit 200 diagnoses an abnormality in the relay 501, or when the self-diagnosis result of the main unit 200 indicates an abnormality, the relay control signal RCS goes to low level. This turns off the relay 501 and cuts off the supply of power from the power source to the actuator 502.
Furthermore, since the relay control signal RCS is output to the OR circuit 401, if the relay control signal RCS switches to a low level while the CAN control signal NCS is at a low level, CAN communication by the CAN communication circuit 400 is stopped in synchronization with the stopping of the drive of the actuator 502.

However, when the main unit 200 outputs a high-level CAN control signal NCS, the CAN communication circuit 400 remains capable of performing CAN communication even if the relay control signal RCS goes to a low level.
The condition for setting the relay control signal RCS to a low level is not limited to the above-mentioned diagnosis result. For example, when the main unit 200 monitors the subunit 300 and detects an abnormality in the subunit (processor) 300, the main unit 200 can control the relay control signal RCS to a low level.

The main unit 200 includes an example problem calculation section (ALU diagnostic section) 201 which receives example problem data from the calculation function monitoring section 301 of the subunit 300 , calculates the received example problem, and outputs an answer to the calculation function monitoring section 301 .
The main unit 200 also includes a relay diagnostic section 202 that diagnoses the relay 501 (such as for stuck-closed or stuck-open abnormalities), and this relay diagnostic section 202 outputs a signal indicating the diagnosis result to the relay output section 302 of the subunit 300, in other words, an on/off command signal for the relay 501.

The main unit 200 also includes a self-diagnosis unit 203. This self-diagnosis unit 203 performs self-diagnosis when the vehicle ignition switch is turned on, and has a determination function that determines that a communication error has occurred if there is no communication for a specified period of time. Furthermore, this self-diagnosis unit 203 performs various self-diagnoses such as timer/clock diagnosis, task execution cycle diagnosis, A/D conversion diagnosis, power supply circuit diagnosis, and CPU function diagnosis, and outputs a signal indicating the diagnosis result to the external relay output unit 700.

The main unit 200 further includes a CAN control section 204 that outputs a CAN control signal NCS to the OR circuit 401 of the CAN communication circuit 400, and a CAN communication section 205 that receives a reception signal RX via the CAN communication circuit 400 and generates a transmission signal TX (CAN data) to transmit to the CAN communication circuit 400.

FIG. 2 shows a reference example time chart from the start-up trigger in a conventional vehicle electronic control device until communication becomes possible, that is, from when the ignition switch, which is the main switch of the vehicle, is turned on to power up and until the electronic control device becomes able to send and receive communication data.
First, when the ignition switch is turned on at time t0 and the ignition signal IGNSW goes high, a power-on reset of the main unit 200 and the sub-unit 300 is initiated from the time t0 when the ignition switch is turned on, and at time t1 after a time Th [s] has elapsed when the reset process is completed, the power-on reset signal RESET goes high and the reset is released. The start-up process starts at this time t1, and if the software start-up time is Ts [s], the start-up process ends at time t2, normal control starts, and CAN communication becomes possible.

Here, the period between times t0 and t2 is the maximum startup time Tmax, where "Tmax = Th + Ts". Time Th is determined by the hardware configuration of the electronic control device, and time Ts is determined by the software of the electronic control device and the software of other electronic control devices that are interposed in the startup path. Time Ts also differs depending on the software version.

Figure 3 is a time chart from the start-up trigger to when communication becomes possible in an electronic control device according to a first embodiment of the present invention. As is clear from a comparison with Figure 2, in this embodiment, a wait time is provided between the start-up process and normal control of the electronic control device, and the timing for starting normal control including CAN communication after startup is preset (adjusted).

That is, when the ignition switch is turned on at time t10 and the ignition signal IGNSW becomes high level, the power-on reset of the main unit 200 and the sub unit 300 is started from the time t10 when the ignition switch is turned on, and at time t11 after the time Th [s] when the reset process is completed has elapsed, the power-on reset signal RESET becomes high level and the reset is released. The startup process starts at this time t11, and if the software startup time is Ts [s], the startup process ends at time t12. When the startup process ends at time t12, the wait time is until time t13. The wait time is calculated from the difference between the processing time in each transition route, for example, measured in advance. This wait time is set to the longest startup time Tmax, which is the longest time from ignition on to the start of CAN communication via multiple startup paths among the electronic control devices mounted on the vehicle control system. Then, when the wait time ends at time t13, normal control starts and CAN communication becomes possible.

