JP2016057888A - Electronic control device and communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To distinctly detect irregularity of a microcomputer in a control device of a communicating opponent and irregularity of a communication line in an electronic control device regularly communicating with other control device via a communication line.SOLUTION: An ECU1 regularly communicating with an ECU2 via a communication line 3 comprises: a microcomputer 11 that performs processing for communicating with the ECU2; and a monitor circuit 15 that monitors an action of the microcomputer 11, and, when determining that the microcomputer 11 is irregular, resets the microcomputer 11 to cause the reset microcomputer to be rebooted. Then, the ECU2 comprises: interruption determination means that determines whether communication is in a communication interrupted state where a communication signal is not normally transmitted from the ECU1; measurement means that measures a time until it is determined by the interruption determination means that the communication is not in the communication interrupted state since it is determined thereby that the communication is in the communication interrupted state; and irregularity discrimination means that distinctly detects irregularity of the microcomputer 11 in the ECU1 and irregularity of the communication line 3 on the basis of the time measured by the measurement means.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an electronic control device and a communication system.

  In a system in which two control devices communicate regularly, there is a technique for determining that there is a communication abnormality when one control device does not receive a transmission signal from the other control device for a predetermined time or longer ( For example, see Patent Document 1).

Japanese Patent Laid-Open No. 9-282002

  In the technique of the above-mentioned Patent Document 1, the cause of the communication abnormality is due to the fact that the microcomputer (microcomputer) in the control device of the communication partner does not operate normally, or the communication line is abnormal (for example, disconnection or short circuit to a predetermined voltage). ) Cannot be distinguished.

  Therefore, the present invention enables an electronic control device that periodically communicates with another control device via a communication line so that a microcomputer abnormality and a communication line abnormality in a communication partner control device can be distinguished and detected. The purpose is to do.

  The electronic control device according to the first aspect of the present invention is an electronic control device that periodically communicates with another control device via a communication line. Another control device that is the communication partner (hereinafter also referred to as a communication partner device) includes a microcomputer that performs processing for the communication partner device to communicate with the electronic control device, and monitors the operation of the microcomputer. Monitoring means for resetting and restarting the microcomputer when it is determined to be abnormal.

The electronic control device according to the first aspect of the present invention includes a disruption determination unit, a measurement unit, and an abnormality determination unit.
The interruption determination unit determines whether or not the communication partner apparatus is in a communication interruption state where a communication signal is not normally transmitted. The measuring means measures the time from when it is determined that the communication is interrupted by the interruption determining means until it is determined that the communication is not interrupted. Then, the abnormality determination unit distinguishes and detects the abnormality of the microcomputer and the abnormality of the communication line in the communication partner apparatus based on the time measured by the measurement unit.

  If the microcomputer of the communication counterpart device does not operate normally (that is, becomes abnormal) and a communication interruption occurs, the microcomputer is determined to be abnormal by the monitoring means in the communication counterpart device and is reset. And a communication interruption state is canceled because a microcomputer returns to normal by reset. In that case, in the electronic control device, the time measured by the measuring means is less than a predetermined value. On the other hand, when a communication interruption state occurs due to an abnormality in the communication line, the communication interruption state is not resolved, so the time measured by the measuring means exceeds a predetermined value. For this reason, the abnormality determination unit distinguishes and detects the abnormality of the microcomputer and the abnormality of the communication line in the communication counterpart device based on the time measured by the measurement unit.

Therefore, according to the electronic control device of the first invention, it is possible to distinguish and detect a microcomputer abnormality and a communication line abnormality in the communication partner apparatus.
For example, the abnormality determining means, if it is determined that the communication is interrupted after the interruption determining means determines that the communication is interrupted, and if the time measured by the measuring means is less than a predetermined determination value, It can be determined that the microcomputer is abnormal. Further, for example, the abnormality determination unit can determine that the communication line is abnormal when the time measured by the measurement unit is equal to or greater than the communication line abnormality determination value set to a value equal to or greater than the determination value. . The determination value and the communication line abnormality determination value may be different values or the same value.

  According to the electronic control device of the first invention, a signal indicating whether or not the microcomputer of the communication counterpart device is operating normally is input to the electronic control device via a signal line different from the communication line. Even if it is not, it is possible to distinguish and detect a microcomputer abnormality and a communication line abnormality in the communication partner apparatus.

  The electronic control device of the second invention is an electronic control device that periodically communicates with other control devices via a communication line. The communication counterpart device (another control device that is the communication counterpart) includes a microcomputer that performs processing for the communication counterpart device to communicate with the electronic control device, and the microcomputer communicates with the communication counterpart device from the electronic control device. It is possible to reset and cancel the reset by the reset signal output to the.

The electronic control device according to the second aspect of the present invention comprises a timing means, a determination means, a restart control means, a counting means, and an abnormality determination means.
The time measuring means measures a continuation time during which no communication signal is sent from the communication partner apparatus. The determining means determines whether or not the time measured by the time measuring means has reached a threshold for communication abnormality determination.

  When the determination unit determines that the measurement time has reached the threshold, the restart control unit sets the reset signal to the communication partner device to an active level for resetting the microcomputer, and then activates the reset signal. The microcomputer is reset by returning to an inactive level opposite to the level, and the measurement time is cleared to zero.

  The counting means counts the number of times that the restart control means sets the reset signal to the active level. Then, the abnormality determination unit distinguishes and detects a microcomputer abnormality and a communication line abnormality in the communication partner device based on the number of times counted by the counting means (hereinafter also referred to as the number of times of counting).

  When the communication partner device's microcomputer does not operate normally or the communication line becomes abnormal and the communication partner device does not send a communication signal normally (that is, when communication is interrupted), the time measured by the time measuring means Has reached the threshold for communication abnormality determination, and the determination means makes an affirmative determination. Then, the restart control means sets the reset signal for the microcomputer of the communication partner device to the active level, then returns the reset signal to the inactive level to cancel the reset of the microcomputer, and clears the time measured by the time measuring means to zero. .

  Here, when communication is interrupted due to an abnormality in the communication line, the restart control means sets the reset signal to the communication partner device to the active level, and then returns to the inactive level. The disruption is not resolved. For this reason, in the electronic control device, “the time measured by the time measuring means reaches the threshold value, the restart control means sets the reset signal to the communication counterpart device to the active level, and then returns the reset signal to the inactive level. At the same time, the operation of “clearing the measurement time by the time measuring means to 0” is repeated. Each time the restart control means sets the reset signal to the active level, the number of counts by the counting means increases.

