JP5098429B2 - Communications system - Google Patents

Description

  The present invention relates to a plurality of ECUs (Electronic Control Units) that control in-vehicle devices, two communication lines that are connected to each other by terminal resistors, and a connection that connects the plurality of ECUs and the two communication lines. The present invention relates to a communication system composed of lines.

Conventionally, it is composed of a plurality of ECUs for controlling in-vehicle devices, two communication lines that are connected to each other by terminal resistors, and connection lines that connect the plurality of ECUs and the two communication lines. For example, in a communication system such as a CAN (Controller Area Network), there is a technique for detecting a fault location, for example, as described in Patent Document 1. In this prior art, an arbitrary ECU of each ECU is designated as a monitoring node, another ECU is designated as another node, and a monitoring message is regularly transmitted from the other node to the monitoring node. Whether or not the monitoring node can receive the failure of each ECU or the disconnection of the communication line or the connection line is detected.
JP 2006-222800 A

  However, in such a conventional technique, when one of the high-voltage side or low-voltage side of the communication line or connection line between one other node and the monitoring node among other nodes is disconnected, The node sends a monitoring message in a situation where it cannot confirm that no other node is communicating and cannot obtain the right to send, and the monitoring message sent by the other node The monitoring message sent by other nodes other than the node is temporarily interrupted, and the monitoring node erroneously determines other nodes as faults even in a situation where no other node has failed. Problems arise.

  In addition, when the priority of the monitoring frame transmitted from one of the other nodes is low and there is a high-priority message transmitted from the other nodes, the latter high-priority message is transmitted. Therefore, even if the other node is normal, the monitoring frame cannot be transmitted, and the other node may erroneously determine that the other node is faulty.

  Considering such a case, it may be possible to set the monitoring message to a high-priority message. However, if another node regularly sends a high-priority monitoring message, this high-priority monitoring message is sent. A problem arises in that the message for use occupies the communication line and the vehicle control message necessary for vehicle control transmitted by the ECU other than the other nodes cannot be transmitted.

  In view of the above problems, an object of the present invention is to provide a communication system that can prevent erroneous determination of a failure without causing a problem that a vehicle control message necessary for vehicle control cannot be transmitted.

In order to solve the above problem, a communication system according to the present invention provides:
It comprises a plurality of control means for controlling the in-vehicle device, two communication lines that are connected to each other by a terminating resistor, and a connection line that connects the plurality of control means and the two communication lines. Then, the plurality of control means pressurize a predetermined signal voltage to the two communication lines to communicate a vehicle control message by a differential voltage between the two communication lines, and the plurality of controls. When one control means among the means transmits a failure confirmation message, and when the one control means designates control means other than the one control means in order and transmission of the failure confirmation message cannot be completed. The one control means transmits a failure confirmation special message having a higher priority than the vehicle control message.

  The communication system is, for example, a CAN (Controller Area Network), and the control means is an ECU (Electronic Control Unit) connected to the CAN.

  Here, when the control means other than the one control means can receive the special message for failure confirmation, the control means other than the one control means may cause a temporary failure of the one control means or the It is preferable to determine that the communication line or the connection line between the one control unit and the control unit other than the one control unit is temporarily disconnected or has a communication failure.

  The temporary failure refers to, for example, a failure in which the control means spontaneously recovers with or without the self-reset function and the phenomenon is not reproduced, and the temporary disconnection refers to natural recovery without repair, for example. This means a disconnection in which the phenomenon is not reproduced.

According to this, when one of the high-voltage side or the low-voltage side of the communication line or connection line between one control means and the other control means among the plurality of control means is disconnected, the one The failure confirmation message transmitted by the one control means is transmitted in a situation where the control means cannot confirm that no other control means is communicating and cannot obtain the transmission right. In a situation where the message is temporarily blocked by the failure confirmation message transmitted by other control means and the failure confirmation message cannot be transmitted, it is possible to prevent erroneous determination as follows. Moreover, the disconnection location can be easily identified.

