Electronic control unit

Abstract

To provide an electronic controller that when a power source off request is made, enables a first microcomputer to detect operation stop of a second microcomputer, which is another microcomputer, without receiving a notification from the second microcomputer to stop power supply to the device.SOLUTION: An electronic controller comprises a plurality of microcomputers 20, 40, and a power supply unit 60. Each of the plurality of microcomputers performs immediately-before-shutdown processing in which processing operations under execution are stopped when a shutdown instruction is issued. Also, when a first microcomputer, which is one of the plurality of microcomputers, completes the immediately-before-shutdown processing, it determines whether a current consumption of a second microcomputer, which is another microcomputer, has become equal to or less than a predetermined threshold, and when the current consumption becomes equal to or less than the threshold value, stops the power supply from the power supply unit.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to an electronic control device including a plurality of microcontrollers.

Background Art

[0002] As described in Patent Document 1, there is known an electronic control device configured to include a main microcontroller and a sub-microcontroller, and to perform a shutdown process in which each microcontroller writes its own data to a non-volatile memory when a power-off request occurs.

[0003] In this electronic control device, when the sub-microcontroller completes the shutdown process, it notifies the main microcontroller to that effect, and the main microcontroller stops supplying power from the power circuit to each microcontroller after completing its own shutdown process and receiving the above notification.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] According to the above electronic control device, the main microcontroller stops supplying power from the power circuit after the main microcontroller and the sub-microcontroller complete the shutdown process. For this reason, each microcontroller can write the data to be saved to the non-volatile memory before the power supply from the power circuit is stopped.

[0006] Incidentally, in the above-mentioned electronic control device, the main microcontroller detects the end of operation of the sub-microcontroller by receiving a notification signal sent from the sub-microcontroller when the shutdown process is complete. Therefore, if the shutdown process of the sub-microcontroller is extended for some reason and no notification signal is sent from the sub-microcontroller, the main microcontroller may determine that a communication failure has occurred with the sub-microcontroller and cut off the power supply from the power supply circuit.

[0007] One aspect of this disclosure is to enable an electronic control device equipped with multiple microcontrollers to detect the shutdown of a second microcontroller without receiving notification from the other second microcontrollers when a power-off request occurs, and to stop supplying power to the device. [Means for solving the problem]

[0008] One aspect of the electronic control device of this disclosure comprises a plurality of microcontrollers (20, 40) and a power supply unit (60) configured to supply power to the plurality of microcontrollers. When a shutdown command is issued to stop the operation of each microcontroller, the plurality of microcontrollers each perform a pre-shutdown process (S150, S250) to stop the processing operation they are currently performing.

[0009] Furthermore, once the first microcontroller (20), which is one of the multiple microcontrollers, has completed the pre-shutdown processing, it determines whether the current consumption of the second microcontroller (40), which is a different microcontroller from the first microcontroller, is below a predetermined threshold (S160). If the current consumption of the second microcontroller is below the threshold, the first microcontroller stops supplying power from the power supply unit.

[0010] In other words, when the current consumption of the second microcontroller drops below a threshold, the first microcontroller determines that the second microcontroller has completed its pre-shutdown processing, and stops supplying power from the power supply unit when both the first and second microcontrollers have completed their pre-shutdown processing.

[0011] Therefore, according to the electronic control device of this disclosure, if the pre-shutdown processing of the second microcontroller is extended for any reason, the first microcontroller can prevent it from stopping the power supply before the pre-shutdown processing of the second microcontroller is completed. [Brief explanation of the drawing]

[0012] [Figure 1] This is a block diagram showing the configuration of the electronic control unit of the vehicle according to the embodiment. [Figure 2] This flowchart shows the control processes executed by the main microcontroller and sub-microcontroller. [Figure 3] This is a time chart showing the operation of the main microcontroller and sub-microcontroller. [Figure 4] This flowchart shows a modified example of the control process executed by the main microcontroller and sub-microcontroller. [Figure 5] This is a time chart illustrating the modified behavior when the sub-microcontroller's pre-shutdown processing is extended beyond what was expected. [Modes for carrying out the invention]

[0013] Embodiments of this disclosure will be described below with reference to the drawings. [composition] The electronic control unit (hereinafter referred to as ECU) 10 of this embodiment is used, for example, to control the engine, motor, and other power sources of a vehicle when mounted on a vehicle.

