JP2009290349A - Failure diagnosis system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an failure diagnosis system that discriminates a cause of failure in an onboard network of a time slot system, and specify an electronic control device in which the failure occurs. <P>SOLUTION: Various ECU (Electronic Control Unit) 101 includes a fault detection unit 102 which detects whether synchronous failure occurs or not, and a data transmission unit 103a which transmits a fault information frame in a different number slot predetermined for every ECU 101 out of slots composing a dynamic segment when the synchronous failure is detected. When communication stops just after the fault information frame is received, while a fault diagnosis device 110a diagnoses that communication stops by a cause of the ECU single body, and specifies the ECU which stops the communication based on the slot number transmitted by the fault information frame. At the same time, when communication stops without receiving the fault information frame, the device prepares a fault diagnosis unit 111a which diagnoses that the communication stops by a cause except the ECU single body. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an abnormality diagnosis system for diagnosing an abnormality in an in-vehicle network.

  Conventionally, as this type of technology, for example, the technology described in Patent Document 1 is known. In the technique described in Patent Document 1, data transmission / reception is interrupted when the abnormality diagnosis device has never received data from an electronic control device (hereinafter referred to as ECU) via an in-vehicle network within a predetermined time. This means that some abnormality has occurred between the abnormality diagnosis device and the ECU.

  In addition, conventionally, for example, a technique described in Patent Document 2 is known. In the technology described in Patent Document 2, the abnormality diagnosis device diagnoses that an abnormality occurs in the ECU alone when the abnormality diagnosis device receives abnormality data transmitted from the ECU via the in-vehicle network.

In addition, for example, a FlexRay is a time slot system in which a plurality of ECUs connected to an in-vehicle network start communication sequentially at a constant cycle, and communication is stopped when a time synchronization abnormality occurs between the plurality of ECUs. The protocol to do is known.
JP 2007-99145 A Japanese Patent Laid-Open No. 2003-19931

  By the way, when the prior art described in Patent Document 1 is applied to the time slot protocol, the following problems arise. Specifically, there are two types of abnormalities: abnormalities caused by other than the ECU alone, such as abnormalities in the communication line (disconnection), abnormalities in connection between the ECU and the communication line, and abnormalities in the ECU alone due to synchronization abnormality with other ECUs. Anomalies are included. However, in the abnormality determination described in Patent Literature 1, although some abnormality has occurred between the abnormality diagnosis apparatus and the ECU, it is impossible to distinguish the cause of the abnormality.

  Further, when the technique described in Patent Document 2 is applied to the time slot protocol, it is only possible to diagnose that an abnormality has occurred in the ECU alone, and it is difficult to identify the ECU in which the abnormality has occurred. .

  In such a situation where there are a plurality of possible causes of the abnormality, or in a situation where the ECU alone in which the abnormality has occurred cannot be specified, it is very inefficient to repair or investigate the ECU, and the service to the user It becomes low.

  The present invention has been made in view of the above circumstances, and its purpose is to identify the cause of an abnormality in a time slot type in-vehicle network and to identify an electronic control device in which an abnormality has occurred. To provide a diagnostic system.

  In order to achieve such an object, in the configuration according to claim 1, a diagnostic device is provided in a time slot type in-vehicle network in which a plurality of connected electronic control devices sequentially transmit data at regular intervals according to a predetermined communication schedule. Is connected, and the abnormality diagnosis system for diagnosing an abnormality in the in-vehicle network, wherein the communication schedule is used for transmitting a frame including data required for vehicle function control, and includes a static segment including a plurality of slots. The communication cycle is used to transmit a frame including data that is not directly required for vehicle function control, and is composed of a dynamic segment composed of a plurality of slots, and the plurality of electronic control devices Detects whether a synchronization error has occurred with the electronic control unit When a synchronization abnormality is detected and a synchronization abnormality is detected, a synchronization abnormality occurs in a slot having a different number predetermined for each of the plurality of electronic control devices among the plurality of slots constituting the dynamic segment. And a data transmission unit that transmits abnormal data indicating that communication is stopped due to the failure, and the diagnostic device monitors the dynamic segment and stops communication immediately after receiving the frame including the abnormal data. In this case, it is diagnosed that the communication is stopped due to the electronic control unit alone, and the electronic control unit in which the communication is stopped is specified based on the slot number to which the frame is transmitted, while the abnormal data is If communication is stopped without receiving the included frame, it is diagnosed that communication was stopped for a reason other than the electronic control unit alone. Characterized in that it comprises a diagnosis unit for.

  In the above-described configuration as the abnormality diagnosis system, first, the plurality of electronic control devices detect whether or not a synchronization abnormality has occurred with another electronic control device using the synchronization abnormality detection unit. When a synchronization abnormality is detected, the plurality of electronic control devices transmit abnormality data by the data transmission unit. On the other hand, the diagnosis device monitors the dynamic segment, and diagnoses that the communication is stopped due to the electronic control unit alone when the communication is stopped immediately after receiving the frame including the abnormal data. Here, since the data transmission unit transmits abnormal data in slots having different numbers predetermined for each of a plurality of electronic control devices among a plurality of slots constituting the dynamic segment, It becomes possible to identify the electronic control unit that has stopped communication based on the slot number that is transmitted. On the other hand, when the communication is stopped without receiving a frame including abnormal data, the diagnosis device diagnoses that the communication has been stopped for a reason other than the electronic control unit alone. As described above, according to the above-described configuration as the abnormality diagnosis system, it is possible to identify the cause of the abnormality in the time slot type in-vehicle network and to specify the electronic control device in which the abnormality has occurred. become.

  However, in the configuration described in claim 1, it is necessary to secure the same number of slots in the dynamic segment as the number of electronic control devices assigned to the communication schedule. However, since the frequency of severe failures that occur as communication is stopped is very low, the slots reserved for transmitting frames including abnormal data are rarely used in practice. Securing a large number of slots that are rarely used in a dynamic segment, and thus in a communication cycle, leads to a decrease in communication efficiency. In addition, as the number of electronic control devices assigned to the communication schedule, that is, the number of electronic control devices connected to the in-vehicle network increases, the reduction in communication efficiency becomes more significant. Further, there may be a case where a large dynamic segment cannot be secured due to vehicle design conditions. In that case, there is a possibility that a slot for transmitting a frame including abnormal data cannot be secured for all electronic control units.

