JPH11345217A - Fault detecting method at the time of inter-electronic controller communication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To surely detect a fault of a slave ECU (electronic controller) through information communication between a master ECU and the slave ECU. SOLUTION: Power is fed from a master ECU 1 to a slave ECU 2 through a power supply line 3. A transmission circuit 22 in the ECU 2 transmits data to a receiving circuit 12 of the ECU 1 through the line 3. A microcomputer 20 of the ECU 2 is reset by the power-on reset function and watch dog reset function of a power supply circuit 21 having a WDT(watch dog timer). In an operation after the reset, 1st specific information is transmitted from the ECU 2 to the ECU 1 to represent that the reset is performed. The ECU 1 counts the number of watch dog resets of the ECU 2 except the reception of the 1st specific information just after starting power supply, decides as a fault when it exceeds plural times that are previously defined and switches on a lamp 9, etc.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention detects a failure of an electronic control unit constituting a system based on communication information when a plurality of electronic control units operate as one system as a whole while performing information communication. The present invention relates to a failure detection method at the time of communication between electronic control devices.

[0002]

2. Description of the Related Art Conventionally, in an electronic control device using a microcomputer or the like, there is a possibility that an abnormal operation such as a runaway that deviates from a normal program execution state due to disturbance such as noise. As a countermeasure, a process called a watchdog timer is used to monitor the operation state of the program, and a reset is performed when a runaway is detected. Japanese Patent Application Laid-Open No. 1-116739 discloses a high-order CP.
U and a lower CPU, when the watchdog timer monitoring the operation of the lower CPU detects an abnormal operation of the lower CPU, the operation of the lower CPU is stopped and
Prior art that interrupts a PU is disclosed.

Japanese Patent Application Laid-Open No. 5-71410 discloses a prior art relating to an electronic control unit for a vehicle which performs data communication between a plurality of microcomputers in synchronization with rotation of an engine. At least one of the microcomputers for performing data communication is provided with a watchdog timer, and the other microcomputer detects an output signal of the watchdog timer of one microcomputer and detects an abnormal operation of the microcomputer or communication data. Is detected.

[0004] In a vehicle electronic control unit, noise generated due to ignition of the engine is large, and there is an environment in which malfunction may occur. If the microcomputer is not simply malfunctioning but has a failure, it becomes difficult to perform advanced control for each part of the vehicle. Therefore, when a failure occurs in one of a plurality of microcomputers or the like,
It is necessary to detect a failure immediately and take measures such as repair.

[0005]

A plurality of microcomputers are mounted on a vehicle, data communication is performed between the microcomputers, and a comprehensive electronic control unit is constituted by collecting data in each part of the vehicle, In addition, it is necessary to appropriately control a controlled part provided in each part of the vehicle. When communication is performed between a plurality of microcomputers, one microcomputer is mainly used and the other microcomputer is used. The main microcomputer detects a failure of the slave microcomputer from the operation result of the watchdog timer provided in the slave computer. JP-A-1-11673
9 and JP-A-5-71410, the output of the watchdog timer is directly transmitted to notify the main microcomputer of an abnormal operation of the slave microcomputer. However, it becomes necessary to provide a communication line for detecting the operation of the watchdog timer separately from the data communication. In electronic control devices for vehicles, wiring between microcomputers is performed using a wire harness, and the increase in even one required communication line increases costs and weight, including connectors for connection. And bring.

A program is set in the watchdog timer so that the microcomputer always accesses the watchdog timer within a certain time interval when the microcomputer performs a series of program operations. If the microcomputer runs away, there is a possibility that access will not be performed within a certain period of time. If the watchdog timer is not accessed even after a certain period of time has elapsed since the previous access, the watchdog timer monitoring circuit determines that the microcomputer has runaway and generates a reset input of the microcomputer.
The microcomputer to which the reset input is given returns the runaway program to a predetermined initial operation, and restarts the execution of the program from the initial operation.

[0007] The abnormality of the subordinate microcomputer is
A method of detecting based on information transmitted from the slave microcomputer to the master microcomputer is also conceivable. If the slave microcomputer goes out of control, data transmission becomes abnormal, or the content of the transmitted data becomes abnormal. When the reset by the watchdog timer occurs, the abnormality of the transmitted data is temporarily resolved. However, the method of detecting a reset based on data transmitted from a slave microcomputer cannot be sufficiently detected unless reset occurs at a high frequency so that transmission data always becomes abnormal. .

