JP6789159B2 - Vehicle control device - Google Patents

Description

The present invention relates to a control device (vehicle control device) used for a vehicle such as an automobile, and is a redundant control device including a main control unit and a sub control unit.

For example, Patent Document 1 discloses a control device for a drive device, the control device includes a main system microcomputer and a sub system microcomputer, and an AD (Analog-to-Digital) conversion module and a CAN (Controller Area Network) module are redundant. It has been converted. Specifically, in the control device of Patent Document 1, the output calculation software for calculating the input data is stored only in the main microcomputer. When the main system CAN module is abnormal and the sub system CAN module is normal, the main system microcomputer uses the sub system CAN input data stored in the DP RAM (Dual Port RAM), and the sub system CAN module is used. Communication can be performed.

In addition, the sub system microcomputer (CPU of the control device for the sub system drive device (ATCU)) of Patent Document 1 always transmits the state (normal or abnormal) of the sub system CAN module and the sub system CAN input data (input value) to the DPRAM. Can be written.

Japanese Unexamined Patent Publication No. 2016-055832

In Patent Document 1, when the main CAN module is normal, the communication in the main CAN module is executed, while the communication in the sub CAN module is not executed. Therefore, when the state of the main CAN module changes from normal to abnormal and the sub CAN module is normal, the communication in the sub CAN module is actually executed. However, the present inventors have recognized that communication in the sub CAN module may not actually be executed when the sub CAN module is activated. In other words, when the sub system microcomputer erroneously determines that the sub system CAN module is normal, even if the transmission data transmission command is transmitted to the sub system CAN module, the sub system CAN module actually transmits the transmission data. Cannot be sent to.

Further, in Patent Document 1, when the main system microcomputer is abnormal, communication in the sub system CAN module is not executed. This is because the communication in the sub CAN module is controlled by the main microcomputer.

One object of the present invention is to provide a vehicle control device capable of reliably operating a sub communication module such as a sub system CAN module. Another object of the present invention is to provide a vehicle control device capable of operating a sub communication module even in a situation where a main control unit such as a main microcomputer fails. Other objects of the invention will become apparent to those skilled in the art by reference to the embodiments and best embodiments illustrated below, as well as the accompanying drawings.

Hereinafter, in order to easily understand the outline of the present invention, embodiments according to the present invention will be illustrated.

In the first aspect, the vehicle control device having a main control unit and a sub control unit connected to the vehicle-mounted network is
The first main communication module capable of executing communication on the in-vehicle network and
The first sub-communication module capable of executing communication on the in-vehicle network and
A second main communication module capable of executing communication on a route different from the in-vehicle network, and
With the second sub-communication module capable of performing communication on the different routes,
With
The first sub-communication module transmits transmission data composed of predetermined data to the first main communication module.
The first main communication module transmits reply data configured based on the transmission data to the first sub communication module.
When the first sub-communication module receives the reply data, the sub-control unit confirms whether or not the first sub-communication module is normal based on the reply data.
When the main control unit determines that the first main communication module has failed, the second main communication module transmits failure data to the second sub communication module.
When the second sub-communication module receives the failure data, the sub-control unit determines that the first main communication module has failed, and determines that the first main communication module has failed.
After confirming that the first sub-communication module is normal via the in-vehicle network, when it is determined that the first main communication module has failed via the different route, the said The transmission of control data to the vehicle-mounted device on the vehicle-mounted network is executed by the first sub-communication module instead of the first main communication module.

In the first aspect, the first sub-communication module transmits over the vehicle-mounted network before the transmission of control data to the vehicle-mounted device on the vehicle-mounted network (eg CAN) is performed by the first sub-communication module. The data is actually transmitted to the first main communication module, and the reply data as the execution result is actually received from the first main communication module. In the first aspect, since it is confirmed that the first sub-communication module was able to actually transmit the transmission data, the first sub-communication module reliably transmits the control data to the in-vehicle device on the in-vehicle network. can do. As described above, in the first aspect, it is possible to provide a vehicle control device capable of reliably operating the sub-communication module.

In the second aspect, which is subordinate to the first aspect,
When the data from the second main communication module is cut off, the sub-control unit may determine whether or not the data from the first main communication module is cut off.
When the data from the second main communication module is interrupted and the data from the first main communication module is not interrupted, the transmission of the control data to the vehicle-mounted device on the vehicle-mounted network is performed by the first. It may continue to be executed by the main communication module of.

In the second aspect, even in a situation where the data from the second main communication module is interrupted, when the data from the first main communication module is not interrupted, the sub-control unit causes an abnormality in the vehicle-mounted network (for example, the main). It is possible to estimate an abnormality of a different route (for example, a disconnection of the SPI communication line) instead of a failure of the control unit. In the second aspect, when the data from the first main communication module is not interrupted, in other words, it is confirmed that the first main communication module can actually transmit, for example, reply data, so that the first The main communication module can reliably transmit control data to the in-vehicle device on the in-vehicle network. In this way, the operation of the first main communication module can be continued.