In this way, by extending the startup process to the maximum startup time Tmax, the startup time Twait can be made constant. In other words, the startup of multiple electronic control devices mounted on the vehicle control system can be aligned with the startup time of the electronic control device that has the longest time from the startup trigger to becoming capable of CAN communication.
The startup time Twait can be expressed as "Twait = Tmax - Th" and may be set, for example, using a timer built into the main unit 200 or the subunit 300. Also, it does not necessarily have to be set to the maximum startup time Tmax, and may be adjusted to a time at which mutual communication between electronic control devices mounted on the vehicle is not judged to be in an abnormal state.

4 is a flow chart showing the process from the start-up trigger to the enablement of communication in the electronic control unit according to the first embodiment of the present invention. First, the ignition signal IGNSW, which is the start-up trigger, is detected (step S1), and it is determined whether the ignition is on or not based on the level of the ignition signal IGNSW (step S2). If it is determined that the ignition is on (high level), a power-on reset of the main unit 200 and the sub-unit 300 is executed (step S3), and it is determined whether the power-on reset has been completed (step S4).
If it is determined in step S2 that the ignition is not on (low level), the process continues to wait until the ignition signal IGNSW becomes high level. If it is determined in step S4 that the power-on reset of the main unit 200 and the sub-unit 300 is not completed, the process returns to step S3 to continue the power-on reset.

When it is determined in step S4 that the power-on reset of the main unit 200 and the sub-unit 300 has been completed, the start-up process is started (step S5). This start-up process includes the selection of a start-up path (transition route), for example, a normal start-up route, a shutdown recovery start-up route, or another start-up route.
In the next step S6, it is determined whether the startup route is a normal startup route, and if so, a wait time ΔWt1 is set (step S7). If it is determined in step S6 that the startup route is not a normal startup route, it is determined whether the startup route is a shutdown recovery startup route (step S8), and if so, a wait time ΔWt2 is set (step S9). If it is determined in step S8 that the startup route is not a shutdown recovery startup route, a wait time ΔWt3 is set (step S10). Then, it is determined whether the set wait time has elapsed (step S11), and normal control is executed at the time of elapse (step S12).

As described above, by providing a wait time between the startup process and normal control of the electronic control device and setting the intercommunication between the electronic control devices based on the long startup time that may occur due to the transition route (startup path), it is possible to suppress unintended communication abnormalities and misdiagnosis during startup while still allowing intercommunication between devices.
In addition, since the time from startup of multiple electronic control devices connected to the vehicle network to the start of normal control can be synchronized, the difference in startup time can be reduced regardless of which startup path is taken, thereby reducing the occurrence of communication errors and erroneous judgments.

In the first embodiment described above, the timing for starting communication after startup is adjusted in advance, but the electronic control device may be configured to set the timing for executing self-diagnosis itself, thereby generating a delay equivalent to the wait time.
Furthermore, if the transition route (startup path) is known, the startup time Ts of the software is determined, and therefore the startup time Twait may be calculated from the transition route.

Furthermore, in order to improve the accuracy of the time Th until the power-on reset of the main unit 200 is released, the time Th may be received from the sub-unit 300 and the startup time Twait may be calculated.
Furthermore, if the time Th cannot be received from the subunit 300 or is longer than the theoretically calculated time Th, a fail-safe (F/S) operation using the time Th may be considered.

5 is a time chart showing a time from a start-up trigger to when communication becomes possible in an electronic control unit according to a second embodiment of the present invention. In this embodiment, an adaptation value is assigned to normal control according to the start-up time of the electronic control unit.
That is, when the ignition switch is turned on at time t20 and the ignition signal IGNSW becomes high level, the power-on reset of the main unit 200 and the sub unit 300 is started from the time t20 when the ignition switch is turned on, and at time t21 after the time Th [s] when the reset process is completed has elapsed, the power-on reset signal RESET becomes high level and the reset is released. If the startup process is started at this time t11 and the software startup time is Ts [s], the startup process ends at time t22 and normal control starts. Then, at time t23, a predetermined time after the start of normal control, CAN communication becomes possible. The time between these times t22 and t23 is adjusted by a suitable value set for each startup path based on "Tinit = Th + Ts" obtained at the completion of the startup process. This suitable value changes depending on the startup path, and becomes larger if the time from the startup trigger to the time when communication becomes possible is long.

6 is a flow chart showing the process from the start-up trigger to the enablement of communication in an electronic control unit according to a second embodiment of the present invention. First, the ignition signal IGNSW, which is the start-up trigger, is detected (step S21), and it is determined whether the ignition is on or not based on the level of the ignition signal IGNSW (step S22). If it is determined that the ignition is on (high level), a power-on reset of the main unit 200 and the sub-unit 300 is executed (step S23), and it is determined whether the power-on reset has been completed (step S24).
If it is determined in step S22 that the ignition is not on (low level), the process continues to wait until the ignition signal IGNSW becomes high level. If it is determined in step S24 that the power-on reset of the main unit 200 and the sub-unit 300 is not completed, the process returns to step S23 to continue the power-on reset.

