JP2007213137A - Electronic controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent a failure of a microcomputer in an electronic controller stopping supply of a power supply voltage to the microcomputer in a sleep mode. <P>SOLUTION: In transfer to the sleep mode after switching off an ignition switch 4 in a vehicle, a main control microcomputer 20 sets an output level of a signal V4a, which is outputted to an auxiliary control microcomputer 30 from an output port of an input/output circuit 25a, at a low level, and at the same time, switches settings of a port, which is installed in the input/output circuit 25 and can be set to either of an output port or an input port, to the input prot. In this way, no high level signal is inputted to the auxiliary control microcomputer 30 via the input/output circuit 25 in the main control microcomputer 20. Subsequently, a signal V6 is set at a low level and a switch 13 is turned off, and supply of the power voltage V3 to the auxiliary control microcomputer 30 is stopped. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an electronic control device configured to stop power supply voltage supply from a power supply circuit to a microcomputer in a sleep mode.

  2. Description of the Related Art Conventionally, for example, an automotive electronic control device includes a microcomputer that performs various processes for controlling electronic devices and the like, and a power supply circuit, and the power supply circuit is supplied from a battery as an external power source of the electronic control device. The voltage (battery voltage) is stepped down to a predetermined constant voltage, and the stepped down constant voltage is supplied to the microcomputer as a power supply voltage (that is, an operating voltage of the microcomputer). In this type of electronic control device, in the sleep mode where the microcomputer does not need to operate, the supply voltage from the power supply circuit to the microcomputer is stopped to reduce the current consumption in the electronic control device. It is considered to be.

In recent years, there are cases where a plurality of microcomputers are provided in an electronic control device from the viewpoint of high performance (for example, see Patent Document 1). Even in such a case, as described above, it is desirable to reduce the current consumption in the electronic control device by stopping the supply of the power supply voltage to the microcomputer in the sleep mode.
Japanese Patent Laid-Open No. 11-250029

  By the way, in the electronic control device provided with a plurality of microcomputers as described above, when the supply of the power supply voltage to the microcomputer is stopped, the following problems may occur.

  For example, if a high-level signal is output from a microcomputer that has not stopped operation to a microcomputer that has stopped operating because the supply of power supply voltage has been stopped, no current normally flows inside the microcomputer that has stopped operating. This is a problem that current flows through the path, and standby current increases or circuit elements or the like fail. That is, in the microcomputer, a part for inputting a signal is provided with a diode or the like for protecting the element, but current may flow through the diode or the like.

  The present invention has been made in view of these problems, and an object of the present invention is to prevent a malfunction of a microcomputer in an electronic control device configured to stop the supply of power supply voltage to the microcomputer in a sleep mode.

  According to another aspect of the present invention, there is provided an electronic control device according to claim 1, wherein the main control microcomputer operates to a main control microcomputer and a main control microcomputer connected to each other via a signal line. Power supply means for supplying a second power supply voltage for operating the sub-control microcomputer to the sub-control microcomputer, and supplying a first power supply voltage for the sub-control microcomputer. When the cutoff signal instructing to stop the supply of voltage is received, the supply of the second power supply voltage is stopped.

  When the main control microcomputer determines that a predetermined interruption condition has been established, the main control microcomputer executes an output signal suppression process for preventing a high level signal from being output from the main control microcomputer to the sub control microcomputer via the signal line. At the same time, when the execution of the output signal suppression process is completed, a cutoff signal is output to the power supply means.

  According to the electronic control device of the first aspect, when the sub-control microcomputer does not need to operate (for example, in the sleep mode), the supply of the second power supply voltage is stopped and the sub-control microcomputer is stopped. The operation of the control microcomputer can be stopped. For this reason, current consumption can be suppressed as an entire electronic control unit, which is advantageous. For example, in a vehicle equipped with an electronic control device, in sleep mode, the power supply voltage for operating the electronic control device will be supplied from the in-vehicle battery, but by suppressing the current consumption of the electronic control device, It is possible to prevent the in-vehicle battery from rising.

  In the electronic control device according to the first aspect, even if the supply of the second power supply voltage is stopped and the sub-control microcomputer stops operating, the main control microcomputer receives the first power supply voltage from the power supply means and operates. Can be. For this reason, a process that should be executed at least in the sleep mode (for example, a process for monitoring whether or not a command for returning from the sleep mode to the normal mode is input) may be executed in the main control microcomputer. it can. Therefore, according to this electronic control device, the current consumption can be suppressed as described above, and the minimum necessary functions can be maintained.

  By the way, when the supply of the second power supply voltage to the sub-control microcomputer is stopped in the sleep mode, the power supply voltage may wrap around from the main control microcomputer to the sub-control microcomputer. That is, a high level signal may be output from the main control microcomputer to the sub control microcomputer via the signal line.

  On the other hand, in the electronic control device according to the first aspect, the main control microcomputer changes from the main control microcomputer to the sub control microcomputer before outputting the cutoff signal for stopping the supply of the second power supply voltage to the power supply means. An output signal suppression process is performed so that a high level signal is not output. Then, when the execution of the output signal suppression process is completed, a blocking signal is output. For this reason, even when the operation of the sub-control microcomputer is stopped, it is possible to prevent a high-level signal from being output from the main control microcomputer to the sub-control microcomputer. Therefore, it is possible to prevent the current from flowing through the sub-control microcomputer and the standby current from increasing or the elements in the sub-control microcomputer from failing.

  And the main control microcomputer should just perform the process as described in Claim 2 as an output signal suppression process. That is, in the electronic control device according to the second aspect, the main control microcomputer executes a process of setting the level of the signal output from the main control microcomputer to the sub control microcomputer through the signal line to a low level.

  Also, in the electronic control device according to claim 1 or 2, the main control microcomputer can be used by switching to either an output port or an input port as a port connected to the signal line. If an input / output switchable port is provided, it may be configured as described in claim 3. That is, the main control microcomputer executes a process of switching the setting of the input / output switchable port to the input port as the output signal suppression process.

  Next, in the electronic control device according to a fourth aspect, in the electronic control device according to any one of the first to third aspects, the sub control microcomputer is configured such that the main control microcomputer outputs a cutoff signal. A blocking permission signal to be permitted is output to the main control microcomputer. The main control microcomputer determines that the cutoff condition is satisfied when the cutoff permission signal is input from the sub-control microcomputer.

  In other words, in the electronic control device according to claim 4, when the sub control microcomputer permits the stop of the supply of the second power supply voltage, the main control microcomputer outputs a cutoff signal, and the power supply means supplies the second power supply voltage. To stop. Therefore, it is possible to reliably prevent a problem that the supply of the second power supply voltage is stopped even when the sub-control microcomputer is operating (for example, during execution of a program).

  According to a fifth aspect of the present invention, in the electronic control device according to the fourth aspect, the sub control microcomputer is configured to communicate with an external device. Then, the sub-control microcomputer outputs a cutoff permission signal when a predetermined time has elapsed after the communication from the external device is completed.

  In other words, in the electronic control device according to the fifth aspect, the sub-control microcomputer determines that communication is not performed when a predetermined time has elapsed after communication is completed, and in this case, the supply of the second power supply voltage is determined. Permits stop (outputs a cut-off permission signal). For this reason, it is possible to efficiently stop the supply of the second power supply voltage. In other words, the blocking permission signal is not output in consideration of the possibility of resuming communication until a predetermined time has elapsed even after communication with an external device is completed. For this reason, it is possible to reduce reception leakage of communication signals. Note that the communication may be terminated in a case where all communication signals to be transmitted / received are normally transmitted and terminated, or in a case where the communication is terminated abnormally due to an abnormality or failure of a device or the like.

