WO2023166758A1

WO2023166758A1 - Electronic control system

Info

Publication number: WO2023166758A1
Application number: PCT/JP2022/031653
Authority: WO
Inventors: 康浩池田; 健一新保; 裕植松; 忠信鳥羽; 英之坂本
Original assignee: 日立Astemo株式会社
Priority date: 2022-03-01
Filing date: 2022-08-23
Publication date: 2023-09-07
Also published as: JP2023127404A

Abstract

The objective of the present invention is to provide an electronic control system that ascertains the states of the whole vehicle at the time of occurrence of a communication error after a communication recovery even in a case of the communication error having occurred in a Zone architecture. An electronic control system 1 according to the present invention comprises a first electronic control device 100 and a plurality of second electronic control devices 210, 220. The first electronic control device 100 receives signals outputted from the plurality of second electronic control devices 210, 220; generates processed data by processing the signals received from the plurality of second electronic control devices 210, 220; stores the generated processed data in a first storage unit 140 by overwriting; and, in a case of a communication error occurring between the first electronic control device 100 and at least one of the second electronic control devices 210, 220, stores, without overwriting, as the data at the time of occurrence of the error, the processed data that had been stored in the first storage unit 140 at the time of detecting the occurrence of the communication error and that was generated from the signals outputted from all of the second electronic control devices 210, 220.

Description

electronic control system

The present invention relates to an electronic control system that controls the memory storage method of vehicle/diagnostic data.

With the increasing performance of automobiles, the number of electronic control units (ECUs: Electrical Control Units) to demonstrate each function is also increasing. If the number of ECUs is large, the network configuration between the ECUs becomes complicated, which may cause problems such as signal delay. In order to address such a problem, in recent years, the introduction of a zone architecture configuration, in which ECUs are grouped for each functional system and collectively controlled by a centralized electronic control unit (central ECU), is under consideration. In addition, vehicle/diagnostic data tends to increase with the advent of automated driving. In addition, due to the demand for miniaturization and low cost, ECUs other than the central ECU (hereinafter referred to as other ECUs) suppress the increase in internal memory. Demand is growing.

When the Zone architecture configuration described above is adopted, vehicle/diagnostic data collected from other ECUs to the central ECU does not pass through other ECUs, that is, is not stored in other ECUs. If a communication error occurs between the central ECU and the central ECU, the update timing of the data managed and stored by the central ECU may differ between the other ECUs. In other words, the vehicle/diagnostic data of the other ECU in which the communication error occurred is not updated, but the vehicle/diagnostic data of the other ECUs are updated. Then, the vehicle/diagnostic data of the other ECU at the time when the communication error occurred is overwritten, and the information of the entire vehicle at the time of the communication error cannot be obtained. This makes factor analysis using the data stored in the central ECU difficult. Among them, there is, for example, Patent Document 1 as a method of securing data when an abnormality occurs.

Japanese Patent Laid-Open No. 2002-200003 describes that the problem is to "reliably store the vehicle state at the time of occurrence of an abnormality even if the vehicle state detection process is executed several times from the time of occurrence of an abnormality to the execution of the storage process." ing. As a means for solving this problem, the vehicle abnormal state storage device 10 stores the vehicle state detected by the vehicle state detection processing unit 21 in each detection cycle by the first vehicle state storage processing unit 23, and the index number assignment processing unit 22 is stored in the first storage unit 13 together with an index number assigned in correspondence with each vehicle state, and when the abnormality determination processing unit 24 determines that an abnormality has occurred in the vehicle state, the index number extraction processing unit 25 An index number corresponding to the vehicle state is extracted, and the index number extracted by the index number extraction processing unit 25 is stored by the second vehicle state storage processing unit 26 for each predetermined storage cycle set to a longer cycle than the detection cycle. The corresponding vehicle state is stored in the second storage unit 14".

