Electronic control unit

Abstract

To provide an electronic control device capable of determining a reset factor even when the operation guarantee voltage values of a plurality of processing devices are the same.SOLUTION: Each CPU executes an end sequence. When the end sequence ends normally, each CPU writes information showing the end of the end sequence as start information in a non-volatile memory and stops power supply. When the end sequence ends with a reset instruction, each CPU stops power supply without writing information showing the end of the end sequence. At S13, when each CPU determines that an own CPU ended normally and the other CPU did not end normally, it determines that the other CPU itself is abnormal. At S16, when each CPU determines that the own CPU did not end normally and the other CPU ended normally, it determines that the own CPU itself is abnormal. At S17, when each CPU determines that the own CPU and the other CPU did not end normally, it determines that the power supply is abnormal.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to electronic control devices. [Background technology]

[0002] One example of an electronic device is a reset circuit for an electronic control device disclosed in Patent Document 1. The reset circuit has a first reset generating unit that resets a first CPU when a low voltage is detected in the power supply, and a second reset generating unit that resets a second CPU when a low voltage is detected in the power supply. The low voltage detection thresholds of the first reset generating unit and the second reset generating unit are set so that a voltage drop in the power supply is detected by the first reset generating unit earlier than by the second reset generating unit. The second CPU monitors the reset signal from the first reset generating unit and determines the cause of the reset based on the pulse width of the reset signal. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2007-41824 Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, an electronic control device may be configured with multiple CPUs that have the same guaranteed-operation power supply voltage value (guaranteed-operation value) and are powered by the same power supply. To apply the reset circuit of Patent Document 1 to such an electronic control device, the low-voltage detection threshold for resetting one CPU must be set to a value sufficiently higher than the guaranteed-operation value. This allows the electronic control device to determine the cause of the reset when one CPU is reset, and to store the determination result. However, in this case, the electronic control device resets the CPU at a power supply voltage value that does not require resetting.

[0005] Another disclosed object is to provide an electronic control device that can determine the cause of a reset even when a plurality of processing devices have the same guaranteed operating voltage value. [Means for solving the problem]

[0006] The electronic control device disclosed herein comprises: a plurality of processing devices (10, 20) that are supplied with power from a common power source and are capable of sharing information with each other through communication; a non-volatile memory (11, 21) for storing start-up information as information indicating whether each processing device has performed a termination process and terminated normally; a reset generating device (13, 23, 40) for outputting a reset command to a processing device in which an abnormality occurs when an abnormality occurs in the processing device itself or when a power supply abnormality occurs such that a power supply voltage applied to the processing device from a power source drops, Each processing device uses startup information of all processing devices to which power is supplied from a common power source to determine whether all processing devices were normally terminated at the time of the previous startup; Each processing device is When the termination process is performed and terminated normally, information indicating termination is written to the nonvolatile memory as startup information and the supply of power is stopped, and when the process is terminated by a reset command, the supply of power is stopped without writing the information indicating termination. a first determination step (S10) of determining whether the processing device was normally terminated at the previous startup depending on whether the startup information of the processing device read from the nonvolatile memory after startup indicates termination; a second determination step (S11) of determining whether the other processing device was normally terminated at the previous startup depending on whether the startup information of the other processing device acquired through communication after startup indicates termination; a first abnormality determination step (S13) of determining that the other processing device itself is abnormal if it is determined that the processing device itself has terminated normally and the other processing device has not terminated normally; If it is determined that the processing apparatus itself has not terminated normally and the other processing apparatuses have terminated normally, a second abnormality determination step (S16) is performed to determine that the processing apparatus itself has an abnormality; When it is determined that the processing apparatus itself and the other processing apparatuses have not terminated normally, a third abnormality determination step (S17) is provided in which it is determined that a power supply abnormality has occurred.

[0007] In this way, after startup, each processing device of the electronic control device determines whether its own processing device and the other processing devices terminated normally at the previous startup based on the startup information of its own processing device and the startup information of the other processing devices.Then, based on the determination result of whether its own processing device and the other processing devices terminated normally, the electronic control device determines that the reset cause is an abnormality in the other processing devices themselves or an abnormality in its own processing device itself.Furthermore, if the electronic control device determines that its own processing device and the other processing devices did not terminate normally, it determines that the reset cause is a power supply abnormality.As a result, the electronic control device can determine the reset cause even if the guaranteed operating voltage values ​​of multiple processing devices are the same.