When it is determined in step S24 that the power-on reset of the main unit 200 and the sub-unit 300 has been completed, a start-up process is started (step S25).
When the startup process is completed, "Tinit=Th-Ts" is obtained to set a suitable value (step S26), whereby the startup path (transition route) is recognized and a suitable value is set.
Next, normal control is started, and the time until the start of CAN communication is adjusted according to the set adaptation value (step S27).

In this way, by providing an adaptation value for each startup path, control according to Tinit can be performed on the normal control side. Since the intercommunication of electronic control devices is set based on the long startup times that can occur due to differences in startup paths, it is possible to suppress unintended communication errors and misdiagnosis during startup while still allowing intercommunication between devices. Furthermore, as a countermeasure to adaptation to startup times, the configuration allows the adaptation value to be changed for each startup time, making it possible to change operating parameters.

In the case of in-vehicle devices, there is a demand from vehicle manufacturers to change the operating parameters when the start-up time changes due to the state of the controlled object or the consistency of the entire vehicle, but in the case of devices in which the start-up time changes depending on the start-up conditions, there is a concern that starting the ECU with a single parameter does not necessarily result in an appropriate operating state. However, in the second embodiment, the operating parameters can be changed, so such demands can be met.

As in the first embodiment described above, the startup time Ts of the software is determined. Therefore, in the second embodiment, if the transition route (startup path) is known, the startup time Twait may be set from the transition route.
In order to improve the accuracy of the time Th until the power-on reset of the main unit 200 is released, the time Th may be received from the sub-unit 300 and the startup time Twait may be calculated.
Furthermore, if the time Th cannot be received from the subunit 300 or is longer than the theoretically calculated time Th, a fail-safe (F/S) operation using the time Th may be considered.

The present invention has been described above using the first and second embodiments, but the present invention is not limited to the above-mentioned embodiments, and various modifications can be made in the implementation stage without departing from the gist of the invention.
For example, the electronic control devices 100A, 100B have been described as being composed of a main unit 200 and a monitoring subunit 300 that diagnoses the main unit 200, but a subunit does not need to be provided if the electronic control devices have a self-diagnosis function.
Further, although CAN communication has been mentioned as the communication method between the electronic control devices 100A and 100B, other communication methods such as AUD communication, LIN communication, and FlexRay communication can be similarly applied.

In this way, the first and second embodiments include inventions at various stages, and various inventions can be extracted by appropriate combinations of the multiple constituent elements disclosed. For example, even if some constituent elements are deleted from all the constituent elements shown in the embodiments, if at least one of the problems stated in the "Problem to be Solved by the Invention" column can be solved and at least one of the effects stated in the "Effects of the Invention" column can be obtained, the configuration from which the constituent elements have been deleted can be extracted as an invention.

100A, 100B...Electronic control device, 200...Main unit, 202...Relay diagnosis section, 203...Self-diagnosis section, 204...CAN control section, 205...CAN communication section, 300...Subunit, 301...Calculation function monitoring section, 305, 600...AND circuit, 400...CAN communication circuit, 401...OR circuit, 402...CAN transceiver, 500...Relay drive circuit, 501...Relay, 502...Actuator

Claims (2)

An electronic control device for a vehicle having a communication function for communicating with other electronic control devices mounted on a vehicle, and a determination function for performing a self-diagnosis when an ignition switch of the vehicle is turned on and determining that a communication error has occurred if there is no communication for a predetermined period of time,
This electronic control device for a vehicle is characterized in that, when an ignition is turned on, after a power-on reset is performed, a startup process is executed, a wait time is set according to whether a normal startup route or a shutdown recovery startup route is selected, and normal control including communication is performed after the wait time has elapsed. An electronic control device for a vehicle having a communication function for communicating with other electronic control devices mounted on a vehicle, and a determination function for performing a self-diagnosis when an ignition switch of the vehicle is turned on and determining that a communication error has occurred if there is no communication for a predetermined period of time,
When the ignition is turned on, a power-on reset is performed, and then a startup process is executed. A compatibility value set for each startup path is obtained by obtaining "Tinit = Th + Ts", where Th is the time from when the power-on reset is started to when the reset process is completed, and Ts is the software startup time. Then, communication becomes possible after a predetermined time adjusted by the compatibility value has elapsed since normal control is started.