An object of the present invention is to easily detect, by a main electronic control unit, that a watchdog timer is activated by a subordinate electronic control unit to cause a reset, and determine whether a failure has occurred. It is an object of the present invention to provide a failure detection method at the time of communication between electronic control units, which can be performed.

[0009]

According to the present invention, a master electronic control unit controls a power supply of a slave electronic unit which is a slave electronic control unit. The slave unit has a power-on reset function and a watch. The master device has a dog reset function and performs communication for periodically transmitting predetermined information to the master device. The master device detects occurrence of reset of the slave device based on information transmitted from the slave device, and performs reset. A failure detection method during communication between electronic control units, characterized in that when the number of occurrences exceeds a preset number of times, it is detected that a failure has occurred in the slave device.

According to the present invention, communication is performed between a master device as a main electronic control device and a slave device as a subordinate electronic control device. The master device controls the power supply of the slave device, and the slave device has a power-on reset function and a watchdog reset function. The slave device performs communication for periodically transmitting predetermined information to the master device. The master device detects the number of resets of the slave device based on information transmitted from the slave device. When the number of reset occurrences exceeds a preset number, the master device detects a failure of the slave device. Since the master device detects the failure of the slave device by detecting the reset a plurality of times, the accuracy of the failure detection can be improved.

Further, in the present invention, communication is performed between the slave device and the master device via a power supply line controlled by the master device.

According to the present invention, since the communication between the master device and the slave device is performed via the power supply wiring controlled by the master device, it is not necessary to prepare a unique communication line for the communication. Wiring can be shared with communication lines.

Further, in the present invention, the slave device transmits predetermined first specific information in the first communication after reset, and the master device transmits the first specific information in accordance with the received first specific information. Reset detection is performed.

According to the present invention, the master device detects the reset of the slave device when receiving the predetermined first specific information from which the first communication after the reset is transmitted from the slave device. By making the first identification information easy to distinguish from other information, reset detection can be easily performed.

Further, in the present invention, even if the master device itself receives the first identification information after performing the control of once turning off and on the power of the slave device, the master device is reset for fault detection. It is not added to the number of occurrences.

According to the present invention, since the slave device is provided with a power-on reset function, when the master device performs a control of once turning off and on the power, the slave device is reset. After the reset, the first transmission of the specific information is performed. However, at this time, since it is not added to the number of times of reset for failure detection, only the reset based on the operation of the watchdog timer can be accurately detected. .

In the present invention, the slave device transmits an information frame including a plurality of information units, and the first identification information is set as a first information unit of the information frame transmitted after reset. Features.

According to the present invention, the slave device transmits an information frame composed of a plurality of information units, and the first identification information is the first information unit of the information frame transmitted after reset. When the first specific information is received, it is possible to easily detect that the reset of the slave device has occurred after the reception of the information frame received earlier.

In the present invention, when transmitting the information frame including the first specific information, the slave device sets a waiting time longer than a normal transmission interval between information frames, and sets the waiting time after resetting. The transmission is performed after the termination.

According to the present invention, when the slave device transmits an information frame including the first specific information, a waiting time longer than a normal transmission interval between information frames is provided, and the waiting time ends after reset. After transmitting, the master device reliably receives the first identification information,
The reset of the slave device can be detected.

[0021]

FIG. 1 shows an electrical configuration for detecting a failure during communication between electronic control units according to an embodiment of the present invention. A power supply line 3 connects a master ECU 1 which is a main electronic control device (hereinafter sometimes abbreviated as “ECU”) and a slave ECU 2 which is a subordinate electronic control device. The output from the power supply 4 such as an automobile battery and a generator is controlled by the master ECU 1,
The power is supplied to the slave ECU 2 via the power supply line 3.
The master ECU 1 and the slave ECU 2 are mounted at different positions on the vehicle, and detect the magnitude of the shock received at each position by the shock sensors 5 and 6. Master ECU 1 is installed, for example, near the driver's seat, and slave ECU 2 is installed near the door. Master ECU1
Controls the ignition of, for example, the airbag 7 provided in the steering device and the airbag 8 provided in the door. The slave ECU 2 reliably detects the impact applied to the door by the impact sensor 6, and outputs the detected signal to the master ECU.
1 to ensure transmission. Master ECU1
Is provided with a lamp 9 that is turned on when the slave ECU 2 fails.