[0008] The various aspects disclosed in this specification employ different technical means to achieve their respective objectives. The reference numerals in parentheses in the claims and in this section are intended to exemplify correspondences with the following embodiments and are not intended to limit the technical scope. The objectives, features, and advantages disclosed in this specification will become more apparent by reference to the following detailed description and the accompanying drawings. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a block diagram showing a schematic configuration of an electronic control device according to a first embodiment. [Figure 2] 4 is a flowchart showing the processing operation of the electronic control device in the first embodiment. [Figure 3] 4 is a time chart showing the processing operation when the electronic control device in the first embodiment is normally terminated. [Figure 4] 4 is a time chart showing the processing operation when the process ends with a reset of the electronic control device in the first embodiment. [Figure 5]FIG. 10 is a block diagram showing a schematic configuration of an electronic control device according to a second embodiment. [Figure 6] 10 is a flowchart showing the processing operation of an electronic control device in a second embodiment. [Figure 7] FIG. 10 is a block diagram showing a schematic configuration of an electronic control device according to a third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, several embodiments for carrying out the present disclosure will be described with reference to the drawings. In each embodiment, parts corresponding to matters described in the preceding embodiment may be assigned the same reference numerals, and duplicated explanations may be omitted. In each embodiment, when only a part of the configuration is described, the other parts of the configuration may be applied by referring to the other embodiment described previously.

[0011] (First embodiment) In this embodiment, as an example, an electronic control unit 101 is used that is mounted on a vehicle and controls on-board equipment. However, the electronic control unit 101 may also control a device other than on-board equipment. Furthermore, the electronic control unit 101 does not have to be mounted on a vehicle.

[0012] <Configuration> The configuration of the electronic control device 101 will be described using Figure 1. The electronic control device 101 mainly comprises two CPUs 10 and 20, two non-volatile memories 11 and 21, and two reset generators 13 and 23. Furthermore, the electronic control device 101 comprises two RAMs 12 and 22, a power supply circuit 30, and a plurality of wires L1 to L7, L11 to L17, L20, and L21. The CPUs 10 and 20 correspond to processing devices. The power supply circuit corresponds to a power supply. Note that the wires L2 to L4 and the wires L12 to L14 can be the same wire, if appropriate.

[0013] The electronic control device 101 also includes main-side components, sub-side components, and components common to both the main and sub-sides. The electronic control device 101 mainly includes a main CPU 10, a non-volatile memory 11, a RAM 12, and a reset generator 13 as main-side components. The main CPU 10 operates by receiving power from a power supply circuit 30. The main CPU 10 executes programs stored in the non-volatile memory 11, for example. By executing the programs, the main CPU 10 performs various calculations using data stored in the RAM 12 and data acquired from an external device (not shown). The main CPU 10 controls in-vehicle equipment using the calculation results obtained by the calculations. The external device may be a sensor or another electronic control device.

[0014] In addition to the above programs, the nonvolatile memory 11 stores startup information indicating the startup state of the main CPU 10. The startup information will be explained in detail later. The RAM 12 stores the calculation results of the main CPU 10 and startup information read from the nonvolatile memory 11. The RAM 12 is a volatile memory. Therefore, the RAM 12 can store startup information and the like only while power is being supplied from the power supply circuit 30.

[0015] The reset generator 13 is a device that resets the main CPU 10 in the event of an abnormality. In other words, the reset generator 13 resets the main CPU 10 in order to restore it to normal when an abnormality occurs in the main CPU 10 itself or when the power supply voltage to the main CPU 10 drops.

[0016] The reset generator 13 determines whether the power supply voltage from the power supply circuit 30 to the main CPU 10 has dropped. In other words, the reset generator 13 determines whether the power supply voltage is lower than the guaranteed operating voltage of the main CPU 10. The reset generator 13 compares the power supply voltage with a preset voltage threshold. If the power supply voltage drops below the voltage threshold, the reset generator 13 determines that a power supply abnormality has occurred, in which the power supply voltage applied from the power supply circuit 30 to the main CPU 10 has dropped. The reset generator 13 then outputs a reset command to the main CPU 10 to reset the main CPU 10. If the power supply voltage from the power supply circuit 30 to the main CPU 10 has dropped, the main CPU 10 can be said to be a processing device experiencing an abnormality. The guaranteed operating voltage is a voltage that ensures normal operation of the main CPU 10.

[0017] Furthermore, if there is no WDT signal from the main CPU 10 within a certain period of time, the reset generator 13 determines that the main CPU 10 itself is malfunctioning and outputs a reset command to the main CPU 10. Note that the reset generator 13 may also determine that there is an abnormality in the main CPU 10 itself if there are too many WDT signal inputs within a certain period of time or if the contents of the WDT signal differ from those predetermined. WDT is an abbreviation for Watchdog Timer.