  In particular, when there are a plurality of external devices, as described in claim 6, the sub-control microcomputer outputs a cutoff permission signal when a predetermined time elapses after communication from all the external devices is completed. What is necessary is just to comprise. Even in this case, the same effect as that of the fifth aspect can be obtained.

  By the way, in the electronic control device according to claim 5 or claim 6, as a communication procedure, an external device transmits a communication cut-off signal for requesting cut-off of communication to the sub-control microcomputer and communication from the sub-control microcomputer. If blocking is permitted, it is conceivable that an external device terminates communication with the sub-control microcomputer. Therefore, in the electronic control device according to the seventh aspect, the sub control microcomputer outputs a cutoff permission signal when a predetermined allowable time has elapsed after receiving the communication cutoff signal.

  In other words, the sub-control microcomputer outputs a cutoff permission signal regardless of whether or not the communication has ended when the allowable time has elapsed since the transmission cutoff signal was transmitted from an external device. is there. The reason for such a configuration is that, for example, when an external device has an abnormality or the end of communication is not permitted by the sub-control microcomputer, the communication may not end. This is because if the cutoff permission signal is not output in such a case, the sub-control microcomputer continues to operate and the current consumption cannot be reduced. That is, in the electronic control device according to the seventh aspect, even when communication between the sub-control microcomputer and the external device does not end due to an abnormality or the like, the supply of power supply voltage to the sub-control microcomputer is stopped to reduce current consumption. You can plan.

  Next, in the electronic control device according to claim 8, in the electronic control device according to any one of claims 4 to 7, the sub-control microcomputer is an electric load provided outside the electronic control device. In this case, after the energization of the electric load is turned off, a cutoff permission signal is output.

  In addition, a motor, a relay, etc. can be considered as an electrical load. For example, when the relay is turned on and the supply of the second power supply voltage is stopped and the sub control microcomputer stops operating immediately after the relay is turned on, a current flows instantaneously through the relay. Then, an overcurrent flows through the contact of the relay, and the contact may be welded. For this reason, after turning off the relay (after turning off the electrical load), the cutoff permission signal is output.

  Further, in the electronic control device according to claim 9, in the electronic control device according to any one of claims 4 to 8, the sub control microcomputer includes a volatile memory for storing data. . Then, after the data stored in the volatile memory is saved in a storage means other than the volatile memory, a cutoff permission signal is output.

  According to such an electronic control device of the ninth aspect, it is possible to reliably prevent the data stored in the volatile memory of the sub-control microcomputer from being lost. The storage means may be outside or inside the sub control microcomputer. And as a memory | storage means provided outside, the memory | storage part with which an external apparatus is provided may be sufficient. Further, it may be a storage medium such as a flash memory or a CD-ROM / RAM. In this case, the data may be stored via a storage device for storing the data in the storage medium.

Further, as an internal storage means, there is a non-volatile memory as described in claim 10. Specifically, a flash ROM or the like can be considered.
By the way, in the electronic control apparatus as described above, a shut-off signal is output due to a malfunction of the main control microcomputer, or a noise signal is erroneously detected by the power supply means as a shut-off signal from the main control microcomputer. It can be considered.

  Accordingly, in the electronic control device according to claim 11, in the electronic control device according to any one of claims 4 to 10, when the sub control microcomputer outputs the cutoff permission signal, the cutoff signal Is supplied to the power supply means, and the power supply means supplies the second power supply voltage when both the cutoff signal from the main control microcomputer and the cutoff signal from the sub control microcomputer are input. Is supposed to stop.

  According to the electronic control device of the eleventh aspect, it is possible to reliably prevent the supply of the second power supply voltage from being erroneously stopped due to the above-described malfunction or the like. That is, even if a non-normal cutoff signal is output from one of the main control microcomputer or the sub control microcomputer, the supply of the second power supply voltage is not stopped unless a cutoff signal is output from the other.

On the other hand, when an abnormality or the like occurs in the main control microcomputer or the sub control microcomputer, it is conceivable that the cutoff signal is not normally output from the main control microcomputer or the sub control microcomputer.
Therefore, in the electronic control device according to claim 12, in the electronic control device according to claim 11, the power supply means is configured to receive a cutoff signal from at least one of the main control microcomputer and the sub control microcomputer. When it is determined that a predetermined time has passed, the supply of the second power supply voltage is stopped.

  According to the electronic control device of the twelfth aspect, even when an abnormality or the like occurs in one of the main control microcomputer and the sub-control microcomputer and the shut-off signal is not output, the shut-off signal is output from the other and the specified time When the time has elapsed, the supply of the second power supply voltage can be stopped and the operation of the sub-control microcomputer can be stopped normally.

Next, an electronic control device according to a thirteenth aspect includes the same main control microcomputer and sub-control microcomputer as those of the electronic control device according to the first aspect, and power supply means.
Then, the main control microcomputer detects whether or not an abnormality that should initialize the main control microcomputer has occurred in the main control microcomputer, and when it detects that an abnormality to be initialized has occurred, outputs a cutoff signal to the power supply means. It is supposed to be.

Further, the signal line is provided with a current cutoff circuit that prevents current from flowing from the main control microcomputer to the sub control microcomputer.
In such an electronic control device according to the thirteenth aspect, when an abnormality that should initialize the main control microcomputer occurs in the main control microcomputer, the supply of the second power supply voltage is stopped and the operation of the sub control microcomputer is stopped. Therefore, it is possible to reliably prevent other electronic devices and the like from being adversely affected. Further, if the sub-control microcomputer is subsequently activated, the normal return of the electronic control device is expected. In addition, in the electronic control device according to the thirteenth aspect, since the current interrupt circuit is provided in the signal line, when the operation of the sub-control microcomputer is stopped, a current flows from the main control microcomputer to the sub-control microcomputer. Can be prevented. Therefore, it is possible to prevent the standby current from increasing or the elements in the sub-control microcomputer from failing. That is, the same effect as that of claim 1 can be obtained.

  Here, the electronic control device according to the thirteenth aspect may be configured as follows. In other words, when the main control microcomputer detects the abnormality to be initialized, the main control microcomputer is initialized, but the cutoff signal is not output (the operation of the sub control microcomputer is not stopped). . According to this, the sub control microcomputer can continue the operation. Even in such a configuration, the current cut-off circuit prevents the power supply voltage from sneaking from the sub-control microcomputer to the main control microcomputer, so that the elements in the main control microcomputer can be prevented from failing. it can.

  The electronic control device according to claim 14 is the electronic control device according to any one of claims 1 to 13, wherein the main control microcomputer is based on a signal input from the sub control microcomputer. Monitoring means for monitoring whether or not the control microcomputer is normal is provided, and when the interruption signal is output to the power supply means, the function of the monitoring means is stopped.

  According to the electronic control device of the fourteenth aspect, since it is monitored whether the sub-control microcomputer is normal or not, a highly reliable electronic control device can be provided. Further, when the operation of the sub-control microcomputer is stopped, the function of the monitoring means is also stopped.

  The electronic control device according to claim 15 is the electronic control device according to claim 14, wherein the main control microcomputer initializes the sub control microcomputer when an abnormality of the sub control microcomputer is detected by the monitoring means. The low active initialization signal to be output is output to the sub-control microcomputer via the signal line. Furthermore, when the main control microcomputer outputs a shut-off signal to the power supply means, the output level of the initialization signal is set to a low level.