  That is, when a control means other than the one control means can receive the special message for failure confirmation, a control means other than the one control means may cause a temporary failure of the one control means or the one A non-temporary failure occurs in the one control means by determining that the communication line or the connection line between the control means and the control means other than the one control means is temporarily disconnected or poor communication. It is prevented that the communication line or the connection line between the one control means and the control means other than the one control means is accidentally disconnected. can do.

  Further, by setting the failure confirmation special message to have a higher priority than the vehicle control message, the failure confirmation special message is transmitted with priority over the vehicle control message, and the plurality of control means If there is a high-priority vehicle control message transmitted by the other control means for the failure confirmation message transmitted by one of the control means, the latter high-priority vehicle control message is transmitted. In order to have the right, even if the one control means is normal, the failure confirmation message cannot be transmitted, and the control means other than the one control means is erroneously determined as a failure. Can be prevented.

  Further, only when the one control means cannot transmit the failure confirmation message, the failure confirmation special message having a high priority is regularly transmitted by transmitting the failure confirmation special message having a high priority. This failure-specific special message for failure confirmation occupies the communication line, and the vehicle control message transmitted by the control means other than the one control means cannot be transmitted. Can be eliminated.

  In addition, when a control means other than the one control means cannot receive the failure confirmation special message, the control means other than the one control means is not temporary of the one control means. It is preferable to determine that the communication line or the connection line between the one control unit and the control unit other than the one control unit is not temporarily broken.

  The non-temporary failure refers to, for example, a failure in which the control means does not naturally recover due to or without the self-reset function, and the non-temporary disconnection refers to natural recovery without repair, for example. It indicates a disconnection without any.

  According to this, by designating the one control means constituting the communication system in order, a non-temporary failure of the one control means or a control means other than the one control means and the one control means It is determined that the communication line or the connection line is not temporarily disconnected, and the failure location or the disconnection location can be specified. Therefore, replacement of the failed control means and repair of the disconnection location are appropriately performed. Can be implemented.

  ADVANTAGE OF THE INVENTION According to this invention, the communication system which can prevent the misjudgment of a failure, without causing the problem that the message for vehicle control required for vehicle control cannot be transmitted can be provided.

  The best mode for carrying out the present invention will be described below with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing an embodiment of a CAN to which a connection line disconnection detecting method of a communication system according to the present invention can be applied. FIG. 2 shows a driver inside each control means of the communication system according to the present invention. It is a schematic diagram which shows this circuit.

  The CAN according to the present invention includes a body ECU 1 (Electronic Control Unit), a window ECU 2, a wiper ECU 3, a seat ECU 4, a meter ECU 5, and two communication lines whose ends are connected to each other by terminal resistors R 1 and R 2. It comprises CANH, CANL, two communication lines CANH, CANL, and connection lines CH, CL for connecting the window ECU 2, the wiper ECU 3, the seat ECU 4, and the meter ECU 5.

  The body ECU 1 includes, for example, a CPU, a ROM, a RAM, and a data bus connecting them, and the CPU performs predetermined processing according to a program stored in the ROM, and is not shown based on opening / closing of a door switch (not shown). The on / off control of the courtesy lamp is performed, and the on / off control of the light is performed based on the operation of the light control switch (not shown), and when the IG on or ACC on, the door open, or the light control switch is operated, Control to send a message to another ECU is performed.

  The window ECU 2 includes, for example, a CPU, a ROM, a RAM, and a data bus connecting them, and the CPU performs predetermined processing according to a program stored in the ROM. Based on an operation of a master switch (not shown), the power window In addition to controlling the opening and closing of the vehicle, when a master switch is operated, a control for transmitting a vehicle control message to another ECU is performed.

  The wiper ECU 3 is composed of, for example, a CPU, a ROM, a RAM, and a data bus connecting them, and the CPU performs predetermined processing in accordance with a program stored in the ROM. Based on the operation of a wiper control switch (not shown), the wiper ECU 3 The motor is driven to operate the wiper, and when a wiper control switch is operated, control for transmitting a vehicle control message to another ECU is performed.

  The seat ECU 4 is composed of, for example, a CPU, a ROM, a RAM, and a data bus connecting them, and the CPU performs predetermined processing according to a program stored in the ROM, and is set by a user by a seat position memory switch (not shown). The seat is moved to the above position, and when a memory switch is operated, control for transmitting a vehicle control message to another ECU is performed.