  On the other hand, if the microcomputer of the communication partner device does not operate normally and communication is interrupted, the restart control means returns the reset signal from the active level to the inactive level, so that the microcomputer of the communication partner device is normal. It returns and the communication interruption is resolved. Therefore, for example, if the microcomputer returns to normal with a single reset, the number of counts by the counting means only increases by one, and remains smaller than when a communication line abnormality occurs. For this reason, the abnormality determination means distinguishes and detects the abnormality of the microcomputer and the abnormality of the communication line based on the number of times counted by the counting means.

Therefore, according to the electronic control device of the second invention, it is possible to distinguish and detect a microcomputer abnormality and a communication line abnormality in the communication partner apparatus.
For example, when the number of counts by the counting unit is 1 or more and less than a first determination value greater than 1, the abnormality determination unit determines that the microcomputer is abnormal, and the number of counts becomes a value greater than or equal to the first determination value. When the set second determination value is exceeded, it can be determined that the communication line is abnormal. The first determination value and the second determination value may be different values or the same value.

  According to the electronic control device of the second invention, a signal indicating whether or not the microcomputer of the communication counterpart device is operating normally is input to the electronic control device via a signal line different from the communication line. Even if it is not, it is possible to distinguish and detect a microcomputer abnormality and a communication line abnormality in the communication partner apparatus.

  Further, according to the electronic control device of the second invention, reset release of the microcomputer of the communication counterpart device (that is, changing the reset signal to the communication counterpart device from the active level to the inactive level) is performed at an arbitrary timing. be able to. For this reason, the reset of the microcomputer can be canceled after preparation for resuming communication with the communication partner apparatus is completed. For example, if a communication interruption occurs due to an abnormality in the microcomputer of the communication partner device at the stage of receiving a part of one or more data scheduled to be received from the communication partner device, a part of the already received data is After completing the discarding process, the reset of the microcomputer can be canceled and communication can be resumed.

  In addition, the code | symbol in the parenthesis described in the claim shows the correspondence with the specific means as described in embodiment mentioned later as one aspect, Comprising: The technical scope of this invention is limited is not.

It is a block diagram showing the communication system of 1st Embodiment. It is a flowchart showing the abnormality detection process of 1st Embodiment. In 1st Embodiment, it is explanatory drawing explaining the effect | action when a communication interruption state arises by abnormality of the microcomputer in ECU of a communicating party. In 1st Embodiment, it is explanatory drawing explaining an effect | action when a communication interruption state arises by abnormality of a communication line. It is a block diagram showing the communication system of 2nd Embodiment. It is a flowchart showing the 1st process of 2nd Embodiment. It is a flowchart showing the 2nd process of 2nd Embodiment. It is a flowchart showing the 3rd processing of 2nd Embodiment. In 2nd Embodiment, it is explanatory drawing explaining the effect | action when a communication interruption state arises by abnormality of the microcomputer in ECU of a communicating party. In 2nd Embodiment, it is explanatory drawing explaining an effect | action when a communication interruption state arises by abnormality of a communication line. It is a truth table showing the operation of the logical product circuit in the second embodiment. It is a flowchart showing the reset function diagnostic process of 3rd Embodiment.

  A communication system according to an embodiment to which the present invention is applied will be described below. The communication system according to the present embodiment is a communication system including, for example, a plurality of electronic control devices (hereinafter referred to as ECUs) mounted on a vehicle.

[First Embodiment]
As shown in FIG. 1, the communication system 10 according to the first embodiment includes at least two ECUs 1 and 2. The ECUs 1 and 2 are communicably connected via the communication line 3.

The ECU 1 includes a microcomputer 11 that controls the operation of the ECU 1, a communication circuit 13, and a monitoring circuit 15 that monitors the operation of the microcomputer 11.
The communication circuit 13 outputs transmission data given from the microcomputer 11 to the communication line 3 as a communication signal, and converts the communication signal sent from the ECU 2 via the communication line 3 into reception data to convert the microcomputer 11 And at least the reception operation to be output to.

  The microcomputer 11 outputs a watchdog pulse WDP to the monitoring circuit 15 as a signal indicating that it is operating normally. The watch dog pulse WDP is a pulse signal in which a valid edge is generated every predetermined time. The valid edge may be both a rising edge from low to high and a falling edge from high to low, or one of them.

  The monitoring circuit 15 is a so-called watchdog timer, and measures a duration time during which the watchdog pulse WDP is not output from the microcomputer 11 (specifically, a valid edge does not occur in the watchdog pulse WDP). The monitoring circuit 15 determines that the microcomputer 11 is abnormal when the continuation time during which the watchdog pulse WDP is not output becomes equal to or longer than the microcomputer abnormality determination time Tm set longer than the predetermined time. The microcomputer 11 is reset and restarted by outputting a reset signal. Note that “outputting a reset signal” means “making the reset signal an active level that is effective for resetting (eg, low in this example)”.

  The ECU 2 also includes a microcomputer 21, a communication circuit 23, and a monitoring circuit 25, similar to the ECU 1. Their roles are the same as those of the microcomputer 11, the communication circuit 13, and the monitoring circuit 15 in the ECU 1.

ECU1 and ECU2 communicate regularly with a fixed communication interval Tint.
The microcomputer 11 of the ECU 1 performs processing for communicating with the ECU 2 at every communication interval Tint, and performs processing for controlling a control target of the ECU 1 using data acquired from the ECU 2 through communication. Similarly, the microcomputer 21 of the ECU 2 performs processing for communicating with the ECU 1 at every communication interval Tint, and performs processing for controlling the control target of the ECU 2 using data acquired from the ECU 1 through communication. For example, the control target of the ECU 1 is an air conditioner or a meter, and the control target of the ECU 2 is an engine or a transmission.

  Next, an abnormality detection process performed by the microcomputers 11 and 21 of the ECUs 1 and 2 to distinguish and detect the abnormality of the microcomputer in the ECU of the communication partner and the abnormality of the communication line 3 will be described with reference to FIG. . Since the contents of the abnormality detection process performed by the microcomputers 11 and 21 of the ECUs 1 and 2 are the same, the ECU 2 will be mainly described below. That is, it demonstrates from a viewpoint that the microcomputer 21 of ECU2 distinguishes and detects the abnormality of the microcomputer 11 in other ECU1 which is a communicating party, and the abnormality of the communication line 3. FIG.

The microcomputer 21 of the ECU 2 executes the abnormality detection process of FIG. 2 at regular intervals shorter than the communication interval Tint.
As shown in FIG. 2, when the microcomputer 21 starts the abnormality detection process, in S110, the microcomputer 21 determines whether or not the communication signal is not normally sent from the communication partner ECU 1 or not. For example, in S110, if the next communication signal does not come even after the communication interruption determination time Tj set slightly longer than the maximum value of the communication interval Tint has elapsed since the previous communication signal has been received, It is determined that the state is disrupted. In S110, if the communication signal is received from the ECU 1 or if the communication interruption determination time Tj has not elapsed since the previous communication signal has been received, it is determined that the communication is not interrupted. The maximum value is a design maximum value (that is, the maximum value in the normal range). In the ECU 2, “a communication signal comes from the ECU 1” means “receives a communication signal from the ECU 1”.

  If the microcomputer 21 determines in S110 that the communication is interrupted, the microcomputer 21 increments the communication interruption timer in S120. The communication interruption timer is a timer for measuring a time from when it is determined that the communication is interrupted in S110 until it is determined that the communication is not interrupted in S110. The value of the communication interruption timer (hereinafter referred to as communication interruption timer value) corresponds to the measured time.

  In step S130, the microcomputer 21 determines whether or not the communication interruption timer value is equal to or greater than a second determination value set to a value equal to or greater than a first determination value described later. If it is not greater than or equal to the second determination value, the abnormality detection process is terminated as it is.

  The first determination value is set to a value larger than a value corresponding to the following return longest time (that is, a value obtained by dividing the longest return time by the execution period of the abnormality detection process). The maximum recovery time is the maximum value of the time from when the microcomputer 11 of the ECU 1 becomes abnormal to when it is reset by the monitoring circuit 15 to return to normal and transmission of the communication signal from the ECU 1 to the ECU 2 is resumed. is there. The second determination value is set to the same value as the first determination value or a value larger than the first determination value.

  If the microcomputer 21 determines in S130 that the communication interruption timer value is greater than or equal to the second determination value, the microcomputer 21 determines in S140 that an abnormality has occurred in the communication line 3 (in other words, It is determined that the cause of the communication interruption state is an abnormality in the communication line 3), and then the abnormality detection process is terminated.

  On the other hand, if it is determined in S110 that the communication is not interrupted, the microcomputer 21 determines in S150 whether or not this time is a communication return time. Specifically, in S150, when it is determined in the previous S110 that the communication has been interrupted, and in this S110, it is determined that the communication has not been interrupted (that is, a communication signal from the ECU 1 has been received). Then, it is determined that the communication is returning. On the contrary, in S150, when it is determined that the communication is not interrupted in the previous S110, it is determined that the communication is not restored.

  If the microcomputer 21 determines in S150 that the communication is being restored, it determines in S160 whether the communication interruption timer value is less than the first determination value. The communication interruption timer value in this case corresponds to a value obtained by measuring the time from determining that the communication is interrupted in S110 to determining that the communication is not interrupted in S110 (until communication is restored).

  If it is determined in S160 that the communication interruption timer value is less than the first determination value, the microcomputer 21 determines in S170 that an abnormality has occurred in the microcomputer 11 in the ECU 1 that is the communication partner. (In other words, it is determined that the cause of the communication interruption state is an abnormality of the microcomputer 11). Thereafter, in S180, the microcomputer 21 clears the communication interruption timer (specifically, sets the communication interruption timer value to 0), and ends the abnormality detection process.

  If the microcomputer 21 determines in S150 that the communication is not restored, or if it determines in S160 that the communication interruption timer value is not less than the first determination value, the microcomputer 21 proceeds to S180 as it is. Then, the communication interruption timer is cleared, and then the abnormality detection process is terminated.

  Next, the effect | action by the microcomputer 21 of ECU2 performing an abnormality detection process is demonstrated using FIG.3 and FIG.4. In FIG. 3 and FIG. 4, the first stage (stage described as “communication signal”) represents a communication signal from the ECU 1 to the ECU 2. In the first stage, “data” is described. The period during which the communication signal from the ECU 1 is transmitted to the ECU 2 is the period during which the ECU 1 is transmitted.

FIG. 3 shows a case where a communication interruption state occurs due to an abnormality in the microcomputer 11 of the ECU 1.
In FIG. 3, before the time t0, a communication signal (data) arrives from the ECU 1 to the ECU 2 at a constant communication interval Tint.

  As shown at time t1, the microcomputer 21 of the ECU 2 is in a communication interruption state if the next communication signal does not come even after the communication interruption determination time Tj (> Tint) has passed since the previous communication signal has come. (S110: YES). Then, the microcomputer 21 continues to determine that the communication is interrupted until a communication signal is sent from the ECU 1 (that is, until a communication signal is received from the ECU 1), and the communication interruption timer is detected as an abnormality. It is incremented at regular intervals that are the execution cycle of the process (FIG. 2) (S120).

  Here, when the microcomputer 11 of the ECU 1 does not operate normally and a communication interruption occurs, the microcomputer 11 is determined to be abnormal by the monitoring circuit 15 in the ECU 1 and is reset. Then, when the microcomputer 11 returns to normal by reset, a communication signal is sent from the ECU 1 to the ECU 2 as shown at time t2 in FIG. 3 (that is, the communication interruption state is eliminated). Then, the microcomputer 21 of the ECU 2 determines “NO” in S110 and “YES” in S150 in the abnormality detection process of FIG. Then, the communication interruption timer value at that time is less than the first determination value. This is because the first determination value is set to a value larger than the value corresponding to the aforementioned longest return time.

For this reason, the microcomputer 21 determines “YES” in S160 of FIG. 2, and determines that the cause of the communication interruption state is an abnormality of the microcomputer 11 in the ECU 1 (S170).
On the other hand, FIG. 4 shows a case where a communication interruption state occurs due to an abnormality in the communication line 3 (for example, disconnection or short circuit to a predetermined voltage).