[0014] Therefore, as shown in Figure 1, the ECU10 is connected to the ignition switch (IGSW)2, which is the vehicle's power switch, and a main relay 4 that, when the IGSW2 is turned ON, opens the power supply path from the vehicle battery to the ECU10.

[0015] The main relay 4 is a well-known one having a switch contact and a coil. When the coil is energized, the switch contact closes, conducting the power supply path from the in-vehicle battery to the ECU 10.

[0016] The ECU 10 is provided with a main microcomputer 20 that controls the engine to be controlled and the like, a sub-microcomputer 40 that assists the control by the main microcomputer 20, and an integrated IC 60 that supplies power to the main microcomputer 20 and the sub-microcomputer 40.

[0017] Note that the main microcomputer 20 and the sub-microcomputer 40 are a microcomputer or a microcontroller including a central processing arithmetic unit (that is, a CPU) that performs various arithmetic processes for control.

[0018] When the IGSW 2 is switched to the ON state while the integrated IC 60 stops supplying power to each of the microcomputers 20 and 40 with the IGSW 2 in the OFF state, for example, the integrated IC 60 energizes the coil by connecting one end of the coil of the main relay 4 to the ground. As a result, the switch contact of the main relay 4 closes, and the battery voltage VB is supplied from the in-vehicle battery to the integrated IC 60.

[0019] The integrated IC 60 generates three types of power supply voltages VC1, VC2, and VC3 for driving the internal circuits of each of the microcomputers 20 and 40 with the battery voltage VB supplied from the in-vehicle battery via the main relay 4, and supplies them to each of the microcomputers 20 and 40.

[0020] That is, the integrated IC 60 supplies power to the main microcomputer 20 and the sub-microcomputer 40 by supplying the generated power supply voltages VC1, VC2, and VC3 to a plurality of functional circuits constituting the main microcomputer 20 and the sub-microcomputer 40. Note that the integrated IC 60 is an example of the power supply unit of the present disclosure.

[0021] Further, the main microcomputer 20 and the sub-microcomputer 40 each include, as a plurality of functional circuits, a CPU 22, 42, semiconductor memories 24, 44 such as ROM and RAM, and input / output units 26, 46 as input / output interfaces.

[0022] The power supply voltages VC1, VC2, and VC3 generated by the integrated IC 60 are supplied to the CPUs 22, 42, semiconductor memories 24, 44, and input / output units 26, 46 of the main microcomputer 20 and the sub-microcomputer 40, respectively.

[0023] Specifically, the output terminal 61 of the power supply voltage VC1 of the integrated IC 60 is connected to the first power supply terminals 31, 51 of the main microcomputer 20 and the sub-microcomputer 40 via the first power supply path L1, and the power supply voltage VC1 is supplied to the CPUs 22, 42 of the respective microcomputers 20, 40.

[0024] Also, the output terminal 62 of the power supply voltage VC2 of the integrated IC 60 is connected to the second power supply terminals 32, 52 of the main microcomputer 20 and the sub-microcomputer 40 via the second power supply path L2, and the power supply voltage VC2 is supplied to the semiconductor memories 24, 44 of the respective microcomputers 20, 40.

[0025] Also, the output terminal 63 of the power supply voltage VC3 of the integrated IC 60 is connected to the third power supply terminals 33, 53 of the main microcomputer 20 and the sub-microcomputer 40 via the third power supply path L3, and the power supply voltage VC3 is supplied to the input / output units 26, 46 of the respective microcomputers 20, 40.

[0026] Next, the main microcomputer 20 is provided with a current consumption monitor unit 28 that monitors the current consumption of the sub-microcomputer 40. This current consumption monitor unit 28 detects the currents isb1, isb2, and isb3 flowing through the CPU 42, semiconductor memory 44, and input / output unit 46 of the sub-microcomputer 40 via current sensors provided in the first to third power supply paths L1, L2, and L3 from the integrated IC 60 to the sub-microcomputer 40.

[0027] The currents ISB1, ISB2, and ISB3 detected by the current consumption monitor unit 28 are input to the CPU 22 of the main microcontroller 20 via the input / output unit 26 as the current consumption of the CPU 42, semiconductor memory 44, and input / output unit 46 of the sub-microcontroller 40. The CPU 22 then determines whether to stop the operation of the sub-microcontroller 40 based on the input current consumption.