  The meter ECU 5 includes, for example, a CPU, a ROM, a RAM, and a data bus connecting them, and the CPU performs predetermined processing in accordance with a program stored in the ROM, and vehicle information such as a vehicle speed and an engine speed is stored. In addition to displaying on a meter (not shown), control is performed to turn on the lamp of the meter based on a vehicle control message from the body ECU 1.

  The body ECU 1, window ECU 2, wiper ECU 3, seat ECU 4, and meter ECU 5 described above all pressurize the H signal to the communication line CANH via the connection line CH on the high-pressure side based on the command from the CPU. And a driver that pressurizes the L signal to the communication line CANL via the connection line CL, and a receiver that detects a differential voltage generated between the communication lines CANH and CANL as a signal. Communication is performed by transmitting and receiving signals including a vehicle control message and a failure confirmation message and a failure confirmation special message described later. In FIG. 1, only the CPU and driver are shown for convenience.

  The driver shown in FIG. 1 is represented by a circuit as shown in FIG. 2, for example, and the circuit on the side of the connection line CH is switches SW1 and SW2 made of MOSFETs, a voltage adjustment circuit 1, a CANH driver, and a transmission control circuit. As shown in FIG. 2, the circuit on the connection line CL side is configured by connecting the switches SW3 and SW4 made of MOSFETs, the voltage adjustment circuit 2, the CANL driver, and the transmission control circuit as shown in FIG. Is done.

  The CANH driver turns on the switch SW1 based on a command from the transmission control circuit based on a transmission signal from the CPU, presses the switch SW2 to pressurize the connection line CH, turns off the switch SW1, turns on the switch SW2, and turns on the connection line CH. Ground. The signal voltage applied to the connection line CH is adjusted to 3.5V or 2.5V by the voltage adjustment circuit 1.

  In the normal control mode, the CANL driver turns on the switch SW3 based on the command from the transmission control circuit based on the transmission signal from the CPU, turns off the switch SW4, pressurizes the connection line CL, turns off the switch SW3, and turns off the switch SW4. The connection line CL is grounded by turning it on. The signal voltage applied to the connection line CL is adjusted to 1.5V or 2.5V by the voltage adjustment circuit 2.

  In addition, the body ECU 1, the window ECU 2, the wiper ECU 3, and the seat ECU 4 of the present embodiment all regularly transmit a failure confirmation message in the normal control mode, and the failure confirmation message cannot be transmitted a plurality of times. In this case, the mode is shifted to the failure diagnosis mode, the transmission of the vehicle control message is stopped, and the failure confirmation special message having a higher priority than the vehicle control message is transmitted.

  The failure confirmation message and the vehicle control message have the same priority, and the failure confirmation special message is set to have a higher priority than the vehicle control message having a higher priority. That is, the body ECU 1, the window ECU 2, the wiper ECU 3, and the seat ECU 4 each constitute an ECU that is a control means.

  The priority of the failure confirmation special message is changed by changing the identification ID in the frame constituting the failure confirmation special message. In addition, the detection of the failure to complete the transmission of the failure confirmation message or the completion of the transmission is made when the CPU in the ECU driver completes the transmission of the frame data constituting the failure confirmation message in its own register. It detects by detecting.

  In addition, the detection of failure to complete the transmission of the failure confirmation message or the completion of the transmission may be detected by receiving the failure confirmation message transmitted by the ECU by itself, You may detect by notifying from the ECUN which received that the other ECUN has received the failure confirmation message which ECUN transmitted.

  Further, the meter ECU 5 of this embodiment constitutes a failure monitoring ECUM which is a control means other than one control means, and a failure confirmation message is received from any one of the body ECU1, the window ECU2, the wiper ECU3 and the seat ECU4. When it is not possible to receive a special message for failure confirmation, it is determined that the ECUN is temporarily broken, or that the communication line or connection line between the ECU and the failure monitoring ECUM is temporarily broken or poorly communicated. To do.

  In addition, when the meter ECU 5 of the present embodiment cannot receive a failure confirmation message from any one of the body ECU 1, the window ECU 2, the wiper ECU 3, and the seat ECU 4, and cannot receive a failure confirmation special message, It is determined that the ECUN is not a temporary failure or the communication line or the connection line between the ECUN and the ECUM is not a temporary disconnection.

  The control contents of the communication system according to the present invention described above will be described with reference to the flowcharts shown in FIGS. FIG. 3 is a flowchart showing the control contents of the ECU N of the communication system according to the present invention, and FIG. 4 is a flowchart showing the control contents of the failure monitoring ECU M of the communication system according to the present invention.

  In S1 of FIG. 3, it is determined whether or not the ECUN has detected uncompleted transmission of the failure confirmation message a plurality of times, and if it is determined that it has been detected a plurality of times, the process proceeds to S2, and if it is not determined that it has been detected a plurality of times Proceed to S7. Note that the incomplete transmission is detected a plurality of times in order to eliminate the influence of disturbance such as noise.

  In S2, the ECUN shifts to the failure diagnosis mode and proceeds to S3. In S3, the ECUN stops transmitting the vehicle control message transmitted in the normal control mode.

  Subsequently, in S4, the ECU transmits only the failure confirmation special message having a higher priority than the vehicle control message and proceeds to S5. In S5, the ECU confirms whether or not the failure confirmation special message has been successfully transmitted. If it is determined that the transmission was successful, the process proceeds to S6. If it is not determined that the transmission has been completed normally, the process returns to S2.

  In S6, the ECU returns from the failure diagnosis mode to the normal control mode, and proceeds to S7. In S7, N is incremented as N + 1. In S8, it is determined whether N> 4. If N> 4, the control is terminated. If N> 4, the process returns to S1, and the next. For the target ECUN, the processes of S1 to S6 are performed.

  Here, when N = 1, ECUN is body ECU1, when N = 2, ECUN is window ECU2, when N = 3, ECUN is wiper ECU3, and when N = 4, ECUN is seat ECU4.

  In S11 of FIG. 4, the failure monitoring ECU M determines whether or not the failure confirmation message from the ECU is normally received. If it is determined that the failure confirmation message has been normally received, there is no failure or disconnection. Therefore, the process proceeds to S16, and if it is not determined that the signal has been normally received, the process proceeds to S12.

  In S12, the failure monitoring ECU M determines whether or not the failure confirmation special message from the ECU N has been normally received. If it is determined that the failure has been normally received, the process proceeds to S13, and if it has not been determined that the failure has been normally received. Proceed to S15.

  In S13, the failure monitoring ECU M determines a temporary failure of the ECUN or a temporary disconnection or communication failure of the communication lines CANH, CANL or the connection lines CH, CL between the ECUN and the failure monitoring ECUM. The failure monitoring ECU M stores the temporary failure or disconnection time or the communication failure time together with the reception history of the failure confirmation message and the failure confirmation special message.

  In S15, the failure monitoring ECUM determines that the ECUN is not a temporary failure or that the communication lines CANH and CANL or the connection lines CH and CL between the ECUN and the ECUM are not temporary.

  In S16, the failure monitoring ECU M increments N = N + 1. In S17, it is determined whether N> 4. If N> 4, the control is terminated. If N> 4, N is not satisfied. Returning to S11, the processing of S11 to S15 is performed for the next target ECUN.

  After the processes of S11 to S15 are completed in N = 1 to 4, that is, in all target ECUs, in S18, the failure monitoring ECU M estimates the disconnection location from the determination result obtained from the above processes. The following method is used to estimate the disconnection location. 5 and 6 are block diagrams showing an example of a broken portion of the communication system according to the present invention.

For example, as shown in FIG. 5, when the connection line CL on the low pressure side of the body ECU 1 is disconnected, the body ECU 1 cannot transmit a failure confirmation message, and the body ECU 1 uses the window ECU 2, the wiper ECU 3, and the seat. There are cases where the transmission of the ECU 4 is obstructed and the failure confirmation message cannot be completely transmitted, causing a temporary communication failure.