JP 2013-142617 A

However, in the invention described in Patent Document 1, indexing processing is always performed on vehicle/diagnostic data, which increases the computational processing load. In addition, when multiple ECUs are connected to the central ECU, only the vehicle data of the ECU in which an abnormality has occurred is stored in the second storage unit, causing an update mismatch with vehicle data other than the ECU in which the abnormality has occurred. When performing factor analysis using vehicle data stored in the ECU, the vehicle data for each ECU was not complete, making the analysis difficult.

In order to solve the above problems, an electronic control system according to the present invention has a first electronic control unit and a plurality of second electronic control units, and the first electronic control unit outputs from the plurality of second electronic control units receive the signals received from the plurality of second electronic control units, process the signals received from the plurality of second electronic control units to generate processing data, overwrite save the generated processing data in a storage unit, and store at least one second electronic control unit If a communication error occurs between Save without overwriting as data.

According to the present invention, the vehicle data of each ECU at the time of/immediately before the communication error can be saved in the storage of the central ECU, so that the state of the entire vehicle at the time of the communication error can be grasped and factor analysis can be performed.
Further features related to the present invention will become apparent from the description of the specification and the accompanying drawings. Further, problems, configurations and effects other than those described above will be clarified by the following description of the embodiments.

1 is a block diagram showing the configuration of an electronic control system according to Embodiment 1 of the present invention; FIG. FIG. 4 is a flowchart showing processing performed by the electronic control system according to the first embodiment of the present invention; The block diagram which shows the structure of the electronic control system which concerns on Example 2 of this invention. The flowchart which shows the process which the electronic control system which concerns on Example 2 of this invention performs. The block diagram which shows the structure of the electronic control system which concerns on Example 3 of this invention. 1 is a diagram showing an example of a connection configuration between electronic control units according to Embodiment 1 of the present invention; FIG. FIG. 5 is a diagram showing another example of the connection configuration between the electronic control units according to the first embodiment of the present invention;

An embodiment of this electronic control system and test method will be described below with reference to the drawings. However, the embodiments shown below are merely examples, and are not intended to exclude the application of various modifications and techniques not explicitly described in the embodiments. In other words, the present embodiment can be modified in various ways without departing from the spirit of the embodiment. Also, each drawing does not mean that it has only the components shown in the drawing, but can include other functions.

[Example 1]
FIG. 1 is a block diagram showing the overall configuration of an electronic control system 1 according to the first embodiment. An electronic control system 1 mounted on a vehicle has a first electronic control unit (central ECU 100) and a plurality of second electronic control units (ECU 210 and ECU 220). The central ECU 100 has a transmission/reception section 110, an error detection section 120, a signal processing section 130, a first storage section (cache 140), a data transfer instruction section 150, and a second storage section (storage 160). The ECUs 210 and 220 are various devices mounted on the vehicle (for example, a camera, a radar sensing device such as LiDAR), acquire information about the control state and safety state of the vehicle, and provide vehicle/diagnostic data. Generate. In this embodiment, two ECUs are used, but the number of ECUs is not limited as long as it is plural.

The transmission/reception unit 110 transmits and receives data to and from the ECU 210 and the ECU 220 . The error detection unit 120 detects an error that has occurred in data transmission/reception between the transmission/reception unit 110 and the

ECUs

210 and 220 . In this embodiment, the error is assumed to be a communication error in which communication between the transmitting/receiving unit 110 and the

ECUs

210 and 220 is interrupted. The signal processing unit 130 processes signals processed by the

ECUs

210 and 220 and received by the transmitting/receiving unit 110 to generate processing data.

The cache 140 and storage 160 store the processed data generated by the signal processing unit 130 . In this embodiment, the storage capacity of cache 140 is smaller than the storage capacity of storage 160 . The same applies to other embodiments. Further, although the storage 160 is built in the central ECU 100 in this embodiment, it may be mounted in another area within the vehicle in which the central ECU 100 is mounted. The data transfer instruction unit 150 transmits a transfer instruction signal instructing the signal processing unit 130 to transfer the processed data stored in the cache 140 to the storage 160 . In this embodiment, the data transfer instructing section 150 transmits a data transfer signal to the signal processing section 130 when it receives an error detection signal from the error detecting section 120, which will be described later in detail.

