ELECTRONIC CONTROL UNIT

Abstract

Electronic control unit comprising: a control computer (11, 12) which is a microcomputer for controlling an operation of a predetermined actuator (32) mounted in a vehicle based on data supplied from sensors (4, 5) mounted in the vehicle; a first power supply circuit (15) provided as a power supply circuit for generating a voltage for driving the control computer (11, 12) from a voltage supplied from a power supply source (2) mounted in the vehicle, and supplying the control computer (11, 12) with voltage; an abnormality detection part (20) for detecting an abnormal operation of the first power supply circuit (15) based on the voltage output from the first power supply circuit (15); a second power supply circuit (16) provided as the power supply circuit separately from the first power supply circuit (15), wherein the second power supply circuit (16) is activated in response to a detection result of the abnormality detection part (20) and supplies power to the control computer (11, 12), and an internal power supply line (Ln) connecting an output terminal of the first power supply circuit (15), an output terminal of the second power supply circuit (16) and a power supply terminal of the control computer (11, 12), where the first power supply circuit (15) starts supplying power to the control computer (11, 12) in response to application of an activation signal applied from a predetermined signal source as a trigger for starting control; the abnormality detection part (20) outputs a signal for stopping an operation of the second power supply circuit (16) when the abnormality detection part (20) does not detect an abnormal operation of the first power supply circuit (15); and the abnormality detection part (20) outputs a signal for activating the second power supply circuit (16) when the abnormality detection part (20) detects the abnormal operation of the first power supply circuit (15).

Description

[0001] The invention relates to an electronic control unit mounted in a vehicle and configured to execute predetermined fail-safe processing in the event of a failure of a power supply circuit provided therein.

[0002] In an electronic control unit mounted in a vehicle to control a predetermined actuator, a microcomputer (hereinafter referred to as a control computer) that performs various arithmetic and logical operations based on data supplied from in-vehicle sensors and a power supply circuit are provided. The power supply circuit is configured to generate electric power required for operations of the control computer and the like based on electric power supplied from an in-vehicle power source such as an in-vehicle battery.

[0003] The electronic control unit of the type described above is generally configured to have an abnormality detection function that monitors whether the electronic control unit is operating normally. If the abnormality detection function detects a predetermined abnormality, the control computer and the like performs fail-safe processing corresponding to each abnormal condition.

[0004] For example, as the fail-safe processing, in the case where an abnormality of the power supply circuit is detected by an abnormality monitoring function, the control computer and the like stop an operation of an actuator to be controlled or limit an output of the actuator to be lower than a predetermined output level.

[0005] JP 2016-128308A proposes to provide a dual system configuration of a power supply circuit, a computer, a drive circuit and the like, thereby preventing the electronic control unit from stopping or terminating all of its functions upon the occurrence of an abnormality in the power supply circuit.

[0006] The power supply circuit receives electric power supplied from the vehicle's on-board power source, and a number of component parts (hereinafter referred to as high-power component parts) must withstand high power. High-power component parts are generally more prone to failure than low-power component parts, which consume comparatively low electric power. Therefore, in the case where the power supply circuit is provided in dual configurations as proposed in JP 2016-128308A, failures will increase with an increase in the number of power supply circuit parts (especially high-power component parts).

[0007] As the power supply circuit fails more frequently, the frequency of fail-safe processing executions increases accordingly. Frequent fail-safe processing executions, such as limiting or restricting a vehicle function (e.g., the output torque of a vehicle's drive power), frighten and disturb the vehicle user.

[0008] Furthermore, from JP 2005-208 939 A, a system for monitoring the power supply voltage of a microcomputer is known, which can determine whether the power supply voltage to be supplied to a microcomputer 10 is suitable or not. The system is provided with a power supply monitoring device 12 for monitoring whether the power supply voltage supplied to the microcomputer 10 is within a suitable power supply voltage range 11 or not, and if the power supply voltage is not within the suitable power supply voltage range 11, the power supply monitoring device 12 stops the control of an external load 60 performed by the microcomputer 10.The invention is directed to the problem described above and has for its object to provide an electronic control unit which reduces a number of fail-safe processings executed in response to failures of a power supply circuit.

[0009] This object is achieved by an electronic control unit having the features of claim 1. Advantageous developments of the invention are the subject of the appended subclaims.

[0010] Thus, according to the invention, an electronic control unit includes a control computer, a first power supply circuit, an abnormality detection part, a second power supply circuit, and an internal power supply line. The control computer is a microcomputer for controlling an operation of a predetermined actuator mounted in a vehicle based on data supplied from sensors mounted in the vehicle. The first power supply circuit is provided as a power supply circuit for generating a voltage for driving the control computer from a voltage supplied from a power source mounted in the vehicle and supplying the voltage to the control computer.The abnormality detection part detects an abnormal operation of the first power supply circuit based on the voltage output from the first power supply circuit. The second power supply circuit is provided as a separate power supply circuit from the first power supply circuit. The second power supply circuit is activated in response to a detection result of the abnormality detection part and supplies power to the control computer. The internal power supply line connects an output terminal of the first power supply circuit, an output terminal of the second power supply circuit, and a power supply terminal of the control computer.

[0011] The first power supply circuit begins supplying power to the control computer in response to an activation signal applied from a predetermined signal source as a trigger for starting control. The abnormality detection part outputs a signal to stop an operation of the second power supply circuit when the abnormality detection part does not detect an abnormal operation of the first power supply circuit. The abnormality detection part outputs a signal to activate the second power supply circuit when the abnormality detection part detects the abnormal operation of the first power supply circuit. Fig. 1 is a block diagram showing a configuration of a vehicle system including an electronic control unit according to an embodiment of the invention; Fig. 2 is a block diagram showing a general configuration of the Fig. 1 shows the electronic control unit; Fig. 3 is a circuit diagram showing an example of a configuration of a first power supply circuit in the embodiment; Fig. 4 is a circuit diagram showing an example of a configuration of a second power supply circuit in the embodiment; Fig. 5 is a timing chart showing an operation of each part at the activation time of the electronic control unit in the embodiment; Fig. 6 is a timing chart showing an operation of each part at a down time of the first power supply circuit in the embodiment; Fig. 7 is a timing chart showing an operation sequence at the turn-off time of the ignition switch in the event of a failure of the first power supply circuit; Fig. 8 is a timing chart showing an operation at the turn-on time of the ignition switch in the case of a normal operation of the first power supply circuit; Fig. 9 is a block diagram showing a modification example of the electronic control unit; Fig. 10 is a block diagram showing another modification example of the electronic control unit; and Fig. 11 is a block diagram showing another modification example of the electronic control unit.

[0012] An electronic control unit (hereinafter referred to as an ECU) 1 according to the invention will be described below with reference to the accompanying drawings. The ECU 1 according to a present embodiment is configured to control an output of a vehicle drive power source (for example, an internal combustion engine) based on data obtained from in-vehicle sensors mounted in a vehicle.

[0013] The ECU 1 may alternatively be configured to control a steering actuator or a braking system of the vehicle. The ECU 1 may further alternatively be configured to control an operation of a motor provided as a driving power source of the vehicle. That is, the ECU 1 may be configured to control any object and may have any functions. Furthermore, the ECU 1 may be provided in a hybrid vehicle with both an internal combustion engine and a motor as a driving power source, or in an electric vehicle with only a motor as a driving power source.

[0014] The ECU 1 according to the present embodiment is mounted in a vehicle having an internal combustion engine as a driving power source and is electrically connected to an in-vehicle battery 2. Further, as shown in Fig. 1, the ECU 1 is connected to an electronic throttle 3, an acceleration sensor 4, a throttle position sensor 5 and a warning lamp 6 via a communication network, that is, a local area network (LAN 7) provided in the vehicle.

[0015] The in-vehicle battery 2 is a secondary battery that supplies the ECU 1 with a predetermined battery voltage Vb. The in-vehicle battery 2 is a power supply source. The vehicle is provided with two power supply lines. One of the power supply lines is called a B line, to which an output voltage (hereinafter referred to as a battery voltage Vb) of the in-vehicle battery 2 is always supplied. The other of the power supply lines is called an ignition (IG) power supply line, to which the battery voltage Vg is supplied only when an ignition switch (hereinafter referred to as IGSW) 8 is turned on by a user. The ECU 1 is connected to both the B line and the IG power supply line.

[0016] The electronic throttle 3 is an integrated device including a throttle valve 31 for controlling the amount of intake air supplied to the engine and a throttle motor 32 provided as an actuator for rotating the throttle valve 31. An output torque of the throttle motor 32 is controlled by the ECU 1. The electronic throttle 3 may be electrically connected to the ECU 1 to receive a control signal from the ECU 1 without the LAN 7.

[0017] Acceleration sensor 4 is provided to detect a position of an accelerator pedal operated by a driver as an accelerator manipulation quantity. Throttle sensor 5 is provided to detect a position (i.e., a rotation angle) of throttle valve 31 as a throttle angle. Detection results of accelerator sensor 4 and throttle sensor 5 are periodically input to ECU 1.

[0018] The warning light 6 is provided to notify a passenger of a predetermined fault or failure of a power supply circuit of the ECU 1. The warning light 6 operates, that is, turns on continuously or intermittently, in response to a command signal from the ECU 1.

[0019] The ECU 1 controls the output torque of the throttle motor 32 based on data supplied from the accelerator sensor 4 and the throttle sensor 5. Thus, the ECU 1 indirectly controls the output torque of the internal combustion engine.

[0020] As in Fig. 2, the ECU 1 includes a main computer 11, a sub-computer 12, a first communication driver 13, a second communication driver 14, a first power supply circuit 15, a second power supply circuit 16, a drive hold part 17, a first power supply activation part 18, a second power supply activation part 19, an abnormality detection part 20, a stabilization filter (SF) 21, and a delay filter (DF) 22.

[0021] Each of the main computer 11 and the sub-computer 12 is a microcomputer including a CPU as a central processing unit, a read-only memory (ROM) as a non-volatile storage medium, a random access memory (RAM) as a volatile memory, registers, and the like. The main computer 11 is configured to operate within a predetermined voltage range. That is, an operating voltage of the main computer 11 is defined by a lower limit and an upper limit.

[0022] As an example, assume that the main computer 11 is operable in a voltage range between 4.0 V and 5.5 V. Similarly, assume that the slave computer 12 is also operable in the same voltage range between 4.0 V and 5.5 V. For simplicity, the voltage range in which the main computer 11 and the slave computer 12 are operable is referred to as a computer operating voltage range.

[0023] The main computer 11 and the slave computer 12 are connected to each other for bilateral communication. The main computer 11 is further connected to the first communication driver 13 for bilateral communication. The slave computer 12 is further connected to the second communication driver 14 for bilateral communication. The main computer 11 is provided with a reset input terminal as an input terminal of a reset signal.

[0024] The slave computer 12 is provided with an input terminal to which an output signal from the abnormality detection part 20 is applied. Furthermore, the slave computer 12 is provided with a first power supply holding terminal, a second power supply holding terminal, and an erase signal output terminal as signal output terminals. The slave computer 12 includes a non-volatile memory 121, which is a rewritable non-volatile storage medium. Operations of the main computer 11 and the slave computer 12 will be described later.

[0025] The main computer 11 and the sub-computer 12 are provided as control computers and operate as a first computer and a second computer, respectively.

[0026] In the following description, each part in the ECU 1 is assumed to operate with positive logic (high-active logic) as an example. Each part may alternatively be configured to operate with negative logic (low-active logic). The drive hold part 17, the first power supply activation part 18, the second power supply activation part 19, the abnormality detection part 20, and the like are configured to output bi-level signals of a low level and a high level.

[0027] The first communication driver 13 is provided to enable the main computer 11 to communicate with other devices (e.g., electronic control units (ECUs), sensors, and actuators) connected to the LAN 7. The second communication driver 14 is provided to enable the slave computer 12 to communicate with other devices (e.g., ECUs, sensors, and actuators) connected to the LAN 7. Although the first communication driver 13 for the main computer 11 and the second communication driver 14 for the slave computer 12 are provided separately in the present embodiment, this configuration may be changed. For example, one communication driver may be shared by both the main computer 11 and the slave computer 12.

[0028] The first power supply circuit 15 is a circuit module that converts the battery voltage Vb=12V supplied by the in-vehicle battery 2 to a predetermined voltage suitable for driving the main computer 11 and the like, and outputs it. As an example, assume that a target supply value of the output voltage (hereinafter referred to as a target supply voltage) of the first power supply circuit 15 is set to 5V. That is, the first power supply circuit 15 converts the battery voltage Vb=12V to the target supply voltage 5V and outputs 5V.

[0029] The first power supply circuit 15 is configured to output a current of 550 mA based on the power supplied by the in-vehicle battery 2. That is, the first power supply circuit 15 functions as an internal power source that supplies the main computer 11 and the like with 5 V and 550 mA. V1 in Fig. 2 indicates an output voltage (hereinafter referred to as a first output voltage) of the first power supply circuit 15. The first power supply circuit 15 is configured to regulate the first output voltage V1 to be in a range between 4.95 V and 5.05 V.

[0030] An exemplary detailed circuit configuration of the first power supply circuit 15 is shown in Fig. 3. As shown in Fig. As shown in Figure 3, the first power supply circuit 15 includes a first power supply IC 151, a converter output circuit 152, and a control output circuit 153. The first power supply IC 151 is an integrated circuit including a power converter circuit 151a and a voltage control circuit 151b.

[0031] The converter output circuit 152 is supplied with the battery voltage Vb=12 V. The converter output circuit 152, in cooperation with the first power supply circuit 151a, converts the battery voltage Vb to a predetermined intermediate voltage V1a. The intermediate voltage V1a is set to be lower than the battery voltage Vb and higher than the target supply voltage of 5 V. The intermediate voltage Va1 is set to 6 V, which is half of the battery voltage Vb, as an example.

[0032] The control output circuit 153 is supplied with the intermediate voltage V1a, which is the output voltage of the converter output circuit 152. The first output voltage V1 is the output voltage of the control output circuit 153. The control output circuit 153, in cooperation with the first power supply circuit 151b, converts the intermediate voltage V1a to the target supply voltage, which is the output voltage V1.

[0033] The power converter circuit 151a is well known, so no further details will be described. The first power supply circuit 15 may be different from the one shown in Fig. 3. The first power supply circuit 15 may have a conventional circuit configuration.

[0034] The first power supply circuit 15 is provided with a signal input terminal (hereinafter referred to as a first activation input terminal) connected to the output terminal of the first power supply activation part 18. The first power supply circuit 15 operates to output 5 V as the output voltage V1 if a high-level signal is applied from the first power supply activation part 18. If the signal applied from the first power supply activation part 18 is not high-level, that is, if a low-level signal is applied from the first power supply activation part 18, the first power supply circuit 15 stops operating. When the first power supply circuit 15 stops operating, the first output voltage is 0 V.The high-level signal output from the first power supply activation part 18 is a drive signal for the first power supply circuit 15.

[0035] An output terminal of the first power supply circuit 15 is connected to an internal power supply line Ln, which is a power line. For this reason, as long as the first power supply circuit 15 is operating normally, 5 V is supplied to the internal power supply line Ln. The internal power supply line Ln is connected to power supply terminals of both the main computer 11 and the subcomputer 11. The internal power supply line Ln is further connected to the abnormality detection part 20. The internal power supply line Ln is also connected to an output terminal of the second power supply circuit 16.

[0036] The second power supply circuit 16 is a circuit module that converts the battery voltage Vb supplied by the in-vehicle battery 2 to a target supply voltage and outputs it. That is, the second power supply circuit 16 converts the battery voltage Vb=12 V to the target supply voltage of 5 V and outputs it.

[0037] The second power supply circuit 16 is configured to be able to output a current of up to 50 mA based on the power or voltage supplied by the in-vehicle battery 2. That is, the second power supply circuit 16 functions as an internal power supply source that supplies power of 5 V and 50 mA. V2 in Fig. 2 indicates the output voltage (hereinafter referred to as a second output voltage) of the second power supply circuit 16.

[0038] An example of a circuit configuration of the second power supply circuit 16 is shown in Fig. 4. As shown in Fig. 4, the second power supply circuit 16 includes a second power supply IC 161, which includes a voltage control circuit 161a and a control output circuit 162.

[0039] The battery voltage Vb is supplied to the second power supply circuit 162. The second output voltage V2 is the output voltage of the control output circuit 162. The second power supply circuit 162 converts the battery voltage Vb in cooperation with the second power supply circuit 161a so that the second output voltage V2 reaches the target supply voltage. The second power supply circuit 162 can be Fig. 4. The second power supply circuit 16 may be configured using a conventional circuit configuration.

[0040] The second power supply circuit 16 is provided with a terminal (hereinafter referred to as a second activation input terminal) as an input terminal, which is connected to the output terminal of the second power supply activation part 19. The second power supply circuit 16 operates when the high-level signal from the second power supply activation part 19 is applied, and outputs 5 V as the second output voltage V2. If the high-level signal from the second power supply activation part 19 is not applied, that is, the low-level signal from the second power supply activation part 19 is output, the second power supply circuit 16 stops its operation. If the second power supply circuit 16 is not operating, the second output voltage V2 is 0 V.The high-level signal output from the second power supply activation part 19 is a drive signal for the second power supply circuit 16.

[0041] The output terminal of the second power supply circuit 16 is connected to the internal power supply line Ln. As long as the second power supply circuit 16 is operating normally, 5 V is applied to the internal power supply line Ln. However, as described later, the second power supply circuit 16 is configured not to operate as long as the first power supply circuit 15 is operating normally.

[0042] The control holding part 17 is provided with two input terminals and one output terminal. One of the two input terminals is connected to the ignition power supply line. The other of the input terminals is connected to a first power supply holding terminal.

[0043] The drive hold section 17 may be a conventional OR circuit and outputs a logical sum of two input signals. The conventional OR circuit may be a hard-wired OR. When the ignition switch or IGSW 8 is in the ON state, a voltage signal of a predetermined threshold or higher (i.e., a high-level signal) is applied to the ignition power supply line.

[0044] If the ignition switch 8 is in the ON state or the high-level signal is supplied from the subcomputer 12, the drive hold part 17 outputs a high-level signal. If the ignition switch 8 is not in the ON state or the high-level signal is not supplied from the subcomputer 12, the drive hold part 17 outputs the low-level signal. The output signal of the drive hold part 18 is applied to the first power supply activation part 18 and the delay filter 22 via the stabilization filter 21. The high-level signal applied to the drive hold part 17 in response to turning on the ignition switch 8 is an activation signal. The ignition switch 8 thus functions as a signal source.

[0045] The first power supply activation part 18 is provided with two input terminals and one output terminal. One of the two input terminals is connected to the drive hold part 17. That is, the output signal of the drive hold part 17 is applied to the first power supply activation part 18. A signal that is an inverted signal of an output signal of the second power supply activation part 19 is applied to the other of the two input terminals. That is, a low level and a high level are applied when the output signal of the second power supply activation part 19 is at the high level and the low level, respectively.

[0046] The first power supply activation part 18 may be a conventional AND circuit and outputs a logical product of two input signals. The first power supply activation part 18 outputs the high-level signal when the output signal of the drive-hold part 17 is the high-level signal and the output signal of the second power supply activation part 19 is the low-level signal. In other cases, that is, when the output signal of the drive-hold part 17 is the low-level signal or the output signal of the second power supply activation part 19 is the high-level signal, the first power supply activation part 18 outputs the low-level signal.

[0047] The second power supply part 19 is provided with two input terminals and one output terminal. One of the two input terminals is connected to the output terminal of the abnormality detection part 20. The other of the two input terminals is connected to the second power supply holding terminal of the slave computer 12.

[0048] The second power supply activation part 19 can be a conventional OR circuit and outputs a logical sum of two input signals. The second power supply activation part 19 outputs the high-level signal when the abnormality detection part 20 outputs the high-level signal or the slave computer 12 outputs the high-level signal. The second power supply activation part 19 outputs the low-level signal when the abnormality detection part 20 does not output the high-level signal and the slave computer 12 does not apply the high-level signal.

[0049] The output signal of the second power supply activation part 19 is applied to the second power supply circuit 16. The output terminal of the second power supply activation part 19 is also connected to the reset input terminal of the main computer 11. For this reason, as long as the second power supply activation part 19 outputs the high-level signal, the main computer 11 remains in the reset state and stops operating. The output signal of the second power supply activation part 19 is inverted and applied to the first power supply activation part 18.

[0050] The abnormality detection part 20 is connected to the internal power supply line Ln and, during its operation period, periodically acquires a value of the voltage supplied to the internal power supply line Ln. When the voltage supplied to the internal power supply line Ln changes to be outside a predetermined normal range, the abnormality detection part 20 detects this change as an abnormal operation of the first power supply circuit 15. That is, the abnormality detection part 20 determines that the first power supply circuit 15 is not operating normally (i.e., is abnormal) when the voltage supplied to the internal power supply line Ln deviates from the predetermined normal range.

[0051] As described later, from the time the ignition switch 8 is turned on until the time the first power supply circuit is detected as abnormal, the second power supply circuit 16 is not operated, and only the output voltage of the first power supply circuit 15 is applied to the internal power supply line Ln. Therefore, by monitoring the voltage supplied to the internal power supply line Ln, the output voltage of the first power supply circuit 15 is monitored.

[0052] That is, the abnormality detection part 20 is configured to monitor the abnormal operation of the first power supply circuit 15 based on the output voltage of the first power supply circuit 15. By detecting the abnormal operation of the first power supply circuit 15, it is checked whether the first power supply circuit 15 is operating normally. It is assumed that the lower limit of the normal range is set higher than a lower limit of the operating range of the computer. It is assumed that the higher limit of the normal range is set lower than the upper limit of the computer operating range. For example, the upper limit and lower limit of the normal range of the voltage may be set to 5.2 V and 4.5 V, respectively.

[0053] The abnormality detection part 20 outputs the low-level signal when the output voltage of the first power supply circuit 15 is within the normal range including limit values. The abnormality detection part 20 outputs the high-level signal when the output voltage of the first power supply circuit 15 is outside the normal range. The high-level signal output by the abnormality detection part 20 indicates that the first power supply circuit 15 is abnormal. Therefore, the high-level signal of the abnormality detection part 20 is an abnormality detection signal. The abnormality detection part 20 may be configured with comparators, an AND circuit, and the like. As another example, the abnormality detection part 20 may be implemented by executing software by a CPU.

[0054] The abnormality detection part 20 is provided, in addition to the above-described input terminal, with an input terminal (hereinafter referred to as a clear signal input terminal) to which a clear signal output from the slave computer 12 is applied. Once the abnormality detection part 20 detects the abnormal operation of the first power supply circuit 15, the abnormality detection part 20 continues to output the high-level signal until the clear signal is applied from the slave computer 12. That is, the abnormality detection part 20 maintains (i.e., latches) the output level at the high level until the clear signal is applied after the high-level signal is output once. The output signal of the abnormality detection part 20 is applied to the second power supply activation part 19 and the slave computer 12.

[0055] By continuing to output the high-level signal from the abnormality detecting part 20, the determination result that the first power supply circuit 15 is not operating normally is displayed.

[0056] As in Fig. As shown in Fig. 2, the abnormality detection part 20 is connected to the output terminals of the drive hold part 17 via the delay filter 22 and the stabilizing filter 21. That is, the output signal of the drive hold part 17 is applied to the abnormality detection part 20 via the stabilizing filter 21 and the delay filter 21. The abnormality detection part 20 is activated in response to the high-level signal applied from the delay filter 22 and starts monitoring the output voltage of the first power supply circuit 15.

[0057] The stabilizing filter 21 is provided to stabilize an input level of the delay filter 22. The voltage supplied to the ignition power supply line tends to fluctuate with operating conditions of an alternator and other electronic devices (e.g., other ECUs) connected to the ignition power supply line. If the output level of the drive holding part 17 fluctuates with such voltage fluctuations, the abnormality detection part 20 is likely to malfunction. Thus, by providing the stabilizing filter 21 between the drive holding part 17 and the abnormality detection part 20, it is possible to stabilize the output of the drive holding part 17 and reduce potentially erroneous operation of the drive holding part 17.

[0058] The delay filter 22 is provided to adjust the activation time of the abnormality detection part 20 so that the abnormality detection part 20 is activated after the first power supply circuit 15 is activated (that is, after starting to output 5V as the target supply voltage). By adjusting the activation time of the abnormality detection part 20, the timing of transmission of the high-level signal applied from the drive-holding part 17 via the stabilizing filter 21 to the abnormality detection part 20 is adjusted. The delay filter 22 can be configured using a capacitor and a resistor.

[0059] The delay filter 22 is provided for the following reason. After the ignition switch 8 is turned on, the first output voltage V1 rises to 5 V with a time delay of a predetermined time Ta. If the delay filter 22 is not provided, the abnormality detection part 20 is activated before the first power supply circuit 15 is activated. As a result, the low voltage state of the first power supply circuit 15 before the completion of the activation of the first power supply circuit 15 is likely to be erroneously detected as the abnormal operation of the first power supply circuit 15. However, with the delay filter 22, the abnormality detection part 20 is activated after the first power supply circuit 15 is activated. It is therefore possible to reduce the above-described erroneous operation.

[0060] That is, the abnormality detection part 20 is configured to be activated after a predetermined period of time has elapsed from the start time at which the high-level signal from the ignition power supply line is applied to the ECU 1. The delay filter 22 has a function of separating a low-voltage state that exists before the activation of the circuit is completed and the other low-voltage state that exists at a failure time of the first power supply circuit 15.

[0061] The main computer 11 is configured to determine a control target value for a predetermined control target (electronic throttle valve 3) based on the data supplied from the first communication driver 13. For example, the main computer 11 calculates a control value for the throttle motor 32 based on the accelerator operation amount detected by the accelerator sensor 4 and outputs a calculated control value to the electronic throttle valve 3 via the first communication driver 13 and the LAN 7.

[0062] The main computer 11 is configured to further monitor whether the slave computer 12 is operating normally through bilateral communication with the slave computer 12. It is possible to check whether the slave computer 12 is operating normally using a conventional method such as a runtime monitor method or an assignment and response method. According to the runtime monitor method, the slave computer 12 is determined to be operating abnormally when a runtime monitor times out without being cleared by a runtime pulse applied from the slave computer 12.

[0063] According to the assignment-response method, the main computer 11 sends a predetermined monitor signal to the slave computer 12 and checks whether the slave computer 12 is normal based on whether the response provided by the slave computer 12 is correct. In the assignment-response method, the slave computer 12 generates response data corresponding to the monitor signal applied from the main computer 11 and replies it to the main computer 11. The main computer 11 determines that the slave computer 12 is operating abnormally (i.e., not operating normally) when the response received from the slave computer 12 is different from the data corresponding to the monitor signal, or when the response signal is not received by the main computer 11 within a predetermined time limit.The main computer 11 executes predetermined recovery processing such as resetting the slave computer 12 upon detecting an abnormal operation of the slave computer 12.

[0064] The power supply terminal of the main computer 11 is connected to the internal power supply line Ln and operates with the power supplied from the first power supply circuit 15 or the second power supply circuit 16. The reset terminal of the main computer 11 is connected to an output terminal of the second power supply activation part 19. The reset terminal of the main computer 11 is an input terminal that prevents the main computer 11 from operating and restores the main computer 11 to an initial state when the high-level signal is applied as the reset signal.

[0065] For this reason, the main computer 11 stops operating when the output signal of the second power supply activation part 19 is high. The output signal of the second power supply activation part is high when the second power supply circuit 16 is operating in response to, for example, the abnormal operation and the like of the first power supply circuit 15. Therefore, the main computer 11 stops operating when the second power supply circuit 16 is operating.

[0066] The slave computer 12 monitors (performs status monitoring) whether the main computer 11 is operating normally through bilateral communication with the main computer 11. It is possible to monitor whether the main computer 11 is operating normally using the conventional method described above. Upon detecting an abnormal operation of the main computer 11, the slave computer 12 executes predetermined processing such as resetting the main computer 11.

[0067] For example, the subcomputer 12 stops driving the throttle motor 32 as the fail-safe processing and changes the engine operation to the limp-home travel mode. The limp-home mode limits the engine output torque to less than a suppression level. In accordance with the limp-home travel mode, the vehicle can be moved to a safe location. In the configuration where the subcomputer 12 is connected to the throttle motor 32 via a driver circuit, the limp-home travel mode can be executed by turning off an output of the driver circuit.

[0068] Furthermore, as part of the fail-safe processing, the slave computer 12 informs other ECUs connected to the LAN 7 of the error or failure of the ECU 1. The slave computer 12 may also illuminate the warning lamp 6 as another part of the fail-safe processing. By illuminating the warning lamp 6, it is possible to notify the user of the error or failure of the ECU 1. Furthermore, information about the state (e.g., date, time, and the like) of the occurrence of the abnormality in the first power supply circuit 15 may be stored in the rewritable non-volatile memory 121.

[0069] The subcomputer 12 executes predetermined shutdown processing when the ignition switch 8 is turned off. For example, as part of the shutdown processing, the subcomputer 12 writes data needed at the next activation time into the nonvolatile memory 121 and clears the RAM.

[0070] The slave computer 12 further executes processing of checking (hereinafter referred to as check processing) whether the second power supply circuit 16 is operating normally and writes the check result into the nonvolatile memory 121 as shutdown processing when the ignition switch 8 is turned off while the first power supply circuit 15 is operating normally. The check processing for the second power supply circuit 16 will be described later. If the result of the check processing indicates the normal operation of the second power supply circuit 16, the slave computer 12 writes that the second power supply circuit 16 is normal into the nonvolatile memory 121. For convenience, the data indicating that the second power supply circuit 16 is normal is referred to as operation confirmation data.

[0071] Furthermore, after activation, the slave computer 12 outputs the high-level signal from the first power supply holding terminal until the abnormality detection part 20 detects the abnormality of the first power supply circuit 15. If the abnormal operation of the first power supply circuit 15 is detected by the abnormality detection part 20, the output level of the first power supply holding terminal is changed to the low level.

[0072] As long as the high-level signal is output from the first power supply holding terminal, the output of the drive holding part 17 is also maintained at the high level. As a result, even if the ignition switch 8 is mistakenly turned off while the vehicle is traveling, the main computer 11 and the sub-computer 12 are enabled to continue their respective vehicle controls. The high-level signal output from the first power supply holding terminal functions as a signal for maintaining the drive of the first power supply circuit 15. Therefore, the high-level signal output from the first power supply terminal is also referred to as a first power supply holding signal.

[0073] If the abnormality detection part 20 does not detect abnormal operation of the first power supply circuit 15, the slave computer 12 outputs the low-level signal from a second power supply holding terminal. If the abnormality detection part 20 detects abnormal operation of the first power supply circuit 15, the slave computer 12 starts outputting the high-level signal from the second power supply holding terminal. Once the slave computer 12 starts outputting the high-level signal from the second power supply holding terminal, the slave computer 12 maintains the same state until the ignition switch 8 is turned off and the predetermined shutdown processing is completed.

[0074] During a period of outputting the high-level signal from the second power supply holding terminal, the output of the second power supply enabling part 19 is maintained at the high level. As a result, the second power supply circuit 16 continues to operate, but the first power supply circuit 15 stops operating. This is because the output of the first power supply enabling part 18 is at the low level if the output of the second power supply enabling part 19 is at the high level.

[0075] The high-level signal output from the second power supply holding terminal functions as a signal for maintaining the driving state of the second power supply circuit 16. Accordingly, the high-level signal output from the second power supply holding terminal is also referred to as a second power supply holding signal.

[0076] The subcomputer 12 further outputs a high-level signal from a clear signal output terminal as a clear signal when the ignition switch 8 is turned off in the state where the high-level signal is output from the second power supply holding terminal. Consequently, the output level of the abnormality detection part 20 is changed to the low level.

[0077] The slave computer 12 is designed to perform less arithmetic and logical operation processing compared to the main computer 11. The slave computer 12 therefore consumes less power than the main computer 11. Furthermore, when the first power supply circuit 15 fails, the main computer 11 stops its operation and does not consume power. It is therefore possible to design the second power supply circuit 16 to have less power supply capacity than that of the first power supply circuit 15. In the present embodiment, the ECU 1 ends its control processing (hereinafter referred to as an ending condition) under the condition that the ignition switch 8 is turned off. However, the ending condition is not limited to this condition. The ending condition can be arbitrarily designed in accordance with the role of the ECU 1. <Betriebsablauf der ECU 1 zur Aktivierungszeit>

[0078] Hereinafter, an operation sequence of each structural part which is performed when the ignition switch 8 is turned on and the ECU 1 is activated will be described with reference to a Fig. 5 shown time diagram. In Fig. 5, it is assumed that the ignition switch 8 is turned on at time T10.

[0079] In Fig. 5, (A) indicates the supply voltage of the IG power supply line, (B), (C), (D), (E), (F), (G), and (H) indicate the outputs of the drive hold part 17, the first power supply activation part 18, the first power supply circuit 15, the delay filter 22, the abnormality detection part 20, the second power supply activation part 19, and the second power supply circuit 16, respectively. Furthermore, (I) indicates the voltage supplied to the internal power supply line Ln, and (J) and (K) indicate the operating states of the main computer 11 and the sub-computer 12, respectively. (L) and (M) indicate the output levels of the first power supply holding terminal and the second power supply holding terminal, respectively. (N) indicates storage contents of the operation confirmation data.It is assumed here as an example that the non-volatile memory 121 stores, as the operation confirmation, data indicating that the second power supply circuit 16 is normal as a result of the foregoing check processing.

[0080] When the ignition switch 8 is turned on at time T10, the battery voltage Vb is supplied to the drive holding part 17, and the output level of the drive holding part 17 is changed to the high level as indicated by (B). At the time of activation of the ECU 1, since the output level of the second power supply holding terminal and the output level of the abnormality detection part 20 are both low, the output level of the second power supply activation part 19 is low. As a result, the output level of the first power supply activation part 18 becomes high as indicated by (C), and the first power supply circuit 15 is activated. That is, the first power supply circuit 15 is triggered by turning on the ignition switch 8 and starts supplying power to the main computer 11 and the like.

[0081] One in (D) of Fig. The time period Ta indicated in Figure 5 indicates a time interval (i.e., a rise period) required for the output voltage V1 to converge to the target supply voltage starting from the activation of the first power supply circuit 15. A time period indicated in (E) of Fig. The time period Tb indicated in Figure 5 indicates a delay period that elapses from the input of the high-level signal to the output of the high-level signal in the delay filter 22. The delay filter 22 is configured such that the delay period Tb is longer than the rise time period Ta of the first power supply circuit 15.

[0082] When the first power supply voltage 15 stops rising, 5 V is supplied to the internal power supply line Ln, and the main computer 11 and the slave computer 12 are activated. During the initial processing at the time of activation, the slave computer 12 starts outputting the high-level signal from the first power supply holding terminal. After activation, the slave computer 12 clears the operation confirmation data as indicated in (N). That is, the slave computer 12 clears the data indicating that the second power supply circuit 16 is normal.

[0083] If the first power supply circuit 15 is operating normally, that is, the first output voltage V1 is within the normal range, the output level of the abnormality detection part 20 is low. The signal output from the second power supply holding terminal of the slave computer 12 is also low. As a result, the second power supply activation part 19 maintains the stop state. The second output voltage V2 is therefore 0 V. <Betriebsablauf zur Ausfallzeit der ersten Leistungsversorgungsschaltung>

[0084] Hereinafter, an operation of each structural part which is performed when the first power supply circuit 15 operates abnormally (for example, when the voltage drops) will be described with reference to a Fig. 6 shown time diagram. In Fig. 6, it is assumed that the voltage of the first power supply circuit 15 drops to be lower than the lower limit of the normal range at time T20.

[0085] In Fig. 6, (A) indicates the supply voltage of the ignition power supply line, that is, the ON / OFF state of the ignition switch 8. (B), (C), (D), (E), and (F) indicate the outputs of the first power supply circuit 15, the abnormality detection part 20, the second power supply activation part 19, the first power supply activation part 18, and the second power supply circuit 16, respectively. (G) indicates the voltage supplied to the internal power supply line Ln. (H) and (I) indicate the output levels of the first power supply holding terminal and the second power supply holding terminal, respectively. (J) and (K) indicate the operation states of the main computer 11 and the sub-computer 12, respectively. As long as at least the ignition switch 8 is in the ON state, the output signals of the drive holding part 17 and the delay filter 22 are respectively maintained at the high levels. For this reason, these output signals are in Fig. 6 not shown.

[0086] When the first power supply circuit 15 fails and the first output voltage V1 falls below the lower limit of the normal range, the abnormality detection part 20 detects this voltage change as the abnormal operation of the first power supply circuit 15. For this reason, the abnormality detection part 20 starts to output the high-level signal from time T20 as indicated at (C).

[0087] The output level of the second power supply activation part 19 also changes to the high level in accordance with the change of the output level of the abnormality detection part 20 to the high level.

[0088] For this reason, the AND condition is not satisfied, and therefore the first power supply activation part 18 starts to output the low level signal.

[0089] The second power supply circuit 16 is activated in response to the high-level signal applied from the second power supply activation part 19 and begins to output the second output voltage V2 = 5 V. Since the output level of the first power supply activation part 19 is changed to the low level, the first power supply circuit 15 terminates its operation. That is, when the first power supply circuit 15 fails, the second power supply circuit 16 supplies the internal power supply line Ln with 5 V instead of the first power supply circuit 15. As a result, as shown in Fig. 6, maintain the power supply to various computers. As indicated by (H) and (I), the slave computer 12 stops outputting the first power supply stop signal in timing relationship with the output of the second power supply stop signal.

[0090] In the present embodiment, the reset signal is continuously applied to the main computer 11 when the first power supply circuit 15 fails. Consequently, the main computer 12 remains in the operation stop state when the first power supply circuit 15 fails.

[0091] With this configuration, the number of power-consuming structural parts in the ECU 1 is reduced after the failure of the first power supply circuit 15 occurs. For this reason, it is possible to design the second power supply circuit 16 to have a lower power supply capability than the first power supply circuit 15. The cost of using the second power supply circuit 16 is thus reduced. However, it should be noted that various fail-safe processing is executed by the slave computer 12 even when the main computer 11 stops operating, and therefore a comparable level of safety to that of the conventional case is ensured. <Abschaltverarbeitung zur Ausfallzeit der ersten Leistungsversorgungsschaltung 15>

[0092] Hereinafter, an operation of each structural part which is performed when the ignition switch 8 is turned off in or under a state that the second power supply circuit 16 is in operation will be described with reference to an example shown in Fig. 7. Even after the ignition switch 8 is turned off, the subcomputer 12 continues to operate for a fixed period of time (e.g., 1 second) and executes the predetermined shutdown processing (e.g., data saving or the like). Fig. 7, it is assumed that the ignition switch 8 is turned off at time T30, and the sub-computer 12 completes the turn-off processing at time T31.

[0093] In Fig. 6. (A) indicates the supply voltage of the ignition power supply line. (B) indicates an operating state of the subcomputer 12. (C), (D), (E), and (F) indicate the outputs of the abnormality detection part 20, the second power supply holding terminal, the second power supply activation part 19, and the second power supply circuit 16, respectively. (G) indicates the voltage supplied to the internal power supply line Ln and thus to the subcomputer 12.

[0094] The subcomputer 12 outputs the cancellation signal to the abnormality detection part 20 when the ignition switch 8 is turned off. For this reason, as indicated by (C), the output signal of the abnormality detection part 20 changes to the low level. The subcomputer 12 continues to output the second power supply stop signal as indicated by (D) until the shutdown processing is completed at time T31. For this reason, the output level of the second power supply activation part 19 is maintained at high until time T31. As a result, the second power supply circuit 16 continues to operate and continues to output 5 V for the predetermined period even after the ignition switch 8 is turned off.

[0095] The slave computer 12 thus completes the shutdown processing using the power supplied from the second power supply circuit 16 and finally completes outputting the second power supply stop signal. <Abschaltverarbeitung zu normaler erster Leistungsversorgungszeit>

[0096] Hereinafter, an operation of each structural part which is performed when the ignition switch 8 is turned off in or under a state in which the first power supply circuit 15 is in normal operation will be described with reference to an example shown in Fig. 8 is described. Even after the ignition switch 8 is turned off, the main computer 11 and the subcomputer 12 continue to operate for a fixed period of time (for example, 1 second) and execute the predetermined shutdown processing (for example, data backup or the like). If the ignition switch 8 is turned off without any abnormality of the first power supply circuit 15 after the ignition switch 8 is turned on, the subcomputer 12 executes the check processing as part of the shutdown processing.

[0097] In Fig. 8, it is assumed that the ignition switch 8 is turned off at time T40, and the main computer 11 completes the shutdown processing at time T41. Further, it is assumed that the sub-computer 12 completes the shutdown processing at time T42.

[0098] The slave computer 12 continues to output the first power supply stop signal as indicated by (D) even after the ignition switch 8 is turned off. For this reason, the output level of the first power supply activation part 18 is also maintained at high. As a result, the first power supply circuit 15 continues to output 5 V to the internal power supply line Ln. The main computer 11 and the slave computer 12 thus complete the shutdown processing using the power supplied from the first power supply circuit 15.

[0099] The main computer 11 outputs a signal (hereinafter referred to as a completion notification) indicating the completion of the shutdown itself to the slave computer 12. Upon receiving the completion notification from the main computer 11, the slave computer 12 outputs the second power supply stop signal and stops outputting the first power supply stop signal. Consequently, the first power supply circuit 15 stops operating.

[0100] Since the second power supply activation part 19 outputs the high-level signal in response to the second power supply stop signal, the second power supply circuit 16 is activated and starts outputting 5 V as long as the second power supply circuit 16 is normal. If the slave computer 12 is operational at a time after a predetermined period of time Tchk from the output of the second power supply stop signal, the slave computer 12 stores second power supply data indicating that the second power supply circuit 16 is normal in the nonvolatile memory 121. Finally, the slave computer 12 stops outputting the second power supply stop signal and stops the second power supply circuit 16.

[0101] As described above, the subcomputer 12 executes the check processing after the ignition switch 8 is turned off. Therefore, it is possible to store data indicating that the second power supply circuit 16 is normal in the nonvolatile memory 121 if the second power supply circuit 16 is operating normally. Nothing is stored in the address (hereinafter referred to as a check result storage address) in which the second power supply data is to be stored in the nonvolatile memory if the second power supply circuit 16 has a failure and the second power supply circuit 16 is not activated normally. That is, the second power supply data is maintained as erased.

[0102] With the configuration described above, the subcomputer 12 can recognize whether the second power supply circuit 16 is normal by referring to the check result storage address of the nonvolatile memory 121 when the subcomputer 12 is activated at the time of the next turning on of the ignition switch 8. In the case where the second power supply circuit 16 has the fault, the warning lamp 6 is turned on, and the other ECUs are notified of the abnormality of the ECU 1. <Vorteil des Ausführungsbeispiels>

[0103] According to the above-described embodiment, if the abnormality detection part 20 does not detect an abnormal operation of the first power supply circuit 15 (hereinafter referred to as normal time), the second power supply circuit 16 does not operate. Therefore, even if the second power supply circuit 16 fails, such a failure is not detected during normal time. As a result, the frequency of fail-safe processing executed in response to the power supply circuit failure can be reduced.

[0104] Furthermore, the second power supply circuit 16 operates only in cases where the test processing is being executed and the first power supply circuit 15 fails. That is, the operating time of the second power supply circuit 16 is shortened compared to the operating time of the first power supply circuit 15. Consequently, it is possible to reduce the probability of failure of the second power supply circuit 16, which increases with the increase in the total operating time.

[0105] Furthermore, when the first power supply circuit 15 fails, the second power supply circuit 16 is activated and supplies power to the computers. The sub-computer 12 operates with the power supply of the second power supply circuit 16 and executes fail-safe processing such as limp-home locomotion. As a result, comparable safety and utility to those of the conventional ECU are provided.

[0106] In the above-described embodiment, the normal range is set to be within the computer operating range. With this configuration, it is possible to switch the power supply source to the second power supply circuit 16 before each computer stops operating.

[0107] Furthermore, in the above-described embodiment, not only the lower limit but also the upper limit are set as the normal range. As a result, it is possible to detect not only the voltage drop but also the abnormal increase of the first output voltage V1 as the abnormal operation. Furthermore, when the output voltage of the first power supply circuit 15 exceeds the upper limit of the normal range, the first power supply circuit 15 is prevented from operating. Thus, it is possible to prevent the excessive voltage exceeding the computer operation range from being supplied to the main computer 11 and the sub-computer 12. As a result, it is possible to reduce the probability that the main computer 11 and the sub-computer 12 will fail due to the failure of the first power supply circuit 15.

[0108] As another embodiment, it may be possible to operate the second power supply circuit 16 without stopping the first power supply circuit 15 even after detecting the abnormal operation of the first power supply circuit 15. In this case, if the first power supply circuit 15 fails to output a voltage higher than the output voltage (5 V) of the second power supply circuit 16, the second power supply circuit 16 substantially does not operate. The first power supply circuit 15 and the second power supply circuit 16 are provided to output the voltage to the common power supply line (i.e., the internal power supply line Ln).

[0109] For this purpose, the output voltage of the second power supply circuit 16 is effectively used if the first power supply circuit 15 is stopped upon detection of the abnormal operation of the first power supply circuit 15.

[0110] If at least one of the outputs of the abnormality detection part 20 and the second power supply holding terminal of the subcomputer 12 is high, the second power supply circuit 16 continues to operate. As a result, it is possible to continue the power supply even if a signal line through which the output signal of the abnormality detection part 20 flows is disconnected. That is, the ECU 1 is able to continue vehicle control.

[0111] Furthermore, it is possible to prevent a situation where vehicle control is inhibited due to a signal line failure during the execution of vehicle movement control. Consequently, reliability is improved.

[0112] The invention is not limited to the embodiment described above, but can be implemented with various modifications, which are described below by way of example. [First modification]

[0113] In the embodiment described above, the normal range is set to be within the computer operating range. However, the normal range may be set wider than the computer operating range while including the computer operating range within the expanded range. For example, the normal range may be set to, for example, between 3.9 V and 5.6 V relative to the computer operating range (4.0 V to 5.5 V). [Second modification]

[0114] To realize the second power supply circuit 16 at low cost, the main computer 11 is prevented from operating when the second power supply circuit 16 is operating. This is because the power supply capability of the second power supply circuit 16 may be reduced by stopping the operation of the main computer 11.

[0115] As a different embodiment, both the main computer 12 and the slave computer 11 can be operated if the second power supply circuit 16 is operating. In this case, the second power supply circuit 16 must be configured to supply the power required to operate both the main computer 11 and the slave computer 11. An exemplary circuit configuration for enabling the operation of the main computer 11 at the time of the operation of the second power supply circuit 16 is shown in Fig. 9, which differs from the one in Fig. 2 in that the output signal of the second power supply activation part 19 is not connected to the reset terminal of the main computer 11. [Third Modification]

[0116] In the above-described embodiment, the first power supply circuit 15 stops its operation when the abnormality detecting part 20 detects the abnormality of the first power supply circuit 15. However, as shown in Fig. 10, the ECU 1 may be configured such that the first power supply circuit 15 continues to operate even after the abnormality of the first power supply circuit 15 is detected by the abnormality detecting part 20.

[0117] In the Fig. In the configuration shown in Figure 10, the output terminal of the second power supply activation part 19 and the reset input terminal are connected. For this reason, the main computer 11 stops operating after the first power supply circuit 15 is detected as abnormal. The ECU 1 can be operated as shown in Fig.11 to allow both the main computer 11 and the first power supply circuit 15 to continue operating even after the first power supply circuit 15 is detected as abnormal. [Fourth Modification]

[0118] In the above-described embodiment, it is assumed that the subcomputer 12 has only a limited vehicle control function, such as limp-home locomotion. However, the subcomputer 12 may be configured to perform other vehicle control similar to the main computer 11. Further, in the above-described embodiment, the ECU 1 is activated when the ignition switch 8 is turned on. The ECU 1 may be triggered and activated in other ways. The ECU 1 may be activated in response to the application of a signal generated when a charging connector is connected or activated by itself when a timer expires. The signal serving as a trigger for starting power supply to the main computer 11 and its signal source may be arbitrarily configured. [Fifth Modification]

[0119] The control computer is not limited to multiple microcomputer configurations, exemplified as the main computer 11 and the subcomputer 12. The control computer may be a single microcomputer, so that when the first power supply circuit 15 is abnormal, the microcomputer is supplied with power from the second power supply circuit 16.

[0120] As described above, an ECU 1 includes a main computer 11, a subcomputer 12, a first power supply circuit 15, a second power supply circuit 16, and an abnormality detection part 20. Output voltages of the first power supply circuit 15 and the second power supply circuit 16 are supplied to the main computer 11 and the subcomputer 12 via an internal power supply line Ln provided in the ECU 1. The first power supply circuit 15 is activated when an ignition switch 8 is turned on and begins to output a predetermined target supply voltage. The abnormality detection part 20 monitors the output voltage of the first power supply circuit 15.When the output voltage of the first power supply circuit 15 deviates from a normal range, the abnormality detection part 20 outputs an abnormality detection signal indicating an abnormal operation of the first power supply circuit 15. When the abnormality detection part 20 outputs the abnormality detection signal, the first power supply circuit 15 stops, and the second power supply circuit 16 is activated instead.

Claims

[1] Electronic control unit, comprising: a control computer (11, 12) which is a microcomputer for controlling an operation of a predetermined actuator (32) mounted in a vehicle based on data supplied from sensors (4, 5) mounted in the vehicle; a first power supply circuit (15) provided as a power supply circuit for generating a voltage for driving the control computer (11, 12) from a voltage supplied from a power supply source (2) mounted in the vehicle, and supplying the control computer (11, 12) with voltage; an abnormality detection part (20) for detecting an abnormal operation of the first power supply circuit (15) based on the voltage output from the first power supply circuit (15); a second power supply circuit (16) provided as the power supply circuit separately from the first power supply circuit (15), wherein the second power supply circuit (16) is activated in response to a detection result of the abnormality detection part (20) and supplies power to the control computer (11, 12), and an internal power supply line (Ln) connecting an output terminal of the first power supply circuit (15), an output terminal of the second power supply circuit (16) and a power supply terminal of the control computer (11, 12), where the first power supply circuit (15) starts supplying power to the control computer (11, 12) in response to application of an activation signal applied from a predetermined signal source as a trigger for starting control; the abnormality detection part (20) outputs a signal for stopping an operation of the second power supply circuit (16) when the abnormality detection part (20) does not detect an abnormal operation of the first power supply circuit (15); and the abnormality detection part (20) outputs a signal for activating the second power supply circuit (16) when the abnormality detection part (20) detects the abnormal operation of the first power supply circuit (15). [2] Electronic control unit according to claim 1, wherein the control computer (11, 12) has an operating voltage range which is predetermined by a lower limit value and an upper limit value of a voltage; the abnormality detection part (20) has a normal voltage range predetermined for use in checking whether the output voltage of the first power supply circuit (15) is normal; the normal voltage range of the abnormality detection part (20) is set to be included in the operating voltage range; and the abnormality detection part (20) detects the output voltage of the first power supply circuit (15) which is outside the normal voltage range as the abnormal operation of the first power supply circuit (15). [3] Electronic control unit according to claim 2, wherein: the first power supply circuit (15) is stopped in its operation when the abnormality detection part (20) detects the abnormal operation of the first power supply circuit (15). [4] Electronic control unit according to one of claims 1 to 3, wherein: the control computer (11, 12) includes a first computer (11) and a second computer (12); both the first computer (11) and the second computer (12) operate when the abnormality detection part (20) does not detect an abnormal operation of the first power supply circuit; and the control computer (11, 12) stops operating when the abnormality detecting part (20) detects the abnormal operation of the first power supply circuit (11). [5] Electronic control unit according to claim 4, wherein: the second computer (12) includes a memory (121) capable of continuously storing data without power supply from the first power supply circuit (15) and the second power supply circuit (16); the second computer (12) stops the first power supply circuit (15) upon fulfillment of a predetermined termination condition and activates the second power supply circuit (16) if no abnormal operation of the first power supply circuit (15) is detected in a period from the time of application of the predetermined signal from the signal source for starting the control to the time of fulfillment of the predetermined termination condition for terminating the control; and the second computer (12) stores in the memory (121) operation confirmation data indicating that the second power supply circuit (16) is normal when the second computer (16) is operable after a lapse of a predetermined period of time since the activation of the second power supply circuit (16). [6] Electronic control unit according to claim 5, wherein: the second computer (12) deletes the operation confirmation data stored in the memory (121) upon each activation. [7] Electronic control unit according to claim 5 or 6, wherein: the abnormality detection part (20) holds a detection result indicating an abnormality of the first power supply circuit (15) until the second computer (12) applies a predetermined clear signal after the abnormal operation of the first power supply circuit (15) is detected; the abnormality detection part (20) continues to output an abnormality detection signal as the signal for activating the second power supply circuit (16), which indicates that the first power supply circuit (15) is abnormal insofar as the first power supply circuit (15) is determined to be abnormal; the second computer (12) controls the second power supply circuit (16) by outputting a second power supply stop signal; and the second power supply circuit (16) operates when the abnormality detection part (20) outputs the abnormality detection signal or the second computer (12) outputs the second power supply stop signal. [8] Electronic control unit according to one of claims 4 to 7, wherein: the second computer (12) executes predetermined operation safety processing when the abnormality detecting part (20) detects the abnormal operation of the first power supply circuit (15). [9] Electronic control unit according to one of claims 4 to 8, wherein: the second power supply circuit (16) is configured to output power for driving both the first computer (11) and the second computer (12). [10] Electronic control unit according to one of claims 1 to 9, wherein: the abnormality detection part (20) is activated after a lapse of a predetermined period of time since the application of the activation signal.

Images