Electronic control device

Abstract

To enable a relay to be maintained to be on even during a reset of a microcomputer, and turned off not only when the microcomputer is abnormal, but when a part of the functions of the microcomputer is defective while the microcomputer is operating.SOLUTION: An electronic control device 10 includes: a microcomputer 20; a latch circuit 22 that holds a control signal for controlling on / off of a relay 11 to output a first signal; a microcomputer monitoring unit 21 that outputs a second signal; and an AND circuit 23 that outputs a logical product of the first signal and the second signal to the relay 11. The microcomputer monitoring unit 21 outputs the second signal for turning on the relay 11 where there is no abnormality, and outputs the second signal for turning off the relay 11 when there is an abnormality, on the basis of at least a test signal and a function diagnosis result of the microcomputer 20 during a period in which a reset signal is not input, and holds and outputs the second signal just before the reset signal is input, during a period in which the reset signal is input.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an electronic control device. [Background technology]

[0002] In an electric vehicle, a lithium-ion battery is connected to a drive motor via a relay, and the power supply is controlled by an electronic control device controlling the on / off of the relay.

[0003] Similarly, in automobiles having an internal combustion engine, a battery is connected to a starter motor via a starter relay, and the on / off of the starter relay is controlled by an electronic control device.

[0004] As a technique related to such an electronic control device, for example, Patent Document 1 is known.

[0005] FIG. 1, FIG. 2 and the abstract of Patent Document 1 state, "To provide an electronic control device that turns off a starter relay when a microcomputer is abnormal, and prevents the starter relay from being turned off even if a reset signal is output during cranking," and "The electronic control device includes a drive circuit for the starter relay, a microcomputer that outputs a control signal to the drive circuit, a microcomputer monitoring unit that determines whether the microcomputer is normal or not and outputs a first signal, a voltage monitoring unit that determines whether the power supply voltage is normal or not and outputs a second signal, and if the power supply voltage is not normal, outputs a reset signal to the microcomputer and the microcomputer monitoring unit as the second signal, a latch circuit that holds the immediately previous control signal until the next control signal is input regardless of the reset signal and outputs it as a third signal, and an AND gate that outputs the logical product of the first signal and the third signal to the drive circuit. The microcomputer monitoring unit holds and outputs the first signal immediately before the reset signal is output during the reset period."

[0006] Furthermore, claim 3 of Patent Document 1 states that "the microcontroller periodically outputs a test signal to the microcontroller monitoring unit for monitoring the validity of the operation of the microcontroller, and the microcontroller monitoring unit sets a specified time for monitoring the test signal and determines whether the microcontroller is operating normally based on whether the test signal is input within the specified time, and sets the specified time immediately after the output of the reset signal is stopped to a time longer than the specified times for other periods." [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2016-130967 A Summary of the Invention [Problem to be solved by the invention]

[0008] However, in the case of the technology described in Patent Document 1, the only method disclosed as a method for determining whether or not the microcomputer is normal in the microcomputer monitoring section is a method using a test signal that indicates that the microcomputer is operating.

[0009] Therefore, even if the microcontroller is operating (a test signal indicating that the microcontroller is operating is being output), no consideration is given to the case where some of the microcontroller's functions are malfunctioning, and there is no control to turn off (shut off) the relay for safety reasons in case of the possibility of an abnormality occurring now or in the future.

[0010] The problem that this invention aims to solve is to provide an electronic control device that controls the on / off of a relay connected between a battery and a load, which is capable of keeping the relay on even when a microcontroller is reset, and capable of turning the relay off not only when there is an abnormality in the microcontroller, but also when the microcontroller is operating but some of its functions are faulty. [Means for solving the problem]

[0011] In order to solve the above-mentioned problems, the electronic control device of the present invention is an electronic control device that controls the on / off of a relay connected between a battery and a load, and includes a microcomputer that outputs a control signal that controls the on / off of the relay, a test signal indicating that the microcomputer is operating, and a functional diagnosis result that is a diagnosis result of a partial failure of the function of the microcomputer, a reset signal output unit that outputs a reset signal to reset the microcomputer, a latch circuit that holds the immediately previous control signal until the next control signal is input and outputs it as a first signal, a microcomputer monitoring unit that monitors the microcomputer and outputs a second signal, and an AND circuit that outputs a logical product of the first signal and the second signal to the relay, and is characterized in that, during a period when the reset signal is not input, the microcomputer monitoring unit determines the presence or absence of an abnormality based on an abnormality diagnosis input including at least the test signal and the functional diagnosis result, and if there is no abnormality, outputs a signal to turn on the relay as the second signal, and if there is an abnormality, outputs a signal to turn off the relay as the second signal, and during a period when the reset signal is input, holds and outputs the second signal immediately before the reset signal is input as the second signal. Effect of the Invention