By connecting the plurality of

ECUs

210 and 220 to the central ECU 100 so as to be able to communicate with each other as in the present embodiment, all vehicle/diagnostic data is not saved in the non-volatile memories of the plurality of

ECUs

210 and 220, but is saved in the central ECU 100.・Management becomes possible. It should be noted that the

ECUs

210 and 220 may have volatile memory and store all data in the memory before sending to the central ECU 100 .

FIG. 2 is a flowchart showing the processing performed by the electronic control system according to this embodiment. While the transmission/reception unit 110 is communicating with the

ECUs

210 and 220, the error detection unit 120 monitors whether an error has occurred in the communication between the transmission/reception unit 110 and the ECUs 210 and 220 (step S201). . When the error detection unit 120 does not detect an error ("No" in step S201), the vehicle/diagnostic data processed by the

ECUs

210 and 220 is transferred to the signal processing unit 130, and processed by the signal processing unit 130 to obtain the processed data. generated (step S202). The generated processing data is first sent to the cache 140 configured by, for example, a volatile memory, and overwritten (step S203). Furthermore, the data stored in the cache 140 is transferred to and stored in the storage 160 configured by, for example, a non-volatile memory at an arbitrary timing, and saved without being overwritten (step S204). After that, the above flow is repeated until an error occurs. Since the data stored in the cache 140 is overwritten and stored, the data stored up to that point is erased. Therefore, by storing the data in the storage 160 having a storage capacity larger than that of the cache 140 every predetermined time, it becomes possible to store the processed data for each predetermined time.

When the error detection unit 120 detects a communication error (“Yes” in step S201), the error detection unit 120 issues an error detection signal indicating that an error has been detected, and transmits the error detection signal to the data transfer instruction unit 150 (step S205). . In the following description, it is assumed that a communication error has occurred between the ECU 210 and the transmitting/receiving section 110, for example. Upon receiving the error detection signal, the data transfer instruction unit 150 issues a transfer instruction signal instructing the data stored in the cache 140 to be transferred to the storage 160 and transmits the transfer instruction signal to the signal processing unit 130 .

Then, the signal processing unit 130, which has received the transfer instruction signal, detects all the ECUs 210 stored in the cache 140 from the time when the data transfer instruction unit 150 receives the error detection signal to the time before the predetermined time. , 220 is transferred to and stored in the storage 160 as error occurrence data (step S207).

Specifically, for example, when data transfer instruction unit 150 receives an error detection signal at time T, signal processing unit 130 receives an The processed data generated by processing the received signal is transferred from the cache 140 to the storage 160 .

After that, it is determined whether or not the communication error has been resolved (step S208). If the communication error is resolved ("Yes" in step S208), the process returns to step S201. If the communication error is not resolved ("No" in step S208), the process proceeds to step S209, and safety control such as stopping the vehicle or degenerating (lowering the automatic driving level, etc.) is performed.

In this embodiment, the error is explained as being a communication error, but it is not limited to this, and may be a signal abnormality or an ECU failure. Also, although there are many error detection methods, for example, determination by a CRC check or a packet loss counter is conceivable.

In this embodiment, with the above configuration, when a communication error occurs in the electronic control system, any data stored in the cache memory up to the time of the error can be saved in the storage, and when factor analysis is performed, the vehicle Since the overall state can be grasped, factor analysis can be facilitated. This is because, as vehicle systems become increasingly computerized and complicated, factor analysis is difficult using only the vehicle/diagnostic data of the ECU in which the communication error occurred. For example, if the ECU in which the communication error occurred is in charge of managing each area/zone (front, rear, left, right), after grasping the situation of each area/zone, it is possible to grasp the basis and situation of vehicle control. This is because it is necessary to The same is true when the ECU performs each function (automatic driving control, driving support control, power train, vehicle body control, etc.).