[0028] When IGSW2 is turned ON, the integrated IC 60 switches the main relay 4 to the ON state and starts generating the respective power supply voltages VC1, VC2, and VC3. Therefore, when IGSW2 is switched ON, the power supply voltages VC1, VC2, and VC3 are supplied to the respective functional circuits of the main microcontroller 20 and sub-microcontroller 40, enabling the microcontrollers 20 and 40 to operate.

[0029] At this time, the integrated IC 60 outputs a reset signal (hereinafter referred to as the RST signal) to the main microcontroller 20, thereby starting up the main microcontroller 20 (i.e., performing a power-on reset). When the main microcontroller 20 starts up after receiving the RST signal from the integrated IC 60, it outputs an RST signal to the sub-microcontroller 40, thereby starting up the sub-microcontroller 40 (i.e., performing a power-on reset).

[0030] Therefore, when IGSW2 is switched to the ON state, the main microcontroller 20 and the sub-microcontroller 40 start up in sequence, and the CPUs 22 and 42 in each microcontroller 20 and 40 start the control processing shown in Figure 2 according to the programs stored in the ROM of the semiconductor memories 24 and 44.

[0031] After startup, the main microcontroller 20 and sub-microcontroller 40 generate a watchdog signal (hereinafter referred to as the WDC signal) at regular intervals when the CPUs 22 and 42 are executing control processing correctly.

[0032] The WDC signal generated by the main microcontroller 20 is input to the integrated IC 60, and the WDC signal generated by the sub-microcontroller 40 is input to the main microcontroller 20. Therefore, the integrated IC 60 can monitor the operation of the main microcontroller 20 based on the WDC signal from the main microcontroller 20, and the main microcontroller 20 can monitor the operation of the sub-microcontroller 40 based on the WDC signal from the sub-microcontroller 40.

[0033] [process] Next, we will explain the control processes executed by the CPUs 22 and 42 of the main microcontroller 20 and the sub-microcontroller 40. In Figure 2, the flowchart on the left represents the control processes executed by the CPU 22 of the main microcontroller 20, and the flowchart on the right represents the control processes executed by the CPU 42 of the sub-microcontroller 40.

[0034] As shown in Figure 2, once the main microcontroller 20 and sub-microcontroller 40 start up and the CPUs 22 and 42 begin control processing, the CPUs 22 and 42 first perform normal processing in S110 and S210.

[0035] In normal processing, CPUs 22 and 42 each acquire various detection signals from various sensors that detect the state of the controlled object and peripheral devices via input / output units 26 and 46, and calculate various control quantities necessary to control the controlled object to the desired state based on the acquired detection signals. Furthermore, CPUs 22 and 42 control the controlled object to the desired state by outputting control signals corresponding to the calculated control quantities to the controlled object and peripheral devices via input / output units 26 and 46.

[0036] Next, during normal processing, CPUs 22 and 42 determine in S120 and S220 whether IGSW2 has been switched to the off state. If IGSW2 has not been switched to the off state, they proceed to S110 and S210 to continue normal processing.

[0037] On the other hand, if the IGSW is switched to the OFF state, S120 and S220 determine that a power-off request has been received and proceed to S130 and S230, respectively, to perform IG-off post-processing to safely stop the control of the controlled object.

[0038] Furthermore, CPUs 22 and 42 transmit and receive data necessary for control via inter-microcontroller communication while performing normal processing and post-IG-off processing. Therefore, as shown in Figure 3, when the IG switch is turned off at time t1, CPUs 22 and 42 will synchronize with each other, terminate normal processing, and begin post-IG-off processing.

[0039] Furthermore, during the execution of the IG-off post-processing in S130, the CPU 22 on the main microcontroller 20 determines whether or not the shutdown conditions for stopping the operation of each microcontroller 20,40 have been met. If the shutdown conditions are met, it generates a shutdown command.

[0040] This shutdown command is a command to stop the operation of the main microcontroller 20 and the sub-microcontroller 40 and shut them down. The main microcontroller 20 generates the shutdown command, for example, by switching the main relay control flag, which is set to the ON state at startup, to the OFF state.

[0041] Furthermore, the main relay control flag, which has been switched to the off state in this manner, is also sent to the CPU 42 of the sub-microcontroller 40 via inter-microcontroller communication. The CPU 42 on the sub-microcontroller 40 then detects the shutdown command from the main microcontroller 20 by receiving the main relay control flag.

[0042] Therefore, while the IG-off post-processing in S130 and S230 is being executed, CPUs 22 and 42 determine in S140 and S240, respectively, whether or not a shutdown command has been issued based on the main relay control flag. If no shutdown command has been issued, they proceed to S130 and S230 to continue the IG-off post-processing.

[0043] Furthermore, if it is determined in S140 or S240 that a shutdown command has been issued, CPUs 22 and 42 will, for example, at time t2 as shown in Figure 3, proceed to S150 and S250 respectively and begin the pre-shutdown processing.

[0044] This pre-shutdown processing is the final processing, for example, to back up various data used for control to the non-volatile memory of semiconductor memory 24, 44, and to store the shutdown timing, and includes a pre-set delay time.

[0045] Then, when the CPU 42 of the sub-microcontroller 40 completes the pre-shutdown processing in S250, it terminates its control processing and stops its own operation (i.e., shuts down). Meanwhile, after the CPU 22 of the main microcontroller 20 completes the pre-shutdown processing in S150, it proceeds to S160. In S160, it is determined whether the current consumption ISB1, ISB2, and ISB3 of the sub-microcontroller 40, which are monitored by the current consumption monitor unit 28, have fallen below the pre-set thresholds Ith1, Ith2, and Ith3, respectively, used for determining when the device will stop working.

[0046] The process in S160 is to wait for the current consumption of the sub-microcontroller 40, isb1, isb2, and isb3, to all fall below the thresholds ith1, ith2, and ith3. Therefore, if at least one of the current consumptions of the sub-microcontroller 40, isb1, isb2, or isb3, is not below the thresholds ith1, ith2, or ith3, the process returns to S160.

[0047] Furthermore, in S160, if it is determined that the current consumption ISB1, ISB2, and ISB3 are all below the thresholds ITH1, ITH2, and ITH3, the CPU 22 of the main microcontroller 20 determines that the sub-microcontroller 40 has stopped operating and stops its own operation (i.e., shuts down).

[0048] In other words, the main microcontroller 20 determines that the sub-microcontroller 40 has stopped operating and stops its own operation when the current consumption of each functional circuit constituting the sub-microcontroller 40, isb1, isb2, and isb3, is all below the thresholds ith1, ith2, and ith3.

[0049] Furthermore, when the main microcontroller 20 stops operating in this manner, the WDC signal is no longer output from the main microcontroller 20 to the integrated IC 60. As a result, the integrated IC 60 detects that the main microcontroller 20 has stopped operating due to the lack of WDC signal output from the main microcontroller 20 and stops the power supply to the coil of the main relay 4.

[0050] As a result, the supply path of battery voltage VB from the vehicle battery to the integrated IC60 is interrupted, causing the integrated IC60 to stop generating power supply voltages VC1, VC2, and VC3, and the ECU10 to completely cease operation.

[0051] [effect] In the ECU10 of this embodiment, as shown in Figure 3, the CPU22 of the main microcontroller 20 continues the pre-shutdown processing, which was started at time t2, until time t3, when it can confirm that the sub-microcontroller 40 has shut down.

[0052] Then, when the CPU 22 of the main microcontroller 20 confirms that the sub-microcontroller 40 has shut down, it stops its own processing operation and stops outputting the WDC signal. As a result, the integrated IC 60 stops supplying power to each microcontroller 20 and 40 at time t4, after the output of the WDC signal from the main microcontroller 20 has stopped.

[0053] Therefore, according to the ECU 10 of this embodiment, it is possible to suppress the integrated IC 60 from stopping the power supply to each microcontroller 20, 40 when the sub-microcontroller 40 is operating.

[0054] Furthermore, the CPU 22 of the main microcontroller 20 detects the shutdown of the sub-microcontroller 40 at point t3, when the current consumption flowing through each functional circuit of the sub-microcontroller 40, such as the CPU 42, semiconductor memory 44, and input / output unit 46, falls below a threshold, and stops the power supply from the integrated IC 60. Therefore, if the pre-shutdown processing of the sub-microcontroller 40 is unintentionally extended, it is possible to prevent the main microcontroller 20 from shutting down and the power supply from the integrated IC 60 from stopping before the pre-shutdown processing of the sub-microcontroller 40 is completed.

[0055] Furthermore, the CPU 22 of the main microcontroller 20 can detect the shutdown of the sub-microcontroller 40 without receiving a communication signal from the sub-microcontroller 40 indicating the shutdown. Therefore, for example, if the main microcontroller 20 cannot detect the shutdown of the sub-microcontroller 40 through a notification signal from the sub-microcontroller 40, it is possible to prevent the power supply from the integrated IC 60 from being cut off as if the communication path to the sub-microcontroller 40 has failed.

[0056] [Differentiation] In the above embodiment, after the CPU 22 on the main microcontroller 20 completes its pre-shutdown processing, it determines whether the current consumption of each functional circuit of the sub-microcontroller 40 is below a threshold, and stops processing if the current consumption is below the threshold.

[0057] Therefore, for example, if the pre-shutdown processing on the sub-microcontroller 40 is extended beyond expectations due to some abnormality, and the current consumption of each functional circuit does not fall below the threshold, the main microcontroller 20 will be unable to determine that the sub-microcontroller 40 has stopped operating.

[0058] Therefore, in the control processing of the main microcontroller 20, the processes S170 and S180 may be executed in addition, as shown in Figure 4. In other words, in the control process shown in Figure 4, if it is determined in S160 that the current consumption of the sub-microcontroller 40 is not below a threshold, the process proceeds to S170, where the elapsed time since the start of the S160 process is measured.

[0059] Furthermore, in S170, it is determined whether the elapsed time has exceeded a preset abnormality detection time. If S170 determines that the elapsed time since the start of processing in S160 has not exceeded the abnormality detection time, the process of S160 is executed again, and the system waits for the sub-microcontroller 40 to shut down until time t11 shown in Figure 5.

[0060] On the other hand, in S170, if the elapsed time since the start of processing in S160 is determined to have exceeded the abnormality detection time, that is, if the shutdown waiting time for the sub-microcontroller 40 has elapsed, the process proceeds to S180.

[0061] Then, in S180, the sub-microcontroller 40 detects that some kind of abnormality has occurred that prevents it from shutting down (hereinafter referred to as a shutdown abnormality), and terminates the control process. As a result, the main microcontroller 20 stops its own operation (i.e., shuts down) at time t11 shown in Figure 5, in conjunction with the termination of the control process.

[0062] Furthermore, when the main microcontroller 20 stops operating in this manner, at time t12 shown in Figure 5, the integrated IC 60 turns off the main relay 4, stopping the power supply to the main microcontroller 20 and the sub-microcontroller 40. As a result, the power state of each microcontroller 20 and 40 becomes off. Consequently, the sub-microcontroller 40 stops operating (i.e., shuts down) at time t13 shown in Figure 5 due to the drop in power supply voltage.

[0063] Thus, in the ECU10 of this modified example, if the sub-microcontroller 40 is unable to shut down due to some abnormality, the main microcontroller 20 detects the shutdown abnormality of the sub-microcontroller 40 from the elapsed time after the completion of the pre-shutdown processing.

[0064] When a shutdown abnormality is detected, the main microcontroller 20 terminates its control processing, and the integrated IC 60 turns off the main relay 4, thereby stopping the power supply to the main microcontroller 20 and the sub-microcontroller 40.

[0065] Therefore, when a shutdown abnormality occurs in the sub-microcontroller 40, it is possible to prevent the integrated IC 60 from stopping the power supply to each microcontroller 20 and 40 (i.e., stopping the operation of the ECU 10).

[0066] Next, when the main microcontroller 20 detects a shutdown abnormality in the sub-microcontroller 40 in S180, it identifies the functional circuit whose current consumption did not fall below a threshold based on the current consumption of each functional circuit of the sub-microcontroller 40 at that time. Then, it stores the identified functional circuit as the functional circuit that caused the shutdown abnormality of the sub-microcontroller 40 in the non-volatile memory of the semiconductor memory 24.

[0067] Therefore, the user can identify the cause of the shutdown abnormality based on the functional circuit stored in the non-volatile memory of the semiconductor memory 24 when the main microcontroller 20 detects a shutdown abnormality, and take measures to prevent the shutdown abnormality.

[0068] Furthermore, if a shutdown abnormality is detected in S180, the system may notify the system of this abnormality and store the time of its occurrence in the non-volatile memory of the semiconductor memory 24. In addition, if a shutdown abnormality of the sub-microcontroller 40 is detected in S180, the system may store the current consumption of each functional circuit of the sub-microcontroller 40 in the non-volatile memory of the semiconductor memory 24.

[0069] Furthermore, in S180, when the functional circuit that caused the shutdown abnormality is identified, the sub-microcontroller 40 may be shut down more safely by executing a predetermined fail-safe process depending on the type of functional circuit.

[0070] Although embodiments and variations of the present disclosure have been described above, the present disclosure is not limited to the embodiments and variations described above and can be implemented in various modified forms. For example, in the above embodiment, the ECU 10 was described as controlling the engine or motor that powers the vehicle, but the technology of this disclosure can be applied in the same manner as in the above embodiment to any electronic control device that controls the controlled object using multiple microcontrollers.

[0071] Furthermore, in the above embodiment, the functional circuits constituting the main microcontroller 20 and the sub-microcontroller 40 were described as CPUs 22 and 42, semiconductor memories 24 and 44, and input / output units 26 and 46. However, these functional circuits are merely examples and can be configured as appropriate. For example, each microcontroller 20 and 40 may also be equipped with functional circuits such as an A / D conversion unit, a D / A conversion unit, and a drive circuit.

[0072] Furthermore, in the above embodiment, the main microcontroller 20 was described as stopping its own operation when it detects that the sub-microcontroller 40 has stopped operating, thereby stopping the output of the WDC signal to the integrated IC 60 and causing the integrated IC 60 to turn off the main relay 4. However, the main microcontroller 20 may also be configured to stop the operation of the ECU 10 by directly switching the main relay 4 to the off state when it detects that the sub-microcontroller 40 has stopped operating.

[0073] Furthermore, multiple functions of one component in the above embodiment may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Furthermore, some parts of the configuration of the above embodiment may be omitted. Furthermore, at least some parts of the configuration of the above embodiment may be added to or replaced with the configuration of other above embodiments.

[0074] Furthermore, this disclosure can be implemented in various forms, including not only the electronic control device described above, but also a system comprising an electronic control device, a program for making a computer function as an electronic control device, a non-transitional physical recording medium such as semiconductor memory on which this program is stored, and a control method using multiple microcontrollers. [Explanation of Symbols]

[0075] 10...ECU, 20...Main microcontroller, 40...Sub-microcontroller, 22,42...CPU, 24,44...Semiconductor memory, 26,46...Input / Output section, 60...Integrated IC.

Claims

1. Multiple microcontrollers (20, 40) A power supply unit (60) configured to supply power to the aforementioned multiple microcontrollers, An electronic control device equipped with, Each of the aforementioned microcontrollers is configured to perform a pre-shutdown process (S150, S250) that stops the currently running process when a shutdown command is issued to stop the operation of that microcontroller. Furthermore, the first microcontroller (20), which is one of the aforementioned plurality of microcontrollers, When the above-mentioned pre-shutdown processing is completed, it is determined whether the current consumption of the second microcontroller (40), which is a different microcontroller from the first microcontroller among the plurality of microcontrollers, has fallen below a predetermined threshold (S160). If the current consumption falls below the threshold, the power supply from the power supply unit is stopped. Furthermore, the second microcontroller measures the elapsed time from when it starts the pre-shutdown processing until the current consumption drops below the threshold, and determines whether the elapsed time exceeds a predetermined abnormality determination time (S170). If the elapsed time exceeds the abnormality determination time, it detects a shutdown abnormality in the second microcontroller (S180) and stops the power supply from the power supply unit. An electronic control unit configured in such a way.

2. The electronic control device according to Claim 1, The power supply unit is configured to supply power to each of the multiple functional circuits (42, 44, 46) constituting the second microcontroller via different power supply paths. The first microcontroller is configured to detect the current supplied from the power supply unit to each of the multiple functional circuits of the second microcontroller via the different power supply paths, and to identify the functional circuit whose elapsed time until the current falls below the threshold exceeds the abnormality determination time as the functional circuit that caused the shutdown abnormality.

3. An electronic control device according to claim 1 or claim 2, The US electronic control unit is installed in the vehicle, The power supply unit is configured to start supplying power to the multiple microcontrollers and activating them when the vehicle's power switch (2) is switched from the off state to the on state. The plurality of microcontrollers are configured to execute pre-configured normal processing (S110, S220) when started by power supplied from the power supply unit, and to execute post-off processing (S130, S140) to terminate the normal processing when the power switch is switched to the off state during the execution of the normal processing. Furthermore, the electronic control device is configured such that the first microcontroller generates the shutdown command during the execution of the post-off processing and transmits it to the second microcontroller, thereby causing the first microcontroller and the second microcontroller to perform the pre-shutdown processing.

Images