In the master ECU 1, there is provided a microcomputer 10 which operates according to a preset program.
The master ECU 1 is connected to the slave EC via the power supply line 3.
A power supply control circuit 11 is provided for controlling the power supply to U2. The power supply control circuit 11 supplies the electric power supplied from the power supply 4 of the vehicle to the slave E via the power supply line 3.
Control is performed to supply or cut off to CU2. The power supply line 3 is also used for information communication from the slave ECU 2 and is received by the receiving circuit 12. Master ECU1
Detects the occurrence of reset of the slave ECU 2 based on the information from the slave ECU 2 received by the receiving circuit 12, and counts the number of occurrences by the counter 13.

The slave ECU 2 includes a microcomputer 20 which operates according to a preset program, and its runaway is controlled by a power supply circuit 21 with a WDT including a watchdog timer (hereinafter sometimes abbreviated as "WDT"). Monitor. A power supply voltage supplied from the master ECU 1 via the power supply line 3 is input to the + B terminal of the power supply circuit 21 with WDT, output from the Vcc terminal which is a power supply output terminal, and provided to the microcomputer 20 and the like. The transmission circuit 22 changes the consumption amount of the current supplied via the power supply line 3 and transmits information to the master ECU 1. Transmission circuit 2
2 is set to be larger than the change in the current consumption of other components in the slave ECU 2, and digital data is transmitted as a serial signal.

The power supply circuit 21 with WDT stabilizes the power supply voltage supplied via the power supply line 3 and
0, supply to the transmission circuit 22, the shock sensor 6, and the like.
A watchdog timer monitoring circuit is built in the power supply circuit 21 with WDT. When the access from the microcomputer 20 to the clock terminal CK is not performed within the time corresponding to the time constant that is the product of the resistance value of the resistor 23 and the capacitance value of the capacitor 24, the watchdog timer monitoring circuit
A reset signal is given to the microcomputer 20 via the reset terminal RST. The power supply circuit with WDT 21 also has a power-on reset function. When the power supply line 3 rises from a state in which the power supply line 3 has dropped below a predetermined voltage, an operation of giving a reset signal from the reset terminal RST to the reset terminal of the microcomputer 20 is also performed. Do.

FIG. 2 shows a format of a signal transmitted from the transmission circuit 22 to the reception circuit 12 via the power supply line 3 in FIG. FIG. 2A shows a standard for normal information communication performed after the power supply voltage supplied to the slave ECU 2 rises. In the transmission circuit 22, a start bit and a stop bit are added before and after a predetermined waiting time TWAIT after the power supply voltage is turned on, and data is transmitted in a start-stop manner. Since the transmission time of one bit is, for example, 20 ms, it takes 200 ms to transmit one byte of data. In the receiving circuit 12, after supplying the power supply voltage of the slave ECU 2 via the power supply control circuit 11, the reception permission state is set, for example, after 50 ms has elapsed. The waiting time TWAIT is set to a sufficient length, for example, 500 ms.

FIG. 2B shows a communication state when an ignition signal is transmitted from the transmission circuit 22. The ignition signal is a signal when the impact sensor 6 in the slave ECU 2 determines that it is necessary to perform ignition for inflating the airbags 7 and 8, and is more effective than the timing used for normal information communication. Communicate information in a short time. When receiving the ignition signal via the receiving circuit 12, the master ECU 1 prohibits the normal communication for 50 ms after the termination of the ignition signal. The transmission circuit 22 restarts transmission of the same information frame again after transmitting the information frame including the ignition signal, for example, after an idle period of 300 msec.

FIG. 3 shows a signal format in the normal communication shown in FIG. FIG. 3A shows a character format, from D0 on the LSB side to D7 on the MSB side.
This shows a state in which a start bit of a logical level “0” is added to the head of data representing one character of one byte by eight bits, and a stop bit of a logical level “1” is added to the rear end. FIG. 3B shows a frame format, and shows that the information frame is composed of a header at the head, data from 1 to n, and a checksum. For example, 300 ± 2 between information frames
An idle period of 5 ms is provided. FIG. 3 (c) shows the contents of the header of FIG. 3 (b). D0 to D on LSB side
4 bits up to 3 indicate command information that is set in advance. Four bits from D4 to D7 on the MSB side indicate the data length, and correspond to the value of n in FIG. 3B. Since the value of n is represented by 4 bits, the maximum length is 15 bytes and the minimum length is 0 bytes. The checksum in FIG.
For example, data from the header to data n is added, and a 2's complement of the value of the lower 8 bits is obtained. In this way, if all the data for one frame from the header to the checksum are added, the total value becomes 0 as long as no apologies occur during transmission. Conversely, when the total value is not 0, it can be determined that there is an error in the data.

