Control device

Abstract

To provide a control device capable of suppressing indefinite communication output at the time of activation of a controller due to the release of reset of the controller.SOLUTION: In an ECU 1, a microcontroller 3 is configured to execute an initial diagnosis after reset of the microcontroller by a power supply IC 5 is released and to output the first watchdog signal WD indicating normal operation to the power supply IC 5 when determining that the microcontroller is normal. The power supply IC 5 prohibits the operation of a transceiver 7 by setting an error signal ERR at low, after the start of the reset of the microcontroller 3, at least until the first watchdog signal WD is output from the microcontroller 3 after the reset is released, to prohibit communication output to the other ECUs 15 and 17 by operation of the microcontroller 3, and permits the communication output after confirming that the watchdog signal WD is output.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a control device. [Background technology]

[0002] The following Patent Document 1 describes a configuration of an ECU mounted on a vehicle in which a main microcomputer communicates with other units via a CAN driver. Note that ECU is an abbreviation for "Electronic Control Unit." CAN is an abbreviation for "Controller Area Network." CAN is also a registered trademark.

[0003] In the ECU described in Patent Document 1, the sub-microcomputer monitors the operation of the main microcomputer based on the program run pulse from the main microcomputer, and if the main microcomputer malfunctions, it outputs an output prohibition signal to the CAN driver to prohibit communication output.The main microcomputer and the sub-microcomputer are also configured to be reset simultaneously by a power supply IC with a watchdog timer. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2004-122942 Summary of the Invention [Problem to be solved by the invention]

[0005] In the ECU of Patent Document 1, the main microcomputer, which serves as a control unit for performing processing to communicate with other units, is reset, and after the reset is released, the main microcomputer, which has not yet returned to normal, may output an undefined communication signal to the CAN driver. This undefined communication signal may then be transmitted to other units, i.e., an undefined communication output may be sent to other units.

[0006] One aspect of the present disclosure provides a control device capable of suppressing unstable communication output at startup following release of a reset of a control unit. [Means for solving the problem]

[0007] A control device according to one aspect of the present disclosure includes a control unit (3) configured to perform processing for communicating with at least other devices, and a monitoring unit (5) configured to reset the control unit when a predetermined reset condition related to the control unit is met.

[0008] After the reset by the monitoring unit is released, the control unit performs an initial diagnosis, which is a self-diagnosis immediately after startup, and if this initial diagnosis determines that the device is normal, it outputs a predetermined signal (WD) to the monitoring unit indicating normal operation.

[0009] The monitoring unit prohibits communication output to other devices due to the operation of the control unit from the time the reset of the control unit is initiated until at least the specified signal is first output from the control unit after the reset is released, and then allows the communication output after confirming that the specified signal has been output.

[0010] With this configuration, after the reset of the control unit is released, an initial diagnosis of the control unit confirms that the control unit can operate normally, and then communication output to other devices by the control unit is permitted. Therefore, it is possible to prevent undefined communication output from being sent to other devices at startup following the release of the reset of the control unit. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 2 is a block diagram showing the configuration of an ECU according to the embodiment. [Figure 2] 10 is a flowchart showing a process executed by a microcomputer. [Figure 3] 1 is a flowchart showing the operation of a power supply IC. [Figure 4] 4 is a time chart showing an example of operation of the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. [1. Overview of configuration and operation of each part] The ECU 1 of the embodiment shown in Fig. 1 is mounted on a vehicle and includes a microcomputer (hereinafter referred to as "microcomputer") 3 that controls the operation of the ECU 1, a power supply IC 5 that supplies power to the microcomputer 3 and monitors the operation of the microcomputer 3, a transceiver 7, and an inverter circuit 9. The microcomputer 3 may be a so-called SoC. "SoC" is an abbreviation for "System on a Chip."

[0013] Information from one or more sensors 11, 13 mounted on the vehicle is input to the ECU 1. The sensors 11, 13 may be sensors for detecting information related to the vehicle, and may be, for example, peripheral monitoring sensor devices such as cameras or millimeter-wave radar for detecting information about the surroundings of the vehicle. The ECU 1 is also communicatively connected to other ECUs 15, 17 mounted on the vehicle via a communication line 19.

