On-board electronic control device

Abstract

The present application is made in view of the above-described problems, and aims at continuing operation without affecting other functions and ensuring safety of a control target device corresponding to a function in which an abnormality is detected, in an electronic control device that controls a plurality of functions. In the vehicle-mounted electronic control device of the present application, a first operation section and a second operation section each output an operation confirmation signal, and a driver control section sets a driver corresponding to one of the first operation section and the second operation section in which the operation confirmation signal indicates an abnormality, to a degenerate state.

Description

Technical Field

[0001] This invention relates to an on-board electronic control device installed in a vehicle. Background Technology

[0002] The Electronic Control Unit (ECU) in a vehicle typically includes a monitoring unit that monitors whether the microcomputer within the ECU is operating normally. Usually, one monitoring unit is configured for each microcomputer. The monitoring unit can be, for example, a Watchdog Timer (WDT). If the monitoring unit indicates an anomaly, it attempts to recover the microcomputer from the abnormal state by resetting it.

[0003] Patent Document 1, titled "An electronic control device for vehicles that enables fault monitoring of multi-core CPUs at low cost without increasing the CPU used for monitoring," describes the following technology: "The CPU core 10 within the control IC 2 is used as the main CPU core, and other CPU cores 20, 30, and 40 are used as secondary CPU cores. The CPU cores 20, 30, and 40 calculate response data to the example data sent to the CPU core 10 and send it to the CPU core 10. The CPU core 10 calculates response data to the example data sent to the monitoring IC 3 and sends the example data to the CPU cores 20, 30, and 40. Based on its own response data and the response data replied by the CPU cores 20, 30, and 40, it generates final response data and sends it to the monitoring IC 3. The monitoring IC 3 uses the comparison result between the final response data received from the CPU core 10 and the pre-prepared expected value of the response data to perform fault diagnosis of the control IC 2" (see abstract).

[0004] Patent Document 2, entitled "An information processing apparatus that can continue to execute another application even if one of two or more applications detects an anomaly," describes the following technology: "It is characterized by having an application monitoring unit 60 that has multiple applications, counts the number of notifications in the action of each application during a first counting period, and an application control unit 32 that controls the action of the application. When the application monitoring unit detects an abnormal sign of the application based on the number of notifications in the past action of the application, the application control unit stops sending the notification in the action of the application with the lowest priority. The application that has not detected an abnormal sign sends the notification in the action at a time before the abnormal sign is detected and at the time when the application that has detected an abnormal sign sends the notification in the action or at a time before or after the time when the notification in the action is sent" (see abstract).

[0005] Existing technical documents

[0006] Patent documents

[0007] Patent Document 1: Japanese Patent Application Publication No. 2015-103052

[0008] Patent Document 2: Japanese Patent Application Publication No. 2013-143093 Summary of the Invention

[0009] The problem the invention aims to solve

[0010] In recent years, in-vehicle electronic control devices have begun to use multi-core microcomputers with multiple processor cores. Multi-core microcomputers allow each core to perform different functions. However, configuring a monitoring unit for each core would be costly; therefore, it is considered ideal for a single monitoring unit to uniformly monitor all cores.

[0011] In a multi-core microcomputer that performs multiple functions, if one function is deemed abnormal by the monitoring department, the entire microcomputer is reset. As a result, functions that are operating normally are also reset, thus hindering the continuity of operation.

[0012] Especially in vehicle electronic control devices, where continuity of action is sometimes required, such a configuration is not ideal.

[0013] In Patent Document 1, CPU cores 10-40 relay the sample data sent by monitoring IC 3, thereby allowing one monitoring IC 3 to monitor multiple CPU cores 10-40. This configuration is considered useful in reducing the cost of monitoring IC 3. However, if the entire CPU is reset when one CPU core malfunctions, it may hinder the continuation of operation.

[0014] Patent Document 2 seeks to notify the user of the lowest priority application and allow other applications to continue operating when one of two or more applications malfunctions. However, according to this document, the notification stops the operation of the lowest priority application when an anomaly occurs, thus reducing the monitoring capability of that application. That is, in this document, the microcomputer changes to a different state than normal when an anomaly occurs. In vehicle electronic control devices, not only the microcomputer but also the controlled devices (actuators, etc.) controlled by the ECU must be considered for operational continuity. Setting the microcomputer itself to a different state than normal, as in Patent Document 2, may not be the most suitable from the viewpoint of operational continuity, because processing is required to restore the microcomputer to its normal state.

[0015] The present invention was made in view of the aforementioned problems, and its object is to enable continued operation of an electronic control device that controls multiple functions in the event of an anomaly being detected without affecting other functions, and to ensure the safety of the controlled device corresponding to the function in which the anomaly was detected.

[0016] Technical means to solve the problem

[0017] In the vehicle electronic control device of the present invention, the first arithmetic unit and the second arithmetic unit respectively output an action confirmation signal, and the driver control unit sets the driver corresponding to the one of the action confirmation signals of the first arithmetic unit and the second arithmetic unit that shows an abnormality to a degenerate state.

[0018] The effects of the invention

[0019] According to the present invention, the vehicle electronic control device can continue to operate without affecting functions that have not experienced abnormalities, and ensures the safety of the controlled device corresponding to the function that has detected an abnormality. Attached Figure Description

[0020] Figure 1 This is a configuration diagram of the vehicle-mounted electronic control device 100 according to Embodiment 1.

[0021] Figure 2 A timing diagram illustrating the sequence in which the determination unit 4 controls each driver.

[0022] Figure 3 A timeline diagram illustrating the sequence of resetting the microcomputer 6 by the determination unit 4.

[0023] Figure 4 A diagram illustrating an example of the equipment controlled by the vehicle electronic control unit 100. Detailed Implementation

[0024] <Implementation Method 1>

[0025] Figure 1 This is a configuration diagram of the vehicle-mounted electronic control device 100 according to Embodiment 1 of the present invention. The vehicle-mounted electronic control device 100 is an electronic control device installed in a vehicle. The vehicle-mounted electronic control device 100 is a device for controlling equipment (such as actuators, etc., specific examples will be described below) equipped in the vehicle.

[0026] The vehicle-mounted electronic control unit 100 includes a monitoring unit 1, a microcomputer 6 (processing unit), a first driver 18, and a second driver 19.

[0027] The microcomputer 6 has a CPU (Central Processing Unit) for executing programs, which are deployed for control calculations to control the equipment equipped in the vehicle. The microcomputer 6 is a multiprocessor microcomputer with multiple CPUs. Figure 1The example shown includes a CPU 11 (first arithmetic unit) and a CPU 13 (second arithmetic unit). CPU 11 performs control calculations to implement function 7 (first processing), and CPU 13 performs control calculations to implement function 8 (second processing). Regarding the functional safety requirement level of the specifications followed by the on-board electronic control device, the functional safety requirement level of function 7 is higher than that of function 8.

[0028] CPU 11 outputs a first drive signal via I / O circuit 17 to control the first driver 18 according to the control calculation result. The first driver 18 drives the first device according to the first drive signal. CPU 13 outputs a second drive signal via I / O circuit 17 to control the second driver 19 according to the control calculation result. The second driver 19 drives the second device according to the second drive signal.

[0029] CPU 11 outputs a first action confirmation signal, indicating that it is executing a program, to monitoring unit 1 via I / O circuit 17. CPU 13 outputs a second action confirmation signal, indicating that it is executing a program, to monitoring unit 1 via I / O circuit 17.

[0030] Lockstep 9 performs the same operation as CPU 11. Lockstep 10 performs the same operation as CPU 13. The MPU monitoring unit 15 (Arithmetic Unit Monitoring Unit) equipped in the microcomputer 6 compares the operation results of the CPU and lockstep respectively. If the two are inconsistent, a signal (error output) indicating that the microcomputer 6 is abnormal is output to the monitoring unit 1.

[0031] The microcomputer 6 also includes memories 12 and 14, peripheral circuitry 16, etc. Memories 12 and 14 are storage devices that store data used by CPUs 11 and 13, respectively.

[0032] Peripheral circuits 16 include, for example, timers, AD converters, communication interfaces, and other circuits typically equipped in a microcomputer 6. In addition to monitoring each CPU, the MPU monitoring unit 15 also monitors the memory 12 and 14, peripheral circuits 16, and I / O circuits 17 for proper functioning. If any of these are abnormal, an error output is sent to the monitoring unit 1. Therefore, the MPU monitoring unit 15 serves to monitor for malfunctions within the microcomputer 6.

[0033] The monitoring unit 1 includes a reset control unit 2, a response monitoring unit 3, a determination unit 4, and a driver control unit 5. The reset control unit 2 outputs a reset signal to the microcomputer 6 according to the instructions from the determination unit 4. The response monitoring unit 3 monitors the operation of the CPU 11. The response monitoring unit 3 can be configured, for example, by a WDT (Write-Ahead Delay Threat). The determination unit 4 determines whether the microcomputer 6 is functioning correctly according to the order described below. The driver control unit 5 outputs signals controlling the first driver 18 (function 1: output permission signal) and controlling the second driver 19 (function 2: output permission signal) according to the instructions from the determination unit 4.

[0034] Figure 2 This is a timing diagram illustrating the sequence in which the determination unit 4 controls each driver. The determination unit 4 instructs the driver corresponding to the action confirmation signal exhibiting an abnormality to stop outputting. Figure 2 If the second action confirmation signal exhibits an anomaly, the determination unit 4 instructs the second driver 19 to stop outputting. The second driver 19 then ceases to output the second drive signal to the second device. In the event of multiple action confirmation signals exhibiting anomalies, the driver corresponding to each action confirmation signal can be instructed to stop outputting. If the action confirmation signals exhibit normal behavior, the corresponding driver is instructed to allow output.

[0035] Figure 3 A timeline diagram illustrating the sequence of resetting the microcomputer 6 by the determination unit 4.

[0036] picture Figure 2 As explained earlier, whenever any action confirmation signal exhibits an abnormality, the determination unit 4 instructs the corresponding driver to stop outputting. If all action confirmation signals (the first action confirmation signal and the second action confirmation signal in this embodiment 1) exhibit abnormalities and an error output is generated from the MPU monitoring unit 15, the CPUs fail to execute programs correctly, and a malfunction occurs within the microcomputer 6. In this situation, it is determined that the operation of the microcomputer 6 can no longer continue. Therefore, the determination unit 4 instructs the reset control unit 2 to output a reset signal. Figure 3 The example shown is that the first action confirmation signal becomes abnormal after the second action confirmation signal becomes abnormal, which in turn leads to an erroneous output.

[0037] <Implementation Method 1: Summary>

[0038] The vehicle electronic control device 100 of this embodiment 1 is a vehicle electronic control device (100) mounted in a vehicle, comprising: a first driver (18) that outputs a first drive signal to drive a first device equipped in the vehicle; a second driver (19) that outputs a second drive signal to drive a second device equipped in the vehicle; a driver control unit (5) that controls the operating states of the first driver (18) and the second driver (19); and a computing unit (6) having a plurality of computing units that perform control processing for controlling the vehicle, the computing unit (6) having a first computing unit (11) and a second computing unit (13) as computing units, the first computing unit (11) performing a first processing for controlling the first device and controlling the first driver (18) according to the result, the second computing unit (13) performing a second processing for controlling the second device and controlling the second driver (19) according to the result, and the computing unit outputting a yes / no indication. When a confirmation signal indicates that the control process is being executed normally, the first arithmetic unit (11) outputs a first action confirmation signal indicating whether the first process is being executed normally, and the second arithmetic unit (13) outputs a second action confirmation signal indicating whether the second process is being executed normally. If the first action confirmation signal indicates that the first process is being executed normally and the second action confirmation signal indicates that the second process is not being executed normally, the driver control unit (5) causes the first driver (18) to operate normally and sets the second driver (19) to a simplified state compared to normal operation. If the first action confirmation signal indicates that the first process is not being executed normally and the second action confirmation signal indicates that the second process is being executed normally, the driver control unit (5) sets the first driver (18) to a simplified state compared to normal operation and causes the second driver (19) to operate normally. By setting the driver to a simplified state, the vehicle's operation can be switched to a fail-safe mode while the CPU continues to operate. Furthermore, there is no need to reset the microcomputer 6 (processing unit), so it is possible to avoid affecting its normal operation.

[0039] The vehicle-mounted electronic control unit (100) also includes an arithmetic unit monitoring unit (15) for monitoring malfunctions within the arithmetic unit (6), and a reset control unit (2) for outputting a reset signal to reset the arithmetic unit (6). When a confirmation signal indicates that all arithmetic units equipped in the arithmetic unit (6) are malfunctioning, and the arithmetic unit monitoring unit (15) detects a malfunction within the arithmetic unit (6), the reset control unit (2) outputs the reset signal to the arithmetic unit (6), thereby resetting the arithmetic unit. Thus, if the malfunction level of the microcomputer 6 (arithmetic unit) is estimated to be high, a reset can be attempted to restore it to a normal state.

[0040] The arithmetic unit (6) continues the first processing performed by the first arithmetic unit (11) even if the first action confirmation signal indicates that the first processing has not been executed normally, and the arithmetic unit (6) continues the second processing performed by the second arithmetic unit (13) even if the second action confirmation signal indicates that the second processing has not been executed normally. Therefore, the vehicle's operation can be switched to fail-safe mode without resetting the microcomputer 6 (arithmetic unit).

[0041] The arithmetic unit (6) continues the second processing performed by the second arithmetic unit (13) even when the first action confirmation signal indicates that the first processing has not been executed normally, and the arithmetic unit (6) continues the first processing performed by the first arithmetic unit (11) even when the second action confirmation signal indicates that the second processing has not been executed normally. Therefore, the vehicle's operation can be switched to fail-safe mode without resetting the microcomputer 6 (arithmetic unit).

[0042] <Implementation Method 2>

[0043] In Embodiment 1, the case where the driver is set to a degenerate state according to the action confirmation signal was described. However, there are cases where, for example, due to a temporary state of the I / O circuit 17 or the wiring, the action confirmation signal incorrectly indicates normal operation when it should indicate an abnormality. Therefore, in Embodiment 2 of the present invention, the order in which the action confirmation signal, the MPU monitoring unit 15, and the response monitoring unit 3 are used simultaneously to determine whether the microcomputer 6 is functioning properly is described. The configuration of the vehicle electronic control device 100 is the same as in Embodiment 1.

[0044] (One of the sequences) When both the first and second action confirmation signals indicate normal operation, the determination unit 4 further acquires the monitoring results from the MPU monitoring unit 15 and the response monitoring unit 3. If the MPU monitoring unit 15 detects a malfunction within the microcomputer 6, and the response monitoring unit 3 detects that the CPU 11 is operating normally, then the CPU 13 or some related components may be malfunctioning. This is because the microcomputer 6 is malfunctioning while the CPU 11 is operating normally. In this case, even if the second action confirmation signal is normal, the determination unit 4 instructs the output of the second driver 19 to be stopped. The first driver 18 continues normal operation. Therefore, even if the second action confirmation signal incorrectly indicates normal operation for some reason, the fault safety of the second driver 19 can be ensured.

[0045] (Second Order) When both the first and second action confirmation signals indicate normal operation, the determination unit 4 further acquires the monitoring results from the MPU monitoring unit 15 and the response monitoring unit 3. If the MPU monitoring unit 15 detects a malfunction within the microcomputer 6, or the response monitoring unit 3 detects that the CPU 11 is not operating normally, the CPU 11 or some related components may be malfunctioning. In this case, even if the first action confirmation signal is normal, the determination unit 4 instructs the output of the first driver 18 to be temporarily stopped. The second driver 19 continues normal operation. Thus, even if the first action confirmation signal incorrectly indicates normal operation for some reason, the fault safety of the first driver 18 can be ensured.

[0046] (Third Order) In the second order, if the MPU monitoring unit 15 detects a malfunction inside the microcomputer 6 and the response monitoring unit 3 detects that the CPU 11 is not operating normally, it is ideal to quickly restore the CPU 11 to its normal state. This is because the CPU 11 performs processing with high functional safety requirements. Therefore, in this case, the determination unit 4 resets the microcomputer 6 via the reset control unit 2. Thus, even if the first operation confirmation signal incorrectly indicates that the normal state continues for some reason, the first driver 18 can be quickly restored to its normal state.

[0047] <Implementation Method 2: Summary>

[0048] In the vehicle electronic control device (100) of this embodiment 2, the functional safety level of the first processing requirement is higher than the functional safety level of the second processing requirement. The vehicle electronic control device (100) also includes a computing device monitoring unit (15) for monitoring malfunctions inside the computing device (6). The vehicle electronic control device (100) also includes a response monitoring unit (3) for monitoring whether the first computing unit (11) is operating normally. When the first operation confirmation signal indicates that the first processing is being performed normally and the second operation confirmation signal indicates that the second processing is being performed normally, and the computing device monitoring unit (15) detects that a malfunction has occurred inside the computing device (6), and the response monitoring unit (3) detects that the first computing unit (11) is operating normally, the driver control unit (5) causes the first driver (18) to operate normally and sets the second driver (19) to a simplified state compared to normal operation. Therefore, even if the second action confirmation signal incorrectly indicates normal operation for some reason, the fault safety of the second drive 19 can be ensured.

[0049] In the vehicle electronic control device (100) of this embodiment 2, the functional safety level of the first processing requirement is higher than the functional safety level of the second processing requirement. The vehicle electronic control device (100) also includes a computing device monitoring unit (15) for monitoring malfunctions inside the computing device (6). The vehicle electronic control device (100) also includes a response monitoring unit (3) for monitoring whether the first computing unit (11) is operating normally. When the first operation confirmation signal indicates that the first processing is being performed normally and the second operation confirmation signal indicates that the second processing is being performed normally, and the computing device monitoring unit (15) detects that a malfunction has occurred inside the computing device (6), and the response monitoring unit (3) detects that the first computing unit (11) is not operating normally, the driver control unit (5) temporarily sets the first driver (18) to a simplified state compared to normal operation, and causes the second driver (19) to operate normally. Therefore, even if the first action confirmation signal incorrectly indicates normal operation for some reason, the first driver 18 can be guaranteed to be fault-safe.

[0050] The vehicle electronic control device (100) of this embodiment 2 further includes a reset control unit (2) that outputs a reset signal to reset the computing device (6). When the first action confirmation signal indicates that the first process is being executed normally and the second action confirmation signal indicates that the second process is being executed normally, and the computing device monitoring unit (15) detects that a malfunction has occurred inside the computing device (6), and the response monitoring unit (15) detects that the first computing unit (11) is not operating normally, the reset control unit (2) outputs the reset signal to the computing device (6) to reset the computing device (6).

[0051] Therefore, even if the first action confirmation signal incorrectly indicates that the normal state continues for some reason, the first driver 18 can be quickly restored to the normal state.

[0052] <Implementation Method 3>

[0053] In embodiments 1 and 2, the case where the driver stops outputting the drive signal to set a degenerate state compared to normal operation was described. This can be implemented, for example, when the driver is composed of a switching element, by fixing the signal level of the drive terminal (gate terminal, etc.) of the switching element in the off state. However, the degenerate state of the driver is not limited to this, and other forms of degenerate state are also considered.

[0054] It is argued that configuring the drive to continue operating without instructions from the microcomputer 6 would impair operational flexibility, but ensure operational continuity. For example, by connecting the circuitry with the prescribed operation to the drive and disconnecting the drive from the microcomputer 6, the drive can be configured to continue its prescribed operation without relying on the microcomputer 6. This is equivalent to switching the drive to a fail-safe mode in ensuring operational continuity, and can therefore be considered a form of degeneracy. This is the same in both the first drive 18 and the second drive 19.

[0055] <Implementation Method 3: Summary>

[0056] In the vehicle electronic control unit (100), the driver control unit (5) controls the first driver (18) without outputting the first drive signal, thereby setting the first driver (18) to a simplified state compared to normal operation. The driver control unit (5) controls the second driver (19) without outputting the second drive signal, thereby setting the second driver (19) to a simplified state compared to normal operation.

[0057] Alternatively, the following can be used: the driver control unit (5) sets the first driver (18) to continue operating without relying on the first drive signal, thereby setting the first driver (18) to a simplified state compared to normal operation; the driver control unit (5) sets the second driver (19) to continue operating without relying on the second drive signal, thereby setting the second driver (19) to a simplified state compared to normal operation.

[0058] <Regarding variations of the present invention>

[0059] This invention includes various modifications and is not limited to the embodiments described above. For example, the above embodiments are detailed descriptions provided to illustrate the invention in an easily understandable manner and are not necessarily limited to all the described configurations. Furthermore, a portion of the configuration of one embodiment may be replaced with the configuration of another embodiment, and the configuration of one embodiment may be added to the configuration of another embodiment. In addition, other configurations may be added, deleted, or replaced in a portion of the configuration of each embodiment.

[0060] Figure 4 This diagram illustrates an example of the devices controlled by the vehicle electronic control unit 100 of the present invention. The vehicle electronic control unit 100 is the vehicle electronic control unit described in any one of embodiments 1 to 3. As the first function 7, the vehicle electronic control unit 100 can control, for example, the following devices: (a) actuators equipped with the engine of the vehicle, such as fuel injection nozzles and throttle valves; (b) a charging circuit that supplies charging current to the battery of the vehicle; and (c) a system that circulates fluid within the vehicle in a heat treatment system that controls the heat of the vehicle, such as a system that uses fluid for heat control like a water cooling system. These systems require continuous operation, so it is ideal for them to be controlled by the first actuator 18. Figure 4 The description shows that one first driver 18 controls three devices, but this is an illustrative example. It is also possible to set an equivalent driver for each device as the first driver 18.

[0061] That is, in the vehicle electronic control unit (100), at least one of the first driver (18) and the second driver (19) can output a drive signal for driving at least one of the following three: an actuator of the engine equipped in the vehicle, a circuit for supplying charging current for charging the battery equipped in the vehicle, and a heat treatment system for controlling the heat of the vehicle.

[0062] In the above embodiments, if the operation confirmation signals return to normal during the period before the microcomputer 6 is reset after the first or second operation confirmation signal indicates an abnormality, the determination unit 4 can restore each driver to normal. If the microcomputer 6 is reset before the operation confirmation signals return to normal, the same processing as in the abnormal embodiment can be repeated.

[0063] That is, in the vehicle electronic control unit (100), after the confirmation signal indicates that one of the first processing or the second processing is abnormal, and before the arithmetic unit (6) is reset, if the confirmation signal changes to indicate that both the first processing and the second processing are normal, the driver control unit (5) can enable both the first driver (18) and the second driver (19) to perform normal operation.

[0064] In the above embodiments, the case where the microcomputer 6 is a multiprocessor microcomputer was described, but the present invention can also be applied to the case where it is a multi-core microcomputer. In this case, different functions are performed on each core.

[0065] In the above embodiments, the case where the microcomputer 6 has two CPUs was described. However, the present invention can also be used when it has three or more CPUs (or processor cores). In this case, each processor performs a different function. The operation is the same as that described in Embodiment 1 when the action confirmation signal indicates that all processors are malfunctioning and the MPU monitoring unit 15 indicates an internal malfunction.

[0066] Symbol Explanation

[0067] 1… Surveillance Department

[0068] 2…Reset Control Unit

[0069] 3…Response Monitoring Department

[0070] 4… Judgment Department

[0071] 5…Driver Control Unit

[0072] 6… Microcomputer

[0073] 11…CPU

[0074] 13…CPU

[0075] 15…MPU Monitoring Department

[0076] 18…First Driver

[0077] 19…Second Driver

[0078] 100…On-board electronic control device.

Claims

1. A vehicle-mounted electronic control device, installed in a vehicle, characterized in that, have: The first driver outputs a first drive signal that drives the first device equipped in the vehicle; The second driver outputs a second drive signal to drive the second device equipped in the vehicle; A driver control unit controls the operating states of the first driver and the second driver respectively; as well as A computing device having multiple computing units that perform control processing for controlling the vehicle; The computing device includes a first computing unit and a second computing unit as the computing unit. The first arithmetic unit performs a first process for controlling the first device and controls the first driver according to the result. The second arithmetic unit performs a second process for controlling the second device and controls the second driver according to the result. The computing device outputs a confirmation signal indicating whether the control process is being executed normally. The first arithmetic unit outputs a first action confirmation signal indicating whether the first process is being executed normally, as the confirmation signal. The second arithmetic unit outputs a second action confirmation signal indicating whether the second process is being executed normally, as the confirmation signal. If the first action confirmation signal indicates that the first process was executed normally and the second action confirmation signal indicates that the second process was not executed normally, the driver control unit causes the first driver to operate normally and sets the second driver to a simplified state compared to normal operation. If the first action confirmation signal indicates that the first process was not executed normally and the second action confirmation signal indicates that the second process was executed normally, the driver control unit sets the first driver to a simplified state compared to normal operation, and causes the second driver to perform normal operation. The driver control unit controls the first driver without outputting the first drive signal, thereby setting the first driver to a simplified state compared to normal operation. The driver control unit controls the second driver without outputting the second drive signal, thereby setting the second driver to a simplified state compared to normal operation; or, The driver control unit sets the first driver to continue operating without relying on the first drive signal, thereby setting the first driver to a simplified state compared to normal operation. The driver control unit sets the second driver to continue operating without relying on the second drive signal, thereby setting the second driver to a simplified state compared to normal operation.

2. The vehicle-mounted electronic control device according to claim 1, characterized in that, The vehicle-mounted electronic control device also includes a computing device monitoring unit for monitoring malfunctions within the computing device. The vehicle-mounted electronic control device also includes a reset control unit that outputs a reset signal to reset the computing device. When the confirmation signal indicates that all the computing units equipped in the computing device are malfunctioning, and the computing device monitoring unit detects that a malfunction has occurred inside the computing device, the reset control unit outputs the reset signal to the computing device, thereby resetting the computing device.

3. The vehicle-mounted electronic control device according to claim 1, characterized in that, Even if the first action confirmation signal indicates that the first process has not been executed normally, the arithmetic unit continues the first process performed by the first arithmetic unit. Even if the second action confirmation signal indicates that the second process has not been executed normally, the arithmetic unit continues the second process performed by the second arithmetic unit.

4. The vehicle-mounted electronic control device according to claim 1, characterized in that, Even if the first action confirmation signal indicates that the first process has not been executed normally, the arithmetic unit continues the second process performed by the second arithmetic unit. Even if the second action confirmation signal indicates that the second process has not been executed normally, the arithmetic unit continues the first process performed by the first arithmetic unit.

5. The vehicle-mounted electronic control device according to claim 1, characterized in that, The functional safety level required for the first processing is higher than that required for the second processing. The vehicle-mounted electronic control device also includes a computing device monitoring unit for monitoring malfunctions within the computing device. The vehicle-mounted electronic control device also includes a response monitoring unit that monitors whether the first computing unit is operating normally. When the first action confirmation signal indicates that the first process is being executed normally and the second action confirmation signal indicates that the second process is being executed normally, and the computing device monitoring unit detects that a malfunction has occurred inside the computing device, and the response monitoring unit detects that the first computing unit is operating normally, the driver control unit causes the first driver to operate normally, and sets the second driver to a simplified state compared to normal operation.

6. The vehicle-mounted electronic control device according to claim 1, characterized in that, The functional safety level required for the first processing is higher than that required for the second processing. The vehicle-mounted electronic control device also includes a computing device monitoring unit for monitoring malfunctions within the computing device. The vehicle-mounted electronic control device also includes a response monitoring unit that monitors whether the first computing unit is operating normally. When the first action confirmation signal indicates that the first process is being executed normally and the second action confirmation signal indicates that the second process is being executed normally, and the computing device monitoring unit detects a malfunction within the computing device, and the response monitoring unit detects that the first computing unit is not operating normally, the driver control unit temporarily sets the first driver to a simplified state compared to normal operation, and causes the second driver to operate normally.

7. The vehicle-mounted electronic control device according to claim 6, characterized in that, The vehicle-mounted electronic control device also includes a reset control unit that outputs a reset signal to reset the computing device. If the first action confirmation signal indicates that the first process is being executed normally, and the second action confirmation signal indicates that the second process is being executed normally, and the computing device monitoring unit detects a malfunction within the computing device, and the response monitoring unit detects that the first computing unit is not operating normally for a continuous period of time, the reset control unit outputs the reset signal to the computing device, thereby resetting the computing device.

8. The vehicle-mounted electronic control device according to claim 2, characterized in that, If, after the confirmation signal indicates that either the first process or the second process is malfunctioning, and before the computing device is reset, the confirmation signal changes to indicate that both the first process and the second process are functioning normally, the driver control unit causes both the first driver and the second driver to operate normally.

9. The vehicle-mounted electronic control device according to claim 1, characterized in that, At least one of the first driver and the second driver outputs a drive signal for driving at least one of the following three: an actuator of the engine equipped in the vehicle, a circuit that supplies charging current for charging the battery equipped in the vehicle, and a heat treatment system for controlling the heat of the vehicle.

Images