  According to the electronic control device of the fifteenth aspect, when an abnormality occurs in the sub-control microcomputer, an initialization signal for initializing the sub-control microcomputer is output to attempt to return the sub-control microcomputer. Therefore, a highly reliable electronic control device can be provided. Further, when the cutoff signal is output, the output level of the initialization signal is set to the low level. In this case, in particular, if it is fixed at the low level, it is possible to prevent the power supply voltage from flowing from the main control microcomputer to the sub control microcomputer via the signal line of the initialization signal. In addition, after outputting the low active initialization signal, the output level may be fixed to the low level. That is, the effect of the present invention can be obtained even when the sub-control microcomputer is initialized.

  Here, in claim 15 dependent on claim 13, it may be configured as follows. In other words, when the abnormality to be initialized is detected in the main control microcomputer, the main control microcomputer is initialized, but the initialization signal is not output to the sub control microcomputer. According to this, the sub control microcomputer can continue the operation.

  Also, in this case, if the current cut-off circuit is configured such that a resistor is provided between the ground line and the signal line, the supply voltage wraps around from the main control microcomputer to the sub control microcomputer, or from the sub control microcomputer to the main control microcomputer. This is advantageous in that it is possible to prevent the power supply voltage from sneaking in to.

  Further, in the electronic control device according to claim 14 or claim 15, as described in claim 16, the monitoring means is configured such that a power supply voltage for operating the monitoring means is supplied to the monitoring means. You may be comprised from the circuit which operate | moves. In such a case, the main control microcomputer may stop the supply of the power supply voltage to the monitoring means when stopping the function of the monitoring means.

  Further, in the electronic control device according to any one of claims 14 to 16, as described in claim 17, the monitoring means determines whether or not a specific signal is output from the sub-control microcomputer at regular intervals. It may be configured to monitor at least one of whether the signal output from the sub-control microcomputer is normal.

  Furthermore, in the electronic control device according to any one of claims 14 to 17, the monitoring means is configured to check whether the second power supply voltage supplied to the sub-control microcomputer is normal. It may be configured to monitor whether or not.

Hereinafter, an electronic control device according to an embodiment to which the present invention is applied will be described.
[Embodiment 1]
As shown in FIG. 1, an electronic control device (hereinafter referred to as an ECU) 1 of the present embodiment is an ECU for an automobile, and shares data with other ECUs 2 while communicating with the equipment ( For example, it controls an engine and a transmission.

  The ECU 1 includes a main control microcomputer (microcomputer) 20 and a sub control microcomputer 30 that perform various processes for controlling a control target, and a constant power source necessary for the main control microcomputer 20 and the sub control microcomputer 30 to operate. A power supply circuit 10 that outputs a voltage and a driver circuit 40 that drives the relay 5 external to the ECU 1 according to a command from the sub-control microcomputer 30 are provided.

  The power supply circuit 10 steps down the battery voltage V1 supplied from the in-vehicle battery 3 as an external power supply, and generates a power supply voltage V2 to the main control microcomputer 20 and a power supply voltage V3 to the sub control microcomputer 30. And a switch 13 connected to the power supply line of the power supply voltage V3 and turned on / off based on a signal V6 from the main control microcomputer 20. The switch 13 is on when the signal V6 is at a high level, and is off when the signal V6 is at a low level. The voltage values of the power supply voltages V2 and V3 are the same.

  The main control microcomputer 20 monitors a power supply voltage V2 from the power supply circuit 10 and a signal SW1 from an automobile ignition switch (hereinafter referred to as IGSW) 4, and outputs a signal V6. Based on the watchdog clear signal WDC output from the control microcomputer 30, the operation monitoring circuit 23 for monitoring the operation of the sub-control microcomputer 30 and the sub-control microcomputer 30 communicate with the signals V7a and V7b, and the ECU 2 And a communication circuit 24 for communicating via the communication lines 6a and 6b, and an input / output circuit 25 for inputting and outputting signals V4a, V4b and V4c to and from the sub-control microcomputer 30. Although not shown, the input / output circuit 25 includes an output port for outputting a signal to the sub-control microcomputer 30 side, an input port for inputting a signal from the sub-control microcomputer 30 side, an output port, and an input port. Both have an input / output switchable port whose setting can be changed. The signal line of the signal V4a is connected to the output port, and the signal line of the signal V4b is connected to the input / output switchable port. The input / output switchable port is an output port during normal operation of the main control microcomputer 20. Is set to The signal line of the signal V4c is connected to the input port. Here, it is assumed that the signal V7a is output from the main control microcomputer 20 to the sub-control microcomputer 30, and the signal V7b is output from the sub-control microcomputer 30 to the main control microcomputer 20.

  The main control microcomputer 20 includes a well-known microcomputer core (not shown) including an arithmetic unit and a register for executing a program. Further, the functions of the power supply monitoring circuit 22, the operation monitoring circuit 23, and the communication circuit 24 described above may be realized by software.

  Next, the sub-control microcomputer 30 includes a relay control unit 32 that controls driving of the relay 5 via the driver circuit 40, a WDC output unit 33 that periodically outputs a watchdog clear signal WDC, and a main control microcomputer 20 When the high-level signal V5 is input from the operation monitoring circuit 23 and the signal V5 changes from the high level to the low level for a certain period of time, the sub-control microcomputer 30 is reset and initialized, and the communication circuit 24 The communication circuit 35 communicates with the communication circuit 24 and the ECU 2 through the communication lines 6a and 6b, and the input buffers 38 and 39. The input buffer 38 is connected to the signal line of the signal V4b, and the input buffer 39 is connected to the signal line of the signal V4a. In FIG. 1, diodes Du1, Dd1, Du2, and Dd2 are input protection diodes. The sub-control microcomputer 30 includes a well-known microcomputer core (not shown) composed of an arithmetic unit, a register, and the like for executing a program, like the main control microcomputer 20. The functions of the relay control unit 32 and the RESET unit 34 are realized by software. Further, the function of the communication circuit 35 may be realized by software.

  In such an ECU 1, in the main control microcomputer 20, the power supply monitoring circuit 22 detects that the signal SW1 has changed from a high level to a low level (that is, that the IGSW 4 has been turned off), and a predetermined condition is met. When established, the signal V6 from the power supply monitoring circuit 22 is set to a low level. Note that the case where the predetermined condition is satisfied is a case where it is determined that the supply of the power supply voltage V3 to the sub control microcomputer 30 may be stopped, as will be described in detail later.

  The operation monitoring circuit 23 is specifically provided with a timer (not shown), and when the watchdog clear signal WDC periodically transmitted from the sub-control microcomputer 30 is input, the count value of the timer is reset. It has become so. If the count value of the timer is not reset and reaches a predetermined value, the watchdog clear signal WDC is not output from the sub-control microcomputer 30 by the microcomputer core of the main control microcomputer 20, that is, It is determined that an abnormality has occurred in the sub control microcomputer 30. In this case, as described above, the signal V5 is set to the low level for a certain time, and the sub-control microcomputer 30 is instructed to be reset. In addition, the communication circuit 24 monitors whether the signal V7b from the communication circuit 35 is abnormal.

Next, processing performed in the main control microcomputer 20 and the sub control microcomputer 30 will be described with reference to FIGS.
2 to 6 are processes executed by the microcomputer core of the sub-control microcomputer 30.