In this embodiment, the slave ECU 2
After the power supply circuit 21 with WDT performs a power-on reset or a watchdog reset, a specific value, for example, “0110” is given to the command portion in FIG. Is set in advance. That is, FIG.
(B) Two bytes of the header and the checksum are transmitted so that the information frame transmitted first after the reset of the header can be easily determined.

FIG. 4 shows a state in which the normal communication waveform shown in FIG. 2 is sampled. Since the waveform of normal communication has a length of one bit of 20 ms, sampling is performed at a cycle of, for example, 2.5 ms. The majority level of the result of the eight samplings determines the level of the bit. That is, when the number of times of sampling determined to be at the high level is greater than the number of times of sampling determined to be at the low level, it is determined that the signal is at a high level as a whole, and in the opposite case, it is determined to be at a low level. Receiving circuit 12
Outputs a flag indicating the detection of a low-level star bit when the high-level communication line is determined to be at the low level for five or more consecutive times in the idle state.

FIG. 5 shows a format of the ignition signal shown in FIG. FIG. 5A shows a format of an ignition signal generated when the normal signal is at a high level.
(B) shows the format of the ignition signal when the normal signal is at the low level. The ignition signal is transmitted in a time shorter than 20 ms, which is a transmission time of one bit of the normal signal.
The time interval is, for example, 8 μs, and the logical value “0”
Following the start bit from the LSB side to the MSB side,
Data of “011011” follows, and the last logical value “1”
Are subsequently formed.

FIG. 6 shows an operation procedure on the slave ECU 2 side in FIG. FIG. 6A shows a normal communication operation.
(B) shows a watchdog reset operation. FIG.
As shown in (a), when the power supply voltage supplied from the power supply line 3 rises in step a1, the operation starts. In step a2, a power-on reset is performed by the power supply circuit with WDT 21. At step a3, the process waits for the elapse of the waiting time TWAIT shown in FIG. 2A, and after the elapse of the time, at step a4, transmits an information frame having the first specified information as the first byte. In step a5, the WDT
The microcomputer 20 reads or writes the clock terminal CK of the attached power supply circuit 21 to access the watchdog timer. At step a6, the process waits for the idle time to elapse, and at step a7, the next information frame is transmitted. Hereinafter, the information frame transmission in step a7 is repeated from the watchdog timer access in step a6. If the microcomputer 20 goes out of control, the watchdog timer access in step a5 is not performed within the time corresponding to the time constant set by the resistor 23 and the capacitor 24, so that the watchdog reset operation as shown in FIG. Is performed. That is, in step b1, a reset signal is supplied from the reset terminal RST of the power supply circuit with WDT 21 to the microcomputer 20, and the microcomputer 20 performs a watchdog reset operation in step b2, and FIG.
It moves to step a3 of (a). To simplify the configuration,
The power-on reset operation in step a2 of the microcomputer 20 and the watchdog reset operation in step b2 are the same.

FIG. 7 shows the operation of the master ECU 1 shown in FIG. In step c1, for example, when the ignition switch of the vehicle is turned on, the operation starts. Step c2
Then, the counter 13 is initialized and set to 0. In step c3, the power supply control circuit 11 is controlled to
The power supply of U2 is turned on. At step c4, data reception is performed. At step c5, an error is detected from the received data. The information frame of normal communication is shown in FIG.
Since the checksum is provided as shown in (b), if the lower 8 bits of the total value for each information frame do not become 0, it can be determined that there is an error in the data. If no error is detected in step c5, it is determined in step c6 whether data has been received immediately after the slave power supply is turned on in step c3. When it is determined that the data is immediately after, the process returns to step c4. If it is determined that the data is not the data immediately after, step c7
Then, it is determined whether or not the received information is the first specific information. When it is determined that the information is not the first specific information, the process returns to step c4. When it is determined in step c7 that the information is the first specific information, the count value of the counter 13 is increased by 1 in step c8. Immediately after the slave power supply is turned on in step c3, the first identification information is received. However, the process proceeds from step c6 to step c4, and the next data reception is performed. Is not done.