Regarding the above, the following problems can be solved by comparing it with this embodiment. That is, for ECU 210 with communication with transmission/reception unit 110 cut off, the vehicle/diagnostic data generated by ECU 210 cannot be updated after time T, but communication with transmission/reception unit 110 is cut off. The vehicle/diagnostic data generated by the ECU 220 that is not in use continues to be transmitted to the central ECU 100 after the time T as well. Data continues to be overwritten in the cache 140, which is a volatile memory. In other words, the data that has been saved up to that point is erased. Therefore, if the communication error continues for a certain amount of time, even if the communication error between the ECU 210 and the transmitting/receiving unit 110 is resolved, the vehicle/diagnostic data generated by the ECU 220 at time T will not be saved. It is not possible to analyze what kind of event occurred to cause an error.

However, according to this embodiment, the vehicle/diagnostic data generated by the

ECUs

210 and 220 at time T are reliably stored in the storage 160 . Therefore, when the communication error of the ECU 210 is resolved, it becomes possible to grasp the state of the entire vehicle at the time T, and it becomes possible to use it for analysis of the cause of the communication error occurring in the ECU 210 and problems accompanying it. .

In this embodiment, communication between the

ECUs

210 and 220 and the transmitting/receiving unit 110 is performed via individual paths (eg, Ethernet, CAN, or SerDes), but the connection method is limited to this. can't Specifically, as shown in FIG. 6, the communication bus 700 shared by the

ECUs

210 and 220 may be connected to the transmitting/receiving section 110 . Alternatively, the connection may be made via a switching device 800 as shown in FIG. In either case, it is possible to simplify the communication path configuration, and for example, by collectively connecting ECUs belonging to the same functional system to the transmitting/receiving unit 110 via a common bus or switching device, Data can be easily managed.

[Example 2]
Next, an electronic control system according to Example 2 will be described with reference to FIGS. 3 and 4. FIG. FIG. 3 is a block diagram showing an example of the configuration of the electronic control system 1 according to this embodiment. The configuration of the central ECU 100 in this embodiment is the same as that in the first embodiment, and the description thereof will be omitted. This embodiment differs from the first embodiment in that data is stored in the cache not only on the central ECU 100 side but also on the

ECUs

210 and 220 side.

In this embodiment, the ECU 210 has a transmission/reception section 111, an error detection section 121, an information processing section 131, a third storage section (cache 141), and an information acquisition section 300. The ECU 220 also has the same configuration.

The transmitting/receiving unit 111 communicates with the transmitting/receiving unit 110 on the central ECU 100 side. The error detection unit 121 issues an error detection signal and transmits it to the information processing unit 131 when detecting a communication error occurring between the transmission/

reception units

110 and 111 . The information acquisition unit 300 is a sensing element such as a camera or radar, and acquires information regarding vehicle control and safety. The information processing section 131 processes the information acquired by the information acquisition section 300 and generates a processed signal.

In the present embodiment, when the error detection unit 121 detects a communication error, it transmits an error detection signal to the information processing unit 131, and the information processing unit 131 receives the error detection signal. Information about the processed signal generated within a predetermined time before and after the detection of the communication error is stored in the cache 141 until the communication error is resolved.

The above processing will be explained using the flowchart in FIG. While the transmission/reception unit 111 is communicating with the transmission/reception unit 110 of the central ECU 100, the error detection unit 121 monitors whether an error has occurred in the communication between the transmission/reception units 110 and 111 (step S401). If the error detection unit 121 has not detected an error ("No" in step S401), the information processing unit 131 processes the information acquired by the information acquisition unit 300 to generate a processed signal (step S402). The information processing unit 131 then transmits the processed signal to the transmission/reception unit 111 (step S403). After that, the above flow is repeated until an error occurs.