  In that respect, in the invention according to claim 2, the diagnostic device is connected to a time slot type in-vehicle network in which a plurality of connected electronic control devices sequentially transmit data every predetermined time according to a predetermined communication schedule, An abnormality diagnosis system for diagnosing an abnormality in an in-vehicle network, wherein the communication schedule is used for transmission of a frame including data required for vehicle function control, a static segment including a plurality of slots, and vehicle function control Are used for transmitting a frame including data that is not required directly, and a communication cycle composed of a dynamic segment composed of a plurality of slots is repeated, and each of the plurality of electronic control devices is another electronic control device. Synchronous error detection to detect whether a synchronous error has occurred between And a frame required for the vehicle function control in a slot having a different number predetermined for each of the plurality of electronic control devices among the plurality of slots constituting the static segment, and the synchronization abnormality Is detected, among the plurality of slots constituting the dynamic segment, the communication is stopped due to the occurrence of the synchronization abnormality in the slot having the same predetermined number common to the plurality of electronic control units. A data transmission unit that transmits a frame including abnormal data indicating that, when the diagnosis device monitors the dynamic segment and communication is stopped immediately after receiving the frame including the abnormal data, It is diagnosed that communication has been stopped due to the electronic control unit alone, and the next static segment is monitored. If the communication is stopped without receiving the frame containing the abnormal data, the electronic control device is identified based on the slot number in which one frame has not been transmitted. A diagnostic unit for diagnosing that the communication has been stopped due to the above.

  In the configuration according to claim 2 as the abnormality diagnosis system, when a synchronization abnormality is detected, the electronic control unit uses the data transmission unit to select the plurality of electronic control units from among the plurality of slots constituting the dynamic segment. A frame including abnormal data indicating that communication is to be stopped due to the occurrence of a synchronous abnormality is transmitted in a slot having the same number set in advance. Thus, unlike the configuration of claim 1, it is not necessary to secure the same number of slots in the dynamic segment as the number of electronic control devices assigned to the communication schedule, and the slots reserved for transmitting frames including abnormal data. The number can be minimized. As a result, a decrease in communication efficiency can be suppressed.

  However, it is possible to diagnose that communication has been stopped due to a cause other than the electronic control unit alone, such as disconnection of the communication line. Since the slot number in which a frame including data is transmitted is the same in common for a plurality of electronic control devices, it may not be possible to identify the electronic control device that caused the communication to stop.

  In that respect, in the configuration described in claim 2, the electronic control device uses a slot having a different number predetermined for each of the plurality of electronic control devices among the plurality of slots constituting the static segment by the data transmission unit. A frame required for vehicle function control is transmitted. Therefore, based on the slot number in which the frame is not transmitted while monitoring the next static segment, the diagnostic device can identify the electronic control device whose communication has been stopped.

  According to a third aspect of the present invention, the diagnostic device is connected to a time slot type in-vehicle network in which a plurality of connected electronic control devices sequentially transmit data at regular intervals according to a predetermined communication schedule. An abnormality diagnosis system for diagnosing an abnormality in the in-vehicle network, wherein the communication schedule is used for transmission of a frame including data required for vehicle function control, a static segment including a plurality of slots, and a vehicle function It is used for transmission of a frame including data not directly required for control, and a communication cycle composed of a dynamic segment composed of a plurality of slots is repeated. Each of the plurality of electronic control devices has a different identification number. Synchronization error with other electronic control units. A synchronization abnormality detection unit that detects whether or not a failure occurs, and, when the synchronization abnormality is detected, among the plurality of slots constituting the dynamic segment, the same predetermined in common for the plurality of electronic control units A data transmission unit for transmitting a frame including the abnormal data indicating that communication is stopped due to the occurrence of a synchronization abnormality in the number slot and a frame including the identification number, and the diagnostic device monitors the dynamic segment. When the communication is stopped immediately after receiving the frame including the abnormal data, the communication is diagnosed as being stopped due to the electronic control unit alone, and the communication is performed based on the identification number included in the frame. If the communication is stopped without receiving the frame including the abnormal data while the electronic control device is Further comprising a diagnosis unit for diagnosing the communication for reasons other than the control apparatus alone is stopped is preferable.

  In the third aspect of the invention, different identification numbers are assigned to the plurality of electronic control devices, respectively, and abnormal data and a frame including the identification number are transmitted by the data transmission unit. Therefore, when there is only one electronic control unit whose communication is stopped, the frame including the abnormal data and the identification number is received by the diagnostic unit without being broken, so it is not necessary to monitor the next static segment. When this frame is received, it becomes possible to identify the electronic control unit whose communication has been stopped.

  In addition, as in the invention described in claim 4, the synchronization abnormality detection unit calculates the synchronization deviation in conjunction with detection of whether or not a synchronization abnormality has occurred with another electronic control device. The data transmission unit preferably transmits the calculation result of the synchronization error. As a result, it is possible to determine the degree of abnormality of the electronic control device whose communication has been stopped.

(First embodiment)
Hereinafter, a first embodiment of an abnormality diagnosis system according to the present invention will be described with reference to FIGS. Among these, FIG. 1 is a block diagram showing an overall configuration of the present embodiment, and FIGS. 2 and 3 are block diagrams respectively showing an internal configuration of an electronic control device and a failure diagnosis device constituting the present embodiment. It is. First, the configuration and function of the present embodiment will be described with reference to FIGS.

  As shown in FIG. 1, the abnormality diagnosis system 1 includes a communication line (in-vehicle network) 100 to which an airbag ECU 101a, an air conditioner ECU 101b, a brake ECU 101c, an engine ECU 101d, and a failure diagnosis device 110a are connected. It is mounted on. In this embodiment, the airbag ECU 101a, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d are provided as a plurality of electronic control devices. However, the types of these ECUs are not limited, and the number of ECUs is also “ It is not limited to “4”. When attention is not paid to the type of ECU, these are collectively referred to as ECU 101.