When the count of the counter 13 is increased in step c8, it is determined in step c9 whether the increased count value is equal to or larger than a reference number, for example, four times.
When the count value of the counter 13 is less than the reference number,
It returns to step c4. When it is determined in step c9 that the count value of the counter 13 is equal to or more than the reference number, the lamp 9 is turned on in step c10 to indicate that the slave ECU 2 has failed. In step c5,
When an error is detected, the slave power supply is turned off in step c11, and then the slave power supply is turned on again in step c3. In the present embodiment, the slave ECU 2
It is determined that the slave ECU has failed when the watchdog reset is performed a plurality of reference times, for example, four or more times. If the slave ECU 2 is out of order, the number of watchdog resets increases, and multiple detections can be performed in a short time. If a failure is determined by detecting a watchdog reset only once, a malfunction due to noise or the like may be determined to be a failure.

[0034]

As described above, according to the present invention, the master device detects the reset state due to the operation of the watchdog timer of the slave device based on information transmitted from the slave device, and the number of reset occurrences is determined in advance. Since the failure of the slave device is detected when exceeding the set number of times,
The failure of the slave device can be easily detected without providing a dedicated communication line for the watchdog timer.

According to the present invention, information is transmitted from the slave device to the master device via the power supply wiring, and the master device detects reset of the slave device based on information from the slave device. No communication line is required between the device and the device, and the number of wires required for connection can be reduced.

Further, according to the present invention, the master device can detect the occurrence of the reset when the first identification information transmitted from the slave device is received, so that the occurrence of the reset can be reliably detected. .

Further, according to the present invention, when the master device controls the power of the slave device, and once turns off and then turns on the power, the slave device is reset by the power-on reset function and transmits the first specific information. However, the reset by the master device is not included in the number of occurrences of failure detection in the master device, eliminating the possibility that the slave device is determined to be a failure due to the repeated occurrence of reset due to power control from the master device. can do.

Further, according to the present invention, since the first specific information is set in the first information unit of the information frame transmitted from the slave device, the master device determines that the reset of the slave device has occurred after the reset has occurred. It can be detected quickly.

Further, according to the present invention, the slave device makes the waiting time until the transmission of the information frame after reset longer than the transmission interval between the normal information frames, so that the master device surely transmits the first identification information. The received information frame can be received.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a schematic electrical configuration of an embodiment of the present invention.

FIG. 2 is a diagram illustrating a signal format when performing normal communication in the embodiment of FIG. 1;

FIG. 3 is a diagram showing a data configuration in normal communication in FIG. 2;

FIG. 4 is a diagram showing a sampling state during normal communication in FIG. 2;

FIG. 5 is a diagram showing a format of an ignition signal shown in FIG. 2 (b).

FIG. 6 is a flowchart showing an operation of the slave ECU 2 of FIG.

FIG. 7 is a flowchart showing the operation of the master ECU 1 of FIG.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Master ECU 2 Slave ECU 3 Power supply line 5, 6 Impact sensor 7, 8 Airbag 9 Lamp 10, 20 Microcomputer 21 Power supply circuit with WDT 22 Transmitter circuit 23 Resistance 24 Capacitor

Claims (6)

[Claims] 1. A master device as a main electronic control device controls a power supply of a slave device as a subordinate electronic control device, and the slave device has a power-on reset function and a watchdog reset function. The master device performs communication for periodically transmitting the determined information to the master device. The master device detects the occurrence of the reset of the slave device based on the information transmitted from the slave device, and the number of reset occurrences is set in advance. A failure detection method at the time of communication between electronic control units, wherein it is detected that a failure has occurred in a slave device when the number of times exceeds a plurality of times. 2. A failure during communication between electronic control units according to claim 1, wherein communication is performed between said slave unit and said master unit via a power supply line controlled by said master unit. Detection method. 3. The method according to claim 1, wherein the slave device is a first device after reset.
The method according to claim 1, wherein the first communication transmits predetermined first identification information in the first communication, and the master device detects reset of the slave device in accordance with the received first identification information. Failure detection method during communication between electronic control units. 4. The reset for fault detection is performed even if the master device receives the first identification information after performing a control of once turning off and on the power of the slave device. 4. The method according to claim 3, wherein the number is not added to the number of times. 5. The slave device transmits an information frame including a plurality of information units, and the first identification information is set as a first information unit of an information frame transmitted after reset. The method for detecting a failure during communication between electronic control units according to claim 3 or 4. 6. The slave device, when transmitting an information frame including the first specific information, sets a waiting time longer than a transmission interval between normal information frames, and ends the waiting time after resetting. 6. The method for detecting a failure at the time of communication between electronic control units according to claim 5, wherein the transmission is performed after the transmission.