[0012] According to the present invention, in an electronic control device that controls the on / off of a relay connected between a battery and a load, the relay can be kept on even when a microcomputer is reset, and the relay can be turned off not only when there is an abnormality in the microcomputer, but also when the microcomputer is operating but some of its functions are faulty. [Brief description of the drawings]

[0013] [Figure 1] FIG. 2 is a functional block diagram of the electronic control device according to the embodiment. [Diagram 2] 4 is a flowchart for explaining the operation of the microcomputer according to the embodiment. [Diagram 3]5 is a flowchart for explaining the operation of a microcomputer monitoring unit according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In each drawing and each embodiment, the same or similar components are designated by the same reference numerals, and duplicated explanations will be omitted.

[0015] FIG. 1 is a functional block diagram of an electronic control device according to an embodiment of the present invention.

[0016] An electronic control device 10 of the embodiment controls the on / off of a relay 11 connected between a battery 13 and a load 12. The battery 13 is, for example, a lithium ion battery for an electric vehicle. The load 12 is, for example, a drive motor for the electric vehicle. In this embodiment, an example of relay control of a lithium ion battery for an electric vehicle will be described, but the present invention is not limited to this, and may be applied to general-purpose relay control such as control of a starter relay in an automobile having an internal combustion engine. In the case of an automobile having an internal combustion engine, for example, the load 12 is a starter motor, and the relay 11 is a starter relay. Note that in the case of an electric automobile, the relay 11 has a longer energization time than the starter relay, so the technology of this embodiment is more necessary.

[0017] The electronic control device 10 of the embodiment includes a microcomputer 20, a reset signal output unit 28, a latch circuit 22, a microcomputer monitoring unit 21, and an AND circuit 23.

[0018] The microcomputer 20 is, for example, a microcomputer having an arithmetic processing unit, memories such as ROM and RAM, an auxiliary storage device, an input / output interface, etc. The microcomputer 20 can realize various functional units by executing a program expanded on the memory in the arithmetic processing unit. The microcomputer 20 of this embodiment has, as its functional units, a function diagnostic unit 24, a latch circuit diagnostic unit 25, a battery diagnostic unit 26, and a relay control unit 27.

[0019] The relay control unit 27 judges whether to turn on (conduct) or off (disconnect) the relay 11 based on predetermined information and outputs a control signal. For example, the relay control unit 27 uses accelerator information and command information from other control units such as a driving control unit (not shown) to output a control signal to turn on the relay 11 when power is supplied to the drive motor for driving. In addition, when driving ends or a shutdown request is made, the relay control unit 27 outputs a control signal to turn off the relay 11 based on the information on the driving end or shutdown request.

[0020] Here, if the relay 11 is controlled only by this control signal, a problem occurs in that the relay 11 is unintentionally turned off when the microcomputer 20 is reset while the relay 11 is on. Also, if there is an abnormality in the microcomputer 20, it is necessary to turn off the relay 11. Furthermore, if the microcomputer 20 is operating (a test signal indicating that the microcomputer 20 is operating is output), but some of the functions of the microcomputer 20 are broken, it is desirable to turn off the relay 11 for safety in such a case as well, taking into consideration the possibility that an abnormality may occur now or in the future. Therefore, in this embodiment, this problem is solved by using the latch circuit 22, the microcomputer monitoring unit 21, the AND circuit 23, the test signal from the microcomputer 20, the function diagnosis result from the function diagnosis unit 24, and the reset signal from the reset signal output unit 28.

[0021] The latch circuit 22 holds the immediately preceding control signal until the next control signal is input, and outputs it as the first signal.

[0022] The microcomputer 20 outputs a test signal indicating that the microcomputer 20 is operating. The test signal is output at a predetermined cycle, for example.

