JP2023127404A - electronic control system - Google Patents

Abstract

To grasp status of entire vehicle at occurrence of communication error after restoration of communication even if communication error occurs in Zone architecture.SOLUTION: An electronic control system 1 according to the invention includes a first electronic control device 100, and a plurality of second electronic control devices 210, 220. The first electronic control device 100 receives signals outputted from the plurality of second electronic control devices 210, 220, generates processed data by processing the signals received from the plurality of second electronic control devices 210, 220, overwrites a first storage part 140 with the generated processed data, and if a communication error occurs in communication with at least one of the second electronic control devices 210, 220, the first electronic control device stores, as data at error occurrence without using it for overwriting, the processed data that was generated from signals outputted from all of the second electronic control devices 210, 220 and stored onto the first storage device 140 when the communication error was detected.SELECTED DRAWING: Figure 1

Description

The present invention relates to an electronic control system for controlling memory storage of vehicle/diagnostic data.

As the performance of automobiles increases, the number of electronic control units (ECUs) for performing various functions is also increasing. When the number of ECUs is large, the network configuration between the ECUs becomes complicated, which may cause problems such as signal delay. To address these problems, in recent years, consideration has been given to introducing a Zone architecture configuration in which ECUs are grouped into functional systems and are collectively controlled by a central electronic control unit (central ECU). Additionally, with the advent of automated driving, vehicle/diagnostic data is on the rise. In addition, due to the demand for downsizing and low cost, ECUs other than the central ECU (hereinafter referred to as other ECUs) are required to manage and store various data processed by other ECUs by the central ECU in order to suppress the increase in internal memory. Demand is increasing.

When the above Zone architecture configuration is adopted, the vehicle/diagnostic data collected from other ECUs to the central ECU does not go through other ECUs, that is, it is not stored in other ECUs. If a communication error occurs between the central ECU and the central ECU, there is a risk that the update timing of data managed and stored by the central ECU may differ between the other ECUs. In other words, the vehicle/diagnostic data of the other ECU where the communication error occurred is not updated, but the vehicle/diagnostic data of the other ECUs are updated. Then, the vehicle/diagnostic data of other ECUs at the time when the communication error occurred is overwritten, and information about the entire vehicle at the time when the communication error occurred cannot be obtained. This makes it difficult to perform factor analysis using data stored in the central ECU. Among them, for example, Patent Document 1 is known as a method for securing data when an abnormality occurs.

Patent Document 1 states that the problem is to "reliably store the vehicle state at the time of occurrence of an abnormality even if the vehicle state detection process is executed several times from the time of the occurrence of the abnormality to the execution of the storage process." ing. As a means for solving this problem, the vehicle abnormal state storage device 10 uses the first vehicle state storage processing section 23 to store the vehicle state detected by the vehicle state detection processing section 21 at each detection period in the index number assignment processing section 22. is stored in the first storage unit 13 together with an index number assigned in association with each vehicle state, and when the abnormality determination processing unit 24 determines that an abnormality has occurred in the vehicle state, the index number extraction processing unit 25 The index number corresponding to the vehicle state is extracted, and the index number extracted by the index number extraction processing unit 25 is stored by the second vehicle state storage processing unit 26 at each predetermined storage cycle set at a cycle longer than the detection cycle. "The corresponding vehicle state is stored in the second storage unit 14."

Japanese Patent Application Publication No. 2013-142617

However, in the invention described in Patent Document 1, since indexing processing is always performed on vehicle/diagnostic data, the calculation processing load becomes high. In addition, when multiple ECUs are connected to the central ECU, only the vehicle data of the ECU in question where the abnormality has occurred is stored in the second storage section, causing an update mismatch with the vehicle data of the ECU other than the one in which the abnormality has occurred, and the central When performing factor analysis using vehicle data stored in the ECU, the problem was that the vehicle data for each ECU was not available, making the analysis difficult.