[0018] The electronic control device 101 includes sub-side components, such as a sub-CPU 20, a non-volatile memory 21, a RAM 22, and a reset generator 23. The sub-CPU 20, the non-volatile memory 21, the RAM 22, and the reset generator 23 are configured in the same manner as the corresponding main-side components. However, the sub-CPU 20 does not have to control in-vehicle equipment. The main CPU 10 and the sub-CPU 20 monitor each other. The sub-CPU 20 has the same guaranteed operating voltage as the main CPU 10.

[0019] The electronic control device 101 includes a power supply circuit 30 as a common component. The power supply circuit 30 supplies power to the CPUs 10 and 20. The power supply circuit 30 is connected to a battery 200 provided outside the electronic control device 101. The power supply circuit 30 applies a power supply voltage, which is, for example, a voltage of the battery 200, to the CPUs 10 and 20. Therefore, the main CPU 10 and the sub-CPU 20 have the same guaranteed operating voltage and are supplied with power from the same power supply circuit 30.

[0020] Wire L1 is a wire for supplying power from the power supply circuit 30 to the main CPU 10. Wire L2 is a wire for writing startup information for the main CPU 10 to the nonvolatile memory 11. Wire L3 is a wire for reading startup information from the nonvolatile memory 11 to the RAM 12. Wire L4 is a wire for the main CPU 10 to refer to the startup information read into the RAM 12.

[0021] The line L5 is a line for outputting a WDT signal from the main CPU 10 to the reset generator 13. The line L6 is a line for outputting a reset command from the reset generator 13 to the main CPU 10. The line L7 is a line for the reset generator 13 to monitor the power supply voltage of the power supply circuit 30.

[0022] The wiring L11 is a power line for supplying power from the power supply circuit 30 to the sub-CPU 20. The wiring L12 is a wiring for writing startup information for the sub-CPU 20 to the non-volatile memory 21. The wiring L13 is a wiring for reading the startup information from the non-volatile memory 21 to the RAM 22. The wiring L14 is a wiring for the sub-CPU 20 to refer to the startup information read into the RAM 22.

[0023] The wiring L15 is a wiring for outputting a WDT signal from the sub CPU 20 to the reset generator 23. The wiring L16 is a wiring for outputting a reset command from the reset generator 23 to the sub CPU 20. The wiring L17 is a wiring for the reset generator 23 to monitor the power supply voltage of the power supply circuit 30.

[0024] The wiring L20 is a wiring through which the sub CPU 20 acquires the startup information of the main CPU 10. The wiring L21 is a wiring through which the main CPU 10 acquires the startup information of the sub CPU 20. Therefore, the main CPU 10 and the sub CPU 20 are configured to be able to supply information to each other through communication. The startup information here is a read value.

[0025] Here, the startup information will be explained. The startup information is information indicating whether the main CPU 10 and the sub CPU 20 each performed the termination sequence S20 and ended normally. In other words, the main CPU 10 startup information is information indicating the startup state of the main CPU 10. The sub CPU 20 startup information is information indicating the startup state of the sub CPU 20. The non-volatile memory 11 stores the startup information of the main CPU 10. Meanwhile, the non-volatile memory 21 stores the startup information of the sub CPU 20. The main CPU 10 and the sub CPU 20 similarly rewrite and read their own startup information. Therefore, the following explanation will be given using the main side components as a representative example.

[0026] The nonvolatile memory 11 stores, as startup information, information indicating termination or information indicating startup. Similarly, the RAM 12 stores, as read storage information, information indicating termination or information indicating startup. The RAM 12 also stores unread information, which is information indicating that startup information has not been read from the nonvolatile memory 11. The unread information can also be considered an initial value.

[0027] The startup information is stored as a digital value in the non-volatile memory 11 or RAM 12. Examples of digital values ​​indicating each piece of information are shown below. "1111 0000" can be used for information indicating termination. "0000 1111" can be used for information indicating startup. "0000 0000" can be used as a value indicating unread information.

[0028] The information indicating termination may also be referred to as termination state information. The information indicating activation may also be referred to as activation state information. In addition, in Figures 3 and 4, the information indicating termination is simply referred to as termination, and the information indicating activation is simply referred to as activation.

[0029] As described above, this embodiment employs an electronic control device 101 equipped with two CPUs 10 and 20. However, the present disclosure is not limited to this and can also be applied to an electronic control device equipped with three or more CPUs. In this case, the electronic control device is equipped with the same number of non-volatile memories, RAMs, and reset generators as the number of CPUs. However, the non-volatile memories and RAMs may be provided in common to the multiple CPUs.

[0030] <Processing operation> The processing operation of the electronic control device 101 will be described using Figures 2 to 4. The main CPU 10 and the sub-CPU 20 perform similar processing operations. That is, the sub-CPU 20 differs from the main CPU 10 in the write target and read target of startup information and the output source of a reset command. However, the processing operation of the sub-CPU 20 is similar to that of the main CPU 10. Therefore, the main CPU 10 will be described here as a representative example. In this case, the main CPU 10 corresponds to its own processing device. On the other hand, the sub-CPU 20 corresponds to another processing device.

[0031] First, the write and read processing of the startup information in the main CPU 10 will be described with reference to Figures 3 and 4. In Figures 3 and 4, the end sequence is written as End S, and the startup sequence is written as Start S. The end sequence S20 corresponds to the end processing.

[0032] 3 is a time chart showing a normal end without being reset by the reset generator 13. That is, FIG. 3 shows the processing operation of the main CPU 10 when the termination sequence S20 is executed and terminated normally in the previous trip. Between timings t3 and t4, the power supply from the power supply circuit 30 to the main CPU 10 is stopped and the power is turned off. The previous trip corresponds to the previous start-up. Therefore, the previous start-up refers to the period during which the main CPU was started up the previous time.

[0033] The main CPU 10 executes a termination sequence S20 during the period from timing t1 before the power is turned off to timing t3. As shown at timing t2, the main CPU 10 writes startup status information as startup information to the nonvolatile memory 11 during the termination sequence S20 (S21). That is, the main CPU 10 rewrites the startup information in the nonvolatile memory 11 from startup status information to termination status information. In this way, when the main CPU 10 executes the termination sequence S20 and ends normally, it writes the termination status information as startup information to the nonvolatile memory 11 and stops the supply of power.

[0034] Therefore, the nonvolatile memory 11 stores the startup state information until timing t2. Then, the startup information in the nonvolatile memory 11 is rewritten with the final state information at timing t2. Furthermore, as shown at timings t3 to t4, the nonvolatile memory 11 continues to store the final state information even when the power supply from the power supply circuit 30 is stopped.

[0035] The RAM 12 stores startup status information as startup information, which is a read value, between timings t1 and t3, and the startup information is erased between timings t3 and t4.

[0036] When power supply from the power supply circuit 30 is started, the main CPU 10 starts the current trip. When power supply is started, the main CPU 10 executes a startup sequence S30. As shown at timing t5, while executing the startup sequence S30, the main CPU 10 reads the end state information stored in the nonvolatile memory 11 and writes it to the RAM 12. The startup information is read only once when the main CPU 10 is started.

[0037] Then, as shown at timing t6, when the main CPU 10 ends the startup sequence S30, it writes the startup status information as startup information into the nonvolatile memory 11 (S31). That is, the main CPU 10 rewrites the startup information in the nonvolatile memory 11 from the end status information to the startup status information.

[0038] Between timings t4 and t5, unread information is stored in the RAM 12. Then, at timing t5, the RAM 12 stores the final state information read from the nonvolatile memory 11 as a read value.

[0039] Fig. 4 is a time chart showing the case where the trip is ended by a reset from the reset generator 13. That is, Fig. 4 shows the processing operation of the main CPU 10 when the previous trip ended without executing the end sequence S20. Between timings t11 and t12, the power supply from the power supply circuit 30 to the main CPU 10 is stopped and the power is turned off.

[0040] As shown at timing t11, when a reset command is output from the reset generator 13, the main CPU 10 is powered off without executing the termination sequence S20. In other words, when the main CPU 10 is terminated by a reset command, the power supply is stopped without writing the termination state information. Therefore, the startup information in the nonvolatile memory 11 is not rewritten with the termination state information. Therefore, as shown after timing t11, the startup state information remains stored in the nonvolatile memory 11 even when the power supply from the power supply circuit 30 is stopped.

[0041] The RAM 12 stores the startup state information as startup information, which is a read value, until timing t11, and the startup information is erased between timings t11 and t12.

[0042] The main CPU 10 starts the current trip when power supply from the power supply circuit 30 is started. When power supply is started, the main CPU 10 executes a startup sequence S30. As shown at timing t13, while executing the startup sequence S30, the main CPU 10 reads out the startup state information stored in the nonvolatile memory 11 and writes it to the RAM 12.

[0043] Then, at timing t14, when the main CPU 10 ends the startup sequence S30, it writes the startup status information as startup information into the nonvolatile memory 11 (S31). In this case, the startup information in the nonvolatile memory 11 is not rewritten from the end status information to the startup status information, but the startup status information is rewritten.

[0044] Between timings t12 and t13, unread information is stored in the RAM 12. Then, at timing t5, the RAM 12 stores the startup state information read from the nonvolatile memory 11 as a read value.

[0045] In this way, if the previous trip ended normally, the nonvolatile memory 11 stores the end status information at the time of startup. On the other hand, if the previous trip was reset, the nonvolatile memory 11 stores the start status information at the time of startup. Therefore, the start information stored in the nonvolatile memory 11 differs depending on whether the main CPU 10 ended normally or was reset. At startup, the main CPU 10 determines whether the main CPU 10 performed the end sequence S20 and ended normally based on the start information read from the nonvolatile memory 11.

[0046] The main CPU 10 also acquires, via the line L21, startup information of the other processing device, the sub-CPU 20. At startup, the main CPU 10 determines whether the sub-CPU 20 has executed and normally terminated the termination sequence S20 based on the startup information of the sub-CPU 20 acquired via the line L21, i.e., by communication.

[0047] Here, the cause determination process of the main CPU 10 will be described with reference to Fig. 2. When the start-up sequence S30 ends, the main CPU 10 starts the process shown in the flowchart of Fig. 2.

[0048] In step S10, it is determined whether the own CPU startup state is "ended" (first determination step). The main CPU 10 refers to startup information (read value) read from the nonvolatile memory 11 and written to the RAM 12. Then, based on the startup information in the RAM 12, the main CPU 10 determines whether the main CPU 10 terminated normally in the previous trip. The startup information stored in the RAM 12 corresponds to the startup information of the own processing device read from the nonvolatile memory 11.

[0049] If the end state information is stored in the RAM 12, the main CPU 10 determines that its own CPU startup state has ended, and proceeds to step S11. If the end state information is stored in the RAM 12, the main CPU 10 can be said to consider that the main CPU 10 ended normally in the previous trip, and proceeds to step S11.

[0050] Furthermore, if the end state information is not stored in the RAM 12, the main CPU 10 proceeds to step S12 without determining that its own CPU startup state has ended. In other words, if the end state information is not stored in the RAM 12, the main CPU 10 does not consider that the main CPU 10 ended normally in the previous trip, and proceeds to step S12.

[0051] In step S11, it is determined whether the other CPU startup state is "ended" (second determination step). The main CPU 10 refers to the startup information of the sub CPU 20 acquired via the line L21. Then, based on the startup information of the sub CPU 20, the main CPU 10 determines whether the sub CPU 20 was normally terminated in the previous trip.

[0052] If the startup information of the sub CPU 20 is end state information, the main CPU 10 determines that the other CPU startup state is ended, and proceeds to step S12. In other words, if the startup information of the sub CPU 20 is end state information, the main CPU 10 assumes that the sub CPU 20 ended normally in the previous trip, and proceeds to step S12.

[0053] Furthermore, if the startup information of the sub CPU 20 is not end state information, the main CPU 10 does not determine that the other CPU startup state is ended and proceeds to step S13. In other words, if the startup information of the sub CPU 20 is not end state information, the main CPU 10 does not consider that the sub CPU 20 ended normally in the previous trip and proceeds to step S13.

[0054] In step S12, the reset cause information is set to "no reset when abnormal". The main CPU 10 writes information indicating "no reset when abnormal" as the reset cause information into the non-volatile memory 11. "no reset when abnormal" indicates that both the main CPU 10 and the sub-CPU 20 ended normally in the previous trip. The main CPU 10 writes (stores) the reset cause information into the RAM 12 for reference when transitioning to a fail operation. The main CPU 10 may store the reset cause information in the non-volatile memory 11.

[0055] In step S13, the reset cause information is set to the other CPU abnormality (first abnormality determination step). If the main CPU 10 determines that the main CPU 10 itself has terminated normally and that the sub CPU 20 has not terminated normally, it determines that an abnormality has occurred in the sub CPU 20 itself. The main CPU 10 then writes information indicating the other CPU abnormality to the RAM 12 as the reset cause information. The main CPU 10 may also store information indicating the other CPU abnormality in the non-volatile memory 11. The other CPU abnormality indicates that the sub CPU 20 has been reset due to an abnormality caused by the sub CPU 20 itself. The other CPU here is the sub CPU 20.

[0056] In step S14, it is determined whether the self-diagnosis of the main CPU is normal. The main CPU 10 determines whether the result of its own self-diagnosis is normal. If the main CPU 10 determines that the self-diagnosis result is normal, it proceeds to step S15, and if it determines that the self-diagnosis result is not normal, it proceeds to step S18. Note that the self-diagnosis may be a ROM abnormality check, a RAM abnormality check, an instruction check, a flow check, or a combination of these.

[0057] In step S18, the WDT signal of the main CPU is set to "Stop." The main CPU 10 stops outputting the WDT signal. By stopping outputting the WDT signal, the main CPU 10 is reset.

[0058] In the present disclosure, steps S14 and S18 may be omitted. In this case, if the main CPU 10 determines NO in step S10, the process proceeds to step S15.

[0059] Step S15 is the same as step S11. If the startup information of the sub CPU 20 is end state information, the main CPU 10 determines that the other CPU startup state has ended and proceeds to step S16. On the other hand, if the startup information of the sub CPU 20 is not end state information, the main CPU 10 does not determine that the other CPU startup state has ended and proceeds to step S17.

[0060] In step S16, the reset cause information is set to "own CPU abnormality" (second abnormality determination step). If the main CPU 10 determines that the main CPU 10 itself did not terminate normally and that the sub CPU 20 terminated normally, it determines that an abnormality has occurred in the main CPU 10 itself. The main CPU 10 then writes information indicating an own CPU abnormality as reset cause information to the RAM 12. The main CPU 10 may store information indicating an own CPU abnormality in the non-volatile memory 11. An own CPU abnormality indicates that the main CPU 10 has been reset due to an abnormality caused by the main CPU 10 itself.

[0061] In step S17, the reset cause information is determined to be a power supply abnormality (third abnormality determination step). If the main CPU 10 determines that the main CPU 10 itself has not terminated normally and that the sub-CPU 20 has not terminated normally, it determines that a power supply abnormality has occurred. The main CPU 10 then writes information indicating a power supply abnormality to the RAM 12 as the reset cause information. The main CPU 10 may also store information indicating a power supply abnormality in the non-volatile memory 11. The power supply abnormality indicates that the main CPU 10 and the sub-CPU 20 have been reset due to an abnormality in the power supply voltage.

[0062] If the determination in step S15 is NO, the main CPU 10 proceeds to step S17. If the determination in step S15 is NO, it means that both the main CPU 10 and the sub CPU 20 have been reset by the reset command. In other words, both the main CPU 10 and the sub CPU 20 have not terminated normally. It is extremely unlikely that multiple CPUs 10, 20 that had been operating normally up until that point will simultaneously malfunction. Therefore, the main CPU 10 determines that an abnormality has occurred in the power supply from the power supply circuit 30 to the main CPU 10 (step S17).

[0063] In this embodiment, an electronic control device 101 including two CPUs 10 and 20 is used. Therefore, the main CPU 10 determines that a power supply abnormality has occurred if the two CPUs 10 and 20 do not terminate normally. However, the present disclosure is not limited to this. The electronic control device 101 may also be configured with three or more CPUs. Furthermore, the main CPU 10 may determine that a power supply abnormality has occurred if at least two of the three or more CPUs do not terminate normally. In other words, the number of CPUs used to determine that a power supply abnormality has occurred is not limited to two. A drop in power supply voltage may occur locally rather than globally. Even in such a case, a power supply abnormality can be determined.

[0064] <Effects> In this way, after startup, each of the CPUs 10, 20 in the electronic control device 101 determines whether the main CPU 10 and the sub-CPU 20 shut down normally at the previous startup based on the startup information of the main CPU 10 and the startup information of the sub-CPU 20. Then, based on the result of determining whether the main CPU 10 and the sub-CPU 20 shut down normally, the electronic control device 101 determines that the reset cause is an abnormality in the sub-CPU 20 itself or an abnormality in the main CPU 10 itself. Furthermore, if the electronic control device 101 determines that the main CPU 10 and the sub-CPU 20 did not shut down normally, it determines that the reset cause is a power supply abnormality. Therefore, the electronic control device 101 can determine the reset cause even if the guaranteed operating voltage values ​​of the multiple CPUs 10, 20 are the same.

[0065] Furthermore, if the electronic control device 101 knows that the cause of the reset is, for example, a drop in the power supply voltage, it can increase the possibility that the system can return to a normal state by temporarily switching to fail-safe operation that reduces the burden on the power supply.

[0066] (Variation) The nonvolatile memory 11 may be built into the main CPU 10. Similarly, the nonvolatile memory 21 may be built into the sub-CPU 20.

[0067] The electronic control device 101 may include a nonvolatile memory provided in common to the plurality of CPUs 10 and 20, instead of the nonvolatile memories 11 and 21. This allows the electronic control device 101 to reduce the number of nonvolatile memories.

[0068] This modification can be applied not only to the electronic control device 101 but also to the electronic control devices 102 and 103, which will be described later.

[0069] The preferred embodiments of the present disclosure have been described above. However, the present disclosure is not limited to the above embodiments, and various modifications are possible within the scope of the present disclosure. Below, the second and third embodiments will be described as other aspects of the present disclosure. The above embodiments, the second and third embodiments, and the third embodiment can be implemented independently, or can be implemented in appropriate combinations. The present disclosure is not limited to the combinations shown in the embodiments, and can be implemented in various combinations.

[0070] (Second embodiment) The electronic control device 102 will be described with reference to Figures 5 and 6. The electronic control device 102 differs from the electronic control device 101 in that each of the CPUs 10 and 20 monitors the power supply voltage.

[0071] While the main CPU 10 is running, it monitors the power supply voltage applied to it from the power supply circuit 30 via the line L8. That is, the main CPU 10 determines whether the power supply voltage applied to it from the power supply circuit 30 has dropped. The voltage threshold used by the main CPU 10 is set to a value that is similar to or higher than the voltage threshold used by the reset generator 13. Note that it is preferable to set the voltage threshold used by the main CPU 10 higher so that it can determine that the power supply voltage has dropped without causing a reset.

[0072] While the sub CPU 20 is running, it monitors the power supply voltage applied to it from the power supply circuit 30 via the line L18. In other words, the sub CPU 20 determines whether the power supply voltage applied to it from the power supply circuit 30 has dropped. The voltage threshold value used by the sub CPU 20 is set to a value that is similar to or higher than the voltage threshold value used by the reset generator 23.

[0073] Each CPU 10, 20 determines that the power supply voltage has dropped if the power supply voltage it monitors is below a voltage threshold. If each CPU 10, 20 determines that the power supply voltage has dropped, it sets the power supply drop determination to on. If each CPU 10, 20 determines that the power supply voltage has not dropped if the power supply voltage it monitors exceeds a voltage threshold. If each CPU 10, 20 determines that the power supply voltage has not dropped, it sets the power supply drop determination to off. Each CPU 10, 20 writes, for example, information indicating on or off as information indicating the power supply drop determination to RAM 12, 22. Note that each CPU 10, 20 may store this information in non-volatile memory 11, 21.

[0074] The voltage threshold used by the main CPU 10 is set to be approximately the same as the voltage threshold used by the sub-CPU 20. The voltage threshold used by each of the reset generators 13 and 23 can be considered a first voltage threshold. The voltage threshold used by each of the CPUs 10 and 20 can be considered a second voltage threshold. The voltage thresholds used by each of the reset generators 13 and 23 are set to be approximately the same. This is also true in the first embodiment.

[0075] Here, the processing operation of each CPU 10, 20 in this embodiment will be described with reference to FIG. 6. Each CPU 10, 20 performs steps S20 to S23 in addition to the processes in FIG. 2. If the determination in step S11 is NO, each CPU 10, 20 proceeds to step S20. In step S20, it determines whether the power reduction determination of its own CPU is ON. If the determination in step S11 is NO, each CPU 10, 20 proceeds to step S21, and if the determination in step S15 is NO, it proceeds to step S13. Step S21 is the same as step S17. Furthermore, if the determination in step S15 is YES, each CPU 10, 20 proceeds to step S22. In step S22, it determines whether the power reduction determination of the other CPU is ON. If the determination in step S15 is NO, each CPU 10, 20 proceeds to step S23, and if the determination in step S15 is NO, it proceeds to step S16. Step S23 is the same as step S17.

[0076] The electronic control device 102 can achieve the same effects as the electronic control device 101. Furthermore, even if the voltage thresholds of the reset generators 13 and 23 are designed to be the same, manufacturing variations can cause actual differences. As a result, if the power supply voltage drops to a value between the two, one CPU will be reset but the other will not. However, in the electronic control device 102, each CPU 10 and 20 determines whether or not the power supply voltage has dropped, so the CPU that was not reset in the above case can recognize the drop in power supply voltage.

[0077] (Third embodiment) 7, the electronic control device 103 will be described. The electronic control device 103 differs from the electronic control device 101 in the configuration of the reset generator and the wiring configuration. The electronic control device 103 is equipped with reset generators 13, 23, and 40.

[0078] The reset generator 13 is provided for the main CPU 10, as in the first embodiment. However, the reset generator 13 only outputs a reset command based on the WDT signal. The reset generator 13 does not output a reset command based on a drop in power supply voltage. The reset generator 23 is provided for the sub CPU 20, as in the second embodiment. However, the reset generator 23 only outputs a reset command based on the WDT signal. The reset generator 23 does not output a reset command based on a drop in power supply voltage. In other words, the reset generators 13 and 23 of this embodiment output a reset command to the CPU 10 and 20 in which the abnormality occurs when an abnormality occurs in each CPU 10 and 20 itself. The reset generators 13 and 23 correspond to first reset generators.