[0023] The reset signal output unit 28 outputs a reset signal that resets the microcomputer 20. The reset signal output unit 28 outputs a reset signal, for example, when the power supply voltage that operates the microcomputer 20 drops below a predetermined value, when the microcomputer 20 needs to be initialized, or when an abnormality occurs in the microcomputer 20 and restarting is required. For example, the reset signal output unit 28 monitors a test signal from the microcomputer 20, and when the test signal is not input within a predetermined period of time, it determines that an abnormality has occurred in the microcomputer 20 and restarting is required, and outputs a reset signal.

[0024] Upon receiving the reset signal, the microcomputer 20 performs a reset operation.

[0025] The microcomputer monitoring unit 21 monitors the microcomputer 20 and outputs a second signal. The microcomputer monitoring unit 21 may be realized, for example, by an IC having logic configured by hardware, or may be realized by software using a microcomputer other than the microcomputer 20.

[0026] The AND circuit 23 outputs the logical product of the first signal and the second signal to the relay 11. As a result, if the first signal and the second signal are both signals that turn on the relay 11, a signal that turns on the relay 11 is output to the relay 11. On the other hand, if at least one of the first signal and the second signal is a signal that turns off the relay 11, a signal that turns off the relay 11 is output to the relay 11.

[0027] The function diagnostic unit 24 outputs a function diagnostic result which is a diagnostic result of a partial malfunction of the function of the microcomputer 20. For example, the function diagnostic unit 24 outputs the function diagnostic result by diagnosing an abnormality including either a memory abnormality or a memory access abnormality. Although the memory abnormality and the memory access abnormality are given as examples of the abnormality diagnosis, they are merely examples and are not limited to these.

[0028] As an example of memory abnormality diagnosis, for example, ROM / RAM diagnosis detects ROM damage or RAM corruption using the ECC (Error Checking and Correction) function of the microcomputer 20. If this abnormality occurs in a memory area related to the control of the relay 11, there is a possibility that the relay control unit 27 will not be able to output a control signal to turn off the relay 11 when desired. In such a case, the function diagnosis unit 24 outputs a result indicating an abnormality as the function diagnosis result.

[0029] As an example of memory access abnormality diagnosis, for example, when an address outside the range for which access has been permitted in advance is accessed during execution of control by the microcomputer 20, a memory access abnormality is detected. If this abnormality occurs in a memory area related to the control of the relay 11, an unintended value may be updated, which may cause the relay 11 to become uncontrollable. Therefore, in such a case, the function diagnosis unit 24 outputs a result indicating an abnormality as the function diagnosis result.

[0030] During a period when the reset signal is not being input, the microcomputer monitoring unit 21 determines whether or not there is an abnormality based on an abnormality diagnosis input including at least a test signal and a function diagnosis result, and if there is no abnormality, outputs as the second signal a signal to turn on the relay 11, and if there is an abnormality, outputs as the second signal a signal to turn off the relay 11. Furthermore, during a period when the reset signal is being input, the microcomputer monitoring unit 21 holds and outputs as the second signal the second signal that was present immediately before the reset signal was input.

[0031] While the microcomputer 20 is in the reset operation, the test signal is not output, but since the test signal is output normally until just before the reset signal is input, if there are no other abnormalities, the second signal that turns on the relay 11 is output just before the reset signal is input. Therefore, by holding and outputting the second signal just before the reset signal is input as the second signal during the period in which the reset signal is input, the relay 11 can be maintained on even while the microcomputer 20 is being reset.

[0032] On the other hand, when a reset occurs due to an abnormality occurring in the microcomputer 20, the test signal is not output even immediately before the reset signal is input, so that the microcomputer monitoring unit 21 determines that there is an abnormality and outputs a signal to turn off the relay 11 as the second signal immediately before the reset signal is input. Therefore, by holding and outputting the second signal immediately before the reset signal is input as the second signal during the period in which the reset signal is input, the relay 11 can be kept off even while the microcomputer 20 is being reset.

[0033] Furthermore, by using the results of functional diagnosis, even if the microcontroller 20 is operating (a test signal indicating that the microcontroller 20 is operating is being output), if some of the functions of the microcontroller 20 are faulty, the relay 11 can be turned off for safety reasons, taking into consideration the possibility that an abnormality may occur now or in the future.

[0034] Moreover, it is preferable that the abnormality diagnosis input in the microcomputer monitoring unit 21 includes the latch circuit diagnosis result.

[0035] The latch circuit diagnostic unit 25 diagnoses an abnormality of the latch circuit 22 based on the control signal and the first signal, and outputs a latch circuit diagnosis result. If the latch circuit 22 is faulty, the latch circuit 22 will be stuck regardless of the content of the control signal output from the microcomputer 20 to the latch circuit 22, so the latch circuit 22 failure is detected by comparing the instruction of the control signal with the second signal. At this time, if the instruction of the control signal and the second signal do not match, it is determined that the latch circuit 22 is stuck and in an abnormal state, and a result indicating the abnormality is output as the latch circuit diagnosis result. If the latch circuit 22 is faulty, the control signal cannot control the relay 11, so the microcomputer monitoring unit 21 outputs a signal to turn off the relay 11 as the second signal, so that the relay 11 can be turned off via the AND circuit 23 regardless of the content of the first signal.

[0036] Moreover, it is preferable that the abnormality diagnosis input in the microcomputer monitoring unit 21 includes the battery diagnosis result.

[0037] The battery diagnostic unit 26 diagnoses the battery 13 for abnormality and outputs the battery diagnostic result. For example, the battery diagnostic unit 26 receives the voltage measurement result of the battery 13 and diagnoses that the voltage of the battery 13 is within a threshold value. If an abnormality occurs, turning on the relay 11 may apply an overvoltage to the circuit, which may damage the circuit, so the battery diagnostic unit 26 outputs a result indicating the abnormality as the battery diagnostic result. As a result, the microcomputer monitoring unit 21 outputs a signal to turn off the relay 11 as a second signal, and the relay 11 is turned off.

[0038] In this embodiment, an example has been shown in which the microcomputer monitoring unit 21 turns off the relay 11 using the battery diagnosis result, but this is not limited to this. For example, the relay control unit 27 may output a control signal to turn off the relay 11 if there is an abnormality in the battery 13 based on the battery diagnosis result.

[0039] Furthermore, the abnormality diagnosis input in the microcomputer monitoring unit 21 may include diagnosis results other than those mentioned above.

[0040] Next, the operation of the microcomputer 20 and the microcomputer monitoring unit 21 of the embodiment will be described with reference to a flowchart.

[0041] FIG. 2 is a flow chart for explaining the operation of the microcomputer of the embodiment.

[0042] In S101, the microcomputer 20 judges whether a reset signal has been input. If a reset signal has been input, the process proceeds to S102, where a microcomputer reset process is performed and the process ends. If a reset signal has not been input, the process proceeds to S103.

[0043] In S103, the microcomputer 20 outputs a test signal. In S104, the function diagnostic unit 24, the latch circuit diagnostic unit 25, and the battery diagnostic unit 26 each perform a predetermined diagnosis and output the diagnosis results.

[0044] In S105, relay control unit 27 determines whether to turn on or off relay 11. If relay 11 is to be turned on, the process proceeds to S106, where the control signal is turned on (high level) as a signal for turning on relay 11. If relay 11 is to be turned off, the process proceeds to S107, where the control signal is turned off (low level) as a signal for turning off relay 11.

[0045] In S108, the microcomputer 20 judges whether there is a shutdown request. For example, when the driver presses a button to enter sleep mode after finishing driving, a shutdown request is input to the microcomputer 20 from the outside. If there is a shutdown request, the process ends. If there is no shutdown request, the process returns to S101 and is repeated.

[0046] 2 is an example, and the order may be changed as long as the process is not affected. Also, the diagnosis by the latch circuit diagnostic unit 25 may be performed between S106 and S107 and S108. When the diagnosis by the latch circuit diagnostic unit 25 is performed in S104, the control signal based on the result of the previous determination in S105 may be compared with the first signal.

[0047] 3 is a flow chart for explaining the operation of the microcomputer monitoring unit of the embodiment. The flow of FIG. 3 is repeatedly executed at a predetermined cycle.

[0048] In S201, the microcomputer monitoring unit 21 judges whether a reset signal is input. If a reset signal is input, the process proceeds to S206, where the second signal is held and output, and the process ends. If a reset signal is not input, the process proceeds to S202.

[0049] In S202, the microcomputer monitoring unit 21 judges whether the test signal is abnormal based on the test signal. If the test signal is abnormal, the process proceeds to S208. If the test signal is not abnormal, the process proceeds to S203.

[0050] In S203, the microcomputer monitoring unit 21 judges whether the function of the microcomputer 20 is abnormal based on the result of the function diagnosis. If the function is abnormal, the process proceeds to S208. If the function is not abnormal, the process proceeds to S204.

[0051] In S204, the microcomputer monitoring unit 21 judges whether the latch circuit 22 is abnormal based on the latch circuit diagnosis result. If the latch circuit 22 is abnormal, the process proceeds to S208. If the latch circuit 22 is not abnormal, the process proceeds to S205.

[0052] In S205, the microcomputer monitoring unit 21 judges whether or not the battery 13 is abnormal based on the battery diagnosis result. If the battery 13 is abnormal, the process proceeds to S208. If the battery 13 is not abnormal, the process proceeds to S207.

[0053] In S207, since the reset signal has not been input and there is no abnormality, in S207, the microcomputer monitoring unit 21 turns on (high level) the second signal as a signal for turning on the relay 11, and ends the process.

[0054] In S208, since the reset signal is not input and an abnormality exists, in S208, the microcomputer monitoring unit 21 turns off (low level) the second signal as a signal for turning off the relay 11, and ends the process.

[0055] It should be noted that the flow shown in FIG. 3 is merely an example, and the order may be changed as long as it does not impede the processing.

[0056] 3, if the result of the functional diagnosis is abnormal, relay 11 is immediately turned off, but if safety can be ensured without immediately turning relay 11 off, such as when the vehicle is not moving, the turning off of relay 11 may be delayed. This allows devices using battery 13 to normally perform shutdown processing, and reduces damage to the circuit due to forced cutoff of battery 13. In this case, if the result of the functional diagnosis is abnormal, microcomputer monitoring unit 21 may output a signal to turn off relay 11 as the second signal after a predetermined time has elapsed or based on a user selection.

[0057] Although the embodiments of the present invention have been described above, the present invention is not limited to the configurations described in the embodiments, and various modifications are possible within the scope of the technical concept of the present invention. In addition, some or all of the configurations described in each embodiment may be combined and applied. [Explanation of symbols]

[0058] 10 Electronic control device 11 Relay 12 Load 13 Battery 20 Microcomputer 21 Microcomputer monitoring section 22 Latch circuit 23 AND Circuit 24 Functional diagnostic section 25 Latch circuit diagnostic section 26 Battery diagnostic section 27 Relay control section 28 Reset signal output section

Claims

1. An electronic control device that controls the on / off of a relay connected between a battery and a load, a microcomputer that outputs a control signal for controlling the on / off of the relay, a test signal indicating that the microcomputer itself is operating, and a functional diagnosis result which is a diagnosis result of a partial failure of the microcomputer itself; a reset signal output unit that outputs a reset signal for resetting the microcomputer; a latch circuit that holds the immediately preceding control signal until the next control signal is input and outputs the hold signal as a first signal; a microcomputer monitoring unit that monitors the microcomputer and outputs a second signal; an AND circuit that outputs a logical product of the first signal and the second signal to the relay; the microcontroller monitoring unit, during a period when the reset signal is not input, determines whether or not there is an abnormality based on an abnormality diagnosis input including at least the test signal and the functional diagnosis result, and if there is no abnormality, outputs a signal to turn on the relay as the second signal, and if there is an abnormality, outputs a signal to turn off the relay as the second signal, and during a period when the reset signal is input, holds and outputs as the second signal the second signal immediately before the reset signal was input.

2. In claim 1, The electronic control device according to the present invention, wherein the microcomputer has a function diagnosis section which performs diagnosis of abnormalities including either a memory abnormality or a memory access abnormality and outputs the function diagnosis result.

3. In claim 1, the microcomputer has a latch circuit diagnosis unit that diagnoses an abnormality in the latch circuit based on the control signal and the first signal and outputs a latch circuit diagnosis result; 4. The electronic control device according to claim 1, wherein the abnormality diagnosis input from the microcomputer monitoring unit includes a latch circuit diagnosis result.

4. In claim 1, the microcomputer has a battery diagnostic unit that performs a diagnosis of an abnormality in the battery and outputs a battery diagnostic result; 4. The electronic control device according to claim 3, wherein the abnormality diagnosis input from the microcomputer monitoring unit includes a result of the battery diagnosis.

5. In claim 1, The electronic control device according to the present invention is characterized in that the microcomputer has a relay control section which determines whether to turn on or off the relay based on predetermined information and outputs the control signal.

6. In claim 1, The electronic control device is characterized in that, if the functional diagnosis result is abnormal, the microcontroller monitoring unit outputs a signal to turn off the relay as the second signal after a predetermined time has elapsed or based on a user's selection.

Images