In order to solve the above problems, an electronic control system according to the present invention includes a first electronic control device and a plurality of second electronic control devices, and the first electronic control device outputs output from the plurality of second electronic control devices. the at least one second electronic control device; receives the signal received from the plurality of second electronic control devices, generates processed data by processing the signal received from the plurality of second electronic control devices; If a communication error occurs between the two electronic control units, the processed data generated from the signals received from all the second electronic control units that were stored in the storage unit at the time the communication error was detected is processed at the time of the error. Save as data without overwriting it.

According to the present invention, vehicle data of each ECU at the time of/immediately before a communication error can be stored in the storage of the central ECU, so that the state of the entire vehicle at the time of a communication error can be grasped and the cause can be analyzed.
Further features related to the invention will become apparent from the description herein and the accompanying drawings. Further, problems, configurations, and effects other than those described above will be made clear by the description of the following examples.

1 is a block diagram showing the configuration of an electronic control system according to a first embodiment of the present invention. FIG. 2 is a flow diagram showing processing performed by the electronic control system according to the first embodiment of the present invention. FIG. 2 is a block diagram showing the configuration of an electronic control system according to a second embodiment of the present invention. FIG. 7 is a flow diagram showing processing performed by the electronic control system according to the second embodiment of the present invention. FIG. 3 is a block diagram showing the configuration of an electronic control system according to a third embodiment of the present invention. 1 is a diagram showing an example of a connection configuration between electronic control devices according to Example 1 of the present invention. FIG. FIG. 7 is a diagram showing another example of the connection configuration between electronic control devices according to the first embodiment of the present invention.

Embodiments of the present electronic control system and test method will be described below with reference to the drawings. However, the embodiments shown below are merely illustrative, and there is no intention to exclude the application of various modifications and techniques not specified in the embodiments. That is, this embodiment can be modified and implemented in various ways without departing from the spirit thereof. Furthermore, each figure is not intended to include only the constituent elements shown in the figure, but may include other functions.

[Example 1]
FIG. 1 is a block diagram showing the overall configuration of an electronic control system 1 according to the first embodiment. The electronic control system 1 installed in a vehicle includes a first electronic control device (central ECU 100) and a plurality of second electronic control devices (ECU 210 and ECU 220). The central ECU 100 includes a transmitting/receiving section 110, an error detecting section 120, a signal processing section 130, a first storage section (cache 140), a data transfer instruction section 150, and a second storage section (storage 160). The ECUs 210 and 220 are various devices installed in the vehicle (e.g., cameras, radar sensing devices such as LiDAR), and acquire information regarding the control status and safety status of the vehicle, and provide vehicle/diagnostic data. generate. In this embodiment, a case will be described in which there are two ECUs, but the number of ECUs is not limited as long as it is plural.

The transmitting/receiving unit 110 transmits and receives data between the ECU 210 and the ECU 220. The error detection unit 120 detects an error that occurs in data transmission and reception between the transmission and reception unit 110 and the ECU 210 and the ECU 220. In this embodiment, it is assumed that the error is a communication error in which communication between the transmitter/receiver 110 and the ECU 210 and the ECU 220 is interrupted. The signal processing unit 130 processes the signals received by the transmitting/receiving unit 110 and processed by the ECU 210 and the ECU 220 to generate processed data.

The cache 140 and the storage 160 store processed data generated by the signal processing unit 130. In this embodiment, the storage capacity of cache 140 is smaller than that of storage 160. The same applies to other embodiments. Furthermore, although the storage 160 is built into the central ECU 100 in this embodiment, it may be installed in another area within the vehicle in which the central ECU 100 is installed. The data transfer instruction unit 150 transmits a transfer instruction signal to the signal processing unit 130 to instruct the signal processing unit 130 to transfer the processed data stored in the cache 140 to the storage 160. In this embodiment, the data transfer instruction section 150 transmits a data transfer signal to the signal processing section 130 when receiving an error detection signal from the error detection section 120, which will be described in detail later.