  Even when an abnormality occurs in the communication line 3, the microcomputer 21 of the ECU 2 continues the next communication even if the communication interruption determination time Tj elapses from when the previous communication signal comes, as shown at time t <b> 3 in FIG. 4. When no signal is received, it is determined that the communication is interrupted (S110: YES). Then, the microcomputer 21 increments the communication interruption timer at regular intervals until a communication signal is sent from the ECU 1 (S120).

  When the communication line 3 is abnormal, since the communication interruption state is not actually resolved, the microcomputer 21 continues to determine “YES” in S110 in the abnormality detection processing of FIG. 2, and further, the communication interruption timer in S120. Will continue to be incremented. Then, the communication interruption timer value reaches the second determination value as shown at time t4 in FIG.

  For this reason, the microcomputer 21 does not determine “NO” in S110, but determines “YES” in S130 (that is, determines that the communication interruption timer value is equal to or greater than the second determination value), and is in a communication interruption state. It is determined that the cause is an abnormality in the communication line 3 (S140).

According to the ECU 2 as described above, the abnormality of the microcomputer 11 in the communication partner ECU 1 and the abnormality of the communication line 3 can be distinguished and detected.
Further, a specific signal indicating whether the microcomputer 11 of the ECU 1 is operating normally (for example, a watch dog pulse WDP from the microcomputer 11) is transmitted from the ECU 1 to the ECU 2 via a signal line different from the communication line 3. Even without inputting, it is possible to detect the abnormality of the microcomputer 11 and the abnormality of the communication line 3 separately. That is, if the specific signal is input from the ECU 1 to the ECU 2, the microcomputer 21 of the ECU 2 can determine whether or not the microcomputer 11 of the ECU 1 is normal. 11 or the communication line 3 can be discriminated. However, it is necessary to add a signal line for inputting the specific signal to the ECU 2. On the other hand, in this embodiment, it is not necessary to add such a signal line.

  In the above embodiment, the first determination value corresponds to a predetermined determination value for determining an abnormality of the microcomputer in the communication partner device, and the second determination value corresponds to a communication line abnormality determination value. Moreover, if the second determination value is set to a value larger than the first determination value, it is advantageous in that the determination accuracy can be improved with respect to the abnormality of the communication line 3. Further, if the first determination value and the second determination value are set to the same value, it is advantageous in terms of simple determination.

  Further, as a modification, regarding the determination of the communication interruption state, the elapsed time from when the reception of the previous communication signal is completed (that is, after the communication signal stops coming) is equal to or longer than a predetermined communication abnormality determination time Tj ′. Then, it may be configured to determine that the communication is interrupted. The communication abnormality determination time Tj ′ is, for example, the same as the communication interruption determination time Tj described above, or the communication signal transmission time (“data” in the first stage of FIGS. 3 and 4) than the communication interruption determination time Tj. It can be set to a time shorter by the time of the described period).

As another modification, only one of the ECUs 1 and 2 (for example, the microcomputer 21 of the ECU 2) may perform the abnormality detection process of FIG.
Further, the number of ECUs connected to the communication line 3 may be three or more. In that case, at least two ECUs among the ECUs connected to the communication line 3 may be in the relationship between the ECU 1 and the ECU 2 described above.

[Second Embodiment]
Next, a communication system according to the second embodiment will be described. In addition, about the component similar to 1st Embodiment, since the same code | symbol as 1st Embodiment is used, detailed description is abbreviate | omitted.

As illustrated in FIG. 5, the communication system 30 according to the second embodiment differs from the communication system 10 according to the first embodiment in the following points <1> to <4>.
<1> An ECU 31 is connected to the communication line 3 instead of the ECU 1, and an ECU 32 is connected instead of the ECU 2.

  <2> A signal line 33 is provided between the ECU 31 and the ECU 32. The signal line 33 is a signal line for outputting a reset signal for resetting the microcomputer 11 of the ECU 31 from the ECU 32 to the ECU 31. Then, the microcomputer 21 of the ECU 32 sets the level of the reset signal output to the ECU 31 via the signal line 33 opposite to the active level (low in this example) that resets the microcomputer 11 (that is, the microcomputer 11). Is switched to the inactive level (high in this example).

  <3> The ECU 31 includes a logical product circuit (AND circuit) 17 as compared with the ECU 1. The AND circuit 17 receives a reset signal output from the monitoring circuit 15 in the ECU 31 and a reset signal input to the ECU 31 from the microcomputer 21 of the ECU 32 via the signal line 33 as two input signals. . The AND circuit 17 outputs a logical product signal of the two input signals to the reset terminal of the microcomputer 11 as a reset signal. For this reason, as shown in FIG. 11, the input signal to the reset terminal of the microcomputer 11 (that is, the reset signal to the microcomputer 11) is the reset signal from the monitoring circuit 15 and the reset signal from the microcomputer 21 of the ECU 32. , When at least one (ie both or one) goes low (0). Further, the input signal to the reset terminal of the microcomputer 11 becomes high when both the reset signal from the monitoring circuit 15 and the reset signal from the microcomputer 21 of the ECU 32 become high (1). Therefore, in the ECU 31, the microcomputer 11 is reset when at least one of the reset signal from the monitoring circuit 15 and the reset signal from the microcomputer 21 of the ECU 32 becomes low. If both the reset signal from the monitoring circuit 15 and the reset signal from the microcomputer 21 of the ECU 32 become high, the reset of the microcomputer 11 is released.

  <4> The microcomputer 21 of the ECU 32 executes the first process of FIG. 6 instead of the abnormality detection process of FIG. Further, the microcomputer 21 of the ECU 32 also executes the second process of FIG. 7 and the third process of FIG.

  Next, the processing executed by the microcomputer 21 of the ECU 32 to distinguish and detect the abnormality of the microcomputer 11 and the abnormality of the communication line 3 in the other ECU 31 that is the communication partner will be described with reference to FIGS. To do.

The microcomputer 21 of the ECU 32 executes the first process of FIG. 6 at regular intervals shorter than the communication interval Tint.
As shown in FIG. 6, when starting the first process, the microcomputer 21 determines the presence or absence of a communication signal from the ECU 31 in S210. In S210, if a communication signal from the ECU 31 is being received, it is determined that there is a communication signal (determined as YES), and if no communication signal is being received, it is determined that there is no communication signal (determined as NO). To do.

