JP4560000B2 - Operation monitoring unit - Google Patents

Description

  The present invention relates to an operation monitoring unit that monitors operation states of a plurality of electronic control units mounted on a vehicle, and in particular, an operation monitoring unit that monitors operation states of electronic control units that are started or stopped in response to a power supply state of the vehicle. It is about.

  Conventionally, an electronic control unit (ECU) that controls various electrical devices is mounted on a vehicle, and the number of ECUs tends to increase. In addition, each ECU is connected by an in-vehicle LAN such as LIN, CAN, FlexRay (registered trademark), and configured to be able to transmit and receive messages to and from each other.

  When the ECU connected by the in-vehicle LAN transmits and receives a message, for example, a reception confirmation signal (hereinafter referred to as ACK) may be used to confirm whether or not the message has been reliably received. The ECU that sent the message resends the message until it can receive the ACK, but an ACK is returned from the ECU that is in a stopped state (in this specification, the stopped state includes a state of waiting while performing memory backup). There is no.

  For this reason, it is necessary to check the operation state of the ECU. In recent years, as shown in Japanese Patent Laid-Open No. 2000-132410 (Patent Document 1), an API (Application Program Interface) typified by OSEK (Offene System und deren Elekrtonik im Kraftfahrzeug) is used for an in-vehicle LAN. It has become.

JP 2000-132410 A

  With the thing like patent document 1, although the cyclic message can be transmitted / received only between operating ECUs, the abnormality of the in-vehicle LAN cannot be detected. In other words, this cannot be detected when the ECU that should be in the operating state is stopped or the ECU that is supposed to be in the operating state is operating due to an abnormal state such as electric leakage.

  In particular, in the case of an in-vehicle LAN that uses a battery as a power source, it is important to reduce the power consumed by the ECU, and an ECU that should not operate when the ignition key is turned off has started. As a result, the power stored in the battery is quickly consumed.

  The present invention has been made in consideration of the above problems, and provides an operation monitoring unit that can monitor the operation state of each ECU connected to the in-vehicle LAN and monitor the state of the in-vehicle LAN. This is the issue.

In order to solve the above problems, the present invention provides:
An operation monitoring unit connected via a transmission line to an in-vehicle LAN connected to a plurality of electronic control units,
A message receiving means for receiving a message transmitted from all the electronic control units ; and an operating state in which the message is transmitted from identification information for identifying an electronic control unit attached to each message received by the message receiving means. Along with discriminating the electronic control unit, it comprises arithmetic processing means for monitoring the operating state of each electronic control unit ,
The arithmetic processing means refers to an operation state list obtained by recording the operation state of each electronic control unit corresponding to the power supply state switching of the vehicle, and the electronic control unit determined to be in the operation state should not operate. The operation monitoring unit is characterized by stopping the operation of the electronic control unit .

  According to the above configuration, when the message receiving unit receives a message transmitted to the in-vehicle LAN, the arithmetic processing unit determines the operating electronic control unit that transmitted the message using the identification information given to each message. be able to. And the arithmetic processing means can confirm whether the electronic control unit which needs to operate | move at each time is surely an operation state.

Message sending means for sending an operation confirmation message to each electronic control unit;
It is preferable that the operation state of the electronic control unit is monitored by receiving a transmission message from the electronic control unit in response to the operation message. That is, the operation of each electronic control unit is immediately performed without waiting for each electronic control unit to send a message according to its own needs by the message transmitting means on the operation monitoring unit side actively transmitting an operation confirmation message. The status can be monitored.

In the present invention, a plurality of electronic control units are connected via a transmission line, and a logical ring is constructed between each electronic control unit in an operating state, and a cyclic message is circulated within the logical ring. An operation monitoring unit connected to a vehicle-mounted LAN via a transmission line, message receiving means for receiving a cyclic message transmitted from all the electronic control units, and the cyclic message received by the message receiving means from the identification information of the electronic control unit identification assigned to, together determine the electronic control unit is in operation that sent the該巡times message, an arithmetic processing means for monitoring the operating state of the electronic control unit,
The arithmetic processing means refers to an operation state list obtained by recording the operation state of each electronic control unit corresponding to the power supply state switching of the vehicle, and the electronic control unit determined to be in the operation state should not operate. The operation monitoring unit is characterized by stopping the operation of the electronic control unit .

  The in-vehicle LAN that constructs the logical ring transmits and receives so as to circulate a cyclic message between the operating electronic units. At this time, when the message receiving means receives the cyclic message transmitted to the in-vehicle LAN, the arithmetic processing means can determine the electronic control unit in operation using the identification information given to the cyclic message. When the arithmetic processing means confirms that the cyclic message is stably transmitted and received, the arithmetic processing means can only confirm whether or not the electronic control unit that needs to operate in this stable state is surely in the operating state. It can be confirmed that the electronic control unit that should have stopped is surely stopped.

  The arithmetic processing means determines that the logical ring is in a stable state when the cyclic message is received once after the activation notification message for constructing the logical ring is received from the electronic control unit. It is preferable. That is, an electronic control unit that starts when the power state of the vehicle is switched and an electronic control unit that stops are generated. When the electronic control unit is activated, an activation notification message is transmitted to join the logical ring of the in-vehicle LAN, and the newly activated electronic control unit is added to the logical ring. That is, since the activation notification message is transmitted from each electronic control unit for a while after the power supply state is switched, the message receiving unit receives the activation notification message.

  The arithmetic processing means determines that the logical ring is in a stable state at the time of receiving at least a cyclic message that circulates all electronic control units in operation after receiving this activation notification message. It is possible to more reliably detect the electronic control unit and the electronic control unit in the stopped state.

The in-vehicle LAN includes a plurality of segments obtained by grouping the transmission line and the electronic control unit, and a gateway that relays messages between the segments,
The message receiving means and the arithmetic processing means are provided in the gateway,
The message receiving means is connected to each transmission line constituting each segment,
It is preferable that the arithmetic processing means is for monitoring the operating states of the electronic control units belonging to the segments.

  By providing the gateway with an operation monitoring function, it is possible to monitor the starting state or the stopping state of each ECU grouped in a plurality of segments by one arithmetic processing means. In addition, since the basic configuration of the gateway includes message receiving means connected to each transmission line so as to be able to receive messages, and arithmetic processing means, the operation monitoring unit is formed in the gateway, thereby monitoring the operation. The unit can be formed at low cost.

As described above, the arithmetic processing means refers to the operation state list obtained by recording the operation state of each electronic control unit corresponding to the state of the vehicle, and switches the vehicle state using the list. The electronic control unit that should operate is monitored, and when the operating electronic control unit is different from the one shown in the list, an abnormality is detected , and processing is performed so that the list is operated. That is, a more reliable operation can be performed by monitoring the operation state of the electronic control unit using a list of the electronic control unit that should operate according to the power supply state of the vehicle and the electronic control unit that should be stopped. .

  As described above, according to the present invention, since the operation state of each electronic control unit is monitored using the message transmitted from the electronic control unit to the vehicle-mounted LAN, the electronic control unit that should not operate sends a message to the vehicle-mounted LAN. At the time of transmission, it can be monitored that this electronic control unit is activated due to some abnormality. Therefore, it is possible to immediately confirm the situation in which the power consumption of the power source is being raised without interruption, and to stop the electronic control unit. Conversely, since it can be confirmed that the electronic control unit that should be operating is in a stopped state, it is also possible to activate the electronic control unit or warn of the discovery of an abnormality.

Embodiments of the present invention will be described with reference to the drawings.
1 to 5 show a first embodiment of the present invention.

  As shown in FIG. 1, the operation monitoring unit 1 of the first embodiment is directly connected to a plurality of electronic control units (ECUs) 2 to be monitored for operation states via a transmission line 3. 4 is a battery mounted on the vehicle, 5 is a + B power line that is always connected to the battery 4, and 6 is an ignition switch 7 (such as a power supply state changeover switch that is switched by turning the ignition key). An ACC power supply line connected to the battery 4 at a certain time. In the following description, when distinction is necessary, the ECU 2 is shown with reference numerals 2A, 2B. ECU2A, 2B, 2C... Are always supplied with power by the + B power line 5 and always operate, and ECUs 2D, 2E, 2F... Are operated by power supplied by the ACC power line power line 6 when the ignition switch 7 is in the accessory state. It is configured.

  8 is an in-vehicle LAN including the plurality of ECUs 2A, 2B... And one transmission line 3 that connects these ECUs 2A, 2B... To each other so as to be able to transmit and receive, and each ECU 2A, 2B. The example which comprises the segment Sa of one vehicle-mounted LAN8 by connecting by the line 3 is shown.

  The operation monitoring unit 1 also functions as the gateway G, and when the in-vehicle LAN 8 is formed by dividing each segment Sa ... (only one segment Sa is shown in FIG. 1), each segment Sa ... It is possible to relay messages between them. Therefore, when the relay function of the operation monitoring unit 1 is described in the following description, this member may be expressed as a gateway G.

  As shown in FIG. 2, the operation monitoring unit 1 and the ECU 2 are provided with in-vehicle LAN communication means 10 and 20 for transmitting and receiving messages conforming to in-vehicle LAN standards such as CAN, for example. It constitutes an in-vehicle LAN bus conforming to CAN (hereinafter referred to as a CAN bus). Further, the in-vehicle LAN communication means 10 on the operation monitoring unit 1 side includes ports 10a, 10b,... According to the number of segments Sa, Sb,.

  The in-vehicle LAN 8 may be an in-vehicle LAN such as LIN and FlexRay (registered trademark) as well as CAN, and can be set freely such as different for each segment Sa,.

  Further, since the in-vehicle LAN communication means 10 has a function of receiving and transmitting a message transmitted / received via the transmission line 3, it also operates as a message receiving means 10r and a message transmitting means 10s.

  Reference numerals 11 and 21 denote arithmetic processing means such as a CPU connected to the in-vehicle LAN communication means 10 and 20 in the operation monitoring unit 1 and the ECU 2, respectively. The compliant interface programs P1 and P2 are executed. Reference numeral 12 denotes recording means provided in the operation monitoring unit 1, and the recording means 12 records an operation state list T indicating the operation states of the ECUs 2 according to the state of the power source.

  As shown in FIG. 3, the operation state list T is a list showing a correspondence relationship between the power state S (Ron, Racc, Roff) and the logical ring R (Ron, Racc, Roff). FIG. 3 shows an example in which the power supply state S includes three power supply states of “IG-ON”, “IG-ACC”, and “IG-OFF”, but the present invention is limited to this point. It is not a thing. 1 and 2 omit the illustration of the ON power supply line in the state “IG-ON” in which the ignition key is turned to the ON position in order to simplify the drawings.

  The interface programs P1 and P2 differ depending on the CPUs 11 and 21 that execute the interface programs and peripheral hardware configurations. That's it. Also, the same code P2 is hidden in the OSEK / COM interface program, and this is called the COM interface P2.

  Further, P3 is an operation monitoring program executed in the arithmetic processing means 11 in the operation monitoring unit 1, and the operation monitoring program P3 uses the NM interface P1 to connect the ECUs 2 ... constituting the logical ring of the OSEK. By receiving the cyclic message transmitted and received so as to circulate in the network, the status of the in-vehicle LAN 8 is confirmed using the identification information given to the cyclic message that circulates in the logical ring. P4 is an application program for executing relay processing and the like necessary for the operation monitoring unit 1 to function as the gateway G. Similarly, P5 is an application program for the ECU 2 to perform each operation.

  The OSEK / NM logical ring R is dynamically changed when each ECU 2 connected to one segment of the in-vehicle LAN 8 is started or stopped, and circulates in the logical ring R when the state of the ECU 2. The patrol message is also stable.

  FIG. 4 is a diagram for explaining the time elapsed until the OSEK logical ring R is stabilized. By using the OSEK / NM, as shown in FIG. 4 (A), when the three ECUs 2... Feed are started at the time t0 and the ECUs 2 are activated at the times t1, t2, and t3, the activated ECUs 2. Transmits activation notification messages Ma11, Ma12, Ma21, Ma31 requesting participation in the in-vehicle LAN 8, respectively, whereby each of the ECUs 2 ... confirms the operation state of the other ECUs 2, and the operation state at every predetermined time interval Δt. The circulating messages Mr01, Mr02,...

  A stable logical ring R can be formed at the time t4 when the cyclic messages Mr06 to Mr08 are received at least once for all the ECUs 2 that are operating after the activation notification message Ma31 is not received. 4 (A) and 4 (B), for the sake of simplicity, the logical ring R is composed of three ECUs 2 with identification information “1”, “2”, and “3”, respectively. Although the example which forms this is shown, it cannot be overemphasized that this invention is not limited to this point.

  Further, as shown in FIG. 4B, in the in-vehicle LAN 8 that performs network management using OSEK / NM, the power supply state is switched at the time t5, and the ECU 2 connected to the in-vehicle LAN 8 stops at the time t6. For example, when leaving the vehicle-mounted LAN 8, the activation notification messages Ma22 and M32 are transmitted again from the ECUs 2 that are continuously operating at the time t7 when the maximum time interval Δtmax has elapsed since the circulation message Mr12 was transmitted. Then, at the time t8 when the cyclic messages Mr14 to Mr15 that make a round of at least all of the operating ECUs 2 are received, a new stable logical ring R can be formed except for the ECU 2 that has left the in-vehicle LAN 8.

  Next, the operation of the operation monitoring program P3 for monitoring the in-vehicle LAN 8 using the logical ring R will be described with reference to FIG. The operation monitoring program P3 is executed when the power supply state is switched.

  S1 is a step of determining whether or not the logical ring R is stable. A guideline for determining that the logical ring R is stable is that at least operation after the activation notification messages Ma11,..., Ma21,. This can be done depending on whether or not a round message Mr01, Mr02,. Then, the process of step S1 is repeated until the logical ring R is stabilized.

  In the processing of step S1, when the message receiving means 10r receives the circular message Mr01..., The identification information of the ECUs 2 included in the logical ring R is stored using the identification information of the cyclic message Mr01. In the determination of the stable state in step S1, it is possible to compare the time after switching the power supply state with a predetermined time.

  S2 is a step of comparing the logical ring R with the operation state list T. That is, an example of the identification information of the ECU 2... That is currently stably operating from the identification information of the cyclic message Mr 01... Received in the logical ring R determined to be stable in the step S 1. This is a step for comparison with the logical rings Ron, Racc, Roff in the current power supply states Son, Sacc, Soff shown in FIG.

  S3 is a step of determining whether or not the comparisons in step S4 match. If they match in step S3, the operation state of each ECU 2... Is the same as the operation state list T, and therefore there is no abnormality, so step S4 is executed. On the other hand, if it is determined in step S3 that they do not match, either the ECU 2 that should be in the operating state is not operating or the ECU 2 that should be in the stopped state is not stopped. The process jumps to step S7 described later.

  S4 is a step of setting a timer for periodically monitoring the logical ring R. By monitoring the logical ring R at each time interval set in S4, it is possible to monitor the ECUs 2 that are started or stopped due to a malfunction that starts regardless of the switching of the power supply state S.

  S5 is a step of determining whether or not the time set in step S4 has elapsed. This step S5 is repeated until time is up.

  S6 is a step of determining whether or not the CAN bus 3 to be monitored is in an operating state. That is, when the CAN bus 3 is in a stopped state, since all the ECUs 2... Connected to the CAN bus 3 are in a stopped state, it is not necessary to perform the processing after the step S2, so that the step S4 is performed. Return and repeat the process.

  S7 is a step that is executed when the logical ring R does not match the operation state list T in step S3, and is a step that determines whether or not the power management is being controlled. If it is determined in step S7 that the power management is not performed, it can be determined that the ECU 2 is abnormally started or stopped, and the process jumps to step S10 described later.

  S8 is a step that is executed when it is determined in step S7 that the power management is performed, and the power management state is investigated. That is, for example, the ECU 2 for power management is accessed, and the ECU 2 that is currently controlled to be stopped by power management is investigated.

  S9 is a step in which it is determined whether or not the abnormally operating or abnormally stopped ECU that has been found not to match the list T in step S2 is operating differently from the normal state by power management. That is, when all ECUs determined to be abnormal in step S2 are under power management, the ECU jumps to step S4 instead of treating the ECU as abnormal. On the other hand, if any one of all ECUs determined to be abnormal in step S2 is under power management, this is determined to be abnormal and the process of step S10 is executed.

  S10 is a step of outputting abnormality information of the ECUs 2. That is, the information of the abnormally activated or abnormally stopped ECU 2... Is displayed on the display unit or meter display unit of the car navigation system or the sound of the warning sound is recorded, the abnormally activated or abnormally recorded ECU 2. Output of a command for stopping the activated ECU 2... And output of a command for performing power control for restricting power supply to the ECU 2. it can.

  By providing the operation monitoring unit 1 configured as described above in the gateway G, it is possible to monitor the operation of the ECUs 2 in the segments Sa, Sb,. Further, since the gateway G includes the existing message receiving means 10r connected to each CAN bus 3 and some arithmetic processing means 11, there is an advantage that the operation monitoring unit 1 can be formed by adding software.

  However, it goes without saying that the operation monitoring unit 1 can be formed by hardware different from the gateway G.

  6 and 7 show a second embodiment of the present invention. The operation monitoring unit 30 shown in FIG. 6 is different from the operation monitoring unit 1 of the first embodiment shown in FIGS. 1 to 5 in that the in-vehicle LAN 8 does not include an interface program corresponding to OSEK / NM. Therefore, the operation monitoring program P6 executed by the arithmetic processing unit 11 is configured to receive a message from the message receiving unit 10r without going through an interface program corresponding to OSEK / NM.

  In addition, the operation monitoring program P6 transmits an operation confirmation message Ms (called an alive message) to the CAN bus 3 via the message transmission means 10s in order to confirm the operation of each ECU 2. The reception confirmation message Mr is received.

  7, S20 is a step of transmitting the operation confirmation message Ms, and S21 receives a reception confirmation message Mr transmitted by each ECU 2... In response to the reception of the operation confirmation message Ms. This is a step of comparing the identification information given to the message Mr with the operation state list T. As a result, it is possible to confirm all the ECUs 2 in an operating state when the operation confirmation message Ms is transmitted.

As shown in this embodiment, even if the in-vehicle LAN 8 does not construct a logical ring such as OSEK, each ECU 2 receives a message transmitted to the transmission line, and identification information given to the message , The arithmetic processing means 11 can discriminate the ECUs 2... In the operating state and monitor the operating state of each electronic control unit.
In addition, since another structure and effect are the same as that of 1st embodiment, the same code | symbol is attached | subjected and the description is abbreviate | omitted.

  In addition, since the first embodiment and the second embodiment described above are examples in all respects, the present invention is not limited to the configuration of each embodiment described above. Rather, the scope of the present invention is defined by the terms of the claims, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims. That is, as long as the effects of the present invention are obtained, other components may be included.

It is a figure which shows the structure of the vehicle-mounted LAN monitored using the operation | movement monitoring unit concerning 1st Embodiment. It is a figure which shows the said operation | movement monitoring unit. It is a figure which shows the example of the operation | movement state list which the said operation | movement monitoring unit uses. It is a figure explaining the process in which the logical ring of OSEK is formed. It is a figure explaining operation | movement of an operation | movement monitoring program. It is a figure which shows the operation | movement monitoring unit concerning 2nd Embodiment. It is a figure explaining operation | movement of the operation | movement monitoring program in the said operation | movement monitoring unit.

Explanation of symbols

1,30 Operation monitoring unit 2 ECU
3 Transmission line 8 In-vehicle LAN
10r Message receiving means 10s Message sending means 11 Arithmetic processing means G Gateway R Logical ring T Operational state list Mr01, ... Cyclic message Ma11, ... Start notification message P4, P6 Operation monitoring program

Claims (6)

An operation monitoring unit connected via a transmission line to an in-vehicle LAN connected to a plurality of electronic control units,
A message receiving means for receiving a message transmitted from all the electronic control units ; and an operating state in which the message is transmitted from identification information for identifying an electronic control unit attached to each message received by the message receiving means. Along with discriminating the electronic control unit, it comprises arithmetic processing means for monitoring the operating state of each electronic control unit ,
The arithmetic processing means refers to an operation state list obtained by recording the operation state of each electronic control unit corresponding to the power supply state switching of the vehicle, and the electronic control unit determined to be in the operation state should not operate. The operation monitoring unit is characterized in that the operation is stopped when it is an electronic control unit. A message transmitting means for transmitting an operation confirmation message to each of the electronic control units is provided, and the operation state of the electronic control unit is monitored by receiving a transmission message from the electronic control unit in response to the operation confirmation message. Item 2. The operation monitoring unit according to Item 1. For an in-vehicle LAN in which a plurality of electronic control units are connected via a transmission line, and a logical ring is constructed between each electronic control unit in an operating state and a cyclic message is circulated in the logical ring. An operation monitoring unit connected via a transmission line, a message receiving means for receiving a cyclic message transmitted from all the electronic control units, and an electron attached to the cyclic message received by the message receiving means From the identification information for control unit identification , the electronic control unit in the operating state that transmitted the cyclic message is determined , and includes an arithmetic processing means for monitoring the operating state of each electronic control unit ,
The arithmetic processing means refers to an operation state list obtained by recording the operation state of each electronic control unit corresponding to the power supply state switching of the vehicle, and the electronic control unit determined to be in the operation state should not operate. The operation monitoring unit is characterized in that the operation is stopped when it is an electronic control unit.   The arithmetic processing means determines that the logical ring is in a stable state when the cyclic message is received once after the activation notification message for constructing the logical ring is received from the electronic control unit. The operation monitoring unit according to claim 3. The in-vehicle LAN includes a plurality of segments obtained by grouping the transmission line and the electronic control unit, and a gateway that relays messages between the segments,
The message receiving means and the arithmetic processing means are provided in the gateway,
5. The message receiving unit according to claim 1, wherein the message receiving unit is connected to each transmission line constituting each segment, and the arithmetic processing unit monitors an operating state of an electronic control unit belonging to each segment. The operation monitoring unit according to any one of claims. The arithmetic processing unit refers to the operation status list, if no message is received from the electronic control unit to operate in accordance with the power supply switching state, in which activates the electronic control unit請 Motomeko The operation monitoring unit according to any one of claims 1 to 5.

Images