JPH0392039A - Method of detecting trouble and/or trouble position in data transmission - Google Patents

Abstract

PURPOSE: To detect a fault and a fault position by the use of a software by inspecting whether or not a status change is generated due to a signal within a previously determined time after sending the signal, and outputting a fault message when the status change is not generated. CONSTITUTION: When a CPU 5 corresponding to a controller area network(CAN) unit 6 in a control equipment 4 sets up a reset instruction, the state of a control register 8 is turned to a value '1'. When the CAN unit 6 is driven without troubles, a status register 9 is turned to reset status within a prescribed time RZ. When it exceeds the reset time RZ up to the reset status, a fault exists in the CAN unit 6. A reset process is executed numerous times over plural loops, and when time is required more than the reset time in each loop, a fault message is transmitted. Consequently inspection related to the software-wise reset possibility of the CAN unit 6 can be executed.

Description

DETAILED DESCRIPTION OF THE INVENTION Field of Industrial Application The present invention relates to a CAM
(Controller Aera IJetvror
The present invention relates to a fault detection method and/or fault location detection method during data transmission via a circuit network such as k).

BACKGROUND OF THE INVENTION Various disturbances occur during data transmission over circuit networks designed as conventional data buses.

SUMMARY OF THE INVENTION The present invention relates to fault detection and fault location detection in data transmission of the above type.

Means for Solving the Problems and Effects of the Invention The method of the present invention having the configuration described in the characteristic part of claim 1 enables inspection of faults during data transmission, fault detection and fault position detection using software. becomes possible. This software fault detection does not require any separate costs and can therefore be installed in a particularly simple manner.

The basic principle of various fault detections described in detail below is that after a signal is sent, a check is made to see if a state change has occurred due to this signal within a predetermined time, and if no state change has occurred, a fault is reported. The purpose is to send a message. That is, if no response to the event occurs within a predetermined period of time, which depends on predetermined criteria, this is attributed to a failure preventing correct data communication.

The method of the invention is particularly suitable for applications in automotive electronics. A circuit network, which is designed, for example, as CAM-EUS, connects the various devices of the motor vehicle, in particular the control equipment. These control devices cooperate with appropriate sensor sensors to provide computer control with actual operating state data, which can be matched to the operating state of, for example, an internal combustion engine in a motor vehicle (e.g. ignition angle, ignition point, fuel injection time, etc.). Used for detection and processing. Regarding current automobile electronic technology, automobiles use the aforementioned CAM
, has many control devices of this type connected to each other for data exchange via BUS. These control devices will hereinafter be referred to as "subscribers". Each subscriber has a central processing unit (cpa), e.g. OAN
- It further comprises a BUS unit with a CAM unit forming an interface between the serial BUs such as BO8 and other equipment of the subscriber. The BU day unit is
A processor (MP = Inter-f) that substantially constitutes the central processing unit (CPU) for the BU8 unit
ace Management Prozessor)
has. BOB unit. It has a control register and a status V register. The state of the control register (B TO) indicates whether control is being performed by the (!PU or the control device. If the control register BIT Q has the state "1", this state is set. In other words, a reset request is made.

This request is necessary, for example, when starting the motor vehicle in order to establish a predetermined state. The state of the status register of the BUS unit indicates which operating state the BUS unit is in. Next, this will be explained in detail.

In one embodiment of the invention, the signal is optionally sent out one more time if no change of state has occurred. This measure, which is advantageously controlled/repeated by the program, increases the reliability of the fault report. A fault exists if there is always no change in the operating state after 1/'4i signal exits.

In another embodiment of the invention, in order to check the resetability of the BUS unit, the signal is sent to the central processing of one of the control equipment, which sets the reset status of the status V register of the BU3 unit. This is a reset command set in the device. In order to obtain the desired state, the BU8 unit must be reset,
This is done by a command to reset CPυ of the control device. By setting the reset request, bit 0 of the control register takes on the value "'1". In the present invention, it is checked in the status register whether the reset status has been set after a predetermined time. This predetermined time is referred to as a reset time in the present invention.