[0014] The microcomputer 3 has at least a function of receiving information from the sensors 11 and 13, and integrating or distributing the received information and transmitting it to the other ECUs 15 and 17. Therefore, the microcomputer 3 performs processing for communicating with at least the other ECUs 15 and 17. The microcomputer 3 may also have a function of transmitting update data of the control contents to the other ECUs 15 and 17.

[0015] The microcomputer 3 is connected to a communication line 19 via a transceiver 7 . The transceiver 7 converts the transmission signal (i.e., the transmission data signal) output from the microcomputer 3 into a transmission signal conforming to the communication protocol and outputs it to the communication line 19. The transceiver 7 also converts the transmission signal on the communication line 19 into a reception signal (i.e., the reception data signal) that can be input by the microcomputer 3 based on the communication protocol and outputs it to the microcomputer 3. This allows the microcomputer 3 to communicate with other ECUs 15 and 17 via the transceiver 7. The communication protocol is, for example, CAN, but may be other than CAN.

[0016] For example, the ECU 15 may be configured to perform control to provide the driver with information about the surroundings of the vehicle, warnings, etc., based on information transmitted from the microcomputer 3. The ECU 17 may be configured to control the power, braking, steering, etc., of the vehicle based on information transmitted from the microcomputer 3.

[0017] Furthermore, the transceiver 7 is configured to stop operation when the standby signal STB input from the inverting circuit 9 becomes active high. Therefore, when the standby signal STB becomes high, the transceiver 7 stops outputting signals (i.e., communication output) to at least the communication line 19.

[0018] The inversion circuit 9 is configured to logically invert the error signal ERR output from the power supply IC 5, and output the logically inverted signal to the transceiver 7 as a standby signal STB.

[0019] Therefore, when the error signal ERR from the power supply IC 5 is low, regardless of the operation of the microcomputer 3, communication output from the transceiver 7, that is, communication output to the other ECUs 15 and 17, is forcibly prohibited.

[0020] The power supply IC 5 generates a power supply voltage for operating the microcomputer 3 from the voltage of an on-board battery (not shown), and supplies the power supply voltage to the microcomputer 3. The power supply IC 5 also monitors the operation of the microcomputer 3, and resets the microcomputer 3 when a predetermined reset condition is met. Specifically, as shown in the first row of Figure 4, the power supply IC 5 resets the microcomputer 3 by setting the reset signal RST to the microcomputer 3 at an active low level for a predetermined hold time TH. The reset condition is a condition under which the power supply IC 5 determines that the microcomputer 3 is abnormal.

[0021] [2. Self-diagnosis performed by SoC3] After the reset by the power supply IC 5 is released, the microcomputer 3 performs an initial diagnosis, which is a self-diagnosis immediately after startup.

[0022] If the microcomputer 3 determines that the initial diagnosis is normal, it starts normal operation, processing information input from the sensors 11 and 13, and transmitting information to other ECUs 15 and 17. On the other hand, if the initial diagnosis determines that the microcomputer 3 is abnormal, it stops operating.

[0023] Furthermore, the microcomputer 3 periodically performs self-diagnosis during normal operation. This self-diagnosis that the microcomputer 3 periodically performs while in operation is called an in-operation diagnosis. Here, "periodic" does not have to be at a fixed time interval, but may be at different time intervals.

[0024] [2-1. Explanation of diagnostics during operation] The microcomputer 3 performs the following voltage diagnosis and calculation diagnosis as the operation diagnosis. [2-1-1. Voltage Diagnosis] In the voltage diagnosis, the microcomputer 3 monitors the power supply voltage within the microcomputer 3, and if the power supply voltage is outside the normal range, it determines that there is a voltage abnormality. This voltage diagnosis is performed, for example, by a voltage diagnosis circuit block provided in the microcomputer 3.