In the third aspect, which is subordinate to the second aspect,
When the data from the second main communication module is cut off and the data from the first main communication module is also cut off, the sub-control unit estimates that the main control unit is out of order. Moreover, the transmission of the control data to the vehicle-mounted device on the vehicle-mounted network may be executed by the first sub-communication module.

In the third aspect, when the data from the second main communication module is disconnected and the data from the first main communication module is also disconnected, the sub-control unit performs an abnormality of a different route (for example, disconnection of the SPI communication line). ), But the failure of the main control unit can be estimated. In the third aspect, in other words, since it is confirmed that the first main communication module could not actually transmit the reply data, for example, the first main communication module is no longer used as an in-vehicle device on the in-vehicle network. Control data cannot be transmitted reliably. Therefore, instead of the first main communication module, the first sub-communication module can reliably transmit control data to the in-vehicle device on the in-vehicle network.

In the fourth aspect, which is subordinate to any one of the first to third aspects,
The predetermined data constituting the transmission data transmitted from the first sub communication module to the first main communication module is generated by executing a predetermined operation in the sub control unit at a predetermined interval. It may be variable data to be generated.

In the fourth aspect, since the predetermined data constituting the transmission data is variable data, the transmission data is changed at predetermined intervals. Therefore, the reply data constructed based on the transmission data is also changed at predetermined intervals. By using such reply data, in the fourth aspect, it is possible to more reliably confirm that the first sub-communication module was able to actually transmit the transmission data. In other words, when the reply data is fixed data or the transmission data (variable data) is not reflected in the reply data, the sub control unit does not confirm that the first sub communication module is normal or the first sub. It is possible to determine an abnormality in the communication module.

In the fifth aspect, which is subordinate to the fourth aspect,
When the reply data is based on the variable data, the sub control unit may confirm that the first sub communication module is normal.

In the fifth aspect, when the reply data is based on variable data (transmission data changed at predetermined intervals), it is more reliably confirmed that the first sub-communication module was able to actually transmit the transmission data. Can be done.

In the sixth aspect, which is subordinate to the fifth aspect,
When the reply data is not based on the variable data, the sub-control unit may transmit the abnormality of the first sub-communication module to the main control unit via the different route.
When the abnormality of the first sub-communication module is received by the main control unit via the different paths and the main control unit determines that the first main communication module is out of order. The second main communication module does not transmit the failure data of the first main communication module to the second sub-communication module, and the control data is transmitted to the vehicle-mounted device on the vehicle-mounted network. , It may not be executed by the first main communication module and the first sub communication module.

In the sixth aspect, when the reply data is not based on variable data (transmission data changed at predetermined intervals), the sub-control unit sends an abnormality of the first sub-communication module to the main control unit via a different route. Send. In the sixth aspect, even in a situation where the first main communication module fails, the main control unit does not notify the sub control unit that the first main communication module has failed. Therefore, in the sixth aspect, when the reply data is not based on the variable data, the sub-control unit cannot determine that the first main communication module is out of order, so that the first sub-communication module is an in-vehicle network. Do not send control data to the above in-vehicle device.

In the seventh aspect, which is subordinate to any one of the first to sixth aspects,
The sub control unit may determine whether or not the first sub communication module is out of order.
After the sub-control unit determines that the first sub-communication module has not failed, the sub-control unit determines whether or not the first sub-communication module is normal based on the reply data. May be confirmed.

In the seventh aspect, when it is determined by the sub-control unit that the first sub-communication module has not failed, it is confirmed by the reply data whether or not the first sub-communication module was able to actually transmit the transmission data. be able to. In other words, the present inventors have recognized that when the sub-control unit determines that the first sub-communication module has not failed, the transmission in the first sub-communication module may not actually be executed. ..

In the eighth aspect, which is subordinate to any one of the first to seventh aspects,
The first sub-communication module may transmit the next transmission data composed of the next predetermined data based on the reply data to the first main communication module.
When the first main communication module receives the transmission data, the main control unit confirms whether or not the first main communication module is normal based on the transmission data and the reply data. Well,
When it is not confirmed that the first main communication module is normal, the second main communication module may transmit an abnormality of the first main communication module to the second sub communication module.

In the eighth aspect, even in a situation where the main control unit determines that the first main communication module has not failed, there is a possibility that the transmission in the first main communication module is not actually executed. The inventors have recognized. In other words, in the eighth aspect, the first main communication module actually transmits the reply data to the first sub communication module via the in-vehicle network, and the reply data as the execution result is not reflected in the transmission data. Occasionally, it is presumed that transmission in the first main communication module is not actually being performed, or it is not confirmed that the first main communication module is normal. In such a situation, in the eighth aspect, the main control unit can notify the sub control unit of the abnormality of the first main communication module.

In the ninth aspect, which is subordinate to any one of the first to eighth aspects,
When the transmission of the control data to the vehicle-mounted device on the vehicle-mounted network is executed by the first sub-communication module instead of the first main communication module, the control data is the operation of the vehicle-mounted device. It may be degenerate data that degenerates.

In the ninth aspect, when the failure of the first main communication module is notified to the sub control unit, the sub control unit can transmit the degenerate data to the in-vehicle device. In other words, in the ninth aspect, when the first sub-communication module is not made redundant, the function of the vehicle-mounted device controlled by the vehicle control device can be reduced or a part of the vehicle-mounted device can be stopped.