  In this case, if N = 1 to 4 is incremented and the above-described processing from S11 to S15 is performed, the failure monitoring ECUM can receive both the failure confirmation message and the failure confirmation special message from the body ECU1. First, the failure confirmation message cannot be received from the window ECU 2, the wiper ECU 3, and the seat ECU 4, and the failure confirmation special message can be received.

  That is, it is determined that there is a non-temporary failure of the body ECU 1 or a non-temporary disconnection of the communication lines CANH, CANL or the connection lines CH, CL between the body ECU 1 and the failure confirmation ECU M, and the window ECU 2, the wiper ECU 3, and the seat Since it is determined that the communication is temporarily interrupted by the body ECU 1, the ECU 4 is disconnected at any of the connection lines CH and CL of the body ECU 1 or the communication lines CANH and CANL located between the body ECU 1 and the window ECU 2. It is estimated that.

  Alternatively, as shown in FIG. 6, when both the high-voltage side connection line CH and the low-voltage side connection line CL of the body ECU 1 are disconnected, the body ECU 1 cannot transmit a failure confirmation message, and the body ECU 1 The transmission of the window ECU 2, the wiper ECU 3, and the seat ECU 4 is not hindered by the ECU 1, and the transmission of the failure confirmation message can be completed, so that a temporary communication failure does not occur.

  In this case, if N = 1 to 4 is incremented and the above-described processing from S11 to S15 is performed, the failure monitoring ECUM can receive both the failure confirmation message and the failure confirmation special message from the body ECU1. The failure confirmation message can be normally received from the window ECU 2, the wiper ECU 3, and the seat ECU 4.

  That is, it is determined that there is a non-temporary failure of the body ECU 1 or a non-temporary disconnection of the communication lines CANH, CANL or the connection lines CH, CL between the body ECU 1 and the failure confirmation ECU M, and the window ECU 2, the wiper ECU 3, and the seat Since it is determined that the ECU 4 is normal and there is no disconnection or communication failure between the ECUs 2 to 4 and the failure confirmation ECU M, the ECU 4 is located on both the connection lines CH and CL of the body ECU 1 or between the body ECU 1 and the window ECU 2. It is estimated that both communication lines CANH and CANL are disconnected.

  As described above, the approximate location of the disconnection can be estimated. The actual form of disconnection of the communication lines CANH and CANL and the connection lines CH and CL is caused by the connector pins being buried in the connectors that are connected to each other, poor contact, or the like due to vibration of the harness. Since there is a disconnection due to interference, after performing the above-described estimation, repair is performed by replacing the connector or harness of the corresponding part.

  The determination result and the estimation result as described above may be displayed based on the control of the failure monitoring ECUM by providing a diagnosis screen in advance on the display or the like, or a dedicated diagnosis tool is connected to the CAN. Alternatively, it may be read out from the failure monitoring ECUM by a diagnostic tool.

  The determination and estimation as described above may be performed manually by a service person, and only the transmission and reception of the failure confirmation special message may be performed on the communication system side.

  According to the present embodiment described above, the following operational effects can be obtained. That is, when one of the high-voltage side connection line CH or the low-voltage side connection line CL of one ECUN is disconnected, it can be confirmed that no other ECUN is communicating with the failure monitoring ECUM. The failure confirmation message is transmitted in a situation where the transmission right cannot be obtained, and the failure confirmation message transmitted by one ECU is temporarily blocked by the failure confirmation message transmitted by another ECU. In a situation where a communication failure has occurred in which a confirmation message cannot be transmitted, erroneous determination can be prevented as follows.

  That is, when the failure monitoring ECU M can receive the failure confirmation special message, the communication line CANH, CANL or the connection line CH between the one ECU and the failure monitoring ECU M is temporarily damaged. By determining that the CL is temporarily disconnected or a communication failure, a non-temporary failure has occurred in the ECU, or the communication lines CANH, CANL or the connection lines CH, CL between the ECU and the failure monitoring ECU M It is possible to prevent erroneous determination that a non-temporary disconnection has occurred.

  Also, by setting the failure confirmation special message to have a higher priority than the vehicle control message, the failure confirmation special message is given priority over the vehicle control message, and the failure confirmation message transmitted by one ECU is sent to the failure confirmation message. If there is a high-priority vehicle control message transmitted by an ECU other than one ECUN, the latter high-priority vehicle control message has the right to transmit, so even if one ECUN is normal It is possible to prevent the failure monitoring ECUM from erroneously judging the ECUN as a failure without transmitting the failure confirmation message.

  In addition, only when one ECU cannot transmit a failure confirmation message, a high priority failure confirmation special message is transmitted at all times to regularly transmit a high priority failure confirmation special message. Along with this, it is possible to solve the problem that the high priority failure confirmation special message occupies the communication lines CANH and CANL and the vehicle control message transmitted by the ECUN other than one ECUN cannot be transmitted.

  In addition to this, when the failure monitoring ECUM fails to receive the failure confirmation special message, the ECUN constituting the communication system is specified in order, and the failure monitoring ECUM Since it is possible to identify the failure location or the disconnection location by determining that the communication line CANH, CANL or the connection lines CH, CL between the ECUN and the failure monitoring ECUM is not temporary, replacement of the failed ECU The repair of the broken part can be carried out as appropriate.

  Further, in S14 shown in FIG. 4, the failure monitoring ECU M stores the time of the temporary failure or disconnection or communication failure together with the reception history of the failure confirmation message and the failure confirmation special message. It can be possible to estimate whether the cause of the temporary failure is any one of disconnection of the harness, poor fitting of the connector, and failure of the ECU.

  Note that the combinations of ECUs in the communication system described above are merely exemplary, and are not limited to the combinations described above, and the number of connected ECUs is not limited to four, but other numbers. It is also possible. Further, the failure monitoring ECU M can be an ECU other than the meter ECU 5, or a failure monitoring ECU.

  Although the preferred embodiments of the present invention have been described in detail above, the present invention is not limited to the above-described embodiments, and various modifications and substitutions are made to the above-described embodiments without departing from the scope of the present invention. be able to.

  In addition, although CAN is shown as a communication system to which the present invention can be applied, any communication system having a control unit that pressurizes a predetermined signal voltage to two communication lines and communicates with a differential voltage between the communication lines. The present invention can be applied.

  The communication system according to the present invention can provide a communication system that can prevent erroneous determination of a failure without causing a problem that a vehicle control message necessary for vehicle control cannot be transmitted. It is useful when applied to various vehicles.

1 is a block diagram showing a communication system according to the present invention. It is a schematic diagram which shows the circuit inside the driver of the communication system which concerns on this invention. It is a flowchart which shows the control content of the communication system which concerns on this invention. It is a flowchart which shows the control content of the communication system which concerns on this invention. It is a block diagram which shows an example of the disconnection location of the communication system which concerns on this invention. It is a block diagram which shows an example of the disconnection location of the communication system which concerns on this invention.

Explanation of symbols

ECU1 Body ECU
ECU2 Window ECU
ECU3 Wiper ECU
ECU4 Seat ECU
ECU5 Meter ECU
CANH communication line CANL communication line R1 Termination resistor R2 Termination resistor CH Connection line CL Connection line

Claims (3)

It comprises a plurality of control means for controlling the in-vehicle device, two communication lines that are connected to each other by a terminating resistor, and a connection line that connects the plurality of control means and the two communication lines. Then, the plurality of control means pressurize a predetermined signal voltage to the two communication lines to communicate a vehicle control message by a differential voltage between the two communication lines, and the plurality of controls. When one of the means transmits a failure confirmation message and the one control means fails to complete the transmission of the failure confirmation message, the one control means controls other than the one control means. A communication system, wherein means are specified in order and a failure confirmation special message having a higher priority than the vehicle control message is transmitted.   When a control means other than the one control means has received the special message for failure confirmation, the control means other than the one control means may cause a temporary failure of the one control means or the one control. 2. The communication system according to claim 1, wherein the communication line or the connection line between the first control unit and the control unit other than the one control unit is determined as a temporary disconnection or a communication failure.   When a control means other than the one control means fails to receive the failure confirmation special message, a control means other than the one control means may cause a non-temporary failure of the one control means or the one 3. The communication system according to claim 1, wherein the communication line or the connection line between the control unit and the control unit other than the one control unit is determined as a non-temporary disconnection. 4.

Images