[0025] When the microcomputer 3 determines that a voltage abnormality has occurred through voltage diagnosis, i.e., when it detects a voltage abnormality, it sets the abnormality notification signal AOUT to low to be sent to the power supply IC 5. In other words, the low level of the abnormality notification signal AOUT is a signal for notifying the power supply IC 5 of a voltage abnormality in the microcomputer 3. [2-1-2. Calculation diagnosis] In the operation diagnosis, the microcomputer 3 applies dummy input values ​​to each predetermined operation process performed by the microcomputer 3 and checks whether a predetermined expected value is output as the operation result. If the operation result differs from the expected value, it is determined that there is an abnormality in the operation function. This operation diagnosis is performed, for example, by software.

[0026] When the microcomputer 3 determines that there is an abnormality in the calculation function through the calculation diagnosis in the operation diagnosis, i.e., when it detects an abnormality in the calculation function, it sets the abnormality notification signal BOUT to low to the power supply IC 5. In other words, the low level of the abnormality notification signal BOUT is a signal for notifying the power supply IC 5 of an abnormality in the calculation function of the microcomputer 3.

[0027] [2-2. Explanation of initial diagnosis] The initial diagnosis is a diagnosis that checks whether the microcomputer 3 itself can operate normally before the actual operation begins, and includes an initial diagnosis using software and an initial diagnosis of hardware such as the memory and communication module built into the microcomputer 3. The communication module is a piece of hardware within the microcomputer 3 that inputs and outputs transmission signals and reception signals to and from the transceiver 7.

[0028] [2-2-1. Initial diagnosis by software] The initial software diagnosis may include at least the same operational diagnosis as the operational diagnosis in the operational diagnosis, or may include operational diagnosis covering more processes. Furthermore, the operational diagnosis performed as the initial software diagnosis may include at least operational diagnosis of the process that provides the communication module with a signal to be transmitted.

[0029] Furthermore, the initial diagnosis by software may include a diagnosis of whether the operation diagnosis is functioning correctly, i.e., a diagnosis of the operation diagnosis. Specifically, input values ​​that should be judged as an operation function abnormality and input values ​​that should be judged as normal are alternately input to the software that performs the operation diagnosis, and it is checked whether the expected judgment result is output in each case.

[0030] [2-2-2. Initial hardware diagnosis] Among the initial hardware diagnoses, for example, in the diagnosis of a communication module, the output path from the communication module to the transceiver 7 is blocked, a predetermined input is given to the communication module, and it is checked whether the output of the communication module reaches a predetermined expected value. Therefore, the initial diagnosis confirms that there is at least no abnormality that would cause an undefined signal to be output from the microcomputer 3 to the transceiver 7. The initial hardware diagnosis may also include a voltage diagnosis that is the same as the voltage diagnosis in the operational diagnosis.

[0031] Furthermore, the initial diagnosis of the hardware may also include a diagnosis of whether the voltage diagnosis functions correctly, i.e., a diagnosis of the voltage diagnosis. Specifically, an input voltage that should be judged as an abnormal voltage and an input voltage that should be judged as normal are alternately input to the circuit block for voltage diagnosis, and it is checked whether the expected judgment result is output in each case.

[0032] If the microcomputer 3 determines that the initial diagnosis is normal, it changes the abnormality notification signals AOUT and BOUT to the power supply IC 5 from the initial low value set by reset to high, which indicates normal operation, and then starts outputting the watchdog signal WD, which will be described later, and begins normal operation.

[0033] [3. Explanation of the watchdog signal WD output by microcontroller 3 to power supply IC 5] When the microcomputer 3 is operating normally, it outputs a watchdog signal WD indicating normal operation to the power supply IC 5, for example, according to the following rules (1) and (2). The watchdog signal WD from the microcomputer 3 to the power supply IC 5 is a data signal transmitted via serial communication (for example, SPI communication). SPI is an abbreviation for "Serial Peripheral Interface."

[0034] (1) The first watchdog signal WD is output within a specified time after the reset is released. The data value of the first watchdog signal WD is set to a predetermined value. Furthermore, the specified time is longer than the time required for the microcomputer 3 to complete the initial diagnosis.

[0035] (2) After the first watchdog signal WD is output, the watchdog signal WD is not changed within a first time period (e.g., 10 ms), and then the data value of the watchdog signal WD is updated according to a predetermined rule within the following second time period (e.g., 5 ms). This process is repeated.

[0036] [4. Explanation of monitoring operation of microcomputer 3 by power supply IC 5] When any of the following conditions {a} to {c} is met, the power supply IC 5 determines that the reset condition is met and resets the microcomputer 3.

[0037] At least one of the abnormality alarm signals AOUT and BOUT from the microcomputer 3 changes from high to low. After the reset of the microcomputer 3 is released, the first watchdog signal WD, that is, the watchdog signal WD with the predetermined value, is not output from the microcomputer 3 until the specified time in <1> above has elapsed.

[0038] <c> Even if the first watchdog signal WD is output from the microcontroller 3, the subsequent watchdog signals WD do not change according to the rule <2> above. [5. Processing performed by microcomputer 3 immediately after startup] 2, when the microcomputer 3 is released from reset by the power supply IC 5, it performs the initial hardware diagnosis described above in S110. Then, in S120, it determines whether or not an abnormality has been detected by the initial hardware diagnosis, and if no abnormality has been detected, it proceeds to S130.

[0039] In S130, the microcomputer 3 performs the initial software diagnosis described above. Then, in S140, it determines whether or not an abnormality has been detected by the initial software diagnosis, and if no abnormality has been detected, the process proceeds to S160.

[0040] In S160, the microcomputer 3 changes the two abnormality alarm signals AOUT and BOUT to the power supply IC 5 from the initial low value set by reset to high, which indicates normal operation. Note that when the microcomputer 3 is reset, the output values ​​of the abnormality alarm signals AOUT and BOUT are initially set to low, and in S160 the output values ​​of the abnormality alarm signals AOUT and BOUT are set to high.

[0041] In the next step S170, the microcomputer 3 outputs the first watchdog signal WD to the power supply IC 5, and then proceeds to step S180 to perform normal operation. Note that the normal operation here also includes the above-mentioned operation-time diagnostic operation.

[0042] On the other hand, if the microcomputer 3 determines in either S120 or S140 that an abnormality has been detected, i.e., if an abnormality is detected in the initial diagnosis, it proceeds to S150 and stops startup. In other words, it enters a state where it does nothing intentionally. Therefore, if an abnormality is detected in the initial diagnosis, the microcomputer 3 enters a state where it does not output at least the watchdog signal WD.

[0043] Although FIG. 2 shows that the initial diagnosis of the hardware is performed before the initial diagnosis of the software, the order may be reversed, or both initial diagnoses may be performed in parallel.

[0044] [6. Operation of power supply IC5] Here, the operation of the power supply IC 5 will be explained based on the flowchart of FIG. 3, but the operation of the power supply IC 5 is actually realized by the hardware inside the power supply IC 5.

[0045] 3, the power supply IC 5 determines whether the reset condition is met in S210. Note that the microcomputer 3 has not yet been reset at this point. In S210, it is also determined whether the condition "a" or "c" is met among the above conditions "a" to "c."

[0046] If the above condition (a) or (c) is met, the power supply IC 5 determines that the reset condition is met, and in S220 resets the microcomputer 3. That is, it sets the reset signal RST to low for the microcomputer 3. Furthermore, in S220, the power supply IC 5 sets the error signal ERR to the inversion circuit 9 to low, thereby prohibiting communication output from the transceiver 7.

[0047] When a predetermined hold time TH has elapsed since the power supply IC 5 set the reset signal RST to the microcomputer 3 low, the power supply IC 5 returns the reset signal RST to high in S230. In other words, the reset of the microcomputer 3 is released.

[0048] Then, in the next step S240, the power supply IC 5 determines whether or not the first watchdog signal WD has been output from the microcomputer 3, and if the first watchdog signal WD has not been output, the process proceeds to step S250.

[0049] The power supply IC 5 may be configured to determine that the first watchdog signal WD has been output when it detects that data has been output to the serial communication line for the watchdog signal WD between the power supply IC 5 and the microcomputer 3. The power supply IC 5 may also be configured to determine that the first watchdog signal WD has been output by determining the value of the data sent over the serial communication line.

[0050] In S250, the power supply IC 5 determines whether the specified time in <1> above has elapsed since the reset of the microcomputer 3 was released, and if the specified time has not elapsed, it returns to S240 and waits for the first watchdog signal WD from the microcomputer 3. If it determines in S250 that the specified time has elapsed, the above condition is met, so it proceeds to S220, resets the microcomputer 3, and prohibits communication output.

[0051] Furthermore, if the power supply IC 5 determines in S240 that the first watchdog signal WD has been output from the microcomputer 3, that is, if the first watchdog signal WD has been output within a specified time period since the microcomputer 3 was released from reset, it proceeds to S260. In S260, the error signal ERR to the inversion circuit 9 is returned from low to high, thereby permitting communication output from the transceiver 7, and then the process returns to S210.

[0052] The power supply IC 5 does not monitor the abnormality notification signals AOUT and BOUT from the microcomputer 3 between the time when communication output is prohibited in S220 and the time when communication output is permitted in S260, since it does not make the determination in S210.

[0053] [7. Example of Action] An example of the operation of the microcomputer 3 and power supply IC 5 that are performed as described above will be described with reference to the time chart of FIG.

[0054] Assume that the microcomputer 3 detects a voltage abnormality during operation, for example, by voltage diagnosis among the operation diagnosis, and changes the abnormality notification signal AOUT to the power supply IC 5 from high to low as shown at time t1 in FIG.

[0055] Then, the above condition (a) is met. Therefore, the power supply IC 5 determines that the reset condition is met, and resets the microcomputer 3 by setting the reset signal RST to low for a predetermined hold time TH, and also changes the error signal ERR to the inversion circuit 9 from high to low. This operation is performed by S220 in FIG. 3.

[0056] When the error signal ERR from the power supply IC 5 goes low, communication output from the transceiver 7 is prohibited no matter what signal the microcomputer 3 outputs to the transceiver 7, and as a result, communication output from the ECU 1 to the other ECUs 15 and 17 due to the operation of the microcomputer 3 is prohibited. Also, while the error signal ERR is kept low, the power supply IC 5 does not monitor the abnormality notification signals AOUT and BOUT from the microcomputer 3.

[0057] Incidentally, even if the microcomputer 3 detects an abnormality in the calculation function through calculation diagnosis, which is one of the operation diagnosis procedures, during operation and changes the abnormality notification signal BOUT to the power supply IC 5 from high to low at time t1 in Fig. 4, the operation shown after time t1 in Fig. 4 is the same. Furthermore, the power supply IC 5 switches the error signal ERR to low substantially simultaneously with the switching of the reset signal RST to low, but this is not limiting, and it may be performed while the reset signal RST is low.

[0058] When the hold time TH has elapsed since the power supply IC 5 switched the reset signal RST to low, it returns the reset signal RST to high, as shown at time t2 in Figure 4. In other words, it releases the reset of the microcomputer 3. This operation is performed by S230 in Figure 3.

[0059] When the reset is released, the microcomputer 3 starts the process shown in Figure 2 and performs an initial diagnosis. If the initial diagnosis does not detect any abnormalities, i.e., if the microcomputer 3 determines that the system is normal, it changes the two abnormality notification signals AOUT and BOUT sent to the power supply IC 5 from low, which is the initial setting upon reset, to high, as shown at time t3 in Figure 4. This operation is performed by S160 in Figure 2.

[0060] 4, the microcomputer 3 outputs the first watchdog signal WD to the power supply IC 5. This operation is performed in accordance with S170 in FIG. Then, the power supply IC5 detects that the first watchdog signal WD has been output and changes the error signal ERR from low to high again. This operation is performed in step S260 in FIG.

[0061] When the error signal ERR from the power supply IC 5 goes high, communication output from the ECU 1 is permitted. Also, the power supply IC 5 returns to a state in which it monitors the abnormality notification signals AOUT and BOUT from the microcomputer 3.

[0062] [8. Terminology] In this embodiment, the microcomputer 3 corresponds to the control unit in this disclosure, the power supply IC 5 corresponds to the monitoring unit in this disclosure, and the watchdog signal WD corresponds to the "predetermined signal indicating normal operation" in this disclosure. Also, the output of either the abnormality notification signal AOUT or BOUT at low level corresponds to the output of the abnormality notification signal in this disclosure.

