Electronic control device

Abstract

To provide an electronic control device capable of detecting a failure of a start signal fixed to an active level even when a failure occurs in a microcomputer.SOLUTION: An integrated circuit device 3 of an ECU 1 is configure to: have a start signal monitoring part 11 for monitoring a start signal WKIN input from the outside, and an MCU signal monitoring part 12 for monitoring a control signal input from the MCU 2; and start an internal power supply of the ECU 1 on the basis of the start signal WKIN. The integrated circuit device 3 detects, as a failure, that the start signal WKIN is fixed to an active level, on the basis of a monitoring result of the start signal WKIN and a monitoring result of the control signal.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an electronic control device that is mounted on a vehicle and includes a microcomputer and an integrated circuit device that starts an internal power supply based on a start signal input from the outside. [Background technology]

[0002] Conventionally, one method for detecting a failure of a start signal in a vehicle electronic control unit involves monitoring the voltage of the signal by a microcomputer (MCU, CPU). For example, Patent Document 1 discloses a configuration in which the voltage of a start signal (IG; ignition) from an external source and the voltage supplied via an internal switch that is turned on by the start signal are monitored to detect a stuck-on state of the internal switch that is operated by the start signal, and the MCU determines the failure. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2022-184459 Summary of the Invention [Problem to be solved by the invention]

[0004] However, with the above configuration, if the MCU fails, it becomes impossible to detect a stuck-on state. Furthermore, in recent years, an increasing number of electronic control devices have been equipped with circuit configurations that allow them to be started by other factors even when the start signal is off, in anticipation of OTA (Over The Air) and other technologies. Even with this configuration, it is not possible to distinguish between a normal on state and a stuck-on state when the start signal is off, and normal operating current continues to flow even when the state is stuck-on, which could result in damage or a dead battery.

[0005] Furthermore, if multiple paths are connected to a start signal, and any of the start signals is stuck ON, the integrated circuit device will be unable to shut down its internal power supply. Monitoring the voltage of all start signals would increase the circuit size, but with the recent trend toward an increasing number of pins and mounting density in integrated circuit devices, this may become difficult to achieve due to mounting constraints.

[0006] The present invention has been made in consideration of the above circumstances, and its object is to provide an electronic control device that can detect a failure in which the activation signal is stuck at an active level even when the microcomputer fails. [Means for solving the problem]

[0007] According to the electronic control device of claim 1, the integrated circuit device (3) has a start-up signal monitoring unit (11) that monitors a start-up signal input from the outside and a microcomputer signal monitoring unit (12) that monitors a control signal input from the microcomputer (2), and starts up the internal power supply of the device based on the start-up signal. Furthermore, the integrated circuit device detects a fault in which the start-up signal is stuck at an active level based on the results of monitoring the start-up signal and the control signal. With this configuration, even if the microcomputer fails, the integrated circuit device can detect a fault in which the start-up signal is stuck at an active level.

[0008] According to the electronic control device of claim 2, the start signal monitoring unit monitors the start signal by switching between an edge detection mode and a level detection mode. When the start signal changes to an inactive level after the microcomputer is released from reset, it outputs a mode switching signal as a control signal to the integrated circuit device. The start signal monitoring unit is initially in edge detection mode, and switches to level detection mode when the mode switching signal is input. The microcomputer signal monitoring unit detects the failure if no mode switching signal is input. This makes it possible to determine whether the start signal has changed normally or whether a failure has occurred that causes the start signal to be stuck at an active level.

[0009] According to the electronic control device of claim 3, the integrated circuit device includes a timer (13) that counts a specified time, and if no mode switching signal is input within the specified time of the timer after detecting an edge of the start signal, the internal power supply is cut off. This prevents the internal power supply of the electronic control device from continuing to be supplied when a failure is detected, which can prevent abnormal operation of the electronic control device and drain of the vehicle battery. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 2 is a functional block diagram showing the configuration of an electronic control device according to an embodiment. [Figure 2] 1 is a flowchart showing the operation of an integrated circuit device; [Figure 3] Flowchart showing MCU operation [Figure 4] Timing chart for normal operation [Figure 5] Operation timing chart when start signal WKIN is detected to be stuck ON [Figure 6] Operation timing chart when the MCU fails [Figure 7] Operation timing chart when the failure continues even after the MCU is reset, or when the MCU fails while the electronic control device is stopped and then remains stuck ON [Figure 8] Operation timing chart for the same case as in Figure 7, where the startup signal monitor remains in level detection mode when the MCU is reset and the failure continues DETAILED DESCRIPTION OF THE INVENTION

[0011] An embodiment will be described below. An electronic control device 1 mounted on a vehicle is an ECU (Electronic Control Unit) and includes an MCU (Micro Controller Unit) 2, an integrated circuit device 3, and a CAN_TR (Transceiver) 4. The vehicle's battery voltage is applied to a terminal BATT of the integrated circuit device 3 via a terminal BATT of the electronic control device 1, and is also applied to a terminal +B of the integrated circuit device 3 via a switch 5S of a relay 5 and a terminal +B of the electronic control device 1. The integrated circuit device 3 is a power supply IC, which generates and supplies internal power to the electronic control device 1 from the battery voltage, thereby starting up the entire electronic control device 1 and maintaining that state. In the following, terminal names and signal names are the same.

[0012] The battery voltage is also applied to the terminal MREL of the integrated circuit device 3 via the coil 5C of the relay 5 and the terminal MREL of the electronic control device 1. The terminal BATT is connected to the power supply terminal of CAN_TR4. The integrated circuit device 3 generates a 5V power supply using an internal power supply circuit, and supplies the power to the MCU 2 and the CAN power supply to CAN_TR4.

[0013] Furthermore, the battery voltage is applied to an ignition switch 6, a terminal IG of the electronic control device 1, and a start-up signal terminal WKIN of the integrated circuit device 3 via a level shifter 7. A communication terminal CAN of the electronic control device 1 is connected to a communication line of a CAN (Controller Area Network; registered trademark) which is an in-vehicle communication network, and is also connected to a terminal CAN of the CAN_TR4.

[0014] The terminal INH of CAN_TR4 is connected to the start signal terminal WKIN via a level shifter 8. The start signal terminal WKIN is also connected to the terminal GPO of the MCU2. The signal GPO is a start signal for the integrated circuit device 3 output by the MCU2. The high level of the signals IG and INH is the battery voltage, but the high level of the signal GPO is 5V, so the high level is converted to 5V by the level shifters 7 and 8. The terminal GPO is an input / output terminal, and the MCU2 can monitor the level of the start signal WKIN.

[0015] The terminal WKIN is directly connected to the output terminals of the level shifters 7 and 8 and the terminal GPO of the MCU 2, so that three signal lines are commonly connected to the terminal WKIN. The output ports of the level shifters 7 and 8 and the terminal GPO each have the driving capability to change the signal level with their own output.

[0016] The SPI (Serial Peripheral Interface) communication terminal SPI1 of the microcomputer MCU2 is connected to the communication terminal SPI of the CAN_TR4. Furthermore, the SPI communication terminal SPI2 of the MCU2 is connected to the communication terminal SPI of the integrated circuit device 3. The terminals WDC and RESET of the MCU2 are each connected to the same-named terminals of the integrated circuit device 3. When the MCU2 starts up, it periodically outputs a watchdog clear pulse from the terminal WDC. The integrated circuit device 3 outputs a reset signal for the MCU2 from the terminal RESET.

[0017] CAN_TR4, which corresponds to the communication interface unit, sets the signal INH to high level when it receives a startup command from the outside via CAN communication and inputs the startup signal WKIN to the integrated circuit device 3. CAN_TR4 keeps the signal INH at high level after receiving the startup command, but sets the signal INH to low level when a command is input from MCU2 via SPI communication. CAN_TR4 also communicates with other communication nodes connected via the communication terminal CAN and the communication network.

[0018] The integrated circuit device 3 includes an activation signal monitoring unit 11, an MCU signal monitoring unit 12, a timer 13, and a memory unit 14. The activation signal monitoring unit 11 is switchable between a level detection mode that detects voltage changes in the activation signal WKIN by level, and an edge detection mode that detects by rising edges. The MCU signal monitoring unit 12, which corresponds to the microcomputer signal monitoring unit, monitors each signal input from the MCU 2 and includes a watchdog timer that is cleared by the above-mentioned watchdog clear pulse.

[0019] The timer 13 is part of the MCU signal monitoring unit 12, and when the wake-up signal monitoring unit 11 detects a rising edge of the wake-up signal WKIN in edge detection mode, it starts counting a specified time, for example, 32 seconds. The signal SPI2 sent by the MCU 2 to the integrated circuit device 3 is a command to switch the wake-up signal monitoring unit 11 from edge detection mode to level detection mode, and corresponds to a mode switching signal. The storage unit 14 is a so-called memory. Data stored in the storage unit 14 can be read from outside via CAN communication.

[0020] Next, the operation of this embodiment will be described. Hereinafter, a high level of a signal may be referred to as ON, and a low level as OFF. Also, circled numbers in the figures are shown in parentheses. In the initial state, the wake-up signal monitoring unit 11 is in edge detection mode. Also, the signal MREL of the integrated circuit device 3 is at a high level. The wake-up signal WKIN is high active, and the reset signal is low active. Figures 2 and 3 show processing flowcharts for the integrated circuit device 3 and MCU 2, respectively, which will be described in conjunction with the timing charts from Figure 4 onwards.

[0021] <Normal operation timing chart> As shown in Figure 4, when a start command is input to the electronic control unit 1 via CAN communication, (1) CAN_TR4 sets the signal INH to high level, turning on the start signal WKIN. The integrated circuit device 3 detects the rising edge of the signal WKIN, sets the signal MREL to low level, and turns on the relay switch 5S. Then, it starts supplying internal power and starts the timer 13, which begins counting the specified time.

[0022] (2) The integrated circuit device 3 releases the reset of the MCU 2 and the internal reset. The MCU 2 shifts to normal operation and starts outputting the signal WDC (I1, M1). (3) The MCU2 sends a command to the CAN_TR4 via SPI communication to turn off the signal INH (M2). As a result, the signal INH turns off, and the startup signal WKIN also turns off, but the integrated circuit device 3 keeps the signal MREL at a low level and continues to supply internal power.

[0023] (4) The MCU2 monitors the level of the terminal GPO, and when it confirms that the start signal WKIN has turned OFF (M3; Y), it turns the signal GPO ON (M4). This turns the start signal WKIN ON again. The timer 13 is not reset, and continues counting from (1).

[0024] (5) Within the specified time counted by the timer 13, the MCU2 inputs a command from the terminal SPI1 to the terminal SPI of the integrated circuit device 3 to switch the start-up signal monitoring unit 11 to the level detection mode (M5). As a result, the MCU signal monitoring unit 12 of the integrated circuit device 3 determines that the MCU2 has started up normally (I2; Y) and switches the start-up signal monitoring unit 11 to the level detection mode (I3). Then, the signal MREL is set to low level, and the supply of internal power continues. The following (6) to (7) are the sequence when the electronic control device 1 is shut down (M7; N).

[0025] (6) When the MCU2 turns off the signal GPO (M9), the start-up signal WKIN turns off. The start-up signal monitor 11, in level detection mode, detects that the start-up signal WKIN has turned off (I9; Y). Then, the integrated circuit device 3 turns the signal MREL to high level and cuts off the supply of internal power (I6).

[0026] (7) The integrated circuit device 3 outputs a reset signal (I6) to reset the MCU 2. This initializes the start signal monitor 11 to the edge detection mode.

[0027] <Operation timing chart when start signal WKIN is detected to be stuck ON> In FIG. 5, the sequences (1) and (2) are the same as those in FIG. (3) MCU2 sends a command to CAN_TR4 to turn off the signal INH, but the signal INH does not turn off, causing the start signal WKIN to be stuck on. (4) Since the signal INH does not turn OFF (M3;N), the MCU2 does not output the signal SPI2 and the subsequent signal GPO.

[0028] (5) The timer 13 started in (1) finishes counting the specified time (I2;N). As a result, the integrated circuit device 3 determines that the start signal WKIN is stuck ON, sets the signal MREL to high level, and turns off the internal power supply to cut off the operating current (I6). In addition, fault information of the stuck ON state is stored in the memory unit 14 (I8). (6) The integrated circuit device 3 outputs a reset signal to reset the MCU 2.

[0029] The fault information stored in the storage unit 14 can be read from outside via CAN communication (I7). The communication sequence is as follows: A request to read out fault information is sent to ECU1 from outside via CAN communication. ·CAN_TR4 sends a read request to MCU2 via SPI communication. The MCU 2 reads out the failure information from the memory unit 14 of the integrated circuit device 3 via SPI communication. · The MCU2 transmits the fault information to CAN_TR4 via SPI communication. · CAN_TR4 transmits the fault information externally via CAN communication.