When the error detection unit 121 detects a communication error (“Yes” in step S401), the error detection unit 121 issues an error detection signal indicating that a communication error has been detected, and transmits it to the information processing unit 131 (step S404). ). The information processing unit 131 that has received the error detection signal stores information about the processing signal generated within a predetermined time before and after the error detection unit 121 detects the error in the cache 141 until the communication error is resolved (step S405). ).

After that, the error detection unit 121 monitors whether or not the communication error has been resolved (step S406). If the communication error has been resolved (“Yes” in step S406), the information processing unit 131 transmits the data stored in the cache 141 to the transmission/reception unit 111. FIG. If the communication error is not resolved ("No" in step S406), the process proceeds to step S408, and safety control such as stopping the vehicle or degenerating (lowering the automatic driving level, etc.) is performed.

In this embodiment, by performing the above-described processing, in addition to the effects of the first embodiment, the data that could not be transmitted to the central ECU 100 and that was generated by the ECU in which the communication error occurred after the communication error occurred can be restored to the communication. can be sent later. Therefore, by analyzing the continuity of data generated before and after the communication error occurs, detailed factor analysis becomes possible, and maintenance can be facilitated and feedback to the design can be realized. Note that there may be a time lag in cache data transmitted from the ECU 210 to the central ECU when communication is restored. is.

Even if the communication error is not resolved or the ECU that caused the error breaks down, according to this embodiment, the data log can be retrieved from the ECU and retrieved from the cache. It becomes possible to grasp the state of each vehicle.

[Example 3]
FIG. 5 is a block diagram showing the configuration of an electronic control system 1 according to Example 3 of the present invention. This embodiment differs from the first embodiment in that it has an external communication unit 500 capable of communicating with the outside (control center or user) 600 of the vehicle 400 on which the central ECU 100 is mounted. Further, in this embodiment, the external communication unit 500 is configured to be able to communicate with the signal processing unit 130, for example, to transfer vehicle/diagnostic data to a center or a user having a mobile terminal at any timing, or Data obtained by integrating and processing the data can be transmitted.

With the above configuration, in addition to the effects of Embodiments 1 and 2, real-time center and driver notifications during vehicle operation are possible, providing highly reliable services such as safety control, alerting, logging, and trend analysis. can be provided.

According to the embodiments of the present invention described above, the following effects are obtained.
(1) An electronic control system according to the present invention has a first electronic control unit and a plurality of second electronic control units, and the first electronic control unit receives signals output from the plurality of second electronic control units. and processes signals received from a plurality of second electronic control units to generate processing data, overwrites and saves the generated processing data in a storage unit, and a communication error occurs between at least one of the second electronic control units If an error occurs, save the processed data generated from the signals received from all the second electronic control units, which was saved in the storage unit when the occurrence of the communication error was detected, as data at the time of error occurrence without overwriting. .

With the above configuration, the vehicle data of each ECU at the time of communication error can be saved in the storage of the central ECU, so it is possible to grasp the state of the entire vehicle at the time of communication error and perform factor analysis.

(2) The data at the time of error includes processing data generated from signals received from all the second electronic control units from the time when the occurrence of the communication error is detected to the time before the predetermined time. This makes it possible to analyze data continuity and the like immediately before a communication error occurs, making it possible to facilitate analysis of error factors.

(3) The storage unit has a first storage unit that overwrites the processed data and a second storage unit that stores the processed data without overwriting, and the first electronic control unit detects the occurrence of a communication error. In response, the error occurrence data is transferred from the first storage unit to the second storage unit. As a result, it becomes possible to adopt a volatile cache memory having a smaller storage capacity than the second storage unit, which is a non-volatile storage memory, as the first storage unit, and it is possible to reduce the size of the device. .