  First, the standby mode process of FIG. 2 is a process periodically executed when the IGSW 4 is on. First, in S110, a signal from the main control microcomputer 20 indicates whether or not the IGSW 4 is turned off. Judgment is made based on V7a. For the signal V7a, specifically, the power supply monitoring circuit 22 detects whether the signal SW1 from the IGSW 4 is high level or low level, and the information is sent to the communication circuit 35 via the communication circuit 24. It is output as V7a.

  If it is determined in S110 that the IGSW 4 is not turned off (S110: NO), the determination process of S110 is executed again. Conversely, if it is determined that the IGSW 4 is turned off (S110: YES), the standby mode transition of S120 is performed. Proceed to processing.

  The standby mode transition process is a process for shifting to a standby mode, which is an operation mode for suppressing the power consumption of the ECU 1. In the standby mode, the supply of the power supply voltage V3 to the sub control microcomputer 30 is stopped. The standby mode transition process (S120) is composed of three different processes. These are a communication end confirmation process shown in FIG. 3, a relay-off confirmation process shown in FIG. 4, and a data save process shown in FIG. These processes are executed in parallel. When each process ends, the process proceeds to S130, and a cutoff permission signal described later is output. Hereinafter, each processing will be described. Of the three processes, any one or any two processes may be executed.

  In the communication end confirmation process of FIG. 3, first, in S210, it is determined whether or not a cut-off request for requesting the end of communication has been transmitted from an external electronic device such as the ECU 2. For example, when the ECU 2 determines that the IGSW 4 is turned off in the ECU 2, the ECU 2 stops various functions such as a communication function in order to reduce power consumption. Is to be sent. Then, if the sub control microcomputer 30 permits the end of communication, the sub control microcomputer 30 returns that fact to the ECU 2. Thereafter, the communication is terminated.

  If it is determined in S210 that the blocking request has not been transmitted (S210: NO), the process of S210 is repeated again. Conversely, if it is determined that the blocking request has been transmitted (S210: YES), the process proceeds to S220, where timer 1 Start. Although not shown, the timer 1 is included in the sub-control microcomputer 30. The sub-control microcomputer 30 also has timers 2 and 3 described later.

  Next, in S230, it is determined whether or not communication from an external electronic device (for example, ECU 2) has ended. If it is determined that communication from all the electronic devices has ended (S230: YES), the process proceeds to S240. When timer 2 is started in S240, the process proceeds to S250.

  In S250, it is determined whether the count time of the timer 2 has passed the specified time T2, and if it is determined that the specified time T2 has not passed (S250: NO), the process of S250 is repeated again. This may be the case where the communication is performed again after the communication is completed in S230, and waits until the specified time T2 elapses.

  If it is determined in S250 that the specified time T2 has elapsed (S250: YES), the process proceeds to S260, where the supply of the power supply voltage V3 to the sub-control microcomputer 30 is stopped (that is, the signal V6 is set to the low level). Generate block permission information. This blocking permission information is stored in a specific register provided in the microcomputer core. Thereafter, the process is terminated.

  If it is determined in S230 that communication from all the electronic devices has not been completed (S230: NO), the process proceeds to S270, and it is determined whether the count time of the timer 1 has passed the specified time T1. When it is determined that the count time of the timer 1 has not passed the specified time T1 (S270: NO), the process returns to S230 again.

  On the other hand, if it is determined that the count time of the timer 1 has passed the specified time T1 (S270: YES), the process proceeds to S260 to generate cutoff permission information. This is because, for example, when communication is not terminated due to a failure in an external electronic device or the like, the supply of the power supply voltage V3 is not permitted to stop and the sub-control microcomputer 30 operates normally. Since there is a possibility that the battery 3 may rise, the blocking permission information is generated when the specified time T1 elapses even if the communication is not finished.

  Next, in the relay-off confirmation process of FIG. 4, first, in S310, it is determined whether or not the above-described blocking request has been transmitted. If it is determined that it has not been transmitted (S310: NO), the process of S310 is performed again. On the contrary, if it is determined that it has been transmitted (S310: YES), the process proceeds to S320.

In S320, it is determined whether or not the relay 5 is turned off.
Here, in the main control microcomputer 20, the confirmation process of FIG. 5 is executed separately from the process of FIG. In the confirmation processing of FIG. 5, first, in S410, it is determined whether or not the relay is turned off. If it is turned off (S410: YES), information indicating that the relay is turned off is stored in S460. And so on. If it is determined in S410 that the relay is not turned off (S410: NO), the process proceeds to S420, and whether or not the relay may be turned off is determined based on, for example, a program for controlling the relay. If it is determined that the relay cannot be turned off (S420: NO), the process returns to S410 again. If it is determined that the relay may be turned off (S420: YES), the process proceeds to S430, and the relay is turned off. In step S440, the timer 3 is started. In step S450, it is determined whether the specified time T3 has elapsed since the timer 3 was started in step S440. In S450, the determination process of S450 is repeated until the specified time T3 elapses. When it is determined that the specified time T3 has elapsed (S450: YES), the process proceeds to S460. Thereafter, the process is terminated.

  Then, in S320 of FIG. 4, it is determined whether or not the relay is turned off based on the information stored in S460. If it is determined that the relay is turned off (S320: YES), the process proceeds to S330 and the above-described interruption is performed. The permission information is generated, and the blocking permission information is stored in a register different from that in S260 described above. Thereafter, the process is terminated.

  Next, in the data saving process of FIG. 6, first, in S510, it is determined whether or not the above-described blocking request has been transmitted. If it is determined that it has not been transmitted (S510: NO), the process of S510 is performed again. On the contrary, if it is determined that it has been transmitted (S510: YES), the process proceeds to S520.

  In S520, the data stored in the volatile memory is stored in the nonvolatile memory or the like. That is, even if the supply of the power supply voltage V3 is stopped and the sub-control microcomputer 30 stops its operation, the data to be held is stored so that the data to be held stored in the volatile memory is not lost. Save to nonvolatile memory. As the volatile memory, there is a RAM or a standby RAM provided separately from the RAM for continuously storing data. Nonvolatile memories include flash ROMs.

  Then, the process proceeds to S530, where the cutoff permission information is generated and stored in the register. Note that this register is different from the above-described cases of S260 and S330. Thereafter, the process is terminated.

  2, when the standby mode transition process in S120 (FIGS. 3 to 6) is completed, the process proceeds to S130, and a cutoff permission signal for permitting the main control microcomputer 20 to stop supplying the power supply voltage V3 is output. To do. In other words, the cutoff permission signal is a signal that permits the output of the signal V6 to be at a low level. Then, the cutoff permission signal is input to the communication circuit 24 of the main control microcomputer 20 through the signal line of the signal V7b. In S130, the block permission information stored in each register in each process of S260, S330, and S530 is referred to just in case.

Next, processing executed by the microcomputer core of the main control microcomputer 20 will be described with reference to FIGS.
The standby mode process of FIG. 7 is a process executed at regular intervals while the IGSW 4 is turned on. First, in S610, it is determined based on the signal SW1 whether or not the IGSW 4 is turned off. If it is determined that the IGSW 4 is turned off (that is, the signal SW1 has changed from the high level to the low level) (S610: YES), the process proceeds to S620, and it is determined whether or not it is possible to shift to the standby mode that is an operation mode for suppressing power consumption. To do. Specifically, for example, if it is determined that the above-described cutoff permission signal is not output from the sub-control microcomputer 30, it is determined that the transition is impossible.
Further, when the main control microcomputer 20 is communicating with another electronic device (for example, the ECU 2) or is executing a process of controlling a control target, it is determined that the transition is impossible. Furthermore, when the IGSW 4 is turned on again (that is, the signal SW1 is changed from the low level to the high level), it is determined that the transition is impossible.