By communicatively connecting multiple ECUs 210 and 220 to the central ECU 100 as in this embodiment, all vehicle/diagnostic data is not stored in the nonvolatile memory of the multiple ECUs 210 and 220, but is stored within the central ECU 100.・It becomes possible to perform management. Note that the ECUs 210 and 220 may have a volatile memory, and may store all data in the memory before transmitting it to the central ECU 100.

FIG. 2 is a flow diagram showing the processing performed by the electronic control system according to this embodiment. While the transmitter/receiver 110 is communicating with the ECUs 210, 220, the error detector 120 monitors whether an error has occurred in the communication between the transmitter/receiver 110 and the ECUs 210, 220 (step S201). . If the error detection unit 120 does not detect an error (“No” in step S201), the vehicle/diagnostic data processed by the ECUs 210 and 220 is transferred to the signal processing unit 130, processed by the signal processing unit 130, and converted into processed data. is generated (step S202). The generated processing data is first transmitted to the cache 140 configured with volatile memory, and is overwritten and saved (step S203). Further, at an arbitrary timing, the data stored in the cache 140 is transferred to and stored in the storage 160 composed of, for example, a non-volatile memory, and is saved without being overwritten (step S204). After that, the above flow is repeated until an error occurs. Since the data stored in the cache 140 is overwritten, the previously stored data will be erased. Therefore, by saving the processed data every predetermined time in the storage 160 having a larger storage capacity than the cache 140, it becomes possible to save the processed data every predetermined time.

If the error detection unit 120 detects a communication error (“Yes” in step S201), the error detection unit 120 issues an error detection signal indicating that an error has been detected, and transmits it to the data transfer instruction unit 150 (step S205). . In the following description, it will be assumed that a communication error has occurred between the ECU 210 and the transmitter/receiver 110, for example. The data transfer instruction unit 150 that has received the error detection signal issues a transfer instruction signal instructing to transfer the data stored in the cache 140 to the storage 160, and transmits it to the signal processing unit 130.

The signal processing unit 130 that has received the transfer instruction signal then processes all the ECUs 210 that have been stored in the cache 140 from the time when the data transfer instruction unit 150 received the error detection signal to the time that has gone back by a predetermined time. , 220 is transferred and stored in the storage 160 as error occurrence data (step S207).

Specifically, for example, when the data transfer instruction unit 150 receives an error detection signal at time T, the signal processing unit 130 transmits an error from each of the ECUs 210 and 220 between time T−Δt, which is Δt back from time T. Processed data generated by processing the received signal is transferred from the cache 140 to the storage 160.

Thereafter, it is determined whether the communication error has been resolved (step S208). If the communication error is resolved (“Yes” in step S208), the process returns to step S201. If the communication error is not resolved (“No” in step S208), the process moves to step S209, and safety control such as stopping or degeneration (lowering of the automatic driving level, etc.) is performed.

In this embodiment, the error is described as a communication error, but the error is not limited to this, and may be a signal abnormality or a failure of the ECU. Furthermore, there are many error detection methods, such as a CRC check or a determination using a packet loss counter.

In this embodiment, with the above configuration, when a communication error occurs in the electronic control system, any data stored in the cache memory up to the time of the error can be saved in the storage, and when the cause is analyzed, the vehicle Since the overall condition can be grasped, factor analysis can be facilitated. This is because as in-vehicle systems become more computerized and more complex, it is difficult to analyze the cause of the communication error using only the vehicle/diagnosis data of the ECU in question. For example, if the ECU where the communication error occurred is in charge of managing each area/zone (front, rear, left, right), it is necessary to understand the situation of each area/zone and understand the basis for vehicle control and the situation. This is because it is necessary to The same applies when the ECU is responsible for various functions (automatic driving control, driving support control, power train, vehicle body control, etc.).