[0079] The reset generator 40 is provided in common to the main CPU 10 and the sub CPU 20. The reset generator 40 determines a drop in the power supply voltage applied to each of the CPUs 10 and 20 from the power supply circuit 30 via the wiring L22. The reset generator 40 outputs a reset command to the main CPU 10 and the sub CPU 20 via the wiring L23.

[0080] When a power supply abnormality occurs such that the power supply voltage applied to each of the CPUs 10 and 20 from the power supply circuit 30 drops, the reset generator 40 outputs a reset command to the CPU 10 or 20 in which the abnormality occurs. In other words, when a power supply abnormality occurs, the reset generator 40 outputs a reset command to both of the CPUs 10 and 20. The reset generator 40 corresponds to a second reset generator.

[0081] The electronic control device 103 can achieve the same effects as the electronic control device 101. Furthermore, the electronic control device 103 can eliminate determination errors due to manufacturing variations in the voltage threshold value, compared to when different reset generators 13 and 23 are used to determine a drop in the power supply voltage.

[0082] Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, although various combinations and forms are shown in the present disclosure, other combinations and forms including only one element, more, or less than one element are also within the scope and spirit of the present disclosure. [Explanation of symbols]

[0083] 10... Main CPU, 11, 21... Non-volatile memory, 12, 22... RAM, 13, 23, 40... Reset generator, 20... Sub-CPU, 30... Power supply circuit, 101 to 103... Electronic control device, 200... Battery

Claims

1. a plurality of processing devices (10, 20) that are supplied with power from a common power source and are capable of sharing information with each other through communication; a non-volatile memory (11, 21) for storing start-up information as the information indicating whether each processing device has performed a termination process and terminated normally; a reset generating device (13, 23, 40) for outputting a reset command to the processing device in which an abnormality occurs when an abnormality occurs in the processing device itself or when a power supply abnormality occurs such that a power supply voltage applied to the processing device from the power supply drops, each processing device uses the startup information of all the processing devices to which power is supplied from a common power source to determine whether all the processing devices were normally terminated at the time of the previous startup; Each processing device is When the termination process is performed and terminated normally, information indicating termination is written as the startup information to the nonvolatile memory and the supply of power is stopped, and when the termination is terminated by the reset command, the supply of power is stopped without writing the information indicating termination, a first determination step (S10) of determining whether the processing device was normally terminated at the previous startup depending on whether the startup information of the processing device read from the nonvolatile memory after startup is information indicating the termination; a second determination step (S11) of determining whether the other processing device was normally terminated at the previous startup depending on whether the startup information of the other processing device acquired through the communication after startup is information indicating the termination; a first abnormality determination step (S13) of determining that the other processing device itself is abnormal when it is determined that the processing device itself has terminated normally and the other processing device has not terminated normally; a second abnormality determination step (S16) of determining that the processing of the processing device itself is abnormal if it is determined that the processing of the processing device itself has not been normally completed and that the processing of the other processing device has been normally completed; An electronic control device that includes a third abnormality determination step (S17) that determines that the power supply is abnormal if it is determined that the processing device itself has not terminated normally and that the other processing device has not terminated normally.

2. The electronic control unit according to claim 1 , wherein each processing unit writes, upon startup, information indicating startup as the startup information stored in the nonvolatile memory.

3. the reset generating device is provided corresponding to each of the processing devices, and outputs the reset command to the corresponding processing device; 3. The electronic control device according to claim 1, wherein each processing unit determines whether or not the power supply voltage applied to the processing unit from the power supply is dropping.

4. Each processing device determines that there is a power supply abnormality when it determines that the power supply voltage applied to said processing device has dropped, and determines that there is an abnormality in said other processing device itself when it determines that there is no drop in the power supply voltage applied to said processing device, 4. The electronic control device according to claim 3, wherein if it determines that the power supply voltage applied to the other processing device has dropped, it determines that there is a power supply abnormality, and if it determines that the power supply voltage applied to the other processing device has not dropped, it determines that there is an abnormality in the processing device itself.

5. The reset generating device a first reset generating device that outputs a reset command to a processing device in which an abnormality occurs when the processing device itself is abnormal; An electronic control device as described in any one of claims 1 to 4, further comprising: a second reset generating device that outputs a reset command to the processing device in the event of a power supply abnormality in which the power supply voltage applied to each processing device from the power supply drops.

6. 6. The electronic control device according to claim 1, wherein the nonvolatile memory is built into each processing unit or is provided externally to each processing unit.

7. 7. The electronic control device according to claim 1, wherein the nonvolatile memory is provided in common to each processing unit.

Images