Those skilled in the art will readily appreciate that the embodiments according to the invention exemplified may be further modified without departing from the spirit of the invention.

A configuration example of a vehicle control device according to the present invention is shown. FIG. 2A shows a flowchart showing an operation example of a sub control device that generates CAN transmission data (predetermined data) for confirming whether or not the first sub communication module is normal. 2 (B) shows a flowchart showing an operation example of the main control device which generates CAN reply data based on CAN transmission data (predetermined data). FIG. 3 (A) shows a flowchart showing an operation example of the main control device that generates CAN failure data for causing the sub control device to transmit degenerate data, and FIG. 3 (B) shows a sub that generates degenerate data. A flowchart showing an operation example of the control device is shown.

The best embodiments described below have been used to facilitate understanding of the present invention. Therefore, one of ordinary skill in the art should note that the present invention is not unreasonably limited by the embodiments described below.

FIG. 1 shows a configuration example of a vehicle control device according to the present invention. Although not shown in FIG. 1, a vehicle such as an automobile typically includes many ECUs (Electronic Control Units), and these ECUs are connected to an in-vehicle network such as CAN. Further, these ECUs can control various actuators (not shown) to realize the running of the vehicle. The vehicle control device shown in FIG. 1 is one of those ECUs, or a general control ECU that controls those ECUs, and the vehicle control device is, for example, a 2-wire differential voltage type CAN communication. It has a main control unit 12 and a sub control unit 22 connected to a CAN (in a broad sense, an in-vehicle network) capable of executing the above. Each of the main control unit 12 and the sub control unit 22 typically includes a calculation unit such as a CPU.

In FIG. 1, the main control unit 12 executes communication on the CAN by a first main communication module 14 (vehicle-mounted network module) such as a CAN communication module, and as a normal operation, an ECU (in a broad sense) on the vehicle-mounted network. Can transmit control data to the in-vehicle device). On the other hand, the sub control unit 22 does not transmit control data to the ECU on the vehicle-mounted network as a normal operation. Only when the CAN communication module on the main side fails, the sub control unit 22 uses the first sub communication module 24 (specifically, the CAN communication module on the sub side) as an exception or an emergency operation to the in-vehicle network. Control data can be transmitted to the above ECU. The CAN communication modules on the main side and the sub side which are made redundant in this way are provided in the vehicle control device.

Specifically, the vehicle control device of FIG. 1 includes a main control device 10 and a sub control device 20, and each of the main control device 10 and the sub control device 20 has a CAN such as an SPI (Serial Peripheral Interface). Has an SPI communication module capable of executing communication on different routes (communication between main and sub). The second main communication module 16 (specifically, the SPI communication module on the main side) causes a failure, abnormality, etc. of the first main communication module 14 (CAN communication module on the main side) to be detected by the second sub communication module 26. (Specifically, it can be transmitted to the SPI communication module on the sub side). Similarly, the second sub-communication module 26 (specifically, the SPI communication module on the sub side) causes a failure, abnormality, etc. of the first sub-communication module 24 (CAN communication module on the sub side) as the first main. It can be transmitted to the communication module 16 (specifically, the SPI communication module on the main side).

FIG. 2A shows a sub control device 20 that generates CAN transmission data (predetermined data) for confirming whether or not the first sub communication module 24 (CAN communication module on the sub side) is normal. A flowchart showing an operation example is shown. FIG. 2B shows a flowchart showing an operation example of the main control device 10 that generates CAN reply data based on CAN transmission data (predetermined data).

As a normal operation, the first sub communication module 24 (CAN communication module on the sub side) does not transmit control data to the ECU (in a broad sense, the in-vehicle device) on the in-vehicle network, and only to the main control device 10. Therefore, CAN transmission data (predetermined data) for confirming whether or not the CAN communication module on the sub side is normal can be transmitted (see step ST04 in FIG. 2A).

When the sub control device 20 starts normal operation, initial values are set for the reply data on the main side (received data on the sub side), and the sub control device 20 omits, for example, steps ST01 and ST02. Then, step ST03 is executed. In other words, when the sub control device 20 starts a normal operation, the sub control device 20 can immediately generate CAN transmission data (predetermined data) in step ST03.

In step ST03 of FIG. 2A, the sub control device 20 adds, for example, a numerical value of received data and, for example, a fixed numerical value on the sub side that is arbitrarily set, as a predetermined operation on the sub side. The added value, which is the calculated value on the sub side, is set to predetermined data (predetermined numerical value). The sub control device 20 generates transmission data including the predetermined data, and the sub control device 20 uses the CAN communication module on the sub side to transmit data (predetermined data) to the main control device 10 on the CAN. Is transmitted (see step ST04).

By the way, the first main communication module 14 (CAN communication module on the main side) transmits control data to the ECU on the vehicle-mounted network as a normal operation, and CAN on the sub side only with respect to the sub control device 20. CAN reply data based on transmission data (predetermined data) from the communication module can be generated (see step ST13 in FIG. 2B).

When the main control device 10 starts a normal operation, the main control device 10 omits, for example, step ST11 and step ST12, and executes step ST13. In other words, when the main control device 10 receives the transmission data (predetermined data) from the sub control device 20, the transmission data (predetermined data) on the sub side is set to the reception data on the main side, and the main control device In step 10, the reply data (transmission data on the main side) based on the reception data (predetermined data) can be generated in step ST13.

In step ST13 of FIG. 2B, the main control device 10 is set as a predetermined operation on the main side, for example, a numerical value of received data (a predetermined numerical value of predetermined data) and a fixed value on the main side which is arbitrarily set. Add the numerical value. The added value, which is the calculated value on the main side, is set to the numerical value of the transmitted data on the main side. The main control device 10 generates reply data including the transmission data, and the main control device 10 transmits the reply data to the sub control device 20 on the CAN by using the CAN communication module on the main side (step ST14). reference).

In step ST01 of FIG. 2A, the sub-control device 20 can determine whether or not a certain time has elapsed after transmitting the transmission data (predetermined data) in step ST04. Here, the fixed time is, for example, a fixed time based on the normal time required from the transmission of the transmission data (predetermined data) in the sub control device 20 to the reception of the received data (reply data) in the sub control device 20. Is set by adding the maximum allowed time to the normal time.

After a certain period of time has elapsed, the sub control device 20 can read the received data on the sub side that has been received by the CAN communication module (specifically, the receive buffer) on the sub side. Since the main control device 10 uses the CAN communication module on the main side to transmit the reply data on the main side to the sub control device 20 on the CAN, the received data on the sub side is usually the reply on the main side. Match the data. In step ST02 of FIG. 2A, the sub control device 20 confirms whether or not the received data on the sub side is valid. Specifically, the sub control device 20 determines whether or not the numerical value of the received data (= reply data on the main side) on the sub side matches the calculated value on the main side in step 13 of FIG. 2 (B). In order to confirm, the same operation as the predetermined operation on the main side is executed (see step ST02 in FIG. 2A).

More specifically, in step ST02 of FIG. 2A, the sub control device 20 is an execution result (execution result of step ST03) on the sub side stored in the sub control unit 22 (specifically, RAM). A predetermined numerical value of a predetermined data) is read out, and the calculated value (a predetermined numerical value of the predetermined data) and, for example, a fixed numerical value on the main side arbitrarily set are added. Alternatively, the sub control device 20 reads out the numerical value of the transmission data on the sub side stored in the CAN communication module (specifically, the transmission buffer) on the sub side, and arbitrarily sets the numerical value (a predetermined numerical value of the predetermined data). Add, for example, a fixed value on the main side to be set.

In step ST02, the sub control device 20 can confirm whether or not the numerical value of the received data (= reply data on the main side) on the sub side matches the added value. As the fixed numerical value on the main side, for example, the same numerical value is used between the sub control device 20 and the main control device 10, and the numerical value is preset in each of the sub control device 20 and the main control device 10. .. When the CAN communication module on the sub side can actually transmit the transmission data (predetermined data) in step ST04, the numerical value of the reception data on the sub side (= reply data on the main side) matches the added value, so that the sub control The device 20 confirms that the CAN communication module on the sub side is normal.

On the other hand, when the CAN communication module on the sub side cannot actually transmit the transmission data (predetermined data) in step ST04, the numerical value of the reception data (= reply data on the main side) on the sub side does not match the added value. , The sub control device 20 does not confirm that the CAN communication module on the sub side is normal. In other words, when the numerical value of the received data (= reply data on the main side) on the sub side does not match the added value, the sub control device 20 does not actually execute the transmission on the CAN communication module on the sub side. Can be estimated and an abnormality of the CAN communication module on the sub side can be determined (see step ST05 in FIG. 2A).

The relationship between the transmission data (predetermined data) on the sub side and the reply data on the main side will be specifically described below. When the received data on the sub side represents, for example, "0" (= initial value) and the fixed value on the sub side is, for example, "2", the predetermined data in step ST03 is, for example, "2" (= "0" +). Represents "2"). Therefore, for example, when the transmission data on the sub side representing "2" is actually transmitted from the CAN communication module on the sub side to the CAN communication module on the main side, the reception data on the main side in step ST12 represents, for example, "2". .. When the received data on the main side represents "2" and the fixed value on the main side is, for example, "3", the reply data on the main side is, for example, "5" (= "2" + "3") in step ST13. Represents. Therefore, for example, when the reply data (transmission data) on the main side representing "3" is actually transmitted from the CAN communication module on the main side to the CAN communication module on the sub side, the reception data on the sub side (main side) in step ST02 (Transmission data) represents, for example, "5". At the same time, in step ST02, the added value (“5”) of the numerical value (“2”) of the transmitted data transmitted in step ST04 and the fixed value (“3”) on the main side is calculated, and this added value and the added value are calculated. The numerical value of the received data on the sub side (transmitted data on the main side) is compared. When the CAN communication module on the sub side can actually transmit the transmission data in step ST04, the numerical value of the reception data (= reply data on the main side) on the sub side matches the added value, so that the sub control device 20 is sub. Confirm that the CAN communication module on the side is normal. In the next step ST03, the next predetermined data represents, for example, "7" (= "5" + "2"). As described above, when the CAN communication module on the sub side is normal, the predetermined data constituting the transmission data is variable data (transmission data changed at a predetermined interval).

By the way, for example, when the next transmission data on the sub side representing "7" is not actually transmitted from the CAN communication module on the sub side to the CAN communication module on the main side, the next reception data on the main side in the next step ST12 is , Continues to be the previous received data, for example representing "2". Therefore, in the next step ST13, the next reply data on the main side continues to represent, for example, "5" (= "2" + "3"). In the next step ST02, the next received data on the sub side (next transmitted data on the main side) in step ST02 continues to represent, for example, "5". At the same time, in the next step ST02, the next addition value (“10”) of the numerical value (“7”) of the transmission data that was not transmitted in step ST04 and the fixed value (“3”) on the main side is calculated. , This next addition value is compared with the numerical value of the next received data (next transmitted data on the main side) on the sub side. When the CAN communication module on the sub side cannot actually transmit the transmission data in step ST04, the numerical value of the reception data (= reply data on the main side) on the sub side does not match the added value, so that the sub control device 20 Do not confirm that the CAN communication module on the sub side is normal. That is, the sub control device 20 can estimate that the transmission by the CAN communication module on the sub side is not actually executed, and determine the abnormality of the CAN communication module on the sub side (see step ST05).

In step ST11 of FIG. 2B, the main control device 10 can determine whether or not a certain time has elapsed after transmitting the transmission data (reply data) in step ST14. Here, the fixed time is based on the normal time required from the transmission of the transmission data (reply data) by the main control device 10 to the reception of the received data (transmission data) by the main control device 10, for example, the fixed time is , Set by adding the maximum permissible time to the normal time.

After a certain period of time has elapsed, the main control device 10 can read the received data on the main side that has been received by the CAN communication module (specifically, the receive buffer) on the main side. Since the sub control device 20 uses the CAN communication module on the sub side to transmit the transmission data on the sub side to the main control device 10 on the CAN, the reception data on the main side is usually transmitted on the sub side. Match the data. In step ST12 of FIG. 2B, the main control device 10 confirms whether or not the received data on the main side is valid. Specifically, the main control device 10 determines whether or not the numerical value of the received data (= transmitted data on the sub side) on the main side matches the calculated value on the sub side in step 03 of FIG. 2 (A). In order to confirm, the same operation as the predetermined operation on the sub side is executed (see step ST12 in FIG. 2B).

More specifically, in step ST12 of FIG. 2B, the main control device 10 is an execution result (execution result of step ST13) on the main side stored in the main control unit 12 (specifically, RAM). (Numerical value of reply data) is read, and the calculated value (numerical value of reply data) and, for example, a fixed numerical value on the sub side arbitrarily set are added. Alternatively, the main control device 10 reads out the numerical value of the transmission data on the main side stored in the CAN communication module (specifically, the transmission buffer) on the main side, and arbitrarily sets the numerical value (the numerical value of the reply data). Add, for example, a fixed value on the sub side.

In step ST12, the main control device 10 can confirm whether or not the numerical value of the received data (= transmitted data on the sub side) on the main side matches the added value. As the fixed numerical value on the sub side, for example, the same numerical value is used between the main control device 10 and the sub control device 20, and the numerical value is preset in each of the main control device 10 and the sub control device 20. .. When the CAN communication module on the main side can actually transmit the transmission data (reply data) in step ST14, the numerical value of the reception data (= transmission data on the sub side) on the main side matches the added value, so that the sub control device 20 confirms that the CAN communication module on the sub side is normal.

On the other hand, when the CAN communication module on the main side cannot actually transmit the transmission data (reply data) in step ST14, the numerical value of the reception data (= transmission data on the sub side) on the main side does not match the added value. The main control device 10 does not confirm that the CAN communication module on the main side is normal. In other words, when the numerical value of the received data (= transmitted data on the sub side) on the main side does not match the added value, the main controller 10 does not actually execute the transmission on the CAN communication module on the main side. Can be estimated and an abnormality of the CAN communication module on the main side can be determined (see step ST15 in FIG. 2B).

The relationship between the transmission data (reply data) on the main side and the next transmission data on the sub side will be specifically described below. For example, when the transmission data on the main side representing "5" is actually transmitted from the CAN communication module on the main side to the CAN communication module on the sub side, the reception data on the sub side in step ST02 represents, for example, "5". When the received data on the sub side represents "5" and the fixed value on the sub side is, for example, "2", the next transmitted data on the sub side in step ST03 is, for example, "7" (= "5" + "2". "). Therefore, for example, when the next predetermined data (next transmission data) on the sub side representing "7" is actually transmitted from the CAN communication module on the sub side to the CAN communication module on the main side, the reception on the main side in step ST12. The data (received data on the main side) represents, for example, "7". At the same time, in step ST12, the added value (“7”) of the numerical value (“5”) of the transmitted data transmitted in step ST14 and the fixed value (“2”) on the sub side is calculated, and this added value and the added value are calculated. The numerical value of the received data on the main side (next transmitted data on the sub side) is compared. When the CAN communication module on the main side can actually transmit the transmission data in step ST14, the numerical value of the reception data on the main side (= the next transmission data on the sub side) matches the added value, so that the main control device 10 , Confirm that the CAN communication module on the main side is normal. The data of the next reply in the next step ST13 represents, for example, "10" (= "7" + "3"). As described above, when the CAN communication module on the main side is normal, the reply data is variable data.

When the CAN communication module on the main side cannot actually transmit the transmission data in step ST14, the numerical value of the reception data on the main side (= the next transmission data on the sub side) does not match the added value, so that the main control device 10 Does not confirm that the CAN communication module on the main side is normal. That is, the main control device 10 can estimate that the transmission by the CAN communication module on the main side is not actually executed, and determine the abnormality of the CAN communication module on the main side (see step ST15).

Note that the main control device 10 may always omit step ST12 (and step ST15) of FIG. 2B. Therefore, for example, only the sub control device 20 has a normal CAN communication module on the sub side. You may check whether or not. Further, the sub control device 20 may always omit step ST05 of FIG. 2A. Therefore, for example, the sub control device 20 does not notify the main control device 10 of the abnormality of the CAN communication module on the sub side. In other words, only the sub control device 20 may recognize the abnormality of the CAN communication module on the sub side. Further, the execution of the predetermined operation in step ST03 and / or step ST13 may be omitted, and therefore, for example, the predetermined data and / reply data may be fixed data, and in this case, for example, reception. The buffer may be initialized and it may be confirmed in step ST12 and / or step ST02 whether or not the received data is valid (predetermined data and / reply data). In addition, for example, when the main controller 10 determines the failure of the CAN communication module on the main side, steps ST04 and ST14 may be executed only once. In this case, the CAN module on the sub side may execute the steps ST04 and ST14 only once. Before transmitting the control data to the ECU on the vehicle-mounted network, the sub control device 20 may confirm the normality of the CAN module on the sub side and determine the failure of the CAN communication module on the main side.

FIG. 3 (A) shows a flowchart showing an operation example of the main control device 10 for generating CAN failure data for causing the sub control device 20 to transmit degenerate data, and FIG. 3 (B) shows a flowchart for generating degenerate data. A flowchart showing an operation example of the sub-control device 20 is shown. When the main control device 10 of FIG. 1 controls or controls the ECU on the CAN, the role of the main control device 10 is large. As an example, when the main control device 10 realizes automatic driving of a vehicle while controlling a plurality of ECUs, for example, the sub control device 20 changes from normal automatic driving to a failure of the CAN communication module on the main side. For example, it is possible to shift to an exception such as evacuation automatic driving (including automatic driving stop) or emergency automatic driving. In other words, when the CAN communication module on the main side is out of order, the sub-control device 20 can transmit degenerate data that degenerates their operations to, for example, a plurality of ECUs.

In step ST21 of FIG. 3A, the main control unit 12 of the main control device 10 determines whether or not, for example, the CAN communication module on the main side corresponding to the first main communication module 14 has failed. The main control unit 12 includes, for example, a CAN controller, the CAN communication module is, for example, a CAN transceiver, and the CAN controller can detect or diagnose a failure of the CAN transceiver. When the CAN communication module on the main side is not out of order, the main control unit 12 calculates, for example, the control output value required for normal automatic driving in real time, and controls the ECU that controls the actuator, for example, based on the control output value. The transmission data including the output value is transmitted from the CAN communication module on the main side (see steps ST22 and ST23). As a result, for example, normal automatic driving of the vehicle is realized.

When the CAN communication module on the main side is out of order, the main control unit 12 can determine whether or not the CAN communication module on the sub side is out of order (see step ST24). In step ST30 of FIG. 3B, the sub-control unit 22 of the sub-control device 20 determines whether or not the sub-side, for example, the CAN communication module corresponding to the first sub-communication module 24 is out of order, and CAN. The failure of the communication module can be notified to the main control unit 12 by, for example, SPI communication (see step ST36).

When the CAN communication module on the main side is out of order, the main control unit 12 can determine whether or not the CAN communication module on the sub side is abnormal (see step ST24). In steps ST02 and ST05 of FIG. 2A, the sub control unit 22 can confirm whether or not the CAN communication module on the sub side is normal, and mainly controls the abnormality of the CAN communication module by, for example, SPI communication. It can be told to the part 12.

In step ST24 of FIG. 3A, the main control unit 12 determines whether or not a failure or abnormality of the CAN communication module on the sub side is received, but CAN communication on the sub side is received. It may be determined whether or not only the abnormality of the module is received. Alternatively, the main control unit 12 may determine whether or not only the failure of the CAN communication module on the sub side is received.

In step ST24 of FIG. 3A, when the CAN communication module on the main side has failed and the CAN communication module on the sub side has also failed, the main control unit 12 does not execute step ST25. Similarly, when the CAN communication module on the main side fails and the CAN communication module on the sub side is abnormal, the main control unit 12 does not execute step ST25. When the CAN communication module on the main side has failed, but the CAN communication module on the sub side has not failed and is confirmed by the main control unit 12 to be normal, the main control unit 12 executes step ST25. ..

In step ST25 of FIG. 3A, in order to cause the sub-control device 20 to transmit the degenerate data, the main control unit 12 transmits, for example, SPI communication of the failure data (degenerate operation instruction) indicating the failure of the CAN communication module on the main side. Can be transmitted to the sub-control unit 22 (see steps ST35, ST33 and ST34 in FIG. 3B).

When the CAN communication module on the sub side is not out of order, the sub control unit 22 can determine whether or not SPI communication between the main control device 10 and the sub control device 20 is effective (FIG. 3). (B) See steps ST30 and ST31). For example, when the clock signal output from the main control unit 12 is not received by the sub control unit 22, SPI communication is not valid in the sub control unit 22, that is, the data from the SPI communication module on the main side is disconnected. Can be determined.

When the CAN communication module on the main side has not failed in step ST21 of FIG. 3A, the main control unit 12 notifies the sub control unit 22 of the non-failure of the CAN communication module on the main side by SPI communication. In other words, the main control unit 12 may always notify the sub control unit 22 of either non-failure or failure of the CAN communication module on the main side by SPI communication. Therefore, even if the clock signal output from the main control unit 12 is received by the sub control unit 22, the data signal received by the sub control unit 22 (SPI communication module on the sub side) is the CAN on the main side. When it does not indicate either non-failure or failure of the communication module, the sub-control unit 22 indicates that SPI communication is not valid in step ST31, that is, the data from the SPI communication module on the main side is disconnected. It can be determined.

When the SPI communication between the main control device 10 and the sub control device 20 is not valid, the sub control unit 22 can determine whether or not the CAN communication module on the main side is normal (FIG. 3 (B). ) Step ST32). For example, in step ST02 of FIG. 2A, when the sub-control unit 22 receives the transmission data or the reply data from the CAN communication module on the main side, the CAN communication module on the main side is normal, that is, the main side. It can be determined that the data from the CAN communication module of the above is not interrupted.

When it is confirmed in step ST12 of FIG. 2B that the CAN communication module on the main side is normal, the main control unit 12 detects an abnormality in the CAN communication module on the main side by SPI communication. Don't tell. Therefore, when the data signal received by the sub control unit 22 (SPI communication module on the sub side) does not indicate an abnormality of the CAN communication module on the main side, the CAN communication module on the main side of the sub control unit 22 is normal. It can be determined that there is, that is, the data from the CAN communication module on the main side is not interrupted.

In step ST32 of FIG. 3B, preferably, as described above, using CAN communication between the main control device 10 and the sub control device 20, the sub control unit 22 uses the CAN communication module on the main side. Normality can be confirmed. However, the sub control unit 22 confirms that the CAN communication module on the main side is transmitting the transmission data addressed to the ECU by using the CAN communication between the main control device 10 and the ECU on the CAN. Then, it may be determined that the CAN communication module on the main side is normal, that is, the data from the CAN communication module on the main side is not interrupted.

Although the SPI communication between the main control device 10 and the sub control device 20 is not valid, the sub control unit 22 can estimate the disconnection of the SPI communication line when the CAN communication module on the main side is normal. Therefore, the sub-control unit 22 does not execute steps ST33 and ST34 in FIG. 3B.

On the other hand, when the SPI communication between the main control device 10 and the sub control device 20 is not valid and the CAN communication module on the main side is not normal, the sub control unit 22 may estimate the failure of the main control unit 12. it can. Therefore, the sub-control unit 22 executes steps ST33 and ST34 of FIG. 3B. In particular, when the main control unit 12 or the main CPU is out of order, in other words, when the main control device 10 is completely out of order, the main control unit 12 may give a degenerate operation instruction to the sub control unit 22. Can not. In such a situation, the failure of the main control unit 12 can be estimated by the sub control unit 22.

When estimating the failure of the main control unit 12, the sub control unit 22 calculates the degenerate operation control output value required for, for example, an exception or emergency automatic driving in real time, and the transmission data including the degenerate operation control output ( Degenerate data) is transmitted from the CAN communication module on the sub side (see steps ST33 and ST34). This allows, for example, vehicle exceptions or emergency autonomous driving.

When the SPI communication between the main control device 10 and the sub control device 20 is valid, the sub control unit 22 can determine whether or not the CAN communication module on the main side has failed (see step ST35). ). Further, when SPI communication between the main control device 10 and the sub control device 20 is valid, the sub control unit 22 can determine whether or not the CAN communication module on the main side is abnormal (step ST35). reference). In step ST35, the sub control unit 22 determines whether or not a failure or abnormality of the CAN communication module on the main side is received, but receives only a failure of the CAN communication module on the main side. It may be determined whether or not it is done. Alternatively, the sub-control unit 22 may determine whether or not only the abnormality of the CAN communication module on the main side is received.

In step ST35 of FIG. 3B, the sub-control unit 22 can receive failure data or abnormality data (degenerate operation instruction) indicating a failure or abnormality of the CAN communication module on the main side, for example, by SPI communication. When receiving the degenerate operation instruction, the sub-control unit 22 calculates, for example, the degenerate operation control output value required for exception or emergency automatic driving in real time, and the transmission data (degenerate data) including the degenerate operation control output. Is transmitted from the CAN communication module on the sub side (see steps ST33 and ST34). This allows, for example, vehicle exceptions or emergency autonomous driving.

The main control device 10 may always omit step ST24 in FIG. 3A. Therefore, for example, in the sub control device 20, the execution result of step ST02 in FIG. 2A is a CAN on the sub side. It may be confirmed at predetermined intervals that it represents the normality of the communication module. In other words, when step ST24 of FIG. 3A is omitted, every time step ST30 of FIG. 3B determines that the CAN communication module on the sub side has not failed, the sub-control device 20 is set to FIG. The normality (non-abnormality) of the CAN communication module on the sub side may be confirmed in step ST02 of (A), and then, for example, ST31 of FIG. 3B may be executed.

The present invention is not limited to the above-mentioned exemplary embodiments, and those skilled in the art will be able to easily modify the above-mentioned exemplary embodiments to the extent included in the claims. ..

10 ... main control device, 12 ... main control unit, 14 ... first main communication module (for example, CAN communication module), 16 ... second main communication module (for example, SPI communication module), 20 ... Sub-control device, 22 ... Sub-control unit, 24 ... First sub-communication module (for example, CAN communication module), 26 ... Second sub-communication module (for example, SPI communication module).

Claims (9)

A vehicle control device having a main control unit and a sub control unit connected to an in-vehicle network.
The first main communication module capable of executing communication on the in-vehicle network and
The first sub-communication module capable of executing communication on the in-vehicle network and
A second main communication module capable of executing communication on a route different from the in-vehicle network, and
With the second sub-communication module capable of performing communication on the different routes,
With
The first sub-communication module transmits transmission data composed of predetermined data to the first main communication module.
The first main communication module transmits reply data configured based on the transmission data to the first sub communication module.
When the first sub-communication module receives the reply data, the sub-control unit confirms whether or not the first sub-communication module is normal based on the reply data.
When the main control unit determines that the first main communication module has failed, the second main communication module transmits failure data to the second sub communication module.
When the second sub-communication module receives the failure data, the sub-control unit determines that the first main communication module has failed, and determines that the first main communication module has failed.
After confirming that the first sub-communication module is normal via the in-vehicle network, when it is determined that the first main communication module has failed via the different route, the said A vehicle control device characterized in that transmission of control data to an in-vehicle device on an in-vehicle network is executed by the first sub-communication module instead of the first main communication module. When the data from the second main communication module is cut off, the sub-control unit determines whether or not the data from the first main communication module is cut off.
When the data from the second main communication module is interrupted and the data from the first main communication module is not interrupted, the transmission of the control data to the vehicle-mounted device on the vehicle-mounted network is performed by the first. The vehicle control device according to claim 1, wherein the control device for a vehicle is continuously executed by the main communication module of the above. When the data from the second main communication module is cut off and the data from the first main communication module is also cut off, the sub-control unit estimates that the main control unit is out of order. The vehicle control device according to claim 2, further comprising transmitting the control data to the vehicle-mounted device on the vehicle-mounted network by the first sub-communication module. The predetermined data constituting the transmission data transmitted from the first sub communication module to the first main communication module is generated by executing a predetermined operation in the sub control unit at a predetermined interval. The vehicle control device according to any one of claims 1 to 3, wherein the variable data is generated. The vehicle control device according to claim 4, wherein when the reply data is based on the variable data, the sub control unit confirms that the first sub communication module is normal. When the reply data is not based on the variable data, the sub-control unit transmits an abnormality of the first sub-communication module to the main control unit via the different route.
When the abnormality of the first sub-communication module is received by the main control unit via the different paths and the main control unit determines that the first main communication module is out of order. The second main communication module does not transmit the failure data of the first main communication module to the second sub-communication module, and the control data is transmitted to the vehicle-mounted device on the vehicle-mounted network. The vehicle control device according to claim 5, wherein the control device for a vehicle is not executed by the first main communication module and the first sub communication module. The sub control unit determines whether or not the first sub communication module is out of order, and determines whether or not the first sub communication module is out of order.
After the sub-control unit determines that the first sub-communication module has not failed, the sub-control unit determines whether or not the first sub-communication module is normal based on the reply data. The vehicle control device according to any one of claims 1 to 6 , wherein the control device for a vehicle is characterized in that. The first sub-communication module transmits the next transmission data composed of the next predetermined data based on the reply data to the first main communication module.
When the first main communication module receives the transmission data, the main control unit confirms whether or not the first main communication module is normal based on the transmission data and the reply data.
When the first main communication module is not confirmed to be normal, the second main communication module transmits an abnormality of the first main communication module to the second sub communication module. The vehicle control device according to any one of claims 1 to 7. When the transmission of the control data to the vehicle-mounted device on the vehicle-mounted network is executed by the first sub-communication module instead of the first main communication module, the control data is the operation of the vehicle-mounted device. The vehicle control device according to any one of claims 1 to 8 , wherein the data is degenerate data.

Images