  If the microcomputer 21 determines that “there is a communication signal” in S210, the microcomputer 21 clears the timer in S215. Specifically, the timer value is set to zero. The timer is a timer for measuring a duration time during which no communication signal is sent from the ECU 31. The value of this timer (hereinafter referred to as timer value) corresponds to the measured time (measurement time).

  In step S217, the microcomputer 21 clears the post-reset release flag to “0”, and then ends the first process. The post-reset release flag is a flag for switching a threshold for abnormality determination described later, and is set to “1” in S340 of FIG. 7 described later.

On the other hand, if the microcomputer 21 determines in S210 that “no communication signal”, the microcomputer 21 increments the timer in S220.
In step S230, the microcomputer 21 determines whether or not the post-reset release flag is “1”. If the post-reset release flag is not “1” (that is, “0”), Proceed to S240. In S240, the microcomputer 21 sets the first threshold value N [Ta] as the abnormality determination threshold value (corresponding to the communication abnormality determination threshold value) out of the first threshold value N [Ta] and the second threshold value N [Tb]. Then, the process proceeds to S260. If the microcomputer 21 determines in S230 that the post-reset release flag is “1”, the microcomputer 21 sets the second threshold “N [Tb]” as the abnormality determination threshold in S250, and then , Go to S260.

The first threshold value N [Ta] and the second threshold value N [Tb] are threshold values for determining an abnormality in communication with the ECU 31.
The first threshold N [Ta] is a value corresponding to the following first time Ta (that is, a value obtained by dividing the first time Ta by the execution cycle of the first process), and the second threshold N [Tb] is , A value corresponding to the following second time Tb (that is, a value obtained by dividing the second time Tb by the execution period of the first process).

  The first time Ta is a time as a threshold for determining an abnormality in communication with the ECU 31, but as a detailed role, it is a determination time for determining a communication interruption state similar to the first embodiment.

  The first time Ta will be described with reference to FIG. In FIG. 9, the first stage (stage described as “communication signal”) represents a communication signal from the ECU 31 to the ECU 32. In the first stage, the period described as “data” is shown. This is a period during which a communication signal from the ECU 31 is transmitted to the ECU 32. This also applies to FIG. 10 described later.

  As shown in FIG. 9, the first time Ta is obtained by subtracting the minimum value of the transmission time of the communication signal (the time of the period described as “data” in the first stage of FIG. 9) from the maximum value of the communication interval Tint. It is set to a time longer than the time Tc, and in this embodiment, is a time obtained by adding a predetermined time Ts to the time Tc. As described above, the maximum value is the design maximum value (that is, the maximum value in the normal range). Similarly, the minimum value is a design minimum value (that is, the minimum value in the normal range).

  In other words, the time Tc is the maximum value of the time from the end of the previous communication signal to the arrival of the next communication signal. The predetermined time Ts is a time equal to or longer than the microcomputer abnormality determination time Tm in the monitoring circuit 15 described above. The first time Ta corresponds to the communication abnormality determination time Tj ′ described as a modification of the first embodiment.

  For this reason, when the continuation time during which the next communication signal is not transmitted after the completion of reception of the communication signal (hereinafter also referred to as “no communication time”) is equal to or longer than the first time Ta, communication is performed from the ECU 31. It can be determined that the communication is interrupted when the signal is not normally transmitted.

  The first time Ta is a time longer than the time Tc by the predetermined time Ts. For this reason, it is considered that the microcomputer 11 has been reset by the monitoring circuit 15 in the ECU 31 when the communication is interrupted due to the abnormality of the microcomputer 11 in the ECU 31 and the no-communication time becomes equal to or longer than the first time Ta. In this embodiment, in this case, in S280 described later, a reset signal from the ECU 32 to the ECU 31 is set to low to reset the microcomputer 11 from the ECU 32 side, and thereafter the reset is released from the ECU 32 side. ing.

  Further, the second time Tb is also a time as a threshold for determining a communication abnormality with the ECU 31, but as a detailed role, even if the microcomputer 11 of the ECU 31 is reset, transmission of the communication signal from the ECU 31 is resumed. It is a determination time for determining that the operation is not performed. Therefore, the second time Tb is the time from when the reset of the microcomputer 11 of the ECU 31 is released (in other words, after the microcomputer 11 is activated) until the transmission of the communication signal from the ECU 31 to the ECU 32 is started. Is set to a value larger than the maximum value.

  Returning to the description of FIG. In S260, the microcomputer 21 determines whether or not the timer value is less than the abnormality determination threshold. If the timer value is not less than the abnormality determination threshold, the timer value is the same as the abnormality determination threshold in S270. Whether the timer value has reached the abnormality determination threshold value or not is determined. If the microcomputer 21 determines in S270 that the timer value is the same as the abnormality determination threshold value, the microcomputer 21 proceeds to S280 and changes the reset signal to the ECU 31 from high to low to reset the microcomputer 11. In step S290, the microcomputer 21 increments the reset counter, and then ends the first process. The reset counter is a counter for counting the number of times that the reset signal to the ECU 31 is low. The initial value of this reset counter is zero.

  If the flag after reset release is “0” and the abnormality determination threshold value is the first threshold value N [Ta], and the microcomputer 21 determines “YES” in S <b> 270, the microcomputer 21 enters a communication interruption state. In step S280, the reset signal to the ECU 31 is set to low.

  If the microcomputer 21 determines in S260 that the timer value is less than the abnormality determination threshold, or if it determines in S270 that the timer value is not the same as the abnormality determination threshold. Then, the first process is finished as it is.

When the microcomputer 21 sets the reset signal to the ECU 31 to low in S280 of the first process (FIG. 6), the microcomputer 21 executes the second process of FIG. 7 at regular intervals, for example.
As shown in FIG. 7, when the second process is started, the microcomputer 21 determines in S310 whether or not preparation for resuming communication (specifically, preparation for resuming communication with the ECU 31) has been completed. For example, when a part of one or a plurality of data scheduled to be received from the ECU 31 is received and the reset signal to the ECU 31 is made low at S280 in FIG. When the process of discarding is completed, it is determined that preparation for resuming communication is completed. Further, for example, when it is not necessary to discard the received data, it is determined that preparation for resuming communication is completed when a certain time has elapsed after the reset signal to the ECU 31 is set to low.

  If the microcomputer 21 determines in S310 that preparation for resuming communication has not been completed, the microcomputer 21 ends the second process as it is, but if it determines that preparation for resuming communication has been completed, Proceed to S320.

  In S320, the microcomputer 21 clears the timer (sets the timer value to 0). In step S330, the microcomputer 21 returns the reset signal to the ECU 31 from low to high to cancel the reset of the microcomputer 11. Further, the microcomputer 21 sets a reset release flag to “1” in the next S340, and then ends the second process.

  After performing the processes of S320 to S340, the microcomputer 21 does not execute the second process until the reset signal to the ECU 31 is set to low again in S280 of the first process (FIG. 6). Note that the execution order of S320 to S340 may be changed.

Moreover, the microcomputer 21 performs the 3rd process of FIG. 8 for every fixed time, for example.
As shown in FIG. 8, when the microcomputer 21 starts the third process, the reset counter value incremented in S290 of the first process (FIG. 6) (hereinafter referred to as a reset counter value) is 1 in S350. It is determined whether it is above. If the microcomputer 21 determines that the reset counter value is 1 or more, the microcomputer 21 proceeds to S360.

  In S360, the microcomputer 21 determines whether or not the reset counter value is less than a first determination value greater than 1, and if the reset counter value is less than the first determination value, the microcomputer in the ECU 31 in S370. 11 is determined to have occurred (in other words, the cause of the communication interruption state is determined to be an abnormality of the microcomputer 11). Then, the third process is finished.

  If the microcomputer 21 determines that the reset counter value is not less than the first determination value in S360, the microcomputer 21 determines that the reset counter value is set to a value equal to or greater than the first determination value in S380. It is determined whether or not it is equal to or greater than a determination value. If the reset counter value is equal to or greater than the second determination value, it is determined in S390 that an abnormality in the communication line 3 has occurred (in other words, the cause of the communication interruption state is determined to be an abnormality in the communication line 3). Thereafter, the third process is terminated.

  If the microcomputer 21 determines in S350 that the reset counter value is not 1 or more (that is, 0), or determines in S380 that the reset counter value is not greater than or equal to the second determination value. If so, the third process is terminated as it is.

  In the present embodiment, the first determination value is set to 1, for example, and the second determination value is set to 2, for example, but other values may be used. Further, the first determination value and the second determination value may be different values or the same value. If the first determination value and the second determination value are set to the same value, if “NO” is determined in S360 of FIG. 8, it is always determined “YES” in S380, so S380 is deleted. Thus, it can be configured to proceed to S390 when it is determined “NO” in S360.

Next, the effect | action by the microcomputer 21 of ECU32 performing a 1st process-a 3rd process is demonstrated using FIG.9 and FIG.10.
FIG. 9 shows a case where a communication interruption state occurs due to an abnormality in the microcomputer 11 of the ECU 31.

In FIG. 9, before the time t13, the communication signal (data) reaches the ECU 32 from the ECU 31 to the ECU 32 at a constant communication interval Tint.
Every time the microcomputer 21 of the ECU 32 receives a communication signal from the ECU 31, it clears the timer and sets the reset release flag to “0” (S215, S217 in FIG. 6).

  Then, as shown at time t11 to time t12, the microcomputer 21 of the ECU 32 has a non-reception period (period during which the communication signal is not being received) from the end of reception of the communication signal until the next communication signal is transmitted. The timer is incremented at regular intervals (S220 in FIG. 6). The fixed time is the execution cycle of the first process (FIG. 6).

  In the normal state before time t13, the timer value is cleared in S215 of FIG. 6 before reaching the abnormality determination threshold value. The abnormality determination threshold value in this case is the first threshold value N [Ta] because the reset release flag is “0”.

Here, in FIG. 9, it is assumed that the microcomputer 11 of the ECU 31 does not operate normally after the time t13 and the communication is interrupted.
In that case, the microcomputer 21 of the ECU 32 ends the reception of the communication signal at time t13, and when the first time Ta described above elapses, in S270 of FIG. 6, the timer value becomes the abnormality determination threshold (= first threshold value). Affirmative determination is made that the threshold value N [Ta]) has been reached. Then, as shown at time t14, the microcomputer 21 sets the reset signal to the ECU 31 to low and increments the reset counter (S280 and S290 in FIG. 6).

  Thereafter, when the preparation for resuming communication is completed (S310: YES in FIG. 7), the microcomputer 21 returns the reset signal to the ECU 31 to high to release the reset of the microcomputer 11 and the timer as shown at time t15. Is cleared (S320, S330 in FIG. 7). Further, the microcomputer 21 sets the reset release flag to “1” (S340 in FIG. 7).

  Since the microcomputer 21 does not receive a communication signal from the ECU 31 even after returning the reset signal to the ECU 31 to high at time t15, the timer is incremented at regular intervals as shown from time t15 to time t16. (S220 in FIG. 6). In addition, since the reset release flag is “1” after the reset signal to the ECU 31 is returned to high, the abnormality determination threshold used in S260 and S270 in the first process (FIG. 6) is It becomes 2 threshold value N [Tb].

  Here, when the microcomputer 11 of the ECU 31 does not operate normally and communication is interrupted, when the reset signal from the ECU 32 to the ECU 31 is returned from low to high at time t15, the microcomputer 11 of the ECU 31 returns to normal. Thus, the communication interruption state is resolved. For this reason, as shown at time t16, the microcomputer 11 of the ECU 31 starts transmission of the communication signal before the above-described second time Tb elapses from time t15.

  In this case, as shown at time t16, the microcomputer 21 of the ECU 32 determines that “there is a communication signal” in S210 of FIG. 6 before the timer value reaches the abnormality determination threshold (= second threshold N [Tb]). The timer is cleared and the reset release flag is set to “0” (S215, S217 in FIG. 6). Thereafter, the operation is the same as in the normal state before time t13.

  In this case, the microcomputer 21 of the ECU 31 determines “YES” in both S350 and S360 in the third process (FIG. 8), and the cause of the communication interruption state is an abnormality of the microcomputer 11 in the ECU 31. (S370).