  In the present embodiment, for example, FlexRay is adopted as a communication protocol for communication between the ECU 101 and the failure diagnosis apparatus 110a. In the FlexRay protocol, the ECU 101 sequentially transmits data at regular intervals according to a predetermined communication schedule. Specifically, this communication schedule is used for transmission of a control information frame including data required for vehicle function control, and is not directly required for vehicle function control and a static segment composed of a plurality of slots (time domain). A communication cycle composed of a dynamic segment including a plurality of slots is repeated while being used for transmission of a frame including data (for example, a failure information frame described later).

  As shown in FIG. 2, the ECU 101 includes a failure detection unit (synchronous abnormality detection unit) 102 and a data transmission unit 103a. Among these, the failure detection unit 102 detects whether or not a synchronization abnormality (failure) has occurred between the own ECU 101 and the other ECU 101. Specifically, the failure detection unit 102 first measures a time shift (synchronization shift) between the own ECU 101 and the other ECU 101 using the static segment. Next, when the static segment ends and enters the subsequent dynamic segment, the failure detection unit 102 calculates a correction value for correcting the synchronization shift based on the measured synchronization shift. Then, when the calculated correction value exceeds a predetermined allowable value, the failure detection unit 102 means that the synchronization deviation exceeds the allowable limit, and thus determines that a synchronization abnormality has occurred. .

  Further, the data transmission unit 103a is a control information that is a frame including data required for vehicle function control in slots of different numbers predetermined for each of the plurality of ECUs 101 among the plurality of slots constituting the static segment. Send a frame. When the occurrence of synchronization abnormality is determined by the failure detection unit 102, the data transmission unit 103a is a slot having a different number predetermined for each ECU 101 among the plurality of slots constituting the dynamic segment following the static segment. , A failure information frame that is a frame including abnormal data indicating that “communication is stopped due to occurrence of synchronization abnormality” is transmitted. Then, the data transmission unit 103a stops communication (frame transmission) when the dynamic segment that has transmitted the failure information frame ends. Therefore, the end of the period during which the ECU 101 can transmit the failure information frame is the end of the communication cycle in which it is determined that the synchronization abnormality has occurred, and the ECU 101 The failure information frame cannot be transmitted.

  As shown in FIG. 3, the failure diagnosis apparatus 110 a includes a failure diagnosis unit (diagnosis unit) 111 a and a memory holding unit 112 inside. Among these, the failure diagnosis unit 111a monitors the dynamic segment and determines whether or not the communication is stopped immediately after receiving the failure information frame. Here, if communication is stopped immediately after receiving the failure information frame, it means that a synchronization abnormality has occurred between the ECU 101 that transmitted the failure information frame and the other ECU 101, and the cause is that the ECU 101 alone is the cause. Diagnose that communication has stopped. Further, in this case, the failure diagnosis unit 111a specifies the ECU 101 that has caused the communication to stop based on the slot number in which the failure information frame is transmitted, and stores and holds the fact in the storage holding unit 112. . On the other hand, when communication is stopped without receiving the failure information frame (data has never been received within a predetermined period), the failure diagnosis unit 111a, for example, disconnection of the communication line 100, ECU 101 and communication line 100 It is diagnosed that the communication has been stopped due to a cause other than the ECU 101 alone, such as a connection error.

  Processing executed by the ECU 101 and the failure diagnosis apparatus 110a configured as described above will be described with reference to FIGS.

  FIGS. 4A to 4D are flowcharts showing the procedure of the failure detection process executed for each communication cycle by the airbag ECU 101a, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d. A failure detection process executed by the various ECUs 101 will be described with reference to FIGS.

  As shown in FIG. 4A, when the communication cycle is started, the airbag ECU 101a first ends the static segment constituting the communication cycle and starts the dynamic segment through the determination process in step S110. Wait until

  When the static segment ends and the dynamic segment starts (“Yes” in the determination process of step S110), the airbag ECU 101a performs self-detection of a failure state as the subsequent process of step S111. Specifically, the airbag 101a calculates the correction value based on the synchronization deviation between the airbag ECU 101a measured in the previous static segment and the other ECU 101 (in this case, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d). When the correction value is calculated, the airbag ECU 101a determines whether or not the correction value exceeds a predetermined allowable value as a determination process in subsequent step S112, whereby the airbag ECU 101a has a failure. Determine whether or not.

  Here, when it is determined that the correction value exceeds the allowable value (“Yes” in the determination process of step S112), the airbag ECU 101a determines that the airbag ECU 101a has a failure, and the subsequent step S113a. As a process of the above, a failure information frame is transmitted to the failure diagnosis apparatus 110a, for example, in the “K + 1” th slot constituting the dynamic segment. On the other hand, when it is determined that the correction value is equal to or less than the allowable value in the determination process of the previous step S112 (“No” in the determination process of step S112), the airbag ECU 101a has no failure. This failure detection process is temporarily terminated.

  As can be seen from FIGS. 4B to 4D, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d also execute a failure detection process according to the airbag ECU 101a. However, when it is determined that the correction value exceeds the allowable value (“Yes” in the determination process in step S112), the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d perform dynamic segment as the subsequent processes in steps S113b to 113d. For example, in the “K + 2”, “K + 3”, and “K + 4” -th slots, the failure information frame is transmitted to the failure diagnosis apparatus 110a. As described above, the slot number for transmitting a frame differs depending on the electronic control unit.

  FIG. 5 is a flowchart showing a processing procedure for the failure diagnosis processing executed by the failure diagnosis apparatus 110a. The failure diagnosis process executed by the failure diagnosis apparatus 110a will be described with reference to FIG.

  As shown in FIG. 5, when the communication cycle is started, the failure diagnosis apparatus 110a (specifically, the failure diagnosis unit 111a) first ends the static segment constituting this communication cycle through the determination process in step S120. And wait until the dynamic segment starts.