(4) Further having an external communication unit capable of communicating with the outside of the vehicle in which the electronic control system is mounted, the external communication unit transmits information including the processed data stored in the storage unit to the outside of the vehicle. to send. This will enable real-time center and driver notifications during vehicle operation, making it possible to provide highly reliable services such as safety control, alerting, logging, and trend analysis.

(5) Each of the plurality of second electronic control units acquires information on the vehicle in which the electronic control system is mounted, processes the information to generate a processing signal, and when a communication error occurs, the communication error Information about the processed signal generated within a predetermined time before and after the occurrence of is stored in the third storage unit. This makes it possible to acquire data even after a communication error occurs by referring to the data log in the storage unit as needed.

(6) Each of the plurality of second electronic control units stores information in the third storage unit until the communication error is resolved, and when the communication error is resolved, stores the information stored in the third storage unit in the third storage unit. - to the electronic control unit; As a result, data immediately after a communication error that could not be sent to the central ECU at the time of the communication error can be sent after the communication is restored, enabling more detailed factor analysis, facilitating maintenance, and providing feedback to design. can be done.

(7) A plurality of second electronic control units are connected to the first electronic control unit via a common communication path or selectively connected via a switching circuit. This makes it possible to simplify the communication path between the second electronic control unit and the first electronic control unit.

The technical scope of the present invention is not limited to the range described in the above embodiments, and includes various modifications without departing from the main features of the present invention. Therefore, the above-described embodiments are merely illustrative and should not be construed as limiting. Moreover, it is possible to add, delete, or replace a part of the configuration of each embodiment with other configurations, all of which are within the scope of the present invention.

1 electronic control system, 100 central ECU (first electronic control unit), 140 cache (first storage unit), 141 cache (third storage unit), 160 storage (second storage unit), 210, 220 ECU (second electronic control unit), 400 vehicle, 500 external communication unit, 600 external, 700 communication bus, 800 switching device

Claims

An electronic control system having a first electronic control unit and a plurality of second electronic control units,
The first electronic control unit,
receiving signals output from the plurality of second electronic control units;
processing signals received from the plurality of second electronic controllers to generate processed data;
overwriting the generated processing data in a storage unit;
When a communication error occurs with at least one of the second electronic control units, received from all of the second electronic control units stored in the storage unit at the time when the occurrence of the communication error is detected. saving the processed data generated from the generated signal as data at the time of error occurrence without overwriting;
An electronic control system characterized by:
The electronic control system of claim 1,
The data at the time of error occurrence includes the processed data generated from the signals received from all the second electronic control units from the time when the occurrence of the communication error is detected to the time before a predetermined time.
An electronic control system characterized by:
The electronic control system of claim 1,
The storage unit has a first storage unit that overwrites the processed data and a second storage unit that stores the processed data without overwriting,
The first electronic control unit transfers the data at the time of error occurrence from the first storage unit to the second storage unit in response to detecting the occurrence of the communication error.
An electronic control system characterized by:
The electronic control system of claim 1,
further comprising an external communication unit capable of communicating with the outside of the vehicle in which the electronic control system is mounted;
wherein the external communication unit transmits information including the processed data stored in the storage unit to the outside of the vehicle;
An electronic control system characterized by:
The electronic control system of claim 1, wherein
Each of the plurality of second electronic control units,
Acquiring information on a vehicle in which the electronic control system is installed,
processing the information to generate a processed signal;
when the communication error occurs, storing information about the processed signal generated within a predetermined time before and after the communication error occurs in a third storage unit;
An electronic control system characterized by:
An electronic control system according to claim 5,
Each of the plurality of second electronic control units stores the information in the third storage unit until the communication error is resolved, and stores the information in the third storage unit when the communication error is resolved. transmitting the information to the first electronic controller;
An electronic control system characterized by:
The electronic control system of claim 1,
The plurality of second electronic control units are connected to the first electronic control unit via a common communication path or selectively connected via a switching circuit,
An electronic control system characterized by: