Electronic control device and diagnostic method for an electronic control device

Abstract

This invention provides an electronic control device that, in an electronic control device equipped with a microcomputer and a power supply IC, can perform high-reliability diagnosis of jamming in the safety control signal of the power supply IC before the microcomputer starts up. The device is characterized by including a microcomputer and a power supply IC that communicates with the microcomputer. The power supply IC has a monitoring circuit for monitoring the microcomputer, a safety processing circuit for outputting a safety control signal when the monitoring circuit determines that the microcomputer is abnormal, and a diagnostic circuit for diagnosing whether the safety control signal has a jamming fault. The diagnostic circuit detects the occurrence of a jamming fault based on the state of the safety control signal before and after the power supply starts up.

Description

Technical Field

[0001] This invention relates to the structure and control of electronic control devices, and particularly to effective techniques applicable to vehicle-mounted electronic control devices requiring high reliability. Background Technology

[0002] In recent years, vehicles equipped with driver assistance features such as steering and acceleration / deceleration support, hybrid vehicles that use electric motors in addition to existing engines, or electric vehicles that operate solely on electric motors have become increasingly common. Compared to the past, these vehicles have become more complex electronically controlled, requiring a higher level of safety control to bring the vehicle to a safe stop in the event of electronic component failure.

[0003] In the electronic control devices used in these vehicles, when a fault is detected, the electric motor, engine, etc. are safely stopped via a safety control signal. It is important to diagnose whether the safety control signal is functioning properly.

[0004] As background technology in this field, there is, for example, technology like Patent Document 1. Patent Document 1 discloses "a semiconductor device comprising: a control circuit that outputs a start signal for power supply; a power supply unit that starts supplying power voltage in response to the start signal; a timer that counts time in response to the start signal and outputs a count value; a first voltage comparator that compares a first predetermined voltage value with a voltage value supplied from the power supply unit and outputs it as a first comparison signal; a second voltage comparator that compares a second predetermined voltage value with a voltage value supplied from the power supply unit and outputs it as a second comparison signal; and an anomaly determination unit that detects the presence or absence of an anomaly based on the count value, the first comparison signal, and the second comparison signal."

[0005] Existing technical documents

[0006] Patent documents

[0007] Patent Document 1: Japanese Patent Application Publication No. 2017-149244 Summary of the Invention

[0008] The technical problem that the invention aims to solve

[0009] As mentioned above, with the increasing complexity and scale of automotive control systems, the risk of system malfunctions is rising. If the control function of an automotive control system fails, it will endanger not only the driver and passengers but also the surrounding environment, including pedestrians. Therefore, improving the reliability of each component of the system and the reliability of safety control functions such as safety control signals have become important issues.

[0010] The invention described in the aforementioned patent document 1 is effective for detecting abnormalities in the power supply itself, but there is room for improvement in detecting abnormalities in output signals other than the power supply output.

[0011] Therefore, the purpose of this invention is to provide an electronic control device and a diagnostic method for the electronic control device, which can perform a reliable diagnosis of the jamming of the safety control signal of the power supply IC before the microcomputer starts up.

[0012] Technical solutions to solve technical problems

[0013] To address the aforementioned problems, the present invention is characterized by including a microcomputer and a power supply IC that communicates with the microcomputer. The power supply IC has a monitoring circuit for monitoring the microcomputer, a safety processing circuit for outputting a safety control signal when the monitoring circuit determines that the microcomputer is abnormal, and a diagnostic circuit for diagnosing whether the safety control signal has a jamming fault. The diagnostic circuit detects whether a jamming fault occurs based on the state of the safety control signal before and after the power is turned on.

[0014] Furthermore, the present invention is a diagnostic method for an electronic control device including a microcomputer and a power supply IC communicating with the microcomputer. The method is characterized in that the power supply IC sequentially activates its internal power supplies before the microcomputer starts up, and after all internal power supplies have been activated, it sequentially activates safety control signals. Based on the state of the safety control signal corresponding to the activation of the internal power supply after the activation of the specified internal power supply, the method detects whether a jamming fault has occurred in the safety control signal.

[0015] The effects of the invention

[0016] According to the present invention, an electronic control device and a diagnostic method for the electronic control device can be realized. In an electronic control device equipped with a microcomputer and a power supply IC, the malfunction of the safety control signal of the power supply IC can be diagnosed before the microcomputer is started with high reliability.

[0017] Therefore, it is possible to detect abnormalities in the electronic control device before the vehicle is put into action, and to perform corresponding safety controls.

[0018] Other technical issues, structures, and effects not mentioned above will be further clarified through the following description of the implementation methods. Attached Figure Description

[0019] Figure 1 This is a block diagram illustrating the internal structure of the electronic control device and power IC involved in Embodiment 1 of the present invention.

[0020] Figure 2 yes Figure 1The timing diagram shows the startup sequence of the electronic control device.

[0021] Figure 3 yes Figure 1 The timing diagram of the safety control signals in the electronic control device is shown. (Under normal conditions)

[0022] Figure 4 yes Figure 1 The diagram shows the timing of safety control signals in the electronic control device. (During high-speed jamming abnormality)

[0023] Figure 5 yes Figure 1 The diagram shows the timing of safety control signals in the electronic control device. (During low-speed jamming abnormality)

[0024] Figure 6 yes Figure 1 The timing diagram shows an example of the operation of diagnosing the jamming of safety control signals in the electronic control device.

[0025] Figure 7 It is shown Figure 1 The timing diagram shows an example of the operation of diagnosing the jamming of safety control signals in the electronic control device.

[0026] Figure 8 This is a block diagram illustrating the internal structure of the engine electronic control device according to Embodiment 2 of the present invention.

[0027] Figure 9 This is a block diagram illustrating the internal structure of the inverter electronic control device according to Embodiment 3 of the present invention.

[0028] Figure 10 This is a flowchart of the diagnostic method for the electronic control device involved in Embodiment 4 of the present invention. Detailed Implementation

[0029] Hereinafter, embodiments of the present invention will be described using the accompanying drawings. Furthermore, in the drawings, the same reference numerals are used to denote the same structures, and detailed descriptions of repeated parts are omitted.

[0030] Example 1

[0031] Structure of Electronic Control Devices and Power Supply ICs

[0032] Reference Figures 1 to 7 The electronic control device and its diagnostic method involved in Embodiment 1 of the present invention will be described. Figure 1 This is a block diagram illustrating the internal structure of the electronic control device and power IC in this embodiment.

[0033] The electronic control device 1 in this embodiment is as follows: Figure 1As shown, it consists of a microcomputer (microcontroller) 2, a power supply IC 3, a sensor class 4, and peripheral circuits 5.

[0034] The microcomputer 2 acts as the brain of the electronic control device 1, using various control signals and input signals to control the peripheral circuits 5. In addition, it communicates with the power supply IC3 via the interface circuit 11, thereby writing information into the register 12, changing the settings of the power supply IC3, transmitting the state of the microcomputer 2 to the power supply IC3, or reading the information stored in the register 12 to confirm the state of the power supply IC3.

[0035] Power IC3 generates multiple power supply voltages from the battery voltage (not shown) and provides them to the microcomputer 2, other peripheral circuits 5, and external sensors (not shown). Figure 1 For example, the voltage generated by the power supply circuit 15 is supplied to the microcomputer 2 as power supply voltage output 1 and power supply voltage output 2. In addition, power supply voltage output 3 is supplied to the peripheral circuit 5. Here, power supply voltage outputs 1 to 3 are shown, but the target and quantity of power supply voltage outputs can be different.

[0036] The power supply circuit 15 and the drive circuit 17 are controlled by the sequencer 16, which starts the power supply voltage output 1 to 3 and various safety control signals according to the determined start sequence.

[0037] Here, "safety control signal" is a control signal used to control the system to a safe state in the event of an abnormality occurring inside or outside the electronic control device 1. Figure 1 In the diagram, three signals are shown as various safety control signals (safety control signals 1 to 3), but the number may vary depending on the system using the electronic control device 1.

[0038] Power supply voltage outputs 1-3 and various safety control signals (safety control signals 1-3) are output to the external power supply IC3 and simultaneously input to the diagnostic circuit 14 to diagnose any abnormalities. Furthermore, the abnormality diagnosis is performed at a timing specified by the sequencer 16. The diagnostic circuit 14 diagnoses whether the input signals are the desired output. If an abnormality is present, the diagnostic result is stored in the diagnostic information register 20 area inside register 12, and / or an abnormality status flag signal is output to the microcomputer 2, reporting the abnormality. Additionally, the information stored in the diagnostic information register 20 is reported to the microcomputer 2 via communication through the interface circuit 11. If the diagnostic circuit 14 detects a jamming fault in the safety control signals, the power supply IC3 outputs an abnormality status flag signal to the microcomputer 2 and stops supplying power to the microcomputer 2, preventing the microcomputer 2 from starting.

[0039] The monitoring circuit 18 is the circuit used by the power supply IC3 to monitor the microcomputer 2. The microcomputer 2 stores its own status in the register 12 via the interface circuit 11. The monitoring circuit 18 judges the information of the microcomputer 2 stored in the register 12 and outputs a microcomputer abnormality flag signal to the security processing circuit 13 to notify the microcomputer 2 of any abnormalities.

[0040] The safety processing circuit 13 is activated when the power supply IC3 detects an abnormality. It takes action based on the microcomputer abnormality flag signal input from the monitoring circuit 18, the diagnostic result input from the diagnostic circuit 14, and information such as temperature input from the sensor class 4. If a signal indicating an abnormality has occurred is input, the safety processing circuit 13 directly controls the drive circuit 17 and uses a safety control signal indicating no abnormality to transfer the system to a safe state.

[0041] Here, three signals are shown as inputs to the safety processing circuit 13, but any one or any combination of two signals can also be used. Furthermore, temperature information is shown as a signal from sensor class 4, but other information such as current or voltage can also be used, or information from multiple sensors can be utilized.

[0042] Startup sequence of power IC3

[0043] Figure 2 It is shown Figure 1 The timing diagram illustrates the startup sequence of the power supply IC3. (Using...) Figure 2 The startup process of power IC3 will be explained.

[0044] Figure 2 The internal state of power IC3, as shown in the timing diagram, is determined by sequencer 16. According to the sequence of power supply 1-3 starting and safety control signal 1-3 starting, the power supply voltage output 1-3 and safety control signal 1-3 are started sequentially as shown in the figure.

[0045] "Anomaly Diagnosis Based on Safety Control Signals of Power Supply IC3"

[0046] The method for determining the abnormality of the safety control signal by the diagnostic circuit 14 is explained.

[0047] [During normal operation]

[0048] Figure 3 This is a timing diagram showing an example of the normal operation of the safety control signal output by power supply IC3. Here, the level after the power supply voltage output 2 is started is set to Vcc, the high level of safety control signal 1 is set to Vcc, and the low level is set to GND. Figure 3The safety control signal 1x shown is a negative logic signal; a low level indicates that certain functions are active, and a high level indicates that certain functions are inactive. The case where safety control signal 1x is used and the safety control signal is a negative logic signal is also explained.

[0049] according to Figure 3 The sequencer (16) is in the state shown. When power supply 2 is enabled, power supply voltage output 2 is started. Then, when safety control signal 1 is enabled, safety control signal 1 is started at Vcc level, and safety control signal 1x is started at GND level. Here, when power supply voltage output 2 is enabled, safety control signal 1x is transitioned to the initial state of negative logic signal, i.e., Vcc level.

[0050] Diagnostic testing of safety control signals is performed by verifying the signal levels before and after the activation of the safety control signals.

[0051] Figure 1 In the process, during the power supply 3 startup state, the level check timing 1 performs a signal level check before startup, and during the safety control signal 1 startup state, the level check timing 2 performs a signal level check after startup.

[0052] If the safety control signal is started normally according to the sequencer (16), the signal level of safety control signal 1 before starting should be GND (low level), and the signal level after starting should be Vcc (high level). The signal level of safety control signal 1x before starting should be Vcc (high level), and the signal level after starting should be GND (low level). That is, under the condition that the safety control signal operates normally, the diagnostic circuit 14 will judge the result as normal when the signal levels before and after starting are different.

[0053] [High choking abnormality]

[0054] Figure 4 This is a timing diagram illustrating an example of operation when the control signal output by power supply IC3 experiences a high-level lag abnormality. Here, it is related to... Figure 3 Similarly, the level of the safety control signal is defined, and the timing for checking the signal level is also set to the same.

[0055] According to the state shown by the sequencer (16), the power supply voltage output 2 is started when the power supply 2 is started. Then, when the safety control signal 1 is started, the safety control signal 1 and the safety control signal 1x are started. However, if the power supply voltage output 2 and the safety control signal 1 or the safety control signal 1x are stuck, the safety control signal 1 / safety control signal 1x performs the same action as the power supply voltage output 2.

[0056] Therefore, safety control signal 1 / safety control signal 1x has been at the Vcc level since before the original startup timing. That is, in the event of a high jamming abnormality in the safety control signal, under the condition that the signal level before and after startup is both Vcc (high level), the diagnostic circuit 14 will determine the result as a high jamming abnormality.

[0057] [When low kinetic energy is abnormal]

[0058] Figure 5 This is a timing diagram illustrating an example of operation when the control signal output by power supply IC3 experiences a low-speed lag abnormality. Here, it is related to... Figure 3 Similarly, the level of the safety control signal is defined, and the timing for checking the signal level is also set to the same.

[0059] Based on the internal state of power IC3, power supply voltage output 2 is started when power supply 2 is enabled. Subsequently, when safety control signal 1 is enabled, safety control signal 1 and safety control signal 1x are enabled. However, if GND (low level) and safety control signal 1 or safety control signal 1x are stuck, safety control signal 1 / safety control signal 1x performs the same action as GND.

[0060] Therefore, safety control signal 1 / safety control signal 1x is also at the GND level after the startup timing. That is, in the event of a low-level jamming abnormality in the safety control signal, under the condition that the signal level before and after startup is both GND (low level), the diagnostic circuit 14 will determine the result as a low-level jamming abnormality.

[0061] Example 1 of determining abnormal jamming between safety control signals

[0062] Figure 6 This is a timing diagram illustrating an example of diagnosing the inter-signal jamming of the safety control signals output by power supply IC3. Here, the case of diagnosing the jamming of safety control signal 1 and safety control signal 2 will be explained.

[0063] Figure (a) shows an example of normal operation. According to the sequencer (16), safety control signal 1 is activated when safety control signal 1 is activated, and safety control signal 2 is activated when safety control signal 2 is activated. The jamming with safety control signal 1 is confirmed by checking the signal level before and after the activation of safety control signal 2. That is, the level check timing 1 in the state where safety control signal 1 is activated performs a signal level check before activation, and the level check timing 2 in the state where safety control signal 2 is activated performs a signal level check after activation.

[0064] The signal level of safety control signal 2 before startup is GND (low level) / the signal level after startup is Vcc (high level). Since the levels before and after startup are different, the diagnostic circuit 14 determines that there is no abnormality.

[0065] Figure (b) shows an example of abnormal operation, illustrating the action when safety control signal 1 and safety control signal 2 are stuck. In this case, safety control signal 2 performs the same action as safety control signal 1, switching to Vcc (high level) at the start time of safety control signal 1. Similar to the normal operation in (a), if the signal level is checked before and after the original start time of safety control signal 2, i.e., at the level check time 1 / 2, the signal level before and after start is Vcc (high level). Since the levels before and after start are the same, the diagnostic circuit 14 determines that the safety control signal is stuck abnormally.

[0066] Example 2 of determining abnormal jamming between safety control signals

[0067] Figure 7 This is a timing diagram illustrating other operational examples of diagnosing the jamming of the safety control signals output by power supply IC3. Here, the case of diagnosing the jamming of safety control signal 1 and safety control signal 2x will be explained. Safety control signal 2x is set as a negative logic signal.

[0068] Figure (a) shows a normal operating example. According to the sequencer (16), safety control signal 1 is activated when safety control signal 1 is activated, and safety control signal 2x is activated when safety control signal 2 is activated. Safety control signal 2x transitions to its initial state, Vcc (high level), when activated by power supply voltage output 2. Figure 6 Similarly, the timing of the level check before and after the activation of the safety control signal 2x is performed by timing 1 before activation, and the level check of the signal level after activation is performed by timing 2 when the safety control signal 2 is activated.

[0069] The signal level of safety control signal 2 before startup is Vcc (high level) / the signal level after startup is GND (low level). Since the levels before and after startup are different, the diagnostic circuit 14 diagnoses that the output of the safety control signal is normal.

[0070] Figure (b) shows an example of abnormal operation, illustrating the action when safety control signal 1 and safety control signal 2x are stuck. In this case, safety control signal 1 and safety control signal 2x perform the same action. Similar to the normal operation in (a), if the signal level is checked before and after the original start timing of safety control signal 2, i.e., at the level check timing 1 / 2, the signal level before and after start is Vcc (high level). Since the levels before and after start are the same, the diagnostic circuit 14 determines that the safety control signal is stuck abnormally.

[0071] Furthermore, by performing a diagnostic check for any jamming faults in various safety control signals before the safety control signal rises, it is possible to diagnose whether there is a short circuit between the internal power supply of power IC3 and the safety control signal. Additionally, by performing a diagnostic check for any jamming faults in various safety control signals after the safety control signal is activated, it is possible to diagnose, for example... Figure 3 The safety control signal 1 and safety control signal 1x shown are short-circuited.

[0072] As described above, the electronic control device 1 of this embodiment includes a microcomputer 2 and a power supply IC 3 that communicates with the microcomputer 2. The power supply IC 3 has a monitoring circuit 18 that monitors the microcomputer 2, a safety processing circuit 13 that outputs various safety control signals when the monitoring circuit 18 determines that the microcomputer is abnormal, and a diagnostic circuit 14 that diagnoses whether there is a jamming fault in various safety control signals. The diagnostic circuit 14 detects whether a jamming fault occurs based on the state of the safety control signal before and after the power is turned on.

[0073] In addition, the diagnostic circuit 14 detects the status of the safety control signal during the period after power-on but before the safety control signal is activated, and detects the status of the safety control signal after the safety control signal is activated. By comparing the status of the safety control signal before and after activation, it diagnoses whether there is a jamming fault in the safety control signal.

[0074] In addition, the diagnostic circuit 14 completes the diagnosis of the safety control signals performed by the diagnostic circuit 14 before the microcomputer 2 is started.

[0075] Then, the power IC3 controls the safety control signal that no jamming fault has been detected, causing the system, the object controlled by the electronic control device 1, to transfer to a safe state.

[0076] According to this embodiment, the power IC3 can be diagnosed as stuck before the microcomputer 2 starts up, and the electronic control device 1 and its controlled object, i.e., the system, can be safely controlled.

[0077] Example 2

[0078] Examples of Electronic Control Units for Engines

[0079] Reference Figure 8 The electronic control device and its control involved in Embodiment 2 of the present invention will be described.

[0080] This embodiment is an example of an engine electronic control device that applies engine control to the electronic control device of Embodiment 1. Figure 8 This is a block diagram illustrating the internal structure of the engine electronic control device in this embodiment.

[0081] The electronic control device 1A in this embodiment is as follows: Figure 8 As shown, except for Example 1 ( Figure 1 The structure of the electronic control device 1 further includes drivers 6A and 6B for driving the electronically controlled throttle valve 21 and injector 24, respectively. Drivers 6A and 6B are controlled by drive control signals from the microcomputer 2.

[0082] The drive circuit 17 outputs a reset signal, an electronic throttle enable signal, and an injector enable signal as safety control signals. The reset signal is used to reset the microcomputer 2. The electronic throttle enable signal is input to the driver 6A to toggle the activation / deactivation of the electronic throttle 21 control performed by the microcomputer 2. Furthermore, the injector enable signal is input to the driver 6B to toggle the activation / deactivation of the injector 24 control performed by the microcomputer 2.

[0083] The electronically controlled throttle valve 21 is a valve that electronically controls the amount of air entering the engine and adjusts the engine's output. The electronically controlled throttle valve 21 adjusts the amount of air introduced from the outside and delivers it to the engine.

[0084] Injector 24 is used to deliver fuel in a mist form into the cylinders of the engine. Fuel supplied from fuel tank 23 is pressurized by high-pressure pump 22 and injected in a mist form through injector 24.

[0085] In the event of a malfunction in the electronic control unit 1A, the electronic throttle enable signal can be used to stop the electronic throttle 21, cutting off the air supply to the engine, or the injector enable signal can be used to stop the injector 24, cutting off the fuel supply to the engine. Furthermore, by resetting the microcomputer 2 using a reset signal, the electronic throttle 21 and injector 24 can be controlled and safely stopped.

[0086] Additionally, as in Example 1 ( Figure 3 As explained in the document, after all the internal power supplies of power IC3 are activated, the enable signals (safety control signals) will rise one by one to activate the electronic control throttle enable signal and the injector enable signal.

[0087] Furthermore, if the reset signal output from the drive circuit 17 is made to start last relative to other safety control signals, then abnormality diagnosis of all safety control signals can be performed before the system starts.

[0088] Example 3

[0089] Examples of electronic control devices for electric vehicles

[0090] Reference Figure 9 The electronic control device and its control involved in Embodiment 3 of the present invention will be described.

[0091] This embodiment is an example of applying the electronic control device of Embodiment 1 to the inverter electronic control device for controlling the motor of an electric vehicle. Figure 9 This is a block diagram illustrating the internal structure of the inverter electronic control device in this embodiment.

[0092] The electronic control device 1B in this embodiment is as follows: Figure 9 As shown, except for Example 1 ( Figure 1 In addition to the structure of the electronic control device 1, it also includes a power module 8 for driving the motor 26, a gate driver 7 for controlling the power module 8, a capacitor 10 for storing charge from the HV (high voltage) battery 25, and a discharge circuit 9 for discharging the charge stored in the capacitor 10.

[0093] The drive circuit 17 outputs a reset signal, a gate drive control signal, and an active discharge signal as safety control signals. The reset signal is used to reset the microcomputer 2.

[0094] In addition, for ease of understanding, Figure 9 The main structure of the electronic control device 1B is omitted, but the motors used in electric vehicles are generally three-phase AC motors and require three types of drive signals. Therefore, three power modules 8 are actually needed. In addition, each power module carries two transistors. To control three power modules, six gate drivers are required, and six control signals are used for control.

[0095] In the event of an malfunction in the electronic control device 1B, the gate driver 7 is controlled by the gate drive control signal output from the drive circuit 17, the motor 26 is safely stopped by controlling the power module 8, and the discharge circuit 9 is controlled by controlling the active discharge signal, thereby safely discharging the charge stored in the capacitor 10 from the HV battery 25. Furthermore, by resetting the microcomputer 2 using a reset signal, the system using the electronic control device 1B can be safely stopped.

[0096] Furthermore, if the reset signal output from the drive circuit 17 is made to start last relative to other safety control signals, then abnormality diagnosis of all safety control signals can be performed before the system starts.

[0097] Example 4

[0098] System startup process

[0099] Reference Figure 10 The control method (diagnostic method) of a representative electronic control device of the present invention will be described. Figure 10 This shows the application of Example 1 ( Figure 1 A flowchart illustrating the processing actions from startup to startup in the electronic control device 1 system.

[0100] When power is supplied to the electronic control device 1 (step S100), the power supply IC3 starts up (step S101). When the power supply IC3 starts up, each generated internal power supply starts up sequentially (step S102). When one internal power supply finishes starting up (step S103), the remaining internal power supplies also start up sequentially. After all internal power supplies have finished starting up (step S104), the safety control signal is activated. Alternatively, if the starting up of all internal power supplies is not completed in step S104, the process returns to step S102, and each internal power supply starts up sequentially.

[0101] The safety control signals output by power IC3 are also started sequentially (step S105). First, a level check is performed on the safety control signals (step S106). After the safety control signals are started (step S107), a level check is performed on the safety control signals after startup (step S108). Then, the results of the level checks performed before and after startup are used to perform a jam diagnosis on the safety control signals (step S109). Regardless of the diagnosis result, the state of the diagnosed safety control signals is stored in register 12 (step S110). The processing of each safety control signal up to this point is performed, and the startup of the safety control signals ends (step S111), and the startup of power IC3 ends (step S112). Alternatively, if the startup of all safety control signals in step S111 is not yet complete, the process returns to step S105, and each safety control signal is started sequentially.

[0102] Here, power IC3 confirms whether there is any jamming abnormality in the safety control signal (step S113). If there is no jamming abnormality (yes), it proceeds to system startup (step S114). On the other hand, if there is a jamming abnormality (no), it outputs a jamming abnormality diagnostic flag signal to microcomputer 2 (step S115), notifying microcomputer 2 of the abnormality. Microcomputer 2 detects the abnormality of the safety control signal using the register information and jamming abnormality diagnostic flag signal saved in step S110 (step S116), performs corresponding processing when the abnormality occurs (step S117), and controls the system to stop it in a safe state (step S119).

[0103] Furthermore, after outputting the stuck abnormality diagnostic flag signal, the power supply IC3 performs a preset (specified) action through register 12, etc. (step S118), which can control the system to stop it in a safe state (step S119). The preset action can take various possibilities, such as not performing any action, stopping the voltage output to the outside, or outputting a safety control signal to safely stop the system.

[0104] In addition, the safety control signal in this embodiment includes at least one of the following: a reset signal for the microcomputer 2, an enable signal for the injector 24, an enable signal for the electronically controlled throttle 21, a control signal for the gate driver (IC) 7, and a signal related to active discharge, as described in Embodiments 1 to 3 above.

[0105] Furthermore, in the above embodiments, the structures of control lines and information lines necessary for the description are shown, but it is not limited to showing all the control lines and information lines necessary for the product.

[0106] Furthermore, the structures of the functional blocks in the above embodiments are merely examples. Several functional structures shown as different functional blocks can be integrated into one unit, or the structure shown in one functional block diagram can be divided into two or more functions. Additionally, other functional blocks can be configured to possess some of the functions of each functional block.

[0107] Furthermore, the above embodiments can be combined separately. Various embodiments have been described above, but the present invention is not limited to these. Other embodiments that can be conceived within the scope of the inventive concept are also included within the scope of the present invention.

[0108] Label Explanation

[0109] 1. 1A, 1B Electronic control devices

[0110] 2. Microcomputer (microcontroller)

[0111] 3 Power IC

[0112] 4. Sensor Class

[0113] 5. Peripheral Circuits

[0114] 6A and 6B drivers

[0115] 7. Gate Driver (IC)

[0116] 8 power modules

[0117] 9. Discharge Circuit

[0118] 10 Capacitors

[0119] 11 Interface Circuit

[0120] 12 registers

[0121] 13 Safety processing circuit

[0122] 14 Diagnostic Circuit

[0123] 15 Power Supply Circuit

[0124] 16 Sequencers

[0125] 17. Drive Circuit

[0126] 18. Monitoring circuit

[0127] 20 Diagnostic Information Register

[0128] 21 Electronic throttle control

[0129] 22 High-pressure pump

[0130] 23 Fuel Tank

[0131] 24 Injectors

[0132] 25 HV (high voltage) battery

[0133] 26. Electric motor.

Claims

1. An electronic control device, characterized by comprising: comprises: a microcomputer; and a power IC that communicates with the microcomputer, the power IC has: a monitoring circuit that monitors the microcomputer; a safety processing circuit that outputs a safety control signal when the monitoring circuit determines that the microcomputer is abnormal; and a diagnosis circuit that diagnoses whether the safety control signal has a stuck fault, the diagnosis circuit detects whether a stuck fault has occurred based on the state of the safety control signal before and after the safety control signal is activated from the state of the safety control signal after the power supply is activated until the safety control signal is activated.

2. The electronic control device according to claim 1, wherein the safety control signal includes at least one of a reset signal for the microcomputer, an enable signal for an injector, an enable signal for an electronic control throttle, a control signal for a gate drive IC, and a signal related to active discharge.

3. The electronic control device according to claim 1, wherein the diagnosis circuit detects the state of the safety control signal during a period before the safety control signal is activated after the power supply is activated, detects the state of the safety control signal during a period after the safety control signal is activated, diagnoses whether the safety control signal has a stuck fault by comparing the state of the safety control signal before and after the safety control signal is activated.

4. The electronic control device according to claim 1, wherein the power IC has a register that stores a diagnosis result of the diagnosis circuit.

5. The electronic control device according to claim 1, wherein the power IC outputs an abnormal state flag signal to the microcomputer so that the microcomputer does not activate in the case where the diagnosis circuit detects a stuck fault of the safety control signal.

6. The electronic control device according to claim 5, wherein the power IC stops a power supply voltage supplied to the microcomputer, thereby causing the microcomputer not to activate.

7. The electronic control device according to claim 1, wherein the diagnosis circuit completes diagnosis of the safety control signal by the diagnosis circuit before the microcomputer activates.

8. The electronic control device according to claim 1, wherein the power IC controls the safety control signal in which a stuck fault is not detected, so that a system that is a control object of the electronic control device shifts to a safe state.

9. A diagnosis method of an electronic control device, which is a diagnosis method of an electronic control device that includes a microcomputer and a power IC that communicates with the microcomputer, characterized by the power IC activates internal power supplies one by one before the microcomputer activates, after all of the internal power supplies are activated, a safety control signal that is used to control a system that is a control object to a safe state when the microcomputer is determined to be abnormal is activated one by one, a stuck fault of the safety control signal is detected based on the state of the safety control signal before and after the safety control signal corresponding to the internal power supply is activated from the state of the safety control signal after the specified internal power supply is activated.

10. The diagnosis method of an electronic control device according to claim 9, wherein The safety control signal includes at least one of a reset signal for the microcomputer, an enable signal for an injector, an enable signal for an electronically controlled throttle, a control signal for a gate drive IC, and a signal related to active discharge.

11. The diagnosis method of an electronic control device according to claim 9, wherein the state of the safety control signal is detected during a period before the safety control signal is activated after the internal power supply is activated, the state of the safety control signal is detected during a period after the safety control signal is activated, whether the safety control signal has a stuck fault is diagnosed by comparing the state of the safety control signal before and after activation.

12. The diagnosis method of an electronic control device according to claim 9, wherein the diagnosis result of the safety control signal is stored in a register of the power supply IC.

13. The diagnosis method of an electronic control device according to claim 9, wherein in the case where a stuck fault of the safety control signal is detected, an abnormal state flag signal is output to the microcomputer so that the microcomputer is not activated.

14. The diagnosis method of an electronic control device according to claim 13, wherein the microcomputer is not activated by stopping a power supply voltage supplied to the microcomputer.

15. The diagnosis method of an electronic control device according to claim 9, wherein the diagnosis of the safety control signal is completed before the microcomputer is activated.

Images