[0063] [9. Effects] According to the embodiment described above in detail, the following effects are achieved. (a) In ECU 1, after the reset by power supply IC 5 is released, microcomputer 3 performs an initial diagnosis, which is a self-diagnosis immediately after startup, and if this initial diagnosis determines that the microcomputer 3 is operating normally, outputs the first watchdog signal WD, indicating normal operation, to power supply IC 5. From the time that the power supply IC 5 starts resetting the microcomputer 3 until at least the first watchdog signal WD is output from the microcomputer 3 after the reset is released, the power supply IC 5 prohibits communication output by the microcomputer 3 to other ECUs 15 and 17. Then, after confirming that the first watchdog signal WD has been output from the microcomputer 3, the power supply IC 5 permits communication output.

[0064] Therefore, after the reset of the microcomputer 3 is released, an initial diagnosis of the microcomputer 3 confirms that the microcomputer 3 can operate normally, and then communication output to the other ECUs 15 and 17 by the operation of the microcomputer 3 is permitted.

[0065] Therefore, when the microcomputer 3 is started up after being released from reset, it is possible to prevent undefined communication outputs from being sent to the other ECUs 15 and 17. As a comparative example, let us assume that the power supply IC 5 is configured to set the error signal ERR high to permit communication output simultaneously with or immediately after the reset of the microcomputer 3 is released. In other words, let us assume that the error signal ERR from the power supply IC 5 is set high at or immediately after time t2 in FIG. 4.

[0066] In this hypothetical configuration, when the error signal ERR is set to high, the microcomputer 3 may not have completed its initial diagnosis and may be malfunctioning. If an abnormality is detected in the initial diagnosis of the microcomputer 3, communication output will be permitted even though the microcomputer 3 is malfunctioning. Therefore, an undefined transmission signal output by the microcomputer 3 may be transmitted from the transceiver 7 to other ECUs 15 and 17, potentially disrupting vehicle control.

[0067] In contrast, according to the ECU 1 of the above embodiment, communication output to other ECUs 15 and 17 is permitted only after it is confirmed that the microcomputer 3 is capable of normal operation, thereby preventing the transmission of undefined signals.

[0068] (b) If the microcomputer 3 detects an abnormality during operation (i.e., voltage diagnosis or calculation diagnosis) that is periodically performed after determining that the microcomputer 3 is normal through an initial diagnosis, it outputs either the abnormality notification signal AOUT or BOUT at low level. After enabling communication output, the power supply IC 5 monitors the abnormality notification signals AOUT or BOUT from the microcomputer 3, and if either the abnormality notification signal AOUT or BOUT is output at low level, it determines that the reset condition is met and resets the microcomputer 3.

[0069] This also makes it possible to achieve highly reliable monitoring of the microcomputer 3. This is because the operational diagnosis performed by the microcomputer 3 after the initial diagnosis has confirmed that the microcomputer 3 is capable of normal operation is considered to be highly reliable, and if an abnormality is detected by the operational diagnosis, the microcomputer 3 can be reset.

[0070] (c) If the microcomputer 3 detects an abnormality during the initial diagnosis, it stops starting up and does not output the watchdog signal WD. If the watchdog signal WD is not output from the microcomputer 3 within a specified time after the power supply IC 5 releases the reset of the microcomputer 3, it resets the microcomputer 3 again.

[0071] Therefore, when an abnormality occurs in the microcomputer 3, it is possible to prevent an unstable communication output, and also to attempt to restore the microcomputer 3 to normal. 10. Other Embodiments Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments and can be implemented in various modified forms.

[0072] For example, the watchdog signal WD output from the microcomputer 3 may be a pulse signal without a data value. In this case, the power supply IC 5 may be configured to determine whether the reset condition, instead of the above condition c, is satisfied: the level of the watchdog signal WD does not invert within a time limit.