The reset time depends on many factors, namely on the one hand the BU
8 unit clock cycles and/or BU on the other hand
It depends on the respective clock cycle of the central processing unit which causes the S unit to respond. Furthermore, reset time Bt7T
It may also depend on the current operating state of the unit. When a CPH reset request is made and the BTITB unit stops transmitting, this transmission is not interrupted immediately, but rather waits for the transmission to complete before bit 0 (reset status of the status V register) is set. . Therefore, the 6-hour delay caused by waiting for this transmission to complete must be taken into account when determining the reset time. If it is not present in the reset status register within the reset time, a failure in the RUS unit 7 is signaled. be done.

If a software enablement of the BUS unit takes place (this refers to its subsequent rejoining of the serial BUS after a reset request), after this reset command, the reset status is changed to the processor ( It is checked whether it has been released again by the engineering MP). In this case too, the enabling time depends on various factors, in particular the clock cycles of the BUS unit and/or the clock cycles of the central processing unit and/or the BUS unit.
It depends on the respective operating state (status state) of the Us unit and is determined accordingly. If the reset status is not released, a fault exists in the BUS unit.

Advantageously, the access prohibition of the central processing unit, which exists during the reception of one message and which has been given in advance by the processor, does not exceed the access prohibition time. A message is information, especially comprising an identifier and data. If the access prohibition exceeds the access time, correct operation of the BUS unit is not guaranteed. Access is prohibited to BUS, W knit clock cycle and /
Or it depends on the operating state (status register state) at each time.

Particularly advantageously, after the access prohibition of the central processing unit, an operation is carried out to set the transfer status of the disk resolution byte located corresponding to the corresponding communication object. c.
The correct operation of the BUS unit is not guaranteed unless the IMF performs the operation of setting the transfer status of the corresponding disk reset byte after the PU access prohibition is detected. In one embodiment, after the information is received via the serial BU 8, the server transfer status is set in the processor 2 server (MP) and the central processing unit (C!PU) is asked for the information. Clear the transfer status and receive the information data. A check is made for the presence of a forwarding status for at most two consecutive queries within the query time of the central processing unit, and the query time is equal to or less than two! lm It is shorter than 1/2 of the minimum time between the next beginning or end of information. If this condition is followed, the operation is correct. However, if the transfer status is detected again after a subsequent or third interrogation, a fault exists. Therefore, if the CPU software sequentially operates the receiver many times (where multiple times is greater than two times), it will depend on the time ratio of the information to detect erroneous operations. be able to.

The reception of the information transmitted by one BUS subscriber is confirmed by the other BUS subscriber, and if there is no confirmation of receipt, the information is transmitted again and the counter status of the failure counter is increased each time. If the counting state exceeds a predetermined value (failure counting state), a fault status is set in the BUS unit.

If there is no reset status after the previously transmitted information, the transfer status is not set and at the same time there is no failure status. Correspondingly, the transfer status of previously sent messages is checked in a time loop. Since this transfer status is not set and the fault counter does not assume its fault counting state even with repeated transmissions, the fault status is not set and there is no possibility that the status register of the Bt7S unit has a reset state. If it does not exist, the operation is incorrect. The above-mentioned timerude must be well designed.

As described above, if there is no confirmation of reception even after transmitting information, the information is always transmitted again and the count state of the failure counter increases. In this case, first of all a fault counting state is reached which leads to a fault status being reset by the processor (MP). Then, since more than one transmission is not confirmed, the failure counter reaches a higher counting state, i.e. BU8.
When the counting state is reached, this is it! 7 BUS status is set. That is, the BUEI count state is as large as the failure count state. However, although there is a failure counting state, B
If there is no US count status and no transfer status, communication is blocked due to a "cable break." A BUS cable disconnection message is sent.

Advantageously, faults in a BUS connection between a number of subscribers are located by checking, at one BUEI subscriber, the transfer status corresponding to each other subscriber.

Based on the knowledge of the BUS cable distribution (subscriber distribution), in the event of a cable break, the Kadel break position can be detected, and the cable break position is always located between active subscribers. An active subscriber is a subscriber who is able to check the transfer status associated with the corresponding communication object.

Advantageously, a BU8 connection short circuit fault message is performed if there are multiple set BUS statuses within one time slot. For example, a fault that occurs in electromagnetic compatibility can certainly be caused by a BUS status being set, but this usually does not occur in sequence over many times. stomach. In this case, it can be assumed that there is a bus failure (short circuit in the C!AM cable).

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows a circuitry 1 installed in a motor vehicle. This circuit network is called CAM (Controller Aera).
Network). The CAM has a serial bus 2 leading to a number of subscribers 3. The subscriber 3 is configured as a control device 4 . - The subscriber 3 receives driving state data etc. via sensors (not shown) and processes these data to set operating points for various devices in the vehicle. For example, ignition operation (ignition point, fuel injection time, ignition angle, etc.)
is determined depending on the parameters of the species. Each control device 4 has a central processing unit 5, a so-called CPU. Furthermore, each control device 4 has a CAN unit 6. Each CAN
Unit 6 is the IMF
A processor 7 called element Prozeaeor.
has. The IMF thus constitutes a central processing unit for each CAM unit 6. Sarah K each c
The aN unit has a control register 8 and a status register 9.

FIG. 2 shows a flowchart for software fault detection in the network 1.

A check is made regarding the possibility of a software reset of one of the CAN units of the CAM units 6. This makes it possible to detect the fault position in the fi (!AN unit 6).If the corresponding control device 4 fails, the CPU corresponding to the CAM unit 6 receives the reset command RB.
(reset request), and the corresponding control register 8's B TO is set to the value "'1".
Take.

If the CAM unit 6 operates without any problems, the status register 9 of the CAN unit 6 must assume a reset status within a predetermined time. Reset time R
The predetermined time, designated as Z, is determined depending on various factors. This time depends on the CAN unit} 5(D clock cycle and/or the clock cycle of the CPU operating this CAN unit 6. Furthermore, there is a dependence on the respective operating state of the (!AN unit 6). That is, there is an influence due to the internal state of the OAli unit 6. For example, during a transmission, the setting by the reset command RB is not performed directly, since this setting ends the transmission.

This must be taken into account when determining the reset time RZ. If the reset time RZ is exceeded to achieve the reset status, a fault exists in the CAM unit 6.

To obtain high reporting reliability, the reset process is performed multiple times in 9 loops. If the reset time RZ is not exceeded no matter which loop the button is pressed, a fault message is sent. Naturally, this specification does not deal with failures caused by hardware, miswiring, or the like.

In FIG. 2, after the start 10, the loop counter first performs a counting operation in step 11, whereby the above-mentioned reset process is carried out many times. In the next step 12, the CAM unit 6 is reset. Next, a timeout counter is counted (step 13). The timeout counter determines the reset time RZ. In step 14, an inquiry is made as to whether, after resetting the CAM unit 6, the reset status has been counted within the operating time of the time-out counter, ie within the reset time RZ. When set within the reset time RZ, the CAM unit 6 operates without any trouble. Although it was not set within the reset time RZ,
However, if the reset time RZ has not yet elapsed, the question regarding the reset status is always asked again in step 7'15. When the timeout counter reaches a full count (step 16), the state of the loop counter is checked (step 1T). If the counting state of the Luso counter is one less than the previously given value, Luso 18 is executed, ie the CAM unit 6 is reset again.

To this end, the previously described steps (from step 12) are performed again. The CAM unit 6 has a fault if the Luso counter reaches a previously given value (state f17) and there is no reset status set.

The flowchart of FIG. 3 shows the software checking of the enable of one of the CAM units 6 after the setting (state "1") has first taken place. Therefore, enabling means rejoining CAM-BUS2 after reset. After a reset, that is, a 1 value entry of a reset command (reset-request; control register: MP).This predetermined period of time is determined by (!AN unit 6).
depends on similar factors as in the case of the above-mentioned software reset possibility. If this time exceeds the enable time, a fault exists in the CAM unit 6;
A corresponding fault message is therefore sent.

Again, the reset process is repeated many times.

FIG. 3 shows the counting operation of the loop counter in step 20 starting from start 19.

In step 21, the reset request is reset. Here, the timeout counter performs a counting operation, that is, the enabled time Fz is started (step 22). In step 23, before the end of the enable time FZ, it is checked whether the reset status has been reset. If the reset status is reset within the enable time yz, the CAN unit 6 operates without any problem. Enable time FZ has not ended yet,
If the reset status remains at the value "1", another interrogation is made in loop 24. If the enable time FZ ends without resetting the reset status (step 25), the loop counter 7'2
6 is executed and the test is performed again during each loop execution. If the Luso counter has counted bulls but the reset status remains at "1", there is a fault in the CAM unit 6.

In order to check the access prohibition of the CPH when a message is received, it is then checked whether a predetermined time has been exceeded. Access prohibition is restricted to the corresponding processor (engineering machine).
P) is given in advance. When access is prohibited, the CPU access of the corresponding communication target is "0".

“0” means prohibited. If the access prohibition time zz is exceeded (however, for access prohibition time 2.2, the corresponding C
The operation of the CAM unit 6 is incorrect (depending on the clock cycle and internal state of the AM unit 6). "Internal state" again refers to the operating state of the CAH.

The flowchart of FIG. 4 shows that after the start 27 there is an access prohibition in step f2B. Next, in step f29, the timeout counter performs a counting operation,
This starts υ access prohibition zz. Next, in step 30 it is checked whether the access prohibition has ended. If the access prohibition is not completed within the timeout (access prohibition time zz) (step 31), a failure exists.

Information sent by one subscriber 3 of the network 1 is acknowledged as "received" by the other subscriber 3. As a result, the transfer status is set as a correct confirmation. Therefore, the transfer status set operation must be interrogated to check for correct confirmation when preceded by a CPU access ban. Correct confirmation of the transfer status (setting operation) is performed by 1MP of the corresponding CAIJ unit 6. C'EU's access ban is ineffective
When detected by P (CPU access = 10”),
If the transfer status setting operation of the corresponding disk resolver byte is not performed, the CAN unit 6 is not operating correctly.

The flowchart of FIG. 5 clearly illustrates the test.

After the start 32, access is prohibited in step 33. After the access prohibition is released (step 34), a check is made to see if the transfer status of the corresponding disk resolver has been set (step 35). The aforementioned fault exists if the transfer status of the corresponding disk resolver is not set. Next, depending on the time between the two pieces of information (with the same identifier), check the correct confirmation (transfer status set) of the received message (data direction = "0') Figures 6a and 6b are used for this purpose.If the information is C!
When the signal is supplied to the CAM unit 6 of the control device 4 via the AN-Bus 2, the transfer status is set to the corresponding MP in the CAN unit 6.

The central processing unit (CPU) of the corresponding control device 4 processes the input information in a short period of time to query the data.
Access transfer status. In FIG. 6b, two pieces of information are input to the +m order. At the end of the first information, the transfer status is set to MP (arrow 36). When the CPU is interrogated a little later (time t1), the forwarding state (arrow 36) is cleared and the message is received.

The question is shown in A. During another interrogation by the CPU at time t2, the CPU receives nothing, since the interrogation has already been made and the transfer status has not been set.

This aforementioned condition is normal. At time t3, noting the interrogation that occurs for the first time after setting the transfer status (arrow 36), a clearing of the transfer status and an interrogation of the message take place. When the CPU is again interrogated at a slightly later point in time (time t4), the transfer status (arrow 36') previously set for the second announcement is cleared, and the corresponding Data is interrogated. This condition is also normal. But if the CPU interrogates again at time t5 (but the time between interrogations is always the same length, i.e. the time between t3 and t4 is equal to the time between t4 and t5) equal), in relation to the time (length of the information) between the information and the respective transmission time t8, it can be seen that in this case (at time t5) the transfer status was not set υ by the engineering MP. . In this case, a fault still exists if there is a set transfer status. Correct operation is not guaranteed.

In FIG. 6a the test is explained again on the basis of the illustrated flowchart. After the start 36, first a loop counter is set in step 37, then step f3
At B, the transfer status is set υ by the received message. In response to the CPH's inquiry, the transfer status is cleared in step 39. In step 40, a check is made whether the counting state of the Luso counter is less than the number to which loop 41 is being executed.

The loop counter must be given the value "2" in advance, since when interrogating the CPH it is not allowed to access the set transfer status only twice in sequence, as described above. Therefore, the number of running rules 7p41 must not be greater than the value "'2".

The aforementioned failure exists if the number of loops being executed is greater than two.

A check is then made for correct confirmation of the sent message (transfer status set). If one subscriber 3 sends information and this information is correctly received by the other subscriber, then this
Confirmed by The forwarding status of sending subscriber 3 is set. If the transfer status is not set, the transmission is repeated continuously. At each transmission cycle, the count state of the fault counter is incremented by one. When the counting state of the fault counter exceeds the fault counting state FB given in advance, the fault status is set (
failure status 2 “1”). If the reset status does not exist, the transfer status will not be set after the previously sent information, and at the same time, the failure message should actually exist because a large number of messages were sent as usual. This is done when there is no such thing. In this case, it must be ensured that no reset status exists.

FIG. 7 shows this operation. After the start 42, the information is sent (step 7' 43), and then the transmission is without confirmation in the time loop (step 44), so both the transfer status and the failure status must be set (step 45). and 46).

If the reset status does not exist in step f47, the operation is incorrect.

The next software fault detection method is OAN-BUS.
Regarding 2. Check CAM-BUS for cable breakage. If one BUS subscriber 3 no longer has a connection to any other subscriber 3, the sending subscriber will not have any confirmation regarding his message. This causes the counter state of the fault counter to increase as described above. In this case, the failure count state ys is exceeded.

The fault status is set by the engineering MP. If the counter state of the fault counter further increases to 1, the BUS status is set when it exceeds the previously given counter state (BUS counting state). If a fault status exists, however, the BUS status is not set, which is due to the fact that in the flowchart of FIG. If not, the transmission is automatically repeated (by MP).

Transfer status is not set (, sten f51
), but after the corresponding number of transmissions the failure status is set (step f52). Despite further transmissions, the BσS status (STETZO 53) is not set, so it can be assumed that a cable fault exists.

C! regarding cable failure! The inspection of the AN-BUS 2 is carried out between all subscribers 3 and the evaluation of the transfer status of the received messages
It can be done in such a way that it is done taking into account the knowledge about it. A cable break can be located by a properly operating subscriber 3 based on an estimate of the transfer status of this subscriber 3.

cAN-Bas 2 testing for short circuits can be performed. caN-Btrs 2 has three conductors, namely (
! ANL. CAMI{ , has earth. CANL
and the supply voltage and/or CANE! and/or between CANL and CANH.

BUS- is transmitted many times within one time slot.
A short circuit of the above type exists if a turn-off occurs and the possibility of faulty operation of the CAM unit has been ruled out by the tests described above.

The above will be explained again based on the flowchart of FIG. After the start 54, a loop counter is counted in step 55.

The Rogue counter is set to the value 0, for example.

In the next step 56 it is checked whether BUS-OFF is present. If there is a BUS-off, a check is made in step 57 as to whether the software is operating erratically and, in particular, as to whether access to the BUS is enabled again. A timer is then started at Stezzo 58. When the timer expires, the test is interrupted. However, if 4 BtTS-OFF is detected again within the timer operating time (step 59), the timer 60 is stored and the elapsed time between start and stop is determined, and this elapsed time is
1 and is compared with the threshold value.

If this elapsed time is smaller than the threshold a, step 63
The loop counter is incremented by "'1" and at the same time a check is made whether the value of the loop counter is less than a previously given threshold value b. If the loop counter is 9 less than the threshold b, the loop 62 is executed again;
BUS-off detection is performed again after the BU8 unit is brought into a state of joining the BUEI (on the sending and/or receiving side) by the corresponding CPU on the control equipment. By steps 58 and 60, it is possible to detect whether p, BtT8-off has occurred within a short time. A cable fault exists if this occurs very frequently, ie frequently and sequentially to a previously given threshold b.

[Brief explanation of drawings]

FIG. 1 is a delocking circuit diagram of a 3AN-BUS with many subscribers; FIG.
The figure is a flowchart for checking the software enablement of the CAM unit.
A flowchart diagram for checking access prohibition to the control central processing unit performed by the processor of the AM unit when receiving a message; FIG. FIG. 6a is a flowchart diagram for checking the correct confirmation of a received message; FIG. 6b is a time sequence diagram for the flowchart of FIG. 6a;
Figure 7 is a flowchart diagram for checking the correct confirmation of transmitted messages; Figure 8 is a diagram of the circuit network (CAN) B.
[Diagram for testing IEl connections, FIG. 9 is a flowchart diagram for testing CAN-BUS for short circuits. 1... Circuit network, 3... Subscriber, 4... Control equipment,
5... Central processing unit (OPU), 6... CAN unit, 7... Processor, 8... Control V register, 9... Status register. Obstacle Fig. 6b Disability

Claims (1)

[Claims] 1. Failure detection and/or failure detection during data transmission via a circuit network.
Or, in the fault location detection method, after sending the signal, it is checked whether a state change has occurred due to this signal within a previously given time, and if no state change has occurred, a fault message is reported. 1. A method for detecting faults and/or fault location during data transmission, characterized in that: