JP2010285001A - Electronic control system and functional agency method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic control system and a functional agency method capable of coping with failure of an ECU (electronic control unit) without depending on a specific ECU. <P>SOLUTION: This electronic control system 100 is provided for connecting a first electronic control unit 1 and one or more of second electronic control units A via a network 20. The first electronic control unit has a failure detecting means 36 for detecting failure of the self function and an agency request means 35 for requesting agency of the failure function of causing failure to the second electronic control unit, and the second electronic control unit has: a determining means 42 for determining whether the failure function can be substituted; and agency means 41 and 43 for acting for the functional function when it is determined that the agency can be performed. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a fail safe for an on-board electronic control unit, and more particularly to an electronic control system and a function substitution method in which another electronic control unit substitutes a function of a failed electronic control unit.

  While the basic functions of vehicles and in-vehicle devices have been digitized, a large number of electronic control units have been installed, and as a result, it has become necessary to deal with failures of the electronic control units. In order to detect a faulty electronic control unit, a technique in which a specific ECU monitors other ECUs has been considered (see, for example, Patent Documents 1 and 2). Patent Document 1 discloses a technology in which when a communication ECU detects a failure of a navigation ECU or the like, the data is transmitted to an information providing center, and the information providing center performs a function. In Patent Document 2, a basic program that simplifies necessary functions is prepared in the manager ECU, and when a failure of the engine ECU or the like is detected, the basic program is downloaded to an appropriate ECU and the ECU is installed in the engine ECU. Techniques for taking over shoulders are disclosed.

JP-A-10-297446 JP 2002-221075 A

  However, when a specific ECU allocates processing to another ECU as in the technique described in Patent Document 1 or 2, there is a problem that it is difficult to cope with a failure in a specific ECU. In addition, there is a process that can be performed by another ECU as long as the process is an information processing system as in Patent Document 1, but when the electronic control unit of the control system fails, the sensors and actuators managed by the failed electronic control unit It is difficult for another ECU to take over the processing. With regard to this point, Patent Document 2 allows other ECUs to take over the processing of the control system by directly connecting the sensors and actuators to the in-vehicle network. The load increases, and it becomes difficult to secure the timing for accessing the sensor and the actuator.

  In view of the above problems, an object of the present invention is to provide an electronic control system and a function substitution method that can cope with a failure of an ECU without depending on a specific ECU.

  In an electronic control system in which a first electronic control unit and one or more second electronic control units are connected via a network, the first electronic control unit includes a failure detection means for detecting a failure in self-function, a failure Proxy requesting means for requesting the second electronic control unit to substitute for the failed function. The second electronic control unit has a determination means for determining whether or not the replacement of the failed function is possible. A proxy means for substituting the fault function when it is determined to be possible.

  It is possible to provide an electronic control system and a function substitution method that can cope with an ECU failure without depending on a specific ECU.

It is a figure which shows an example of the relationship of the operating time of ECU1, ECU_A, and ECU_B. It is an example of the schematic block diagram of an electronic control system. It is an example of a functional block diagram of ECU1 and ECU_A. It is a figure which shows an example of a substitute required specification table. It is an example of the flowchart figure which shows the procedure until ECU_A substitutes the function of ECU1. It is an example of the functional block diagram of ECU1 and ECU_A (Example 2). (Example 2) which is a figure which shows an example of a substitute required specification table. It is an example of the flowchart figure which shows the procedure until ECU_A substitutes the function of ECU1.

  DESCRIPTION OF EMBODIMENTS Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.

  In the electronic control system 100 of the present embodiment, when a failure occurs in the ECU (Electronic Control Unit) 1, the ECU_A or the ECU_B performs part or all of the functions of the ECU 1. In the electronic control system 100, an ECU_A or an ECU_B that can provide a malfunctioning function of the ECU 1 instead of a specific ECU performs the function. By doing so, it is possible to appropriately cope with the failure of the ECU 1 without incurring extra costs for a specific ECU.

  FIG. 1 is a diagram illustrating an example of a relationship between operating times of the ECU 1 and ECU_A and ECU_B. The shaded area in FIG. 1 means that the ECU is operating. As shown in the figure, ECU1 and ECU_A, or ECU1 and ECU_B have a complementary relationship with respect to the operation time. That is, while the ECU 1 is activated during traveling, the ECU_A and the ECU_B are substantially stopped during traveling. The ECU 1 is an ECU that electronically controls actuators used for basic functions of the vehicle such as “run, turn, stop” such as an engine ECU, a power train ECU, a brake ECU, and a power steering ECU (EPS). On the other hand, the ECU_A provides functions necessary during parking, such as detecting an electronic key near the vehicle by wireless communication and unlocking the door. Further, the ECU_B provides a function necessary during entering the garage, for example, when the vehicle travels backward, such as displaying an expected locus superimposed on a camera image behind the vehicle (back guide monitor function).

  The electronic control system 100 uses such a relationship between the ECU 1 and the ECU_A or the ECU 1 and the ECU_B. When the ECU 1 breaks down during traveling, the ECU_A or the ECU_B having a sufficient processing capacity during traveling is used by the ECU 1 or ECU_B. Is substituted for part or all of the above (hereinafter simply referred to as function substitution). In the present embodiment, ECU_A or ECU_B that stops while traveling performs the function of ECU 1, but the ECU that performs the function only needs to have a sufficient processing capacity and does not need to be stopped.

  When the ECU 1 breaks down during traveling, the ECU 1 requests the ECU_A and the ECU_B to perform the function substitution, and the ECU having the capability necessary for the substitution of the function of the ECU 1 of the ECU_A or the ECU_B substitutes the function of the ECU 1. Since ECU_A or ECU_B determines whether or not the function substitution of the ECU 1 is possible, an appropriate ECU can perform the function substitution without depending on a specific ECU.

By the way, there are two major cases of failure of the ECU 1.
(I) When the main part of the CPU of the ECU 1 fails In this case, the ECU_A or ECU_B performs at least the minimum necessary functions for providing the functions of the ECU 1, and the ECU_A or ECU_B performs the I / O processing of the ECU 1. take over.
(II) When some functions of the CPU of the ECU 1 fail In this case, the ECU_A or ECU_B performs only some functions of the ECU 1 and returns the processing result to the ECU 1. The ECU 1 executes the I / O processing as before the failure.

In this embodiment, (I) a case where a main part of the CPU of the ECU 1 has failed will be described.
FIG. 2 shows an example of a schematic configuration diagram of the electronic control system 100. ECU1, ECU_A, and ECU_B are connected via the in-vehicle LAN 20. The configuration of ECU_B is omitted because it is the same as that of ECU_A. A peripheral IC 12, a memory 13, and I / Os 14 and 15 are connected to the microcomputer 11 via a bus, and a sensor 17 and an actuator 18 are connected to the I / Os 14 and 15. The microcomputer 11 includes a CPU 33, a register 16, a RAM 19, a CAN communication unit 31, a switch element, an ASIC (Application Specific Integrated Circuit), which will be described later. The peripheral IC 12 is an integrated IC having a reset circuit 27, a timer, and the like. The memory 13 is a nonvolatile memory such as an EEPROM or a flash memory, and stores an application program for the ECU 1 to provide a predetermined function, an OS (Operating System), and the like. I / O 14 is an A / D conversion circuit, and I / O 15 is a D / A conversion circuit or a motor drive circuit. The microcomputer 11 reads the application program stored in the memory 13, performs an operation on the sensor signal detected by the sensor 17, and repeats processing such as controlling the actuator 18.

  If the ECU 1 is an engine ECU, the sensor 17 is a water temperature sensor, an engine speed sensor, an O2 sensor, or the like, and the actuator 18 is a throttle motor, an injector, or the like. If the ECU 1 is a brake ECU, the sensor 17 is a master cylinder pressure sensor, a vehicle speed sensor, or the like, and the actuator 18 is a pressure increasing valve, a pressure reducing valve, a pressure holding valve, or the like arranged in a hydraulic circuit. If the ECU 1 is a transmission ECU, the sensor 17 is an oil temperature sensor, an accelerator opening sensor, or the like, and the actuator 18 is various solenoids built in the valve body.

  A peripheral IC 22, a memory 23, and I / Os 24 and 25 are connected to the microcomputer 21 of the ECU_A through a bus. Sensors and actuators may also be connected to the I / Os 24 and 25. The microcomputer 21 includes a CPU 41, a register 26, a RAM 29, a CAN communication unit 43, a switch element, an ASIC, and the like. The peripheral IC 22 has a reset circuit 27. The reset circuit 27 starts the microcomputer 21 by resetting the microcomputer 21. Similarly, ECU_B has a reset circuit and a determination circuit, and either ECU_A or ECU_B substitutes for the function of ECU1.

  When the ECU_A is an ECU for a keyless entry system (control ECU or body ECU) that controls door lock and unlock, the I / O 24 is connected to a communication device or antenna that forms an electronic key detection area, and the I / O 25 Is connected to a door lock motor. When ECU_A or ECU_B is an ECU that provides a bag guide monitor function, the I / O 24 is connected with a camera that captures the rear.

  FIG. 3 is an example of a functional block diagram of the ECU 1 and ECU_A. When the ECU 1 detects a failure, the ECU_A or ECU_B performs the function substitution in the form of taking over the I / Os 14 and 15 of the ECU 1. The microcomputer 11 includes a CAN communication unit 31 for communicating with other ECUs via the in-vehicle LAN 20, a MUX 34 that selectively switches connection between the CPU 33 and the I / Os 14 and 15, and the CAN communication unit 31 and the I / Os 14 and 15. In addition, the I / O 14 and 15 and the CAN communication unit 31 have a DMAC (Direct Memory Access Controller) 32 that enables mutual access without using the CPU 33.

  Moreover, ECU_A has the determination part 42 which determines whether the function substitution of ECU1 is possible. The ECU_B also has a determination unit, but the illustration is omitted. The determination part 42 is implement | achieved when CPU41 of activated ECU_A runs the program memorize | stored in the memory 23, for example.

(Fault detection)
First, failure detection of the ECU 1 will be described. When the main part of the CPU 33 fails, it is often difficult for the microcomputer 11 itself to detect the failure or to request a function substitution from the ECU_A or ECU_B after the failure. Therefore, in this embodiment, the peripheral IC 12 of the ECU 1 performs processing after failure detection.

  The peripheral IC 12 includes a substitution request unit 35 that requests the ECU_A or ECU_B to perform a function substitution of the ECU 1, a failure detection unit 36 that detects a failure of the CPU 33, and a switching unit 37 that allows the ECU_A or ECU_B to take over the I / Os 14 and 15. Have. Since these functional blocks provide relatively simple functions, they may be implemented by either software or hardware.

  The failure detection unit 36 uses, for example, a watchdog timer, and the microcomputer 11 periodically sets an initial value in the watchdog timer, thereby confirming that the microcomputer 11 is operating normally. On the other hand, when the microcomputer 11 fails and the initial value cannot be set in the watchdog timer, the value of the watchdog timer becomes zero and the peripheral IC 12 is interrupted. The failure detection unit 36 detects an abnormality of the microcomputer 11 from this interrupt. It should be noted that a failure in which the watchdog timer is not written often causes a predetermined application to wait for a response or enter an infinite loop, and a reset circuit (not shown) may reset the CPU 33 to restore the function of the CPU 33. . The failure detection unit 36 may detect a failure of the microcomputer 11 because an interrupt is generated again from the watchdog timer even if reset several times.

  When the failure detection unit 36 detects a failure of the microcomputer 11, the substitution request unit 35 requests the ECU_A or ECU_B for a function substitution. If it is assumed that the main part of the CPU 33 has failed, function substitution is difficult unless it is another ECU having the same processing ability as the microcomputer 11 of the ECU 1. Further, if the time delay until the ECU_A or ECU_B communicates with the ECU 1 is too long, it is difficult for the ECU or ECU_B to take over the I / Os 14 and 15 of the ECU 1. Further, when high reliability is required for the control of the ECU 1, the ECU_A or ECU_B acting as a function also requires appropriate reliability. For example, when the reliability required for the ECU 1 is high, such as a power steering ECU that controls the steering of the vehicle, it is preferable that the ECU_A or ECU_B acting as a function also has the same or higher reliability.

  The proxy request unit 35 requests a function proxy by sending a proxy request signal including processing capability, delay time, and reliability to the ECU_A or ECU_B when requesting a proxy. Thereby, the determination part 42 of ECU_A or ECU_B can determine whether the function of ECU1 can be substituted.

The substitution request unit 35 stores a substitution necessary specification table 38 in which necessary substitution necessary specifications are registered in order to request the ECU_A or the ECU_B to perform the function substitution.
FIG. 4 is a diagram illustrating an example of the substitution requirement specification table 38. In the processing capability, the operating clock frequency of the CPU 33 and the memory capacity of the work area (RAM 29) are registered as specifications of the substitute ECU. Also, the delay time and reliability are registered. The delay time is, for example, an average time when a response request is sent from ECU_A or ECU_B to ECU1. In addition, the reliability is determined in, for example, about three stages of A to C. When the reliability of the substitution required specification is A, the reliability can be represented by the function B unless the reliability is an ECU of A. In the case of the above, it means that the function cannot be performed unless the reliability is an ECU of A or B, and when the reliability is C, it means that the function cannot be performed unless the reliability is an ECU of A to C. The substitute necessary specification of the substitute necessary specification table 38 does not necessarily mean the processing capability itself of the ECU 1, but may be a specification that is necessary for the other ECUs to substitute the necessary functions among the functions of the ECU 1. .

  When the failure detection unit 36 detects a failure, the substitution request unit 35 transmits a substitution request signal to the ECU_A or the ECU_B via the CAN communication unit 31. The CAN communication unit 31 generates frame data according to the CAN protocol and stores a proxy request signal. When the CAN communication unit 31 broadcasts the substitute request signal, all ECUs connected to the in-vehicle LAN 20 can determine whether or not the function of the ECU 1 can be substituted. Note that the proxy request signal may be transmitted only to a plurality of predetermined ECU_A or ECU_B.

  For example, when the ECU_A and the ECU_B receive the substitute request signal and transmit a preparation completion signal indicating that the substitute is possible to the ECU 1, the ECU 1 can select which of the ECU_A or the ECU_B is requested to substitute. The preparation completion signal will be described later, but the ECU 1 selects the most preferable ECU_A or ECU_B with reference to the preparation completion signal.

  In addition, when there are a plurality of ECUs that satisfy all the necessary substitution specifications, the ECU 1 requests the functional substitution from the ECU_A or ECU_B that has transmitted the preparation completion signal earliest. By doing so, ECUA or ECUB acting as a function of ECU1 can be determined at an early stage. The ECU 1 individually transmits a signal to the effect that the function substitution is no longer necessary to the ECU that has not requested the function substitution. The ECU that has received the signal indicating that the function substitution is no longer necessary can be stopped, thereby suppressing an increase in power consumption. The following processing will be described assuming that the ECU_A performs the function substitution.

[Function substitution]
When the main part of the CPU 33 breaks down, the ECU_A takes over the processing that the ECU 1 has been executing until the failure. Here, since the application program executed by the ECU 1 is rarely stored in the memory 23 of the ECU_A, the ECU 1 transmits the application program to the ECU_A. Then, the ECU 1 receives a processing result obtained when the ECU_A executes the application program.

  For this reason, when the preparation completion signal is received from ECU_A, the switching unit 37 of the ECU 1 requests the DMAC 32 to transmit the application program stored in the memory 13. If the ECU_A has sufficient free space in the memory 23, the DMAC 32 can transmit all of the application programs before the ECU_A starts function substitution. When ECU_A does not have sufficient capacity of memory 23, the application program for every predetermined amount is repeatedly transmitted to ECU_A. In this embodiment, the latter will be described as an example.

  By the way, when the microcomputer 11 fails during the execution of the application program, the ECU_A obtains the processing result up to the failure, so that consistency with the control up to the failure can be easily maintained. For example, in a series of processes for motor control, the next control amount is often determined using the processing results up to that point. For example, since the occupant feels uncomfortable when the torque and the rotational speed of the electric motor are suddenly increased, a target value corresponding to the previous control amount is obtained in the process of determining the energization amount of the electric motor by feedback control. Thus, the control amount of the electric motor is determined. Further, even if it is not necessary to maintain the consistency of control up to the failure as described above, the ECU_A can start the function substitution of the ECU 1 at an early stage by using the processing result up to the failure. Calculation information up to the failure by the application program is stored in the RAM 19 which is the main storage device or the register 16 used by the CPU 33. Further, since the register 16 includes information for specifying the state of the ECU 1, such as a PC (program counter), the address of the application program that the ECU_A resumes is also clarified. Therefore, the application program can be resumed from the middle by the ECU_A using the calculation information in the RAM 19 and the register 16.

  If the main part of the CPU 33 is faulty, the contents of the RAM 19 and the register 16 cannot often be read out in the first place. Therefore, the DMAC 32 transmits these contents only when the contents of the RAM 19 and the register 16 can be called. .

  Then, the switching unit 37 switches the connection destination of the I / Os 14 and 15 from the CPU 33 to the CAN communication unit 31. If the main part of the CPU 33 breaks down, it becomes difficult for the CPU 33 to directly control the I / Os 14 and 15. For this reason, when receiving the preparation completion signal, the switching unit 37 outputs a control signal for switching the connection destination of the I / Os 14 and 15 from the CPU 33 to the CAN communication unit 31 to the MUX 34. The MUX 34 switches the connection destination of the I / Os 14 and 15 from the CPU 33 to the CAN communication unit 31, so that the CAN communication unit 31 can transmit the sensor signal detected by the sensor 17 to the ECU_A without using the CPU 33. Further, the processing result of the ECU_A is directly transmitted to the I / O 15 so that the ECU_A can control the actuator 18 via the I / O 15.

  Thus, ECU1 enables ECU_A to take over I / O14,15 of ECU1 by repeating transmission of an application program, transmission of a sensor signal, and reception of a processing result.

[Determining whether or not function substitution is possible]
As described with reference to FIG. 1, since ECU_A or ECU_B is activated according to the vehicle state such as stopped or running, when ECU_A or ECU_B receives the substitute request signal, only the peripheral IC 22 21 is in a state of operating to determine whether or not the activation of 21 is necessary.

  When receiving the proxy request signal, the CAN communication unit 43 causes the reset circuit 27 to output a reset signal. When the reset circuit 27 outputs a reset signal to the microcomputer 21, the CPU 41 is activated, and the ECU_A can substitute the function of the ECU 1. Specifically, circuits such as the CPU 41 and the register 26 of the microcomputer 21 are initialized by receiving a reset signal. As a result, a predetermined interrupt occurs in the CPU 41, and the CPU 41 starts a startup routine. The startup routine initializes the microcomputer 21 and then causes the CPU 41 to execute the Main function. The CPU 41 detects that the proxy request signal has been received by using a flag or the like, and determines the determination unit 42 implemented by a subroutine from the MAIN function. call.

  The determination unit 42 determines whether or not the function of the ECU 1 can be performed based on the proxy request signal. The determination unit 42 stores the processing capability and reliability of the ECU_A as parameters. The determination unit 42 compares the stored parameter with the processing capability and reliability included in the proxy request signal to determine whether the function of the ECU 1 can be substituted.

On the other hand, the delay time from when the ECU_A performs the function until the ECU 1 receives the processing result is greatly influenced by the bus load of the in-vehicle LAN 20, and is not necessarily fixed. Therefore, the determination unit 42 determines whether or not the required delay time is satisfied from the bus load when the proxy request signal is received. The bus load can be calculated by the following equation, for example.
Bus load = {number of bits × transmission time} / observation time The observation time is about 5 to 10 seconds, and the number of bits is the total number of bits of frame data transmitted on the in-vehicle LAN 20 during the observation time. The transmission time is the time required for 1-bit transmission. For example, when the transmission capability is 500 kbps, the transmission time is 2 microseconds. Accordingly, the CAN communication unit 31 can determine the bus load by monitoring the frame data transmitted on the in-vehicle LAN 20 during the observation time. The determination unit 42 obtains an expected average delay time from a table that defines the relationship between the bus load and the delay time, and compares it with the delay time included in the proxy request signal.

The determination unit 42 transmits a preparation completion signal including the determination result to the ECU 1. Several modes of the ready signal can be considered.
(A) A mode in which the determination unit 42 transmits a preparation completion signal when it is determined whether or not the proxy required specifications are satisfied for the processing capability, reliability, and delay time, respectively.
(B) A mode in which a preparation completion signal including information describing whether or not the specification is satisfied is transmitted for each specification of the substitute requirement specification.

  The aspect of (a) is effective when there is a high possibility that a plurality of ECU_A and ECU_B that may be substituted will satisfy the necessary substitution specifications, and the aspect of (b) is to search for an ECU that satisfies the necessary substitution specifications. It is effective when it is difficult.

  For example, the processing capability and the delay time may be acceptable even if they do not satisfy the proxy requirements. On the other hand, if the reliability does not satisfy the requirement for substitution, it is preferable not to substitute. Therefore, the aspect of (b) is preferable in the sense that the degree of freedom is left in the selection of the ECU that performs the function of the ECU 1. The switching unit 37 of the ECU 1 that has received the preparation completion signal of (b) can request the substitution of the function from the ECU that satisfies the high-priority specification if there is no ECU that satisfies all the specifications among the necessary substitution specifications. The ECU 1 predetermines the priority for each specification.

  Note that when the determination unit 42 determines that none of the specifications of the substitute required specifications are satisfied, the preparation completion signal may not be transmitted to the ECU 1. By doing so, the selection target can be narrowed.

[Warning during function substitution]
When the ECU_A performs the function of the ECU 1, it is difficult for the ECU_A to provide the door unlock function or the bag guide monitor function, which is the original function. Therefore, the ECU_A acting as a function agent can know the reason why the driver cannot use a desired function when the driver parks the vehicle by notifying the driver that the original function cannot be used. For example, the ECU_A can request the meter ECU or the navigation ECU to turn on a warning lamp or a message such as “The ECU for the bag guide monitor is currently unavailable because the function of the OO ECU is acting on its behalf”. . Note that when the vehicle is parked or the driver forcibly terminates the substitution, the ECU_A terminates the substitution and provides the original function.

[Operation procedure]
FIG. 5 is an example of a flowchart illustrating a procedure until the ECU_A performs the function of the ECU 1. When the flowchart of FIG. 5 starts, ECU1 is in the process of being activated, and ECU_A and ECU_B are in a state in which only the peripheral IC 22 is activated.

  First, the failure detection unit 36 detects a failure of the microcomputer 11 (S10). Thereby, the substitute request | requirement part 35 refers to the substitute required specification table 38, and transmits a substitute request signal to ECU_A and ECU_B (S20). Although both ECU_A and ECU_B start activation, only the procedure of ECU_A is shown in FIG.

  When ECU_A is activated (S30), the determination unit 42 determines whether or not the function of the ECU 1 can be substituted (S40). The determination unit 42 compares the processing capability stored in advance as a parameter and the processing capability of the proxy request signal with the reliability stored in advance as a parameter and the reliability included in the proxy request signal, respectively. Further, the determination unit 42 obtains an expected delay time based on the calculated bus load, and compares it with the delay time included in the function substitution signal.

  When the determination unit 42 determines that the ECU_A can perform the function of the ECU 1, the determination unit 42 transmits a preparation completion signal to the ECU 1 (S50).

  The switching unit 37 transmits the application program and the sensor signal to, for example, the ECU_A that satisfies all of the necessary substitution specifications from among the ECUs that have transmitted the preparation completion signal (S60). In this case, it is preferable to transmit the contents of the RAM 19 and the register 16 together. In order to transmit the application program and the sensor signal, the switching unit 37 requests the DMAC 32 to transmit the application program stored in the memory 13. The switching unit 37 also outputs a control signal for switching the connection destination of the I / Os 14 and 15 from the CPU 33 to the CAN communication unit 31 to the MUX 34. Thereby, the CAN communication part 31 can transmit a sensor signal to ECU_A as a destination.

  The CAN communication part 31 of ECU_A receives an application program and a sensor signal. Then, the CPU 41 of the ECU_A executes the application program and performs a predetermined calculation on the sensor signal to substitute the function of the ECU 1 (S70). The CAN communication part 31 of ECU_A transmits a process result to ECU1 (S80).

  The CAN communication unit 31 of the ECU 1 sends the received processing result to the I / O 15 via the MUX 34. As a result, the ECU 18 can control the actuator 18 of the ECU 1 in such a manner that the ECU_A takes over the I / O 15 of the ECU 1 (S90).

  After the control of the actuator 18 taken over by the ECU_A, the ECU 1 and the ECU_A repeat steps S60 to S90.

  According to the electronic control system 100 of the present embodiment, ECU_A satisfying the specifications for substituting the function of the failed ECU 1 is detected, and the ECU_A performs the function substitution. Therefore, the ECU 1 can be operated without depending on a specific ECU. It can respond. Since ECU_A is an ECU that is not activated when ECU1 is activated, it is possible to cope with a failure of ECU1 without increasing the total cost of electronic control system 100, such as increasing the processing capacity of ECU_A acting as a function. it can.

  In this embodiment, the peripheral IC 12 of the ECU 1 detects a failure, but other ECUs connected to the in-vehicle LAN 20 can also detect a failure of the ECU 1. The ECU that detects the failure may be an active ECU, and is hereinafter referred to as ECU_Z. For example, the ECU_Z detects a failure of the microcomputer 11 because communication with the ECU 1 is disabled. Since the ECU_Z is an ECU that executes its own processing using the sensor signal detected by the sensor 17 and the processing result processed by the ECU 1, the ECU_Z cannot detect the signal or the processing result, and therefore can detect a failure of the ECU 1. .

  In this case, the ECU 1 automatically switches the MUX 34 to the I / O 14 or 15 side when a failure is detected. When the ECU_Z detects a failure of the ECU 1, the ECU_A and the ECU_B request a function substitution, and the ECU_A and the ECU_B read the substitution function necessity table from the ECU 1, thereby determining that the function substitution is possible. To do. Thereafter, ECU_A or ECU_B can perform the function of ECU 1 by repeating communication with CAN communication unit 31 of ECU 1.

  In this embodiment, (II) a case where a part of the function of the CPU 33 of the ECU 1 has failed will be described. In this case, ECU_A or ECU_B performs only a partial function of ECU 1 and returns the processing result to ECU 1. The ECU 1 executes the I / O processing as before the failure.

  FIG. 6 is an example of a functional block diagram of the ECU 1 and ECU_A. In FIG. 6, the same parts as those in FIG. In this embodiment, since a part of the CPU 33 has failed, the microcomputer 11 executes failure detection, function substitution request, and the like. The CPU 33 includes a failure detection unit 36, a substitution request unit 35, a calculation completion unit 39, and a calculation information transmission unit 40 that are realized by executing a failure program stored in the memory 13. The application program executed by the CPU 33 calls the failure program periodically, or by calling the failure program when the processing load becomes a predetermined value or less, the CPU 33 executes the failure program.

[ECU1]
The failure detection unit 36 detects a failure of the microcomputer 11 based on whether or not the execution result of the predetermined calculation matches the expected value stored in advance. Predetermined operations are individually prepared for floating point operations, multiplications, divisions, image processing operations, timers, and the like so that a failed circuit can be easily identified.

The substitution request unit 35 transmits a substitution request signal including substitution necessary specifications to the ECU_A and the ECU_B according to the failed circuit. The substitution request unit 35 has a substitution requirement specification table 38 as in the first embodiment.
FIG. 7 is a diagram illustrating an example of the substitute requirement specification table 38. The proxy required specifications are registered in association with the failed circuit. For example, the substitution required specification when the floating point arithmetic circuit fails is registered with the floating point arithmetic accuracy, and the substitute necessary specification when the image processing circuit fails is registered with the frame rate necessary for image processing. Yes. The substitution request unit 35 refers to the substitution necessary table based on the failed circuit, and transmits a substitution request signal including the broken circuit and the substitution necessary specification from the CAN communication unit 31. The ECU_A or ECU_B that has received the function substitution request determines whether or not it can perform the function substitution based on the substitution request signal.

  When the calculation information transmission unit 40 receives the preparation completion signal, the calculation information transmission unit 40 transmits the calculation information stored in the RAM 19 and the register 16 to the ECU_A that has transmitted the preparation completion signal. Since the calculation information stored in the RAM 19 and the register 16 is the result of the calculation executed so far by the ECU 1 to control the actuator 18, the consistency with the control up to the failure can be obtained by sending this to the ECU_A. Can keep.

  In this embodiment, since the ECU_A is requested to perform a calculation by a specific circuit, the application program need not be transmitted, but what kind of calculation is required is described in the application program. Part of the program code may be used. That is, the calculation information includes a minimum calculation content. ECU_A acting on behalf of the function substitutes the calculation based on the calculation information, and transmits the processing result to ECU 1.

  When a part of the CPU 33 fails, the sensor signal detected by the sensor 17 from the I / O 14 is used to execute the same processing as before the failure, but the sensor signal is stored in the RAM 19 or the register 16. For this reason, the sensor signal is transmitted together with the calculation information when the CPU 33 transmits the contents of the RAM 19 or the register 16 to the ECU_A or the ECU_B. Therefore, the information that the ECU 1 transmits to the ECU_A is substantially the same as that in the first embodiment.

  The calculation completion unit 39 completes the calculation for controlling the actuator 18 using the processing result. That is, when a request for calculation is requested to ECU_A in the middle of a necessary series of calculations, the calculation is completed by executing subsequent calculations using the processing result received from ECU_A. If necessary, calculation information stored in the RAM 19 or the register 16 may be used.

  When only a specific circuit of the CPU 33 fails as in the present embodiment, the CPU 33 can control the I / Os 14 and 15 as before the failure. Therefore, the CPU 33 controls the actuator 18 from the I / O 15 using the calculation result obtained by the calculation completion unit 39 completing the calculation.

  Also in this embodiment, the ECU_A can take over the I / O 15. For example, if the calculation information transmitted by the ECU 1 includes all procedures of a series of calculations, the calculation completion unit 39 is not necessary. Also, when the ECU_A is requested to substitute for the calculation at the end of the series of calculations, the calculation completion unit 39 does not need to execute the calculation. Therefore, in such a case, ECU_A can control the actuator 18. That is, if the connection destination of the I / O 15 is switched to the CAN communication unit 31 while the connection destination of the I / O 14 is maintained in the CPU 33, the ECU_A takes over the I / O 15. In this case, since it is not necessary for the ECU 1 to complete the calculation, it is possible to minimize the control delay due to the substitution.

  As described above, in the electronic control system 100 according to the present embodiment, the ECU 1 performs the function of the ECU 1 in which the ECU_A has failed by repeating the transmission of calculation information, the reception of processing results, and the control of the I / O 15.

[Decision by ECU_A or ECU_B]
The block diagram of ECU_A or ECU_B is the same as that in the first embodiment. That is, when the ECU_A receives the proxy request signal, the reset circuit outputs the reset signal to the microcomputer 21, thereby starting the CPU 41. The CPU 41 detects that the proxy request signal has been received using a flag or the like, and calls the determination unit 42 implemented by a subroutine or the like from the MAIN function.

  The determination unit 42 determines whether or not the function of the ECU 1 can be substituted based on the failed circuit and the substitution required specification included in the substitution request signal. Since the circuit of the CPU 41 of the ECU_A and the specification of the circuit are fixed, the determination unit 42 stores the circuit and the specification of the CPU 41 of the ECU_A as parameters as in FIG. Note that the determination method regarding delay time and reliability is the same as that in the first embodiment.

  The determination unit 42 determines whether or not the specifications of the failed circuit, the delay time, and the reliability satisfy the proxy required specifications, and determines that the ECU_A can perform the function of the ECU 1 when all the requirements are satisfied. In the case of the present embodiment, ECU_A or ECU_B that satisfies the specifications of the faulty circuit at the minimum transmits a preparation completion signal to the ECU 1. The ECU 1 can determine the most suitable ECU as a function substitution request destination from the ECU_A or the ECU_B that satisfies the specifications of the failed circuit.

  When the determination unit 42 determines that the ECU_A satisfies the specification of the failed circuit, the determination unit 42 transmits a preparation completion signal to the ECU 1. When determining that the ECU_A does not satisfy the specification of the failed circuit, the determination unit 42 does not transmit a preparation completion signal to the ECU 1. In this case, if another ECU_B transmits a preparation completion signal, the ECU_B substitutes the function of the ECU 1.

[Operation procedure]
FIG. 8 is an example of a flowchart illustrating a procedure until the ECU_A performs the function of the ECU 1. In FIG. 8, the same parts as those in FIG. In the present embodiment, in step S60, the ECU 1 transmits calculation information to the ECU_A. If calculation other than the faulty circuit is requested to ECU_A, ECU_A can take over I / O 15 by switching the connection destination of I / O 15 from CPU 33 to CAN communication unit 31.

  In step S90, when the calculation completion unit 39 completes the calculation using the processing result, the calculation result is sent to the actuator 18 via the I / O 15. By doing so, the actuator 18 can be controlled in a manner in which the ECU 1 controls the I / O 15 as before the failure (S90).

  According to the electronic control system 100 of the present embodiment, in addition to the effects of the first embodiment, the ECU_A can perform the function substitution even when a part of the circuit of the CPU 33 of the ECU 1 fails.

  The function substitution mode of the first embodiment and the second embodiment can be implemented only by either one, but preferably both. By providing both the function substitution of the first embodiment and the second embodiment, the ECU_A or the ECU_B can perform the function substitution even when the main part of the CPU 33 fails or when some of the circuits break down.

11, 21 Microcomputer 12, 22 Peripheral IC
13, 23 Memory 14, 15, 24, 25 I / O
16, 26 Register 17 Sensor 18 Actuator 19, 29 RAM
20 In-vehicle LAN
27 Reset circuit 100 Electronic control system

Claims (9)

In an electronic control system in which a first electronic control unit and one or more second electronic control units are connected via a network,
The first electronic control unit is
A failure detection means for detecting a failure of the self-function;
Proxy requesting means for requesting the second electronic control unit to perform a proxy for the failed fault function;
The second electronic control unit is
Determining means for determining whether or not the failure function can be replaced;
If it is determined that substitution is possible, a substitution means that substitutes the failure function,
An electronic control system characterized by that. The first electronic control unit is
It has a microcomputer that provides self-functions and a peripheral IC connected to the microcomputer.
The failure detection means mounted on the peripheral IC detects the failure by monitoring the operation of the microcomputer.
The electronic control system according to claim 1. There is a time zone in which the second electronic control unit is not operating during the time zone in which the first electronic control unit is operating,
The electronic control system according to claim 1 or 2, wherein The proxy request means transmits calculation information until a failure stored in the memory or register of the first electronic control unit is detected to the second electronic control unit,
The proxy means transmits a processing result obtained by processing the calculation information to the first electronic control unit.
The electronic control system according to any one of claims 1 to 3. The first electronic control unit is
I / O interface for connecting microcomputers and peripheral devices,
Switching means for switching the connection destination of the input / output interface from the microcomputer to the second electronic control unit so that the second electronic control unit takes over the input / output interface;
The electronic control system according to claim 1, comprising: The failure detection means detects a failure of a specific arithmetic circuit of self-function,
The proxy means substitutes the failure function by an arithmetic circuit equivalent to the arithmetic circuit.
The electronic control system according to claim 4. The determination means includes
For each of a plurality of specifications required for the substitution notified from the substitution request means, information describing whether or not to satisfy is transmitted to the first electronic control unit,
The first electronic control unit determines a second electronic control unit that requests substitution based on information describing whether or not the first electronic control unit is satisfied.
The electronic control system according to claim 1, wherein: Delay time information is included in multiple specifications required for delegation.
The electronic control system according to claim 7. In the function surrogate method in which the function of the first electronic control unit is replaced by one or more second electronic control units when connected via a network,
The failure detection means of the first electronic control unit detects a failure of the self-function;
A proxy request means requesting the second electronic control unit to perform a proxy for the failed fault function;
A step of determining whether or not the determination unit of the second electronic control unit can replace the failure function;
A proxy function method comprising: substituting the fault function when the proxy means determines that proxy is possible.

Images