[0030] <Operation timing chart when MCU2 fails> In FIG. 6, the sequences (1) to (5) are the same as those in FIG. 4. (6) During normal operation, if the output of the signal WDC from the MCU2 is interrupted (M6; N → M8), the watchdog timer in the MCU signal monitoring unit 12 counts up, and the integrated circuit device 3 determines that the MCU2 has failed (I4; Y).

[0031] (7) The integrated circuit device 3 outputs a reset signal to reset the MCU2 and initializes the startup signal monitoring unit 11 to the detection mode at the edge. Further, the signal MREL is set to the high level, and the internal power supply is turned off to cut off the operating current (I6). Also, the fault information of ON fixation is stored in the storage unit 14 (I5).

[0032] <When the fault continues even after the reset of the MCU2 in (7) of FIG. 6, or When a fault occurs in the MCU2 during the stop of the electronic control device 1, and then Operation timing chart when an ON fixation of the startup signal WKIN occurs> (1) As shown in FIG. 7, an ON fixation of the signal INH occurs, and the MCU signal monitoring unit 12 detects the rising edge of the startup signal WKIN and becomes the same as (1) in FIG. 2.

[0033] (2) The integrated circuit device 3 releases the reset of the MCU2, but since it is faulty, it cannot output the signal WDC, and the integrated circuit device 3 determines that the MCU2 has failed and issues a reset again. (3) Since the MCU2 is faulty, the signal GPO is not output. (4) Similarly, since it is faulty, a command to lower the signal INH is not output to the CAN controller 4.

[0034] (5) Because of this failure, no command is output to the integrated circuit device 3 to switch the start signal monitoring unit 11 to the level detection mode. Therefore, the start signal monitoring unit 11 remains in the edge detection mode, and the timer 13 continues counting the specified time. (6) The timer 13 completes counting the specified time, and (5) it determines that the startup signal is stuck ON because there is no mode switching signal output from the MCU 2 (I2;N). The integrated circuit device 3 sets the signal MREL to high level and turns off the internal power supply to cut off the operating current (I6).

[0035] For comparison, FIG. 8 shows a case similar to that of FIG. 7, in which the start signal monitor 11 of the integrated circuit device 3 remains in the level detection mode when the MCU 2 is reset, and the failure continues. (1) As in Figure 5, when the start signal WKIN is stuck ON, the start signal monitoring unit 11 detects a change in the level of the start signal WKIN, causing the signal MREL to go low and start supplying internal power. However, because it does not detect a rising edge, the timer 13 does not start. The following (2) to (5) are the same operations as in Figure 5, but because the timer 13 does not start in (1), the signal MREL continues to go low and the internal power supply continues even after the specified time has elapsed. This causes the operating current to continue flowing, draining the vehicle battery. To prevent this from happening, as shown in Figure 5, the start signal monitoring unit 11 is initialized to edge detection mode when the MCU 2 is reset.

[0036] As described above, according to this embodiment, the integrated circuit device 3 of the ECU 1 has a start-up signal monitoring unit 11 that monitors the start-up signal WKIN input from the outside and an MCU signal monitoring unit 12 that monitors the control signal input from the MCU 2, and starts up the internal power supply of the ECU 1 based on the start-up signal WKIN. Furthermore, the integrated circuit device 3 detects a fault in which the start-up signal WKIN is stuck at an active level based on the results of monitoring the start-up signal WKIN and the control signal. With this configuration, even if the MCU 2 fails, the integrated circuit device 3 can detect a fault in which the start-up signal WKIN is stuck at an active level.

[0037] Furthermore, the start signal monitoring unit 11 monitors the start signal WKIN by switching between edge detection mode and level detection mode. When the start signal WKIN changes to an inactive level after reset is released, the MCU 2 outputs a mode switching signal SPI2 as a control signal to the integrated circuit device 3. The start signal monitoring unit 11 is initially in edge detection mode, but switches to level detection mode when a mode switching signal is input. The MCU signal monitoring unit 12 detects the above-mentioned failure if no mode switching signal is input. This makes it possible to determine whether the start signal WKIN has changed normally or whether a failure has occurred that causes it to remain at an active level.

[0038] The integrated circuit device 3 also includes a timer 13 that counts a specified time, and if no mode switching signal is input within the specified time after detecting an edge of the start signal WKIN, the internal power supply is cut off. This prevents the ECU 1 from operating abnormally or the vehicle battery from being drained due to the internal power supply of the ECU 1 continuing to be supplied when a fault is detected.

[0039] Furthermore, when the integrated circuit device 3 outputs a reset signal to the MCU 2, it initializes the start signal monitoring unit 11 to the edge detection mode, so that the next time the start signal WKIN changes to a high level, the timer 13 can reliably start counting. Furthermore, the terminal WKIN of the integrated circuit device 3 is connected to the output terminal of a level shifter 7 that outputs a start signal when battery power is supplied via the vehicle's ignition switch 6, the output terminal of a level shifter 8 that sends a start command as a trigger from the outside via CAN communication and outputs the start signal from CAN_TR4, and the terminal GPO of the MCU2. This allows the number of terminals and implementation scale of the integrated circuit device 3 to be reduced. Furthermore, the ECU1 can be started from the outside via CAN communication. The start signal output from CAN_TR4 can be stopped by the MCU2 giving the signal SPI.

[0040] In addition, when the integrated circuit device 3 detects a failure, it stores the failure information in the storage unit 14, so that the failure information can be read from the outside via CAN communication to obtain diagnostic information. (Other embodiments) The specified time is not limited to 32 seconds.

[0041] The active level of the signal is not limited to a high level. When the start signal WKIN is low active, the start signal monitor 11 only needs to detect the falling edge. Instead of SPI communication between the MCU 2 and the integrated circuit device 3 and CAN_TR 4, command signals corresponding to SPI1 and SPI2 may be output via a single signal line.

[0042] The start command from the outside does not necessarily have to be input via communication, but may be input using a dedicated signal line. In-vehicle communication protocols are not limited to CAN. When the timer 13 is started by detecting the level of the start signal WKIN, the start signal monitor 11 may be set to only the level detection mode. Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and equivalent modifications. In addition, various combinations and forms, including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure. [Explanation of symbols]

[0043] In the drawing, 1 is an electronic control device, 2 is an MCU, 3 is an integrated circuit device, 4 is a CAN_TR, 6 is an ignition switch, 11 is a start signal monitoring unit, 12 is an MCU signal monitoring unit, 13 is a timer, and 14 is a memory unit.

Claims

1. It is mounted on a vehicle, a microcomputer (2); an integrated circuit device (3) having a start-up signal monitoring section (11) that monitors a start-up signal input from the outside and a microcomputer signal monitoring section (12) that monitors a control signal input from the microcomputer, and that starts up an internal power supply based on the start-up signal; The integrated circuit device is an electronic control device that detects, as a fault, when the activation signal is stuck at an active level, based on the monitoring results of the activation signal and the control signal.

2. the start-up signal monitoring unit has a function of monitoring the start-up signal by switching between an edge detection mode for detecting an edge of a voltage change and a level detection mode for detecting a level of the voltage change; The start signal is input to the microcomputer, When the start signal changes to an inactive level after the reset is released, the microcomputer outputs a mode switching signal as the control signal to the integrated circuit device; the start signal monitoring unit is initially in the edge detection mode, and switches to the level detection mode when the mode switching signal is input; 2. The electronic control device according to claim 1, wherein the microcomputer signal monitoring unit detects the failure if the mode switching signal is not input.

3. The microcomputer signal monitoring unit includes a timer (13) that counts a specified time, 3. The electronic control device according to claim 2, wherein if the mode switching signal is not input within a specified time of the timer after the edge of the start signal is detected, the internal power supply is shut off.

4. 4. The electronic control unit according to claim 2, wherein the integrated circuit device outputs a reset signal to the microcomputer, and initializes the start signal monitoring unit to the edge detection mode when outputting the reset signal.

5. 2. The electronic control device according to claim 1, wherein a signal line for outputting a start signal when battery power is supplied via an ignition switch (6) of the vehicle, a signal line for a start signal input from the outside via on-board communication, and a signal line for the control signal are connected to the terminal through which the start signal is input to the integrated circuit device.

6. The communication interface unit (4) for the in-vehicle communication is provided, 6. The electronic control device according to claim 5, wherein the communication interface unit outputs a start signal to the integrated circuit device when a start signal trigger is input from the outside via the in-vehicle communication.

7. 7. The electronic control device according to claim 6, wherein the communication interface unit stops outputting the activation signal when a control signal is input from the microcomputer.

8. the integrated circuit device includes a storage unit (14) from which data can be read from an external device via the in-vehicle communication; The electronic control device according to claim 5 , wherein when the failure is detected, failure information is stored in the storage unit.

Images