[0073] The microcomputer 3 may be configured to perform only one of the voltage diagnosis and the calculation diagnosis as the operation diagnosis. In this case, one of the abnormality notification signals AOUT and BOUT may be omitted. Furthermore, the power supply IC 5 may be configured to proceed to S260 in FIG. 3 when it determines in S240 in FIG. 3 that the first watchdog signal WD has been output and then when another predetermined condition is met.

[0074] A function similar to that of the power supply IC 5 may be realized by a microcomputer other than the microcomputer 3. The ECU 1 and methods described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to execute one or more functions embodied in a computer program. Alternatively, the ECU 1 and methods described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the ECU 1 and methods described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to execute one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium. The methods for implementing the functions of each unit included in the ECU 1 do not necessarily need to include software; all of the functions may be implemented using one or more hardware devices.

[0075] In the above embodiments, multiple functions of one component may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, some of the configurations of the above embodiments may be omitted.

[0076] In addition to the ECU1 described above, the present disclosure can also be realized in various forms, such as a system including the ECU1 as a component, a program for causing a computer to function as the ECU1, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a method for prohibiting communication output in a control device. [Explanation of symbols]

[0077] 1...ECU, 3...microcontroller, 5...power supply IC, 7...transceiver, 15,17...other ECUs.

Claims

1. a control unit (3) configured to perform processing for communicating with at least another device; a monitoring unit (5) configured to reset the control unit when a predetermined reset condition related to the control unit is met; A control device comprising: the control unit is configured to, after the reset by the monitoring unit is released, perform an initial diagnosis which is a self-diagnosis immediately after startup, and, after determining that the initial diagnosis is normal, output a predetermined signal (WD) indicating normal operation to the monitoring unit; the monitoring unit is configured to prohibit communication output to the other device due to an operation of the control unit from starting to reset the control unit until at least the predetermined signal is first output from the control unit after the reset is released, and to permit the communication output after confirming that the predetermined signal has been output; the control unit is configured to output an abnormality notification signal to the monitoring unit when an abnormality is detected by an operation diagnosis, which is a self-diagnosis that is periodically performed during operation after determining that the device is normal by the initial diagnosis, the monitoring unit is configured to monitor whether the abnormality notification signal is output from the control unit after permitting the communication output, and, if the abnormality notification signal is output, determine that the reset condition is met and reset the control unit. Control device.

2. a control unit (3) configured to perform processing for communicating with at least another device; a monitoring unit (5) configured to reset the control unit when a predetermined reset condition related to the control unit is met; A control device comprising: the control unit is configured to, after the reset by the monitoring unit is released, perform an initial diagnosis which is a self-diagnosis immediately after startup, and, after determining that the initial diagnosis is normal, output a predetermined signal (WD) indicating normal operation to the monitoring unit; the monitoring unit is configured to prohibit communication output to the other device due to an operation of the control unit from starting to reset the control unit until at least the predetermined signal is first output from the control unit after the reset is released, and to permit the communication output after confirming that the predetermined signal has been output; the control unit is configured to, when an abnormality is detected by the initial diagnosis, not output the predetermined signal; the monitoring unit is configured to reset the control unit again if the predetermined signal is not output from the control unit until a specified time has elapsed since the reset of the control unit was released. Control device.

3. a control unit (3) configured to perform processing for communicating with at least another device; a monitoring unit (5) configured to reset the control unit when a predetermined reset condition related to the control unit is met; A control device comprising: the control unit is configured to, after the reset by the monitoring unit is released, perform an initial diagnosis which is a self-diagnosis immediately after startup, and, after determining that the initial diagnosis is normal, output a predetermined signal (WD) indicating normal operation to the monitoring unit; The initial diagnosis includes diagnosis of a communication module, which is hardware for inputting and outputting transmission signals and reception signals to and from a transceiver, and the diagnosis of the communication module involves blocking an output path from the communication module to the transceiver, providing a predetermined input to the communication module, and checking whether the output of the communication module reaches a predetermined expected value; The monitoring unit is configured to prohibit communication output to the other device due to the operation of the control unit from the start of resetting the control unit until at least the predetermined signal is first output from the control unit after the reset is released, and to permit the communication output after confirming that the predetermined signal has been output. Control device.

Images