On the other hand, FIG. 10 shows a case where a communication interruption state occurs due to an abnormality in the communication line 3 (for example, disconnection or short circuit to a predetermined voltage).
Also in FIG. 10, as in FIG. 9, before time t <b> 13, a normal state in which a communication signal (data) reaches the ECU 32 from the ECU 31 to the ECU 32 at a constant communication interval Tint. FIG. 10 shows a case where an abnormality has occurred in the communication line 3 after time t13.

In FIG. 10, the operation up to time t15 is the same as the operation described with reference to FIG.
When communication is interrupted due to an abnormality in the communication line 3, even if a reset signal from the ECU 32 to the ECU 31 is returned from low to high at time t15, the communication interruption is not resolved.

  For this reason, the microcomputer 21 of the ECU 32 returns the reset signal to the ECU 31 to high at time t15 and clears the timer, and then increments the timer every predetermined time. However, the second time Tb has elapsed from time t15. However, the communication signal from the ECU 31 is not received.

Therefore, as shown at time t17 when the second time Tb has elapsed from time t15, the timer value reaches the abnormality determination threshold value (= second threshold value N [Tb]).
Then, the microcomputer 21 makes an affirmative determination in S270 of FIG. 6 that the timer value has reached the abnormality determination threshold value (= second threshold value N [Tb]), and again sets the reset signal to the ECU 31 to low. At the same time, the reset counter is incremented (S280 and S290 in FIG. 6).

  Thereafter, when preparation for resuming communication is completed (S310: YES in FIG. 7), the microcomputer 21 returns the reset signal to the ECU 31 to high and clears the timer (S320, FIG. 7). S330). In this case, the reset release flag remains “1” due to 340 in FIG. 7, and thus the abnormality determination threshold value remains the second threshold value N [Tb].

Thereafter, the same operation as that from time t15 to time t18 is repeated, and the reset counter value increases (see time t18 to time t20).
Therefore, in the third process (FIG. 8), the microcomputer 21 of the ECU 31 determines “YES” in S380, and determines that the cause of the communication interruption state is an abnormality in the communication line 3 (S390). .

  Even with the ECU 32 as described above, the abnormality of the microcomputer 11 in the ECU 31 of the communication partner and the abnormality of the communication line 3 can be distinguished and detected. Similarly to the first embodiment, a specific signal indicating whether or not the microcomputer 11 of the ECU 31 is operating normally must be input from the ECU 31 to the ECU 32 via a signal line different from the communication line 3. Also, the abnormality of the microcomputer 11 and the abnormality of the communication line 3 can be distinguished and detected. Furthermore, according to the ECU 32, the reset release of the microcomputer 11 of the ECU 31 can be performed at an arbitrary timing. For this reason, it is possible to cancel the reset of the microcomputer 11 after the preparation for resuming communication with the ECU 31 is completed.

  Further, the ECU 32 determines the abnormality determination threshold value (= first threshold value N [Ta]) from when a communication signal is sent from the ECU 31 until first determining “YES” in S270 of FIG. 6 (positive determination). The abnormality determination threshold (= second threshold N [Tb]) after the reset signal to the ECU 31 is returned from low to high is set to a different value. Therefore, an optimum value can be used as the abnormality determination threshold value.

  The abnormality determination threshold value may be a single value without switching. In that case, for example, the larger one of the first threshold value N [Ta] and the second threshold value N [Tb] may be used as one abnormality determination threshold value.

  Further, the ECU 32 may be provided with a circuit that plays the same role as the AND circuit 17 of the ECU 31, and the microcomputer 11 of the ECU 31 may be configured to perform the above-described first to third processes.

[Third Embodiment]
Next, a communication system according to the third embodiment will be described. As a reference numeral of the communication system, “30” which is the same as that of the second embodiment is used. The same reference numerals as those in the second embodiment are used for the same components and processes as those in the second embodiment.

  The communication system 30 of the third embodiment is different from the communication system 30 of the second embodiment in that the microcomputer 21 of the ECU 32 further executes the reset function diagnosis process of FIG.

  When the microcomputer 21 is activated as the ECU 32 is turned on, the microcomputer 21 executes the reset function diagnosis process shown in FIG. 12 immediately after the activation. In the communication system 30, when the ECU 32 is turned on, the ECU 31 is also turned on, and the microcomputer 11 of the ECU 31 is also activated. In addition, the predetermined time T1 and the predetermined time T2, which will be described later, are the time from the start of the microcomputer 11 of the ECU 31 to the start of transmission of the communication signal from the ECU 31 to the ECU 32, similarly to the second time Tb described above. The value is set larger than the maximum value.

  As shown in FIG. 12, when starting the reset function diagnosis process, the microcomputer 21 of the ECU 32 sets the reset signal to the ECU 31 to low in S410. The low output of the reset signal is continued for a predetermined time T1 (corresponding to a predetermined diagnosis time).

  In step S420, the microcomputer 21 waits for a predetermined time T1, and whether or not a communication signal is sent from the ECU 31 during the predetermined time T1 (that is, while the reset signal to the ECU 31 is low). Determine whether.

  If the microcomputer 21 determines in S420 that a communication signal has been sent during the predetermined time T1, the microcomputer 21 proceeds to S430, and the ECU 32 cannot reset the microcomputer 11 of the ECU 31 by the ECU 32. It is determined that Then, the process proceeds to S450. Examples of the reset impossible abnormality include a disconnection of the signal line 33, a short circuit of the signal line 33 to a high equivalent potential, a failure of a signal output circuit for setting the reset signal to low, and the like.

  If the microcomputer 21 determines in S420 that a communication signal has not been sent, the microcomputer 21 determines that the function of resetting the microcomputer 11 by the ECU 32 is normal, and then proceeds to S450. move on.

In S450, the microcomputer 21 performs processing for returning the reset signal to the ECU 31 from low to high.
In step S460, the microcomputer 21 waits for a predetermined time T2 (corresponding to a predetermined waiting time), and determines whether a communication signal is sent from the ECU 31 during the predetermined time T2.

  If the microcomputer 21 determines in S460 that no communication signal has been sent during the predetermined time T2, the microcomputer 21 proceeds to S470, and the ECU 32 cannot cancel the reset of the microcomputer 11 of the ECU 31. It is determined that an abnormality that cannot be reset is occurring. Thereafter, the reset function diagnosis process is terminated. Note that, as a reset impossible abnormality, for example, a short circuit of the signal line 33 to a low equivalent potential or a failure of a signal output circuit for setting the reset signal to high can be considered.