  When the static segment ends and the dynamic segment starts (“Yes” in the determination process in step S120), the failure diagnosis apparatus 110a determines whether or not the frame is normally received in the slot number K + 1 as the determination process in step S121. (Specifically, it is determined whether or not the flag of the VALID frame is set). Here, when the frame is normally received at the slot number K + 1 (“Yes” in the determination process of step S121), the ECU that transmits the frame at this slot number is the airbag ECU 101a. As the process of S122, the airbag ECU 101a is diagnosed as having a failure, and that is stored and held in the storage holding unit 112. On the other hand, when the frame is not normally received at the slot number K + 1 (“No” in the determination process of step S121), the failure diagnosis apparatus 110a proceeds to the subsequent process of step S123.

  The failure diagnosis apparatus 110a determines whether or not the frame is normally received with the slot number K + 2 as the determination process in the subsequent step S123. Here, when the frame is normally received with the slot number K + 2 (“Yes” in the determination process of step S123), the ECU that transmits the frame with this slot number is the air conditioner ECU 101b. Therefore, the failure diagnosis apparatus 110a continues to step S124. In this process, the air conditioner ECU 101b is diagnosed as having a failure, and the storage holding unit 112 stores that fact. On the other hand, when the frame is not normally received at the slot number K + 2 (“No” in the determination process of step S123), the failure diagnosis apparatus 110a proceeds to the subsequent process of step S125.

  The failure diagnosis apparatus 110a determines whether or not the frame is normally received at the slot number K + 3 as the determination process in the subsequent step S125. Here, when the frame is normally received at the slot number K + 3 (“Yes” in the determination process of step S125), the ECU that transmits the frame at this slot number is the brake ECU 101c, and therefore the failure diagnosis apparatus 110a continues to step S126. In this process, the brake ECU 101c is diagnosed as having a failure, and the storage holding unit 112 stores that fact. On the other hand, if the frame is not normally received at the slot number K + 3 (“No” in the determination process of step S125), the failure diagnosis apparatus 110a proceeds to the subsequent process of step S127.

  The failure diagnosis apparatus 110a determines whether or not the frame is normally received at the slot number K + 4 as the determination process in the subsequent step S127. Here, when the frame is normally received with the slot number K + 4 (“Yes” in the determination process of step S127), the ECU that transmits the frame with this slot number is the engine ECU 101d. Therefore, the failure diagnosis apparatus 110a continues to step S128. As a process of this, the engine ECU 101d is diagnosed as having a failure, and the fact is stored and held in the storage holding unit 112. On the other hand, when the frame is not normally received at slot number K + 4 (“No” in the determination process of step S127), failure diagnosis apparatus 110a proceeds to the subsequent process of step S129. Then, the failure diagnosis apparatus 110a waits until the dynamic segment constituting this communication cycle is terminated through the determination process in step S129.

  FIG. 6A shows an example of frame transmission when no abnormality has occurred in the various ECUs 101, and FIG. 6B shows an example of frame transmission when an abnormality has occurred only in the engine ECU 101d. The operation of the present embodiment will be summarized with reference to FIGS. 6 (a) and 6 (b).

  When no abnormality has occurred in the various ECUs 101, as shown in FIG. 6 (a), the slots constituting the static segment Sn of the communication cycle N from the airbag ECU 101a, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d. Control information frames are transmitted with numbers 1 to 4, respectively, and failure information frames are not transmitted with slot numbers K + 1 to K + 4 constituting the dynamic segment Dn of the communication cycle N.

  Similarly, control information frames are respectively transmitted from the airbag ECU 101a, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d in the slot numbers 1 to 4 constituting the static segment Sn of the communication cycle N + 1, thereby constituting the dynamic segment Dn of the communication cycle N. No failure information frame is transmitted in slot numbers K + 1 to K + 4.

  However, for example, in the communication cycle N, it is assumed that a synchronization abnormality has occurred in the engine ECU 101d. In such a case, as shown in FIG. 6B, the airbag ECU 101a, the air conditioner ECU 101b, the brake ECU 101c and the engine ECU 101d are controlled by slot numbers 1 to 4 constituting the static segment Sn of the communication cycle N. Each information frame is transmitted, and a failure information frame is transmitted with the slot number K + 4 constituting the dynamic segment Dn of the communication cycle N. Since the ECU 101 that transmits the control information frame with this slot number is the engine ECU 101d, the failure diagnosis apparatus 110a can specify that the ECU in which the failure has occurred is the engine ECU 101d.

  Incidentally, since the engine ECU 101d stops communication when the communication cycle N ends, control information frames are transmitted from the airbag ECU 101a, the air conditioner ECU 101b, and the brake ECU 101c in slot numbers 1 to 3 constituting the static segment Sn + 1 of the communication cycle N + 1. However, the control information frame is not transmitted from engine ECU 101d at slot number 4 constituting static segment Sn + 1 of communication cycle N + 1.

  As described above, in the first embodiment, each of the various ECUs 101 includes the failure detection unit 102 that detects whether or not a synchronization abnormality has occurred with another ECU 101, and a plurality of the static segments. When a control information frame is transmitted in a slot having a different number predetermined for each ECU 101 among the slots and a synchronization abnormality is detected by the failure detection unit 102, the control information frame is predetermined for each ECU 101 among the slots constituting the dynamic segment. And a data transmission unit 103a for transmitting a failure information frame in a slot with a different number. In addition, the failure diagnosis device 110a monitors the dynamic segment, and when communication is stopped immediately after receiving the failure information frame, the failure diagnosis device 110a diagnoses that communication is stopped due to the ECU alone and transmits the failure information frame. Based on the assigned slot number, the ECU that caused the communication to be stopped is specified. On the other hand, when the communication is stopped without receiving the failure information frame, it is diagnosed that the communication has been stopped for a reason other than the ECU alone. The failure diagnosis unit 111a is provided. Thus, when communication is stopped immediately after receiving the failure information frame, failure diagnosis apparatus 110a identifies the ECU that caused the communication to stop based on the slot number in which the failure information frame was transmitted. When communication is stopped without receiving a failure information frame, it can be diagnosed that communication has been stopped for reasons other than the ECU alone. That is, the cause of the abnormality in the time slot type in-vehicle network can be distinguished, and the ECU 101 in which the abnormality has occurred can be identified. If the cause of the abnormality can be distinguished, the ECU 101 can be replaced from the beginning if the ECU 101 alone is abnormal, and if there is an abnormality other than the ECU 101 alone, it can be investigated from the beginning whether there is a problem with the communication line 100 or the connector. Repair / investigation can be performed very efficiently, and serviceability for the user can be improved.

(Second Embodiment)
Hereinafter, a second embodiment of the abnormality diagnosis system according to the present invention will be described with reference to FIGS. Since this embodiment also has a configuration according to the first embodiment, the description overlapping with the first embodiment will be omitted below.

  FIG. 7 is a diagram corresponding to FIG. 2 described above, and is a block diagram showing an internal configuration of the electronic control unit constituting the present embodiment. As shown in FIG. 7, the ECU 101 includes a failure detection unit 102 and a data transmission unit 103b. Among these, the data transmission part 103b transmits the said control information frame by the slot of a different number predetermined for every various ECU101 among the some slots which comprise the said static segment. In addition, when the failure detection unit 102 determines that a synchronization abnormality has occurred, the data transmission unit 103b has the same predetermined predetermined common to the various ECUs 101 among the plurality of slots constituting the dynamic segment following the static segment. The failure information frame is transmitted in the numbered slot.

  FIG. 8 is a diagram corresponding to FIG. 3 and is a block diagram showing an internal configuration of the failure diagnosis apparatus constituting the present embodiment. As shown in FIG. 8, the failure diagnosis apparatus 110b includes a failure diagnosis unit (diagnosis unit) 111b and a memory holding unit 112 inside. Among these, the failure diagnosis unit 111b monitors the dynamic segment and determines whether or not the communication is stopped immediately after receiving the failure information frame. Here, if communication is stopped immediately after receiving the failure information frame, it means that a synchronization abnormality has occurred between the ECU 101 that transmitted the failure information frame and the other ECU 101, and therefore the ECU 101 alone is the cause. Diagnose that communication has stopped. Further, in this case, the failure diagnosis unit 111b identifies the ECU 101 that has caused the communication to stop based on the slot number for which the control information frame has not been transmitted while monitoring the next static segment, and stores and holds it. That is stored in the unit 112. On the other hand, the failure diagnosis unit 111b, for example, when communication is stopped without receiving the failure information frame (data has never been received within a predetermined period), the communication line 100 is disconnected, the ECU 101 and the communication line 100, for example. It is diagnosed that the communication has been stopped due to a cause other than the ECU 101 alone, such as a connection error.

  Processing executed by the ECU 101 and the failure diagnosis apparatus 110b configured as described above will be described with reference to FIGS.

  FIG. 9 is a flowchart showing a processing procedure of failure detection processing executed by the ECU 101 for each communication cycle. With reference to this FIG. 9, the failure detection process which ECU101 performs is demonstrated. In the present embodiment, the airbag 101a, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d are employed as the ECU 101, as in the first embodiment, but these ECUs 101a and ECU 101d are identical in the failure detection process. Execute.

  As shown in FIG. 9, when the communication cycle is started, first, the ECU 101 waits until the static segment constituting the communication cycle is completed and the dynamic segment is started through the determination process of step S210.

  When the static segment is ended and the dynamic segment is started (“Yes” in the determination process in step S210), the ECU 101 performs self-detection of a failure state as the subsequent process in step S211. Specifically, the ECU 101 calculates the correction value based on the synchronization deviation between the ECU 101 measured in the previous static segment and the other ECU 101. When the correction value is calculated, the ECU 101 determines whether or not the ECU 101 has a failure by determining whether or not the correction value exceeds a predetermined allowable value as a determination process in subsequent step S112. to decide.

  Here, when it is determined that the correction value exceeds the allowable value (“Yes” in the determination process in step S212), the ECU 101 determines that the ECU 101 has a failure, and the following process in step S213 is performed. For example, a failure information frame is transmitted to the failure diagnosis apparatus 110b in the “L” th slot constituting the dynamic segment. On the other hand, when it is determined that the correction value is equal to or less than the allowable value in the determination process of the previous step S212 (“No” in the determination process of step S212), the ECU 101 determines that there is no failure in the ECU 101, This failure detection process is temporarily terminated.

  FIG. 10 is a flowchart showing a processing procedure for failure diagnosis processing executed by the failure diagnosis apparatus 110b. The failure diagnosis process executed by the failure diagnosis apparatus 110b will be described with reference to FIG.

  As shown in FIG. 10, when the communication cycle is started, the failure diagnosis apparatus 110b (specifically, the failure diagnosis unit 111b) first ends the static segment constituting the communication cycle through the determination process in step S220. And wait until the dynamic segment starts.

  When the static segment ends and the dynamic segment starts (“Yes” in the determination process in step S220), the failure diagnosis apparatus 110b determines whether or not there is a frame in the slot number L as a determination process in subsequent step S221. to decide. Here, for example, when a synchronization abnormality occurs in a plurality of ECUs 101 within the same communication cycle, since the ECUs 101 transmit a failure information frame with the slot number L, a collision between frames occurs, resulting in failure diagnosis. The device 110b cannot receive the frame normally (results in a syntax error). However, unlike the first embodiment, the present embodiment does not matter whether or not the frame 110 can be normally received. Specifically, the failure diagnosis apparatus 110b determines that there is a frame in the slot number L when at least one of the VALID frame flag and the syntax error flag is set, while the VALID frame flag and syntax If both flags indicating a tax error are reset, it is determined that there is no frame in slot number L.

  Here, when it is determined that there is no frame in the slot number L (“No” in the determination process in step S221), no synchronization abnormality has occurred in the plurality of ECUs 101. Therefore, the failure diagnosis device 110b temporarily performs the failure diagnosis process as it is. finish. On the other hand, when it is determined that there is a frame in slot number L (“Yes” in the determination process in step S221), failure diagnosis apparatus 110b starts the static segment of the next communication cycle through the determination process in subsequent step S222. Wait until.

  The failure diagnosis apparatus 110b determines whether or not the control information frame is normally received with the slot number 1 as the determination process in the subsequent step S223. Here, when the control information frame cannot be normally received with the slot number 1 (“No” in the determination process of step S223), the ECU 101 that transmits the control information frame with the slot number is the airbag ECU 101a. In the subsequent step S224, the device 110b diagnoses the airbag ECU 101a as having a failure, and stores and holds that fact in the storage holding unit 112. On the other hand, when the control information frame is normally received with the slot number 1 (“Yes” in the determination process of step S223), the failure diagnosis apparatus 110b proceeds to the subsequent process of step S225.

  The failure diagnosis apparatus 110b determines whether or not the control information frame has been normally received in the slot number 2 as the determination process in the subsequent step S225. Here, when the control information frame cannot be normally received with the slot number 2 (“No” in the determination process of step S225), the ECU 101 that transmits the control information frame with the slot number is the air conditioner ECU 101b. 110b diagnoses that the air conditioner ECU 101b has a failure as the processing of the subsequent step S226, and stores and holds that fact in the storage holding unit 112. On the other hand, when the control information frame is normally received with the slot number 2 (“Yes” in the determination process of step S225), the failure diagnosis apparatus 110b proceeds to the subsequent process of step S225.

  The failure diagnosis apparatus 110b determines whether or not the control information frame is normally received at the slot number 3 as the determination process in the subsequent step S227. Here, if the control information frame cannot be normally received at slot number 3 (“No” in the determination process of step S227), the ECU 101 that transmits the control information frame at this slot number is the brake ECU 101c. 110b diagnoses that the brake ECU 101c has a failure as a process of subsequent step S228, and stores and holds that fact in the storage holding unit 112. On the other hand, when the control information frame is normally received with the slot number 3 (“Yes” in the determination process of step S227), the failure diagnosis apparatus 110b proceeds to the subsequent process of step S229.

  The failure diagnosis apparatus 110b determines whether or not the control information frame is normally received at the slot number 4 as the determination process in the subsequent step S229. If the control information frame cannot be normally received at slot number 4 (“No” in the determination process of step S229), the ECU 101 that transmits the control information frame at this slot number is the engine ECU 101d. 110b diagnoses that the engine ECU 101d has a failure as the processing of the subsequent step S230, and stores and holds that fact in the storage holding unit 112. On the other hand, when the control information frame is normally received with the slot number 4 (“Yes” in the determination process in step S229), the failure diagnosis apparatus 110b proceeds to the subsequent process in step S231. Then, the failure diagnosis apparatus 110b waits until the static segment constituting the communication cycle is terminated through the determination process in step S231.

  FIG. 11A shows an example of frame transmission when a synchronization abnormality occurs only in the engine ECU 101d within a communication cycle N. FIG. 11A shows a frame when a synchronization abnormality occurs in the air conditioner ECU 101b and the engine ECU 101d within a communication cycle N. An example of the transmission is shown in FIG. The operation of the present embodiment will be summarized with reference to FIGS. 11 (a) and 11 (b).

  For example, it is assumed that a synchronization abnormality occurs in the engine ECU 101d in the communication cycle N. In such a case, as shown in FIG. 11A, control is performed by slot numbers 1 to 4 constituting the static segment Sn of the communication cycle N from the airbag ECU 101a, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d. Each information frame is transmitted, and a failure information frame is transmitted from the engine ECU 101d with the slot number L constituting the dynamic segment Dn of the communication cycle N. Thereby, failure diagnosis apparatus 110b can determine that a failure has occurred in any of ECUs 101.

  Since the engine ECU 101d stops communication when the communication cycle N ends, control information frames are transmitted from the airbag ECU 101a, the air conditioner ECU 101b, and the brake ECU 101c in slot numbers 1 to 3 constituting the static segment Sn + 1 of the communication cycle N + 1. However, the control information frame is not transmitted from the engine ECU 101d at slot number 4 constituting the static segment Sn + 1 of the communication cycle N + 1. Thereby, failure diagnosis apparatus 110b can specify that the ECU in which an abnormality has occurred is engine ECU 101d.

  Incidentally, in the case of this operation example, as shown in FIG. 10, the failure diagnosis apparatus 110b follows “Step S220 → S221 → S222 → S223 → S225 → S227 → S229 → S230 → S231”. .

  Further, for example, in the communication cycle N, it is assumed that a synchronization abnormality has occurred in the air conditioner ECU 101b and the engine ECU 101d. In such a case, as shown in FIG. 11B, the airbag ECU 101a, the air conditioner ECU 101b, the brake ECU 101c, and the engine ECU 101d are controlled by slot numbers 1 to 4 constituting the static segment Sn of the communication cycle N. Each information frame is transmitted, and a failure information frame is transmitted from the air conditioner ECU 101b and the engine ECU 101d with the slot number L constituting the dynamic segment Dn of the communication cycle N. Since these transmitted failure information frames collide and a flag indicating a syntax error is set, failure diagnosis apparatus 110b can determine that a plurality of ECUs 101 have failed.

  Since the air conditioner ECU 101b and the engine ECU 101d stop communication when the communication cycle N ends, the control information frames are not transmitted from the air conditioner ECU 101b and the engine ECU 101d in the slot numbers 2 and 4 constituting the static segment Sn of the communication cycle N + 1, respectively. The control information frames are transmitted from the airbag ECU 101a and the brake ECU 101c in slot numbers 1 and 3 constituting the static segment Sn of the communication cycle N + 1, respectively. As a result, the failure diagnosis apparatus 110b can identify that the abnormal ECU 101 is the air conditioner ECU 101b and the engine ECU 101d.

  Incidentally, in the case of this operation example, as shown in FIG. 10, the failure diagnosis apparatus 110b follows “Step S220 → S221 → S222 → S223 → S225 → S226 → S227 → S229 → S230 → S231”. become.

  As described above, in the second embodiment, each of the various ECUs 101 includes the failure detection unit 102 that detects whether or not a synchronization abnormality has occurred with the other ECUs 101, and the plurality of static segments. When a control information frame is transmitted in a slot having a different number predetermined for each ECU 101 among the slots and a synchronization abnormality is detected by the failure detection unit 102, it is common to various ECUs 101 among the slots constituting the dynamic segment. A data transmission unit 103b that transmits a failure information frame in a predetermined slot with the same number is provided. In addition, the failure diagnosis device 110b monitors the dynamic segment, and when communication is stopped immediately after receiving the failure information frame, it diagnoses that communication is stopped due to the ECU alone and monitors the next static segment. On the other hand, if the ECU that caused the communication to stop is identified based on the slot number for which the control information frame has not been transmitted, the communication is stopped without receiving the failure information frame. Thus, a failure diagnosis unit 111b for diagnosing that communication has been stopped is provided.

  Thus, when communication is stopped immediately after receiving the failure information frame, failure diagnosis apparatus 110b stops communication based on the slot number for which the control information frame was not transmitted while monitoring the next static segment. The cause ECU can be specified, and when communication is stopped without receiving a failure information frame, it can be diagnosed that communication has been stopped for reasons other than the ECU alone. . That is, the cause of the abnormality in the time slot type in-vehicle network can be distinguished, and the ECU 101 in which the abnormality has occurred can be identified. If the cause of the abnormality can be distinguished, the ECU 101 can be replaced from the beginning if the ECU 101 alone is abnormal, and if there is an abnormality other than the ECU 101 alone, it can be investigated from the beginning whether there is a problem with the communication line 100 or the connector. Repair / investigation can be performed very efficiently, and serviceability for the user can be improved.

  Further, unlike the previous failure diagnosis device 110a, the failure diagnosis device 110b does not need to secure the same number of slots as the number of ECUs assigned to the communication schedule in the dynamic segment, and ensures that a failure information frame is transmitted. The number of slots can be minimized. As a result, a decrease in communication efficiency can be suppressed. However, in the failure diagnosis apparatus 110b, the timing at which the ECU that caused the communication to be stopped can be identified is delayed by one communication cycle at the maximum from the timing at which the failure information frame is received. However, since one communication cycle is an extremely short time of about several milliseconds, for example, it does not affect abnormality diagnosis.

  The abnormality diagnosis system according to the present invention is not limited to the configuration exemplified in the first and second embodiments, and can be implemented with various modifications without departing from the spirit of the present invention. Is possible. In other words, for example, the following embodiment can be implemented by appropriately changing the above embodiment.

  In the second embodiment, the data transmission unit 103b, when a failure in synchronization is detected by the failure detection unit 102, is a slot having the same number that is predetermined in advance among the various ECUs 101 among the slots constituting the dynamic segment. Although the failure information frame is transmitted in the above, it is not limited to this. When there are a plurality of causes for the communication to be stopped in the ECU alone, a slot having the same number that is predetermined in advance for the various ECUs 101 may be secured in the dynamic segment for each cause. For example, it may be desired to distinguish between a case where communication is stopped due to an abnormality in synchronization with another ECU and a case where communication is actively stopped by the ECU itself. At this time, the data transmission unit transmits a failure information frame in a different slot for each cause, thereby enabling more detailed failure diagnosis. Therefore, as a matter of course, even with such a configuration, the cause of the abnormality in the time slot type in-vehicle network can be distinguished as in the second embodiment, and the ECU 101 in which the abnormality has occurred can be identified. To be able to identify.

  In the first and second embodiments, abnormal data indicating that “communication is stopped due to the occurrence of a synchronous abnormality” is included in the failure information frame. However, the present invention is not limited to this. In addition, for example, different identification numbers are assigned to the various ECUs 101, and when a synchronization abnormality is detected, the data transmission unit is identical to a predetermined one that is common to a plurality of ECUs among a plurality of slots constituting the dynamic segment. A failure information frame including the abnormal data and the identification number is transmitted in the number slot. Then, the diagnostic device monitors the dynamic segment, and when communication is stopped immediately after receiving the failure information frame, it diagnoses that communication has been stopped due to the ECU alone, and an identification number included in the frame On the basis of the above, the ECU whose communication is stopped may be specified. On the other hand, when the communication is stopped without receiving the failure information frame, it may be diagnosed that the communication is stopped due to a cause other than the ECU alone. As a result, when there is only one ECU whose communication is stopped, the failure information frame including the abnormal data and the identification number is received by the diagnostic device without colliding, and therefore, the next static segment is monitored. Instead, when this frame is received, it is possible to identify the ECU whose communication has been stopped.

  Further, for example, supplementary information on the cause of the failure may be added to the failure information frame, such as a calculation result when performing synchronous calculation. As a result, the failure diagnosis apparatus can determine the degree of synchronization abnormality that has led to communication stoppage. If the value of the synchronization error is a value that cannot be a hardware failure, for example, the controller It also becomes possible to infer that there may be an abnormality in internal processing (for example, whether it is an oscillator or a microcomputer). Incidentally, FIG. 12 schematically shows a configuration example of the failure information frame. In the header area 121, for example, information related to the slot number is stored. Further, the data area 122 stores an ECU identification number or failure cause information indicating that “communication is stopped due to the occurrence of synchronization abnormality”. The trailer area 123 stores information for checking whether there is an error in the entire frame.

  In the first embodiment and the second embodiment, the ECU and the failure diagnosis apparatuses 110a and 110b are separately provided. However, the present invention is not limited to this. The failure diagnosis function of failure diagnosis devices 110a and 110b may be installed in any ECU.

The block diagram which shows the whole structure about 1st Embodiment of the abnormality diagnosis system which concerns on this invention. The block diagram which shows the internal structure about the electronic control apparatus which comprises 1st Embodiment. The block diagram which shows the internal structure about the failure diagnosis apparatus which comprises 1st Embodiment. FIG. 4A is a flowchart showing a processing procedure of a failure detection process executed for each communication cycle by an airbag ECU among a plurality of ECUs constituting the first embodiment. (B) is a flowchart showing a processing procedure of failure detection processing executed for each communication cycle by the air conditioner ECU. (C) is a flowchart showing a processing procedure of failure detection processing executed for each communication cycle by the brake ECU. (D) is a flowchart showing a processing procedure of a failure detection process executed by the engine ECU for each communication cycle. The flowchart which shows the process sequence about the failure diagnosis process performed by the failure diagnosis apparatus which comprises 1st Embodiment. (A) is a timing chart showing an example of frame transmission in the case where no abnormality has occurred in the ECU according to the first embodiment. (B) is a timing chart showing an example of frame transmission when an abnormality occurs in the engine ECU. The block diagram which shows the internal structure about the electronic control apparatus which comprises 2nd Embodiment. The block diagram which shows the internal structure about the failure diagnosis apparatus which comprises 2nd Embodiment. The flowchart which shows the process sequence of the failure detection process performed for every communication cycle by several ECU which comprises 2nd Embodiment. The flowchart which shows the process sequence about the failure diagnosis process performed by the failure diagnosis apparatus which comprises 2nd Embodiment. (A) is a timing chart showing a transmission example of a frame in the case where there is one ECU that transmits a failure information frame in the second embodiment. (B) is a timing chart showing an example of frame transmission when there are two ECUs that transmit failure information frames. The schematic diagram which shows the structural example of a failure information frame.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Abnormality diagnosis system, 100 ... Communication line, 101 ... ECU (electronic control apparatus), 101a ... Airbag ECU (electronic control apparatus), 101b ... Air-conditioner ECU (electronic control apparatus), 101c ... Brake ECU (electronic control apparatus) , 101d ... Engine ECU (electronic control unit), 102 ... Failure detection unit (synchronous abnormality detection unit), 103a, 103b ... Data transmission unit, 110a, 110b ... Failure diagnosis device (diagnosis device), 111a, 111b ... Failure diagnosis unit (Diagnostic unit), 112 ... storage holding unit, 121 ... header area, 122 ... data area, 123 ... trailer area.

Claims (4)

An abnormality diagnosis system in which a diagnosis device is connected to a time slot type in-vehicle network in which a plurality of connected electronic control devices sequentially transmit data every predetermined time according to a predetermined communication schedule, and diagnoses an abnormality in the in-vehicle network. There,
The communication schedule is used for transmission of a frame including data required for vehicle function control, and is used for transmission of a frame including a static segment composed of a plurality of slots and data not directly required for vehicle function control. A communication cycle composed of a dynamic segment composed of a plurality of slots is repeated,
The plurality of electronic control devices include a synchronization abnormality detection unit that detects whether or not a synchronization abnormality has occurred with another electronic control device, and a plurality of components that constitute the dynamic segment when the synchronization abnormality is detected. Data transmission units for transmitting abnormal data indicating that communication is stopped due to occurrence of synchronization abnormality in slots of different numbers predetermined for each of the plurality of electronic control devices. ,
The diagnostic device monitors the dynamic segment, and when communication is stopped immediately after receiving a frame including the abnormal data, diagnoses that communication is stopped due to the electronic control unit alone, and the frame When the communication is stopped without receiving the frame including the abnormal data, while the communication control is stopped based on the slot number to which the communication is stopped, An abnormality diagnosis system comprising a diagnosis unit that diagnoses that communication has been stopped. An abnormality diagnosis system in which a diagnosis device is connected to a time slot type in-vehicle network in which a plurality of connected electronic control devices sequentially transmit data every predetermined time according to a predetermined communication schedule, and diagnoses an abnormality in the in-vehicle network. There,
The communication schedule is used for transmission of a frame including data required for vehicle function control, and is used for transmission of a frame including a static segment composed of a plurality of slots and data not directly required for vehicle function control. A communication cycle composed of a dynamic segment composed of a plurality of slots is repeated,
Each of the plurality of electronic control devices includes a synchronization abnormality detection unit that detects whether or not a synchronization abnormality has occurred with another electronic control device, and a plurality of slots among the plurality of slots constituting the static segment. While transmitting a frame required for the vehicle function control in a slot of a different number predetermined for each electronic control unit, and when the synchronization abnormality is detected, among a plurality of slots constituting the dynamic segment, A data transmission unit that transmits a frame including abnormal data indicating that communication is to be stopped due to the occurrence of synchronization abnormality in a slot having the same predetermined number in common with the plurality of electronic control units,
The diagnostic device monitors the dynamic segment, and when communication is stopped immediately after receiving the frame including the abnormal data, diagnoses that communication is stopped due to the electronic control unit alone, and Based on the slot number in which the frame was not transmitted while monitoring the static segment, while identifying the electronic control unit that has stopped communication, if communication is stopped without receiving the frame containing the abnormal data, An abnormality diagnosis system comprising: a diagnosis unit that diagnoses that communication is stopped due to a cause other than the electronic control unit alone. An abnormality diagnosis system in which a diagnosis device is connected to a time slot type in-vehicle network in which a plurality of connected electronic control devices sequentially transmit data every predetermined time according to a predetermined communication schedule, and diagnoses an abnormality in the in-vehicle network. There,
The communication schedule is used for transmission of a frame including data required for vehicle function control, and is used for transmission of a frame including a static segment composed of a plurality of slots and data not directly required for vehicle function control. A communication cycle composed of a dynamic segment composed of a plurality of slots is repeated,
Each of the plurality of electronic control devices is assigned a different identification number, and a synchronization abnormality detection unit that detects whether or not a synchronization abnormality has occurred with another electronic control device, and the synchronization abnormality is detected. Indicates that communication is stopped due to the occurrence of synchronization abnormality in a slot having the same number that is predetermined in common among the plurality of electronic control devices among the plurality of slots constituting the dynamic segment. A data transmission unit for transmitting a frame including abnormal data and the identification number;
The diagnostic device monitors the dynamic segment, and when communication is stopped immediately after receiving a frame including the abnormal data, diagnoses that communication is stopped due to the electronic control unit alone, and the frame If the communication is stopped without receiving the frame containing the abnormal data, while identifying the electronic control device whose communication is stopped based on the identification number included in the An abnormality diagnosis system comprising a diagnosis unit that diagnoses that communication has been stopped. In addition to detecting whether or not a synchronization abnormality has occurred between other electronic control devices, the synchronization abnormality detection unit calculates the synchronization deviation,
The abnormality diagnosis system according to claim 1, wherein the data transmission unit also transmits a calculation result of the synchronization error.

Images