Regarding the above, when compared with this embodiment, the following problems can be solved. That is, for the ECU 210 whose communication with the transmitter/receiver 110 is cut off, the vehicle/diagnostic data generated by the ECU 210 cannot be updated after time T; The vehicle/diagnostic data generated by the ECU 220 that is not used continues to be transmitted to the central ECU 100 even after time T. Data continues to be overwritten and stored in the cache 140, which is a volatile memory. In other words, the data saved up to that point will be erased. Therefore, if the communication error continues for a certain period of time, even if the communication error between the ECU 210 and the transmitter/receiver 110 is resolved, the vehicle/diagnostic data generated by the ECU 220 at time T will not be saved, and at time T. It is not possible to analyze what kind of event occurred that caused the error.

However, according to this embodiment, the vehicle/diagnostic data generated by the ECUs 210 and 220 at time T is reliably stored in the storage 160. Therefore, when the communication error in the ECU 210 is resolved, it becomes possible to grasp the overall state of the vehicle at time T, which can be used to analyze the cause of the communication error occurring in the ECU 210 and problems associated with it. .

Note that in this embodiment, communication between the ECUs 210 and 220 and the transmitter/receiver 110 was performed via separate paths (for example, Ethernet, CAN, or SerDes), but the connection method is not limited to this. I can't do it. Specifically, as shown in FIG. 6, the ECUs 210 and 220 may be connected to the transmitter/receiver 110 via a shared communication bus 700. Further, as shown in FIG. 7, the connection may be made via a switching device 800. In either case, it is possible to simplify the communication path configuration, and for example, by connecting ECUs belonging to the same functional system together to the transmitting/receiving section 110 via a common bus or switching device, it is possible to simplify the communication path configuration. It becomes possible to manage data easily.

[Example 2]
Next, an electronic control system according to a second embodiment will be described using FIGS. 3 and 4. FIG. 3 is a block diagram showing an example of the configuration of the electronic control system 1 according to this embodiment. The configuration of the central ECU 100 in this embodiment is the same as that in the first embodiment, and a description thereof will be omitted. This embodiment differs from the first embodiment in that data is stored in the cache not only on the central ECU 100 side but also on the ECU 210 and 220 sides.

In this embodiment, the ECU 210 includes a transmitting/receiving section 111, an error detecting section 121, an information processing section 131, a third storage section (cache 141), and an information acquisition section 300. The ECU 220 also has a similar configuration.

The transmitter/receiver 111 communicates with the transmitter/receiver 110 on the central ECU 100 side. The error detection unit 121 issues an error detection signal when detecting a communication error occurring between the transmission and reception units 110 and 111, and transmits it to the information processing unit 131. The information acquisition unit 300 is a sensing element such as a camera or radar, and acquires information regarding vehicle control and safety. The information processing unit 131 processes the information acquired by the information acquisition unit 300 and generates a processed signal.

In this embodiment, when the error detection unit 121 detects a communication error, it transmits an error detection signal to the information processing unit 131, and the information processing unit 131 transmits the error detection signal to the error detection unit 121 in accordance with reception of the error detection signal. Information regarding processed signals generated within a predetermined period of time before and after detecting a communication error is stored in the cache 141 until the communication error is resolved.

The above processing will be explained using the flowchart of FIG. While the transmitting/receiving section 111 is communicating with the transmitting/receiving section 110 of the central ECU 100, the error detection section 121 monitors whether an error has occurred in the communication between the transmitting/receiving sections 110 and 111 (step S401). If the error detection unit 121 does not detect an error (“No” in step S401), the information processing unit 131 processes the information acquired by the information acquisition unit 300 to generate a processed signal (step S402). The information processing unit 131 then transmits the processed signal to the transmitting/receiving unit 111 (step S403). After that, the above flow is repeated until an error occurs.

If the error detection unit 121 detects a communication error (“Yes” in step S401), the error detection unit 121 issues an error detection signal indicating that a communication error has been detected, and transmits it to the information processing unit 131 (step S404). ). The information processing unit 131 that has received the error detection signal stores information related to the processed signal generated within a predetermined time before and after the error detection unit 121 detected the error in the cache 141 until the communication error is resolved (step S405 ).

After that, the error detection unit 121 monitors whether the communication error has been resolved (step S406). If the communication error is resolved (“Yes” in step S406), the information processing unit 131 transmits the data stored in the cache 141 to the transmitting/receiving unit 111. If the communication error is not resolved (“No” in step S406), the process moves to step S408, and safety control such as stopping or degeneration (lowering of the automatic driving level, etc.) is performed.

In this embodiment, by performing the above-described processing, in addition to the effects of the first embodiment, data generated after a communication error occurs by the ECU that could not be transmitted to the central ECU 100 and is generated after the communication error is restored. It will be possible to send it later. Therefore, by analyzing the continuity of data generated before and after a communication error occurs, detailed factor analysis becomes possible, which facilitates maintenance and provides feedback to design. Note that there may be a time lag in the cache data sent from the ECU 210 to the central ECU when communication is restored, but this can be adjusted by the signal processing unit 130 performing synchronization processing using, for example, time stamps. It is.

Furthermore, even if the communication error is not resolved or the ECU that caused the error breaks down, according to this embodiment, by taking out the ECU and acquiring the data log from the cache, it is possible to resolve the situation when the communication error occurs. It becomes possible to understand the condition of the vehicle.

[Example 3]
FIG. 5 is a block diagram showing the configuration of an electronic control system 1 according to a third embodiment of the present invention. This embodiment differs from the first embodiment in that it includes an external communication unit 500 that can communicate with the outside (management center and user) 600 of the vehicle 400 in which the central ECU 100 is mounted. In addition, in this embodiment, the external communication unit 500 is configured to be able to communicate with the signal processing unit 130, and can, for example, transfer vehicle/diagnostic data to a center or a user with a mobile terminal at any timing, or Data obtained by integrating and processing the data can be transmitted.

In addition to the effects of Embodiments 1 and 2, the above configuration enables real-time center and driver notification while the vehicle is in operation, providing highly reliable services such as safety control, alerting, logging, and trend analysis. It becomes possible to provide

According to the embodiments of the present invention described above, the following effects are achieved.
(1) The electronic control system according to the present invention includes a first electronic control device and a plurality of second electronic control devices, and the first electronic control device receives signals output from the plurality of second electronic control devices. The controller processes the signals received from the plurality of second electronic control devices to generate processed data, overwrites and saves the generated processed data in the storage unit, and detects a communication error with at least one second electronic control device. When a communication error occurs, the processing data generated from the signals received from all the second electronic control units, which was saved in the storage unit at the time when the occurrence of the communication error was detected, is saved as data at the time of error occurrence without being overwritten. .

With the above configuration, the vehicle data of each ECU at the time of a communication error can be stored in the storage of the central ECU, so that the overall state of the vehicle at the time of a communication error can be grasped and the cause can be analyzed.

(2) The data at the time of error occurrence includes processing data generated from signals received from all the second electronic control devices from the time when the occurrence of a communication error is detected to the time a predetermined period of time back. This makes it possible to analyze data continuity and the like from immediately before a communication error occurs, making it easier to analyze the cause of the error.

(3) The storage unit has a first storage unit that overwrites and stores processed data and a second storage unit that stores processed data without overwriting it, and the first electronic control unit detects the occurrence of a communication error. Accordingly, the error occurrence data is transferred from the first storage section to the second storage section. This makes it possible to use volatile cache memory as the first storage unit, which has a smaller storage capacity than the second storage unit, which is non-volatile storage memory, making it possible to downsize the device. .

(4) It further includes an external communication unit capable of communicating with the outside of the vehicle in which the electronic control system is installed, and the external communication unit transmits information including processed data stored in the storage unit to the outside of the vehicle. and send. This enables real-time center and driver notifications while the vehicle is in operation, making it possible to provide highly reliable services such as safety control, warnings, logging, and trend analysis.

(5) Each of the plurality of second electronic control devices acquires information about the vehicle in which the electronic control system is installed, processes the information to generate a processed signal, and when a communication error occurs, the communication error occurs. Information regarding the processed signals generated within a predetermined period of time before and after the occurrence of is stored in the third storage section. This makes it possible to obtain data even after a communication error occurs by referring to the data log in the storage unit as needed.

(6) Each of the plurality of second electronic control units stores information in the third storage unit until the communication error is resolved, and when the communication error is resolved, the information stored in the third storage unit is stored in the third storage unit. 1 to an electronic control unit. As a result, the data immediately after the communication error occurred, which could not be sent to the central ECU at the time of the communication error, can be sent after the communication is restored, making it possible to analyze the cause in more detail, facilitating maintenance and providing feedback to the design. I can do it.

(7) The plurality of second electronic control devices are connected to the first electronic control device via a common communication path or selectively connected via a switching circuit. This makes it possible to simplify the communication path between the second electronic control device and the first electronic control device.

The technical scope of the present invention is not limited to the scope described in the above embodiments, and includes various modifications without departing from the main characteristics of the present invention. Therefore, the above embodiments are merely illustrative and should not be construed in a limiting manner. Furthermore, it is possible to add, delete, or replace some of the configurations of each embodiment with other configurations, all of which are within the scope of the present invention.

1 Electronic control system, 100 Central ECU (first electronic control unit), 140 Cache (first storage section), 141 Cache (third storage section), 160 Storage (second storage section), 210, 220 ECU (second storage section) electronic control unit), 400 vehicle, 500 external communication unit, 600 external, 700 communication bus, 800 switching device

Claims (7)

An electronic control system having a first electronic control device and a plurality of second electronic control devices,
The first electronic control device includes:
receiving signals output from the plurality of second electronic control devices;
processing signals received from the plurality of second electronic control devices to generate processed data;
Overwrite and save the generated processing data in the storage unit,
When a communication error occurs with at least one of the second electronic control devices, all of the data stored in the storage unit at the time when the occurrence of the communication error is detected are received from all the second electronic control devices. storing the processed data generated from the signal as error occurrence data without overwriting it;
An electronic control system characterized by: The electronic control system according to claim 1,
The error occurrence data includes the processing data generated from the signals received from all the second electronic control devices from the time when the occurrence of the communication error was detected to the time a predetermined time back.
An electronic control system characterized by: The electronic control system according to claim 1,
The storage unit has a first storage unit that overwrites and stores the processed data, and a second storage unit that stores the processed data without overwriting,
The first electronic control device transfers the error occurrence data from the first storage unit to the second storage unit in response to detecting the occurrence of the communication error.
An electronic control system characterized by: The electronic control system according to claim 1,
further comprising an external communication unit capable of communicating with the outside of the vehicle in which the electronic control system is installed,
The external communication unit transmits information including the processed data stored in the storage unit to the outside of the vehicle.
An electronic control system characterized by: The electronic control system according to claim 1,
Each of the plurality of second electronic control devices,
Obtaining information on a vehicle in which the electronic control system is installed;
processing the information to generate a processed signal;
When the communication error occurs, storing information regarding the processed signal generated within a predetermined time before and after the communication error occurs in a third storage unit;
An electronic control system characterized by: The electronic control system according to claim 5,
Each of the plurality of second electronic control devices stores the information in the third storage unit until the communication error is resolved, and stores the information in the third storage unit when the communication error is resolved. transmitting the information to the first electronic control device;
An electronic control system characterized by: The electronic control system according to claim 1,
The plurality of second electronic control devices are connected to the first electronic control device via a common communication path, or are selectively connected to the first electronic control device via a switching circuit.
An electronic control system characterized by:

Images