  The microcomputer core of the main control microcomputer 20 periodically executes a monitoring process (FIG. 8) for monitoring whether the IGSW 4 is turned on in a state where the IGSW 4 is turned off. Here, the monitoring process of FIG. 8 will be described. First, in S710, it is determined whether or not IGSW4 is turned on based on the signal SW1. If it is determined that the switch is turned on (S710: YES), the process proceeds to S720, and a return process for returning to the operating state when the IGSW 4 is turned on is performed. For example, if there is a function stopped by turning off the IGSW 4, the function is restored. When the signal V6 is at a low level and the switch 13 is turned off, the signal V6 is set to a high level to turn on the switch 13.

  On the other hand, in S620 of FIG. 7, the cutoff control information is output from the sub-control microcomputer 30, and it is not necessary for the main control microcomputer 20 to communicate with other electronic devices or control the control target, and the IGSW 4 is turned off. If it is, it is determined that the transition to the standby mode is possible. Further, here, if the cutoff permission information is output from the sub-control microcomputer 30, it may be determined that the transition to the standby mode is immediately possible.

  If it is determined that the transition to the standby mode is possible (S620: YES), the process proceeds to S630, and a standby mode transition process for shifting to the standby mode is executed. Hereinafter, the standby mode transition process executed in the main control microcomputer 20 will be described with reference to FIG.

  In the standby mode transition processing of FIG. 9, first, in S810, port processing for changing the setting of the output port of the input / output circuit 25 or the input / output switchable port is executed. Specifically, the output level of the output signal of the output port is set to a low level. In addition, among the input / output switchable ports, the setting of the input / output switchable port whose setting is the output port is changed to the input port. This prevents a high level signal from being output from the input / output circuit 25 to the sub-control microcomputer 30 side.

  Here, if a high-level signal is output from the input / output circuit 25 to the sub-control microcomputer 30 side, the following problem can be considered. That is, in the sub-control microcomputer 30, as shown in FIG. 1, the input protection diodes Du1, Dd1, Du2, and Dd2 are provided at the portion to which the signal V4a or the signal V4b is connected. When a high level signal is input from the circuit 25 to the sub-control microcomputer 30, current may flow through the diodes Du1 and Du2 using the signal as a power source. In addition, current may flow through the sub-control microcomputer 30 via the diodes Du1 and Du2. Since such a current does not normally flow, there is a possibility that the diodes Du1, Du2, etc. may fail. Further, if the diodes Du1 and Du2 fail, the input buffers 38 and 39 may also fail. For this reason, port processing as in S810 is executed so that a high level signal is not input to the sub-control microcomputer 30.

In step S820, which proceeds from step S810, the supply of the power supply voltage V3 is stopped. Specifically, the signal V6 is set to a low level, and the switch 13 is turned off.
Next, it progresses to S830 and the monitoring function for monitoring the sub control microcomputer 30 is stopped. Specifically, the functions of the operation monitoring circuit 23 and the communication circuit 24 are stopped. Further, the function of monitoring the power supply voltage V2 of the power supply monitoring circuit 22 is stopped. In particular, the operation monitoring circuit 23, the communication circuit 24, and the power supply monitoring circuit 22 are each supplied with a voltage for operation, but the supply of the voltage is stopped. In the power supply monitoring circuit 22, the function of monitoring the power supply voltage V2 and the function of monitoring the signal SW1 are configured as separate circuits, and a voltage is supplied to each circuit separately. S830 Then, the supply of voltage to the circuit realizing the former function is stopped, and the supply of voltage to the circuit realizing the latter function is not stopped. Thereafter, the process is terminated.

  As described above, in the present embodiment, when the ECU 1 is in the standby mode, the power supply voltage V3 is not supplied to the sub-control microcomputer 30 and the power consumption is suppressed, but before the supply of the power supply voltage V3 is stopped. The port processing (S810) described above is executed to prevent the power supply voltage from wrapping around from the main control microcomputer 20 to the sub control microcomputer 30. Further, in the main control microcomputer 20, the monitoring function for monitoring the sub control microcomputer 30 is stopped (S830), unnecessary operations are not performed, and power consumption is suppressed.

Next, the operation of the ECU 1 as described above will be described using the time chart of FIG.
First, as shown at time t1, when the in-vehicle battery 3 is connected to the ECU 1 and the battery voltage V1 is supplied, the power supply voltage V2 from the regulator 12 becomes high level and the main control microcomputer 20 is activated. In this state, the switch 13 is in an OFF state, and the sub-control microcomputer 30 is in a stopped state.

  Thereafter, as shown at time t2, when IGSW4 is turned on and signal SW1 becomes high level (S710), signal V6 becomes high level, switch 13 is turned on, and power supply voltage V3 is supplied to sub-control microcomputer 30. (S720).

  Then, when the sub control microcomputer 30 is activated, as shown at time t3, the output of the signal V4a from the output port of the input / output circuit 25 is started (the signal V4a becomes high level). Although not shown, the signal level of the signal line of the signal V4b is also high. Further, communication using the signals V7a and V7b is started. Further, the signal V5 becomes high level, and the operation monitoring circuit 23 starts monitoring the operation of the sub-control microcomputer 30.

  Thereafter, when the IGSW 4 is turned off at time t4 (S110: YES), the sub-control microcomputer 30 starts executing the standby mode transition process (S120). When the standby mode transition process ends, at time t5, a cutoff permission signal is output from the sub control microcomputer 30 to the main control microcomputer 20 (S130).

  On the other hand, the main control microcomputer 20 starts execution of the standby mode transition process (S630) when the cutoff permission signal is input at time t5 and it is determined that the transition to the standby mode is possible (S620: YES). Then, by the port process (S810), the signal V4a is set to the low level (time t6). At time t7, supply of the power supply voltage V3 is stopped (S820). Further, the monitoring function of the main control microcomputer 20 is stopped and the signal V5 becomes low level (S830).

After time t7, the sub-control microcomputer 30 is in a stopped state, and the main control microcomputer 20 is in a standby mode with reduced power consumption.
Thus, when the IGSW 4 is turned off, the supply of the power supply voltage V3 to the sub-control microcomputer 30 is stopped to further reduce the power consumption, and before the supply of the power supply voltage V3 is stopped, the main control microcomputer 20 sets the level of the signal V4a to low level and switches the setting of the input / output switchable port to which the signal line of the signal V4b is connected to the input port so that the power supply voltage from the main control microcomputer 20 to the sub control microcomputer 30 is The wraparound is prevented. Further, the monitoring function of the main control microcomputer 20 for the sub control microcomputer 30 is also stopped.

  In the present embodiment, the in-vehicle battery 3 and the power supply circuit 10 correspond to power supply means, the power supply voltage V2 corresponds to the first power supply voltage, the power supply voltage V3 corresponds to the second power supply voltage, and the low level. The signal V6 corresponds to a cutoff signal, the processing in S810 corresponds to output signal suppression processing, and the power supply monitoring circuit 22, the operation monitoring circuit 23, and the communication circuit 24 correspond to monitoring means.

  As described above, in the present embodiment, when the IGSW 4 is turned off to shift to the standby mode, the supply of the power supply voltage V3 to the sub control microcomputer 30 is stopped. The main control microcomputer 20 continues to operate, while the function for monitoring the sub control microcomputer 30 is stopped. For this reason, current consumption in the standby mode can be suppressed, and a minimum necessary function can be maintained.

Further, in the present embodiment, before the supply of the power supply voltage V3 to the sub control microcomputer 30 is stopped, the main control microcomputer 20 performs the port process (S810). For this reason, it is possible to prevent a high level signal from being output from the main control microcomputer 20 to the sub control microcomputer 30 after the supply of the power supply voltage V3 is stopped. Therefore, it is possible to prevent the current from flowing through the sub-control microcomputer 30 and the standby current from increasing or the elements (for example, the diodes Du1, Du2, etc.) inside the sub-control microcomputer 30 from being damaged.
[Embodiment 2]
Next, an electronic control device according to a second embodiment will be described with reference to FIG.

  As shown in FIG. 11, in the ECU 1 according to the second embodiment, the sub-control microcomputer 30 includes a power monitoring circuit 31 as compared with the ECU 1 according to the first embodiment, and the power circuit 10 includes the signal monitoring circuit 14. It is different from the point of having.

  The power supply monitoring circuit 31 monitors the signal SW1 from the IGSW4. That is, in the second embodiment, the signal SW1 is monitored separately from the main control microcomputer 20 and the sub control microcomputer 30.

  The power monitoring circuit 22 inputs a signal V8 for turning off the switch 13 to the signal monitoring circuit 14, and the power monitoring circuit 31 also inputs a signal V9 for turning off the switch 13 to the signal monitoring circuit 14. .

  The signal monitoring circuit 14 monitors the signals V8 and V9 and outputs a signal V10 for turning the switch 13 on and off. When a predetermined condition is satisfied, the signal monitoring circuit 14 sets the level of the signal V10 to the switch 13. The switch 13 is turned off at a low level, and the supply of the power supply voltage V3 to the sub-control microcomputer 30 is stopped.

This will be specifically described below.
First, processing executed by the main control microcomputer 20 and the sub control microcomputer 30 will be described.
In the second embodiment, the main control microcomputer 20 and the sub control microcomputer 30 execute the standby mode process of FIG. In the standby mode transition processing of FIG. 12, the processing of S610 to S630 is basically the same as S610 to S630 of FIG. 7, but the main control microcomputer 20 and the sub control microcomputer 30 are different in the following points. .

  First, the main control microcomputer 20 executes processing excluding S820 in FIG. 9 as the standby mode transition processing in S630 in FIG. That is, the process of S830 is executed after the process of S810.

  On the other hand, the sub-control microcomputer 30 executes the communication end confirmation process of FIG. 3, the relay-off confirmation process of FIG. 4, and the data save process of FIG. 6 as the standby mode transition process of S630 of FIG. Further, the confirmation process of FIG. 5 is also executed. It should be noted that any one or two of the three processes of the communication end confirmation process (FIG. 3), the relay-off confirmation process (FIG. 4), and the data save process (FIG. 6) are executed. Also good.

  Then, after the process of S630, the process proceeds to S640, and a cut-off signal for stopping the supply of the power supply voltage V3 is output. That is, in S640, the main control microcomputer 20 outputs the signal V8, and the sub control microcomputer 30 outputs the signal V9.

The main control microcomputer 20 and the sub control microcomputer 30 also execute the monitoring process of FIG.
Next, the operation of the power supply circuit 10 will be described with reference to FIG. In FIG. 13, the operation of the power supply circuit 10 is represented by a flowchart. This process is a process realized by the hardware configuration of the signal monitoring circuit 14 included in the power supply circuit 10. Note that a microcomputer or the like may be provided in the power supply circuit 10 so that the processing of FIG. 13 is executed by software.

  In the power supply circuit processing of FIG. 13, first, in S910, it is determined whether the signal V8 or the signal V9 is input from the main control microcomputer 20 or the sub control microcomputer 30. If it is determined that the signal V8 or the signal V9 is not input (S910: NO), the process of S910 is repeated again. Conversely, if it is determined that the signal V8 or the signal V9 is input (S910: YES), the process proceeds to S920. move on. Here, the following description will be made assuming that the signal V8 is input from the main control microcomputer 20 in S910.

  In S920, which proceeds from S910, a timer (not shown) provided in the signal monitoring circuit 14 is started. In subsequent S930, it is determined whether or not the signal V9 is input from the sub-control microcomputer 30, and if it is determined that the signal V9 is input (S930: YES), it is determined that both the signal V8 and the signal V9 are input. Then, the process proceeds to S940.

In S940, the signal V10 is set to a low level, and the switch 13 is turned off. That is, the supply of the power supply voltage V3 is stopped.
On the other hand, if it is determined in S930 that the signal V9 is not input from the sub-control microcomputer 30 (S930: NO), the process proceeds to S950, and whether the count time of the timer started in S920 has passed the specified time T5. Determine whether or not. If it is determined that the specified time T5 has not elapsed (S950: NO), the process returns to S930 again. Conversely, if it is determined that the specified time T5 has elapsed (S950: YES), the process proceeds to S940. Here, even when the count time of the timer has passed the specified time T5, the reason for shifting to S940 (turning off the switch 13) is, for example, when an abnormality occurs in the sub-control microcomputer 30 and the signal V9 is not output. This is to prevent the in-vehicle battery 3 from being raised by the sub-control microcomputer 30 operating normally without stopping the supply of the power supply voltage V3.

  If it is determined in S910 that the signal V9 is input from the sub-control microcomputer 30, the process proceeds to S920 to start the timer, and in subsequent S930, it is determined whether or not the signal V8 is input from the main control microcomputer 20. If it is determined in S930 that the signal V8 is input, the process proceeds to 940. Conversely, if it is determined in S930 that the signal V8 is not input, the process proceeds to S950. If it is determined in S950 that the timer count time has not passed the specified time T5, the process returns to S930 again. If it is determined that the timer count time has passed the specified time T5, the process proceeds to S940.

  As described above, in the second embodiment, when both the signal V8 from the main control microcomputer 20 and the signal V9 from the sub control microcomputer 30 are input, the power supply voltage V3 is supplied to the sub control microcomputer 30. Is stopped. This can reliably prevent the supply of the power supply voltage V3 from being stopped by mistake. That is, for example, when the main control microcomputer 20 malfunctions, a signal V8 that is not normal is output, or the signal monitoring circuit 14 erroneously detects that the noise signal is the signal V8. However, the supply of the power supply voltage V3 is not stopped unless the signal V9 from the sub-control microcomputer 30 is input.

On the other hand, in the second embodiment, the supply of the power supply voltage V3 is stopped when the specified time T5 has elapsed after the signal V8 or the signal V9 is input from at least one of the main control microcomputer 20 and the sub control microcomputer 30. It has come to be. For this reason, even if an abnormality occurs in one of the main control microcomputer 20 and the sub control microcomputer 30 and the signal V8 or the signal V9 is not output, if either the signal V8 or the signal V9 is output. After the lapse of the specified time T5, the supply of the power supply voltage V3 can be stopped normally. Thereby, current consumption can be reduced. Further, before the supply of the power supply voltage V3 is stopped, the main control microcomputer 20 executes the same port processing (S810) as that in the first embodiment, so that the power supply voltage is prevented from wrapping around, and the sub control microcomputer 30 It is possible to prevent the diodes Du1, Du2, etc. from failing.
[Embodiment 3]
Next, an electronic control device according to a third embodiment will be described with reference to FIG.

  As shown in FIG. 14, in the ECU 1 of the third embodiment, the main control microcomputer 20 includes a WDP output unit 28 that periodically outputs watchdog pulses, and a main control microcomputer 20, as compared with the first embodiment. When the voltage in any of the circuits decreases, the abnormality is detected, and the abnormality is detected based on the low voltage detection circuit 27 that outputs a voltage abnormality signal indicating the abnormality, and the watchdog pulse and the voltage abnormality signal. In this case, there is a difference in that the main control microcomputer 20 is reset and initialized, and the communication circuit 24 is not provided.

  Specifically, if the RESET unit 26 determines that the watchdog pulse from the WDP output unit 28 is not output at a predetermined timing, it determines that an abnormality has occurred and resets the main control microcomputer 20. If it is determined that a voltage abnormality signal is input from the low voltage detection circuit 27, the main control microcomputer 20 is reset. The function of the RESET unit 26 is realized by software.

Further, the sub-control microcomputer 30 is different from the first embodiment in that the communication circuit 35 is not provided.
In the third embodiment, the other end of the resistor 29 having one end connected to the ground is connected to the signal line L4 of the signal V4a. The ECU 1 of the third embodiment is configured not to communicate with other ECUs. Of course, it may be configured to communicate with other ECUs.

  The sub-control microcomputer 30 according to the third embodiment executes the processes of FIGS. Further, the main control microcomputer 20 executes the processes of FIGS. 7 to 9 and also executes the abnormality monitoring process of FIG. 15 and the abnormality detection process of FIG.

  The abnormality monitoring process of FIG. 15 is a process for monitoring the presence or absence of abnormality in the sub-control microcomputer 30 and initializing the sub-control microcomputer 30 if there is an abnormality. First, in S1010, based on the watchdog clear signal WDC. Then, it is determined whether or not an abnormality has occurred in the sub-control microcomputer 30, and if it is determined that no abnormality has occurred (S1010: NO), the process of S1010 is repeated again, and conversely, if an abnormality has occurred (S1010: YES), the process proceeds to S1020.

  In step S1020, the signal V5 is set to a low level for a certain time, and the sub-control microcomputer 30 is instructed to be reset. In S1020, after instructing the sub-control microcomputer 30 to reset, the output level of the signal V5 is fixed to a low level. As a result, the wraparound of the power supply voltage from the main control microcomputer 20 to the sub control microcomputer 30 is prevented.

  Thereafter, in S1030, it is determined again whether or not an abnormality has occurred in the sub-control microcomputer 30, and if it is determined that an abnormality has occurred (S1030: YES), the process proceeds to S1040, and a standby mode transition process is executed. This standby mode transition process is the same as the standby mode transition process of S630. That is, in S1040, the process of FIG. 9 is executed.

  Then, the supply of the power supply voltage V3 is stopped by the process of S820 in FIG. 9 and the operation of the sub-control microcomputer 30 is stopped, but the port process of S810 is executed before the supply of the power supply voltage V3 is stopped. Therefore, it is possible to prevent the power supply voltage from wrapping around from the main control microcomputer 20 to the sub control microcomputer 30. As described above, the present invention can also be applied to the case where an abnormality occurs in the sub-control microcomputer 30 and the operation is stopped. Furthermore, in the present embodiment, since the resistor 29 is connected to the signal line L4 of the signal V4a, it is possible to more reliably prevent the power supply voltage from wrapping around. This will be specifically described below.

  In the sub control microcomputer 30, the cathodes of the diodes Du 1 and Du 2 are connected to a power line in the sub control microcomputer 30, and the power line is connected to the ground line via each circuit in the sub control microcomputer 30. Yes. The impedance of the resistor 29 is smaller than the impedance of the circuit in the sub-control microcomputer 30. Then, in a state where the operation of the sub control microcomputer 30 is stopped, the current from the main control microcomputer 20 flows to the resistance 29 side having a small impedance. For this reason, even if a high level signal is output from the main control microcomputer 20, the power supply voltage is prevented from wrapping around to the sub control microcomputer 30.

  On the other hand, if it is determined in S1030 that there is no abnormality in the sub-control microcomputer 30 (S1030: NO), the process proceeds to S1050 and returns to normal operation. Specifically, for example, the output level of the signal V5 is fixed to a low level in S1020, but the fixing is reset.

  In the abnormality detection process of FIG. 16, first, in S1110, it is determined whether an abnormality has occurred in the main control microcomputer 20 itself. Specifically, the RESET unit 26 determines whether or not a reset signal instructing reset is input to the operation monitoring circuit 23. If it is determined that the reset signal is input, it is determined that an abnormality has occurred. On the other hand, if it is determined that no reset signal is input, it is determined that no abnormality has occurred.

  If it is determined in S1110 that no abnormality has occurred (S1110: NO), the process of S1110 is repeated again. Conversely, if it is determined that an abnormality has occurred (S1110: YES), the process proceeds to S1120.

  In S1120, the signal V6 is set to a low level to turn off the switch 13 and stop the supply of the power supply voltage V3. This is because the main control microcomputer 20 that monitors the operation of the sub-control microcomputer 30 has an abnormality and the operation monitoring of the sub-control microcomputer 30 may not be normal. Therefore, it is preferable to stop the sub-control microcomputer 30. Because.

  In step S1130, the main control microcomputer 20 itself is reset and initialized. Specifically, the program execution address of the microcomputer core is jumped to the start address.

Even in such a case, as described above, the wraparound of the power supply voltage from the signal line L4 is prevented by the resistor 29 provided in the signal line L4.
As described above, according to the electronic control device of the third embodiment, when an abnormality occurs in the main control microcomputer 20, the main control microcomputer 20 is reset and the supply of the power supply voltage V3 is stopped. Therefore, it does not affect other electronic devices. In addition, a highly reliable ECU 1 can be provided. In addition, the resistance 29 provided on the signal line L4 prevents the power supply voltage from wrapping around, and the input protection diodes in the main control microcomputer 20 and the input protection diodes Du1, Du2 in the sub control microcomputer 30 are provided. Although one embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and can take various forms within the technical scope of the present invention. be able to.

For example, in the above embodiment, the present invention can be applied to the case where the main control microcomputer 20 is a sub control microcomputer and the sub control microcomputer 30 is a main control microcomputer.
In FIG. 16 of the third embodiment, when an abnormality occurs in the main control microcomputer (S1110: YES), the signal V6 (low level) is output in S1120. In S1120, A low active signal V5 may be output. That is, the sub control microcomputer 30 may be initialized. Furthermore, when an abnormality occurs in the main control microcomputer 20 (S1110: YES), the signal V6 may not be output, or the signal V5 may not be output. In this case, the operation of the sub control microcomputer 30 can be continued.

  15 and 16 may also be executed in the first and second embodiments. In this case, in order to execute the processing of FIG. 16 in the first and second embodiments, in the first and second embodiments, the RESET unit 26, the low voltage detection circuit 27, and the third embodiment. A WDP output unit 28 may be provided.

  Moreover, in the said embodiment, even when not only the relay 5 but electrical loads, such as a motor, are provided, this invention is applicable.

It is a block diagram showing the structure of ECU of embodiment. It is a flowchart showing the flow of the standby mode process performed in a sub control microcomputer. It is a flowchart showing the flow of the communication end confirmation process performed in a sub control microcomputer. It is a flowchart showing the flow of the relay OFF confirmation process performed in a sub control microcomputer. It is a flowchart showing the flow of the confirmation process performed in a sub control microcomputer. It is a flowchart showing the flow of the data saving process performed in a sub control microcomputer. It is a flowchart showing the flow of the standby mode transition process performed in the main control microcomputer. It is a flowchart showing the flow of the monitoring process performed in the main control microcomputer. It is a flowchart showing the flow of the standby mode transition process performed in the main control microcomputer. It is a time chart showing the operation of an embodiment. It is a block diagram showing the structure of ECU of 2nd Embodiment. It is a flowchart showing the flow of the standby mode process performed in the main control microcomputer and sub control microcomputer of 2nd Embodiment. It is a flowchart showing the flow of the power supply circuit process performed in the power supply circuit of 2nd Embodiment. It is a block diagram showing the structure of ECU of 3rd Embodiment. It is a flowchart showing the flow of the abnormality monitoring process performed in the main control microcomputer of 3rd Embodiment. It is a flowchart showing the flow of the abnormality detection process performed in the main control microcomputer of 3rd Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1, 2 ... ECU, 3 ... Vehicle-mounted battery, 4 ... Ignition switch, 5 ... Relay, 6a, 6b ... Communication line, 10 ... Power supply circuit, 12 ... Regulator, 13 ... Switch, 14 ... Signal monitoring circuit, 20 ... Main control Microcomputer, 22 ... power supply monitoring circuit, 23 ... operation monitoring circuit, 24 ... communication circuit, 25 ... input / output circuit, 26 ... RESET unit, 27 ... low voltage detection circuit, 28 ... WDP output unit, 29 ... resistor, 30 ... sub Control microcomputer 31 ... Power supply monitoring circuit 32 ... Relay control unit 33 ... WDC output unit 34 ... RESET unit 35 ... Communication circuit 38, 39 ... Input buffer 40 ... Driver circuit L4 ... Signal line

Claims (18)

A main control microcomputer and a sub control microcomputer connected to each other via a signal line;
Power supply means for supplying a first power supply voltage for operating the main control microcomputer to the main control microcomputer and supplying a second power supply voltage for operating the sub control microcomputer to the subcontrol microcomputer; An electronic control device comprising:
The power supply means is configured to stop the supply of the second power supply voltage upon receiving a cutoff signal instructing the stop of the supply of the second power supply voltage,
When the main control microcomputer determines that a predetermined interruption condition is satisfied, an output signal suppression process is performed so that a high level signal is not output from the main control microcomputer to the sub control microcomputer via the signal line. An electronic control device characterized in that, when the output signal suppression process is executed, the cutoff signal is output to the power supply means. The electronic control device according to claim 1.
The output signal suppression process executed by the main control microcomputer is a process of setting the level of a signal output from the main control microcomputer to the sub control microcomputer via the signal line to a low level. apparatus. The electronic control device according to claim 1 or 2,
The main control microcomputer includes an input / output switchable port that can be used by switching to either an output port or an input port as a port connected to the signal line, and the output signal suppression In the processing, the electronic control device is characterized in that the setting of the input / output switchable port is switched to the input port. The electronic control device according to any one of claims 1 to 3,
The sub-control microcomputer is configured to output a cutoff permission signal that permits the main control microcomputer to output the cutoff signal to the main control microcomputer,
The electronic control device according to claim 1, wherein the main control microcomputer determines that the blocking condition is satisfied when the blocking permission signal is input from the sub-control microcomputer. The electronic control device according to claim 4.
The sub-control microcomputer is configured to communicate with an external device, and when the communication from the external device ends and a predetermined time has elapsed, the cutoff control signal is output. An electronic control device. The electronic control device according to claim 5.
There are a plurality of external devices, and the sub-control microcomputer outputs the blocking permission signal when the predetermined time elapses after communication from all the external devices is completed. Control device. The electronic control device according to claim 5 or 6,
The external device transmits a communication cut-off signal requesting cut-off of communication to the sub-control microcomputer, and when the cut-off of communication is permitted by the sub-control microcomputer, the communication is terminated.
The electronic control device according to claim 1, wherein the sub control microcomputer outputs the cutoff permission signal when a predetermined allowable time has elapsed after receiving the communication cutoff signal. The electronic control device according to any one of claims 4 to 7,
The sub-control microcomputer controls an electric load provided outside the electronic control unit, and outputs the cutoff permission signal after turning off the electric load of the electric load. An electronic control device. The electronic control device according to any one of claims 4 to 8,
The sub-control microcomputer includes a volatile memory for storing data, and after the data stored in the volatile memory is saved in a storage means other than the volatile memory, the cutoff permission signal is output. An electronic control device characterized in that it is adapted to output. The electronic control device according to claim 9.
The electronic control apparatus according to claim 1, wherein the storage means is a nonvolatile memory. The electronic control device according to any one of claims 4 to 10,
The sub-control microcomputer outputs the cutoff signal to the power supply means when outputting the cutoff permission signal,
The power supply means stops the supply of the second power supply voltage when both a cutoff signal from the main control microcomputer and a cutoff signal from the sub control microcomputer are input. An electronic control device. The electronic control device according to claim 11,
When the power supply means determines that a predetermined time has elapsed since the cutoff signal was input from at least one of the main control microcomputer and the sub control microcomputer, the second power supply voltage An electronic control device characterized in that the supply is stopped. A main control microcomputer and a sub control microcomputer connected to each other via a signal line;
Power supply means for supplying a first power supply voltage for operating the main control microcomputer to the main control microcomputer and supplying a second power supply voltage for operating the sub control microcomputer to the subcontrol microcomputer; An electronic control device comprising:
The power supply means is configured to stop the supply of the second power supply voltage upon receiving a cutoff signal instructing the stop of the supply of the second power supply voltage,
The main control microcomputer detects whether or not an abnormality that should initialize the main control microcomputer has occurred in the main control microcomputer. When detecting that the abnormality to be initialized has occurred, the main control microcomputer sends the cutoff signal to the power supply means Output to
The electronic control device according to claim 1, wherein the signal line is provided with a current cutoff circuit that prevents current from flowing from the main control microcomputer to the sub control microcomputer. The electronic control device according to any one of claims 1 to 13,
The main control microcomputer includes a monitoring unit that monitors whether the sub control microcomputer is normal based on a signal input from the sub control microcomputer, and outputs the cutoff signal to the power supply unit. An electronic control device characterized in that the function of the monitoring means is stopped. The electronic control device according to claim 14.
The main control microcomputer sends a low-active initialization signal for initializing the sub control microcomputer to the sub control microcomputer via the signal line when an abnormality of the sub control microcomputer is detected by the monitoring means. Output,
Furthermore, the main control microcomputer is configured to set the output level of the initialization signal to a low level when the cutoff signal is output to the power supply means. The electronic control device according to claim 14 or 15,
The monitoring means is composed of a circuit that operates when a power supply voltage for operating the monitoring means is supplied to the monitoring means, and
The electronic control device according to claim 1, wherein the main control microcomputer stops supply of power supply voltage to the monitoring means when the function of the monitoring means is stopped. The electronic control device according to any one of claims 14 to 16,
The monitoring means monitors at least one of whether a specific signal is output from the sub-control microcomputer at regular intervals and whether a signal output from the sub-control microcomputer is normal. An electronic control device characterized in that The electronic control device according to any one of claims 14 to 17,
The electronic control apparatus characterized in that the monitoring means further monitors whether or not the second power supply voltage supplied to the sub-control microcomputer is normal.

Images