  If the microcomputer 21 determines in S460 that a communication signal has been sent, the microcomputer 21 proceeds to S480 and determines that the function of releasing the reset of the microcomputer 11 by the ECU 32 is normal. Thereafter, the reset function diagnosis process is terminated.

  By the processes in S410 to S430 and S450, it is possible to detect an abnormality that cannot be reset. Further, it is possible to detect an abnormality that cannot be reset by the processes of S460 and S470. And when those abnormalities are detected, since some suitable fail safe process can be performed, the reliability of the communication system 30 can be improved.

  When the microcomputer 11 of the ECU 31 is also configured to perform the above-described first to third processes, the microcomputer 11 can also be configured to perform the reset function diagnosis process of FIG.

As mentioned above, although embodiment of this invention was described, this invention can take a various form, without being limited to the said embodiment. The above-mentioned numerical values are also examples, and other values may be used.
For example, the present invention is not limited to a communication system including an in-vehicle ECU, and can be similarly applied to a communication system for other purposes. Further, the active level of the reset signal may be high. In that case, in the second and third embodiments, an OR circuit (OR circuit) may be used instead of the AND circuit 17. Further, the methods of the second and third embodiments can be applied without the monitoring circuit 15 in the ECU 31 of the communication partner, for example. In that case, the reset signal from the ECU 32 to the ECU 31 may be configured to be input to the reset terminal of the microcomputer 11 without going through the AND circuit 17.

  In addition, the functions of one component in the above embodiment may be distributed as a plurality of components, or the functions of a plurality of components may be integrated into one component. Further, at least a part of the configuration of the above embodiment may be replaced with a known configuration having the same function. Moreover, you may abbreviate | omit a part of structure of the said embodiment. In addition, at least a part of the configuration of the above embodiment may be added to or replaced with the configuration of the other embodiment. In addition, all the aspects included in the technical idea specified by the wording described in the claims are embodiments of the present invention. Further, the present invention can be realized in various forms such as a program for causing a computer to function as the ECUs 2 and 32 described above, a medium on which the program is recorded, an abnormality determination method, and the like.

  1, 2, 31, 32 ... ECU (electronic control unit), 3 ... communication line, 11, 21 ... microcomputer, 15, 25 ... monitoring circuit

Claims (9)

An electronic control device (2) that periodically communicates with another control device (1) via a communication line (3),
The other control device monitors the operation of the microcomputer (11) that performs processing for the control device to communicate with the electronic control device, and determines that the microcomputer is abnormal. Monitoring means (15) for resetting and restarting,
The electronic control device
Interruption determination means (21, S110) for determining whether or not a communication interruption state where a communication signal is not normally transmitted from the other control device;
Measuring means (21, S120, S180) for measuring a time from when it is determined that the communication is interrupted by the interruption determining means until it is determined that the communication is not interrupted;
Based on the time measured by the measuring means, an abnormality determining means (21, S130, S140, S160, S170) that distinguishes and detects an abnormality of the microcomputer and an abnormality of the communication line in the other control device. )When,
An electronic control device comprising: The electronic control device according to claim 1.
The abnormality determination means includes
If the time measured by the measuring unit is less than a predetermined determination value when it is determined by the interruption determining unit that the communication is interrupted and then determined that the communication is not interrupted, the microcomputer Determining that there is an abnormality (S160, S170),
An electronic control device. The electronic control device according to claim 2,
The abnormality determination means includes
When the time measured by the measuring unit is equal to or greater than the communication line abnormality determination value set to a value equal to or greater than the determination value, it is determined that the communication line is abnormal (S130, S140);
An electronic control device. An electronic control device (32) that periodically communicates with another control device (31) via a communication line (3),
The other control device includes a microcomputer (11) that performs processing for the control device to communicate with the electronic control device,
The microcomputer is capable of resetting and releasing the reset by a reset signal output from the electronic control unit to the other control unit,
The electronic control device
Time measuring means (21, S210, S215, S220) for measuring a duration time during which no communication signal is sent from the other control device;
Determining means (21, S270) for determining whether or not the time measured by the time measuring means has reached a threshold for determining communication abnormality;
If the determination means affirmatively determines that the measurement time has reached the threshold, the reset signal to the other control device is set to an active level for resetting the microcomputer, and then the reset signal is A restart control means (21, S280, S310 to S330) for returning the inactive level opposite to the active level to cancel the reset of the microcomputer and clearing the measurement time to 0;
Counting means (21, S290) for counting the number of times that the restart control means sets the reset signal to the active level;
An abnormality determination means (21, S350 to S390) for distinguishing and detecting an abnormality of the microcomputer and an abnormality of the communication line based on the number of times counted by the counting means;
An electronic control device comprising: The electronic control device according to claim 4.
The abnormality determination means includes
When the number of times counted by the counting means is 1 or more and less than a first determination value greater than 1, it is determined that the microcomputer is abnormal, and the number of times is set to a value greater than or equal to the first determination value. Determining that the communication line is abnormal when the second determination value is exceeded.
An electronic control device. The electronic control device according to claim 4 or 5,
The threshold value from when the communication signal is sent from the other control device to when the determination unit makes an affirmative determination first, and the restart control unit returns the reset signal from the active level to the inactive level. The threshold value after
An electronic control device. The electronic control device according to any one of claims 4 to 6,
Whether the reset signal is set to the active level for a predetermined diagnosis time, and a communication signal is sent from the other control device during the diagnosis time when the reset signal is set to the active level. If the communication signal is sent during the diagnosis time, a reset that determines that an unresetable abnormality that prevents the microcomputer from being reset by the electronic control device has occurred Disability abnormality detection means (21, S410 to S430, S450),
An electronic control device. The electronic control device according to claim 7.
It is determined whether or not a communication signal is sent from the other control device during a predetermined waiting time after the reset impossible abnormality detecting means sets the reset signal to the inactive level, and the waiting time If the communication signal is not sent during this period, it is determined that there is an unrepairable abnormality that cannot be reset by the electronic control unit. , S460, S470),
An electronic control device. In a communication system in which a plurality of electronic control devices are connected via a communication line (3),
At least one of the plurality of electronic control devices is the electronic control device according to any one of claims 1 to 8.
A communication system characterized by the above.

Images