Drive device and drive system

Abstract

A driving device includes: a receiving unit (1, 2) for a load control signal indicating the driving state of each load; a control storage unit (11) for the load control signal; a driving unit (20) that switches according to the load control signal; an acquisition unit (10, 81 to 84, 90 to 92) for the current driving state of each load or the current vehicle state at the current moment; a determination storage unit (50) for a conversion determination value; and a determination unit (30, 40) that compares the relevant driving state of each load related to the load control signal with the conversion determination value, and determines that the load control signal is abnormal when the relevant driving state and the conversion determination value satisfy a predetermined correspondence relationship.

Description

Technical Field

[0001] The present disclosure relates to a drive device and a drive system. Background Art

[0002] As disclosed in Patent Document 1, there is a technology related to cyber security of an in-vehicle communication network.

[0003] Prior Art Documents

[0004] [Patent Document]

[0005] [Patent Document 1] JP 2019-115067 A Summary of the Invention

[0006] According to one example, a drive device includes: a receiving unit for a load control signal indicating a drive state of each load; a control storage unit for the load control signal; a drive unit for a switch according to the load control signal; an acquisition unit for a current drive state of each load or a current vehicle state at a current moment; a determination storage unit for a conversion determination value; and a determination unit that compares a relevant drive state of each load related to the load control signal with the conversion determination value, and determines that the load control signal is abnormal when the relevant drive state and the conversion determination value satisfy a predetermined correspondence relationship. Brief Description of the Drawings

[0007] The above and other objects, features, and advantages of the present disclosure will become more apparent from the following detailed description made with reference to the accompanying drawings. In the drawings:

[0008] Figure 1 is a circuit diagram showing a schematic configuration of a drive device according to a first embodiment;

[0009] Figure 2 is a circuit diagram showing a schematic configuration of a drive IC unit according to a first embodiment;

[0010] Figure 3 is a diagram showing a schematic configuration of an energization pattern in a first embodiment;

[0011] Figure 4 is a diagram showing a schematic configuration of a transition prohibition pattern in a first embodiment;

[0012] Figure 5 is a diagram showing a schematic configuration of a control register according to a first embodiment;

[0013] Figure 6 is a diagram showing a schematic configuration of a monitor register in the first embodiment;

[0014] Figure 7 is a flowchart showing the operation of a driving device according to the first embodiment;

[0015] Figure 8 is a block diagram showing the operation of a sequence circuit according to the first embodiment;

[0016] Figure 9 is a diagram showing the setting operation of an energization spectrum in the first embodiment;

[0017] Figure 10 is a diagram showing the setting operation of a control spectrum (previous value) in the first embodiment;

[0018] Figure 11 is a schematic diagram showing the setting operation of a control spectrum (updated value) in the first embodiment;

[0019] Figure 12 is a schematic diagram showing the setting operation of a conversion inhibition spectrum in the first embodiment;

[0020] Figure 13 is a diagram showing a conversion inhibition spectrum in a modified example;

[0021] Figure 14 is a diagram showing a conversion inhibition spectrum in Modified Example 2;

[0022] Figure 15 is a flowchart showing the operation of a driving device according to the second embodiment;

[0023] Figure 16 is a flowchart showing the operation of a driving device according to the third embodiment;

[0024] Figure 17 is a flowchart showing the operation of a driving device according to the fourth embodiment;

[0025] Figure 18 is a flowchart showing the operation of a driving device according to the fifth embodiment;

[0026] Figure 19 is a flowchart showing the operation of a driving device according to the sixth embodiment;

[0027] Figure 20 is a flowchart showing the operation of a driving device according to the seventh embodiment;

[0028] Figure 21is a flowchart showing the operation of the drive device according to the eighth embodiment;

[0029] Figure 22 is a circuit diagram showing the schematic configuration of the drive device according to the ninth embodiment;

[0030] Figure 23 is a flowchart showing the operation of the drive device according to the ninth embodiment;

[0031] Figure 24 is a flowchart showing the operation of the ECU in the ninth embodiment; and

[0032] Figure 25 is a circuit diagram showing the schematic configuration of the drive device according to the tenth embodiment. DETAILED DESCRIPTION

[0033] According to conceivable techniques, a load control signal for driving a load can be transmitted and received via a communication bus. In order to prevent falsification of such a load control signal, complex processes such as authentication and encryption for communication need to be performed using a microcomputer.

[0034] The drive device and the drive system are configured to be able to prevent a transition to a prohibited conversion map due to falsification of a load control signal without performing complex processes.

[0035] The drive device disclosed herein drives a plurality of loads by controlling a plurality of semiconductor switches corresponding to the plurality of loads. The drive device includes:

[0036] a receiving unit that receives a load control signal from an external control device, the load control signal including a signal indicating a drive state of each load;

[0037] a control storage unit that stores the load control signal received by the receiving unit;

[0038] a drive unit that controls a plurality of semiconductor switches according to the load control signal stored in the control storage unit;

[0039] an acquisition unit that acquires a current drive state or a current vehicle state, the current drive state being the drive state of each load at the current moment;

[0040] a determination storage unit that stores a conversion determination value for determining whether the load control signal received by the receiving unit is abnormal, the conversion determination value being associated with a drive conversion from the current drive state or the current vehicle state; and

[0041] A determination unit that compares the relevant driving state of each load associated with the load control signal received by the receiving unit with the conversion determination value, and determines that the load control signal received by the receiving unit is abnormal when the relevant driving state and the conversion determination value satisfy a predetermined correspondence relationship.

[0042] As described above, the drive device stores the conversion determination value for determining whether the load control signal received by the receiving unit is abnormal, and the conversion determination value is associated with the drive conversion from the current driving state or the vehicle state. The drive device can determine whether the load control signal received by the receiving unit is abnormal by comparing the relevant driving state of each load associated with the load control signal received by the receiving unit with the conversion determination value. Thus, the drive device can prevent the transformation into a prohibited conversion map due to the tampering of the load control signal without performing complex processing.

[0043] In addition, the drive system disclosed herein is a drive system that includes a drive device that drives a plurality of loads by controlling a plurality of semiconductor switches corresponding to the plurality of loads, and a control device that is configured to communicate with the drive device.

[0044] The control device includes:

[0045] A sending unit that sends a load control signal, and the load control signal includes a signal indicating the driving state of each load.

[0046] The drive device includes:

[0047] A receiving unit that receives the load control signal;

[0048] A control storage unit that stores the load control signal received by the receiving unit;

[0049] A drive unit that controls a plurality of semiconductor switches according to the load control signal stored in the control storage unit;

[0050] An acquisition unit that acquires the vehicle state or the current driving state indicating the current driving state of each load;

[0051] A determination storage unit that stores a conversion determination value for determining whether the load control signal received by the receiving unit is abnormal, and the conversion determination value is associated with the drive conversion from the current driving state or the current vehicle state; and

[0052] A determination unit that compares the relevant driving state of each load associated with the load control signal received by the receiving unit with the conversion determination value, and determines that the load control signal received by the receiving unit is abnormal when the relevant driving state and the conversion determination value satisfy a predetermined correspondence relationship.

[0053] As described above, the drive system can prevent transformation into a prohibited conversion map due to tampering with the load control signal without performing complex processing.

[0054] Multiple embodiments for implementing the present disclosure will be described below with reference to the accompanying drawings. In each embodiment, parts corresponding to those described in the previous embodiment are denoted by the same reference numerals, and redundant descriptions will be omitted in some cases. In each embodiment, when only a part of the configuration is described, the other parts of this embodiment can refer to other previously described embodiments and be applied.

[0055] (First Embodiment)

[0056] Reference will be made to Figures 1 to 12 to describe the drive device 100 of this embodiment. The drive device 100 can be applied to, for example, a circuit for driving a load installed on a vehicle. Hereinafter, an example in which the drive device 100 is applied to an automatic transmission of a vehicle will be described.

[0057] Reference will be made to Figures 1 to 12 to describe the drive device 100 and the drive system 1000 of this embodiment. The drive system 1000 includes the drive device 100 and an ECU 200 configured to be able to communicate with the drive device 100. The drive device 100 can be applied to, for example, a circuit for driving a load installed on a vehicle. Hereinafter, an example in which the drive device 100 is applied to an automatic transmission of a vehicle will be described.

[0058] <Automatic Transmission>

[0059] The schematic configuration of the automatic transmission will be described. The automatic transmission includes, for example, a valve body, a transmission mechanism, an oil pump, and a parking lock mechanism. The transmission mechanism includes a plurality of friction elements, and the friction elements include, for example, a clutch and a brake. The transmission mechanism can gradually change the transmission ratio by selectively engaging each friction element.

[0060] The valve body is provided with a hydraulic circuit that regulates the pressure of the hydraulic oil supplied to the transmission mechanism. The valve body includes a plurality of solenoid valves that regulate the pressure of the hydraulic oil pumped from the oil pump and supply the hydraulic oil to the friction elements. The solenoid valve includes a solenoid. The solenoid can be referred to as a coil. The energization of the solenoid valve is controlled, so that the hydraulic oil is regulated.

[0061] The solenoid valve corresponds to the load. In this embodiment, the solenoid valve serves as a plurality of actuators 401 to 40n that will be described later. Therefore, the energized state of the load is the same as the energized state of the solenoid valve (solenoid). The solenoid valve can be a linear solenoid valve. When the actuators do not need to be particularly distinguished from each other, the actuators 401 to 40n will also be referred to as the actuator 40n.

[0062] When the parking gear is selected, the parking lock mechanism performs parking locking to lock the rotation of the output shaft (axle) of the automatic transmission. When a gear other than the parking gear is selected from the parking lock state, the parking lock mechanism releases the parking locking. Therefore, the output shaft is unlocked. However, the structure of the automatic transmission is not limited to the above structure.

[0063] <Drive System>

[0064] As Figure 1 shown, the drive system 1000 includes at least a drive device 100, an ECU 200, and a communication bus B1. In this embodiment, as an example, a drive system 1000 including a first signal line L1 and a second signal line L2 different from the communication bus B1 is adopted.

[0065] The drive system 1000 controls the driving of a plurality of actuators 40n. In the drive system 1000, the drive device 100 is provided on the valve body. That is, the drive device 100 has an electromechanical structure integrally provided with the automatic transmission. The ECU 200 is mechanically separated from the automatic transmission. The automatic transmission including the valve body can also be regarded as a load. In Figure 1 it, the energization path of the actuators 401 to 40n is simplified.

[0066] Here, n is a natural number of 2 or more. In this embodiment, n = 8 is taken as an example. Therefore, this embodiment adopts an example in which the first actuator 401 to the eighth actuator 408 are energized and driven. In this embodiment, an example in which the automatic transmission is switched between the first speed to the fifth speed, P gear, R gear, and N gear by controlling the driving of the first actuator 401 to the eighth actuator 408 is adopted.

[0067] However, the present disclosure is not limited thereto. The present disclosure can also be adopted even when shifting the automatic transmission between the first gear speed and the fifth gear speed by controlling the driving of the plurality of actuators 40n. For example, the present disclosure can also be adopted even when shifting the automatic transmission between the P range, R range, N range, and D range by controlling the driving of the plurality of actuators 40n. The actuator 40n can be a solenoid valve for a switch.

[0068] The drive system 1000 controls the driving of the plurality of actuators 40n by controlling the plurality of drive switches 301 to 30n. The drive switches 301 to 30n are respectively and individually provided in the energization paths of the actuators 40n. Therefore, in the present embodiment, an example in which the first to eighth drive switches 301 to 308 are provided is adopted. When the drive switches do not need to be particularly distinguished from each other, the drive switches 301 to 308 will also be referred to as the drive switch 30n. The drive switch 30n can be included in the drive IC 20 described later.

[0069] When the drive switch 30n is turned on, current is supplied to the corresponding actuator 40n. When the drive switch 30n is turned off, the current supply to the corresponding actuator 40n is blocked. In other words, when the corresponding drive switch 30n is turned on, each actuator 40n is energized. By turning off the corresponding drive switch 30n, each actuator 40n is de-energized.

[0070] As Figure 1 and Figure 2 shown, the load drive system includes a power feed switch 500 (PSC). The load drive system can include various sensors. However, the load drive system does not necessarily include the power feed switch 500 and the sensors, and the power feed switch 500 and the sensors can be provided outside the load drive system.

[0071] The power feed switch 500 is provided in the energization path of the actuator 40n. A single (common) power feed switch 500 is provided for the plurality of actuators 40n. When the power feed switch 500 is turned on, current can be supplied to each actuator 40n. When the power feed switch 500 is turned off, the current supply to each actuator 40n is blocked.

[0072] With respect to the plurality of actuators 40n, the power feed switch 500 can be arranged on the high side, that is, the power supply side, or can be arranged on the low side, that is, the ground (GND) side. The power feed switch 500 of the present embodiment is arranged on the high side. For example, a semiconductor switch such as a MOSFET can be used as the power feed switch 500. The power feed switch 500 is provided in the drive device 100.

[0073] The sensor outputs a signal indicating the load state. That is, the sensor detects the state of the automatic transmission including the valve body. The example adopted in this embodiment provides the rotation sensor 600 (RS) as an example of the sensor. The rotation sensor 600 includes, for example, a sensor that outputs a signal indicating the rotational speed on the input side of the automatic transmission and a sensor that outputs a signal indicating the rotational speed on its output side.

[0074] The ECU 200 and the drive device 100 are connected to the common communication bus B1. Devices (not shown) different from the ECU 200 and the drive device 100 may be connected to the communication bus B1. In this embodiment, the ECU 200 and the drive device 100 are configured to be able to communicate with each other via the communication bus B1 of the in-vehicle network conforming to the CAN protocol. In other words, the ECU 200 and the drive device 100 perform mutual communication of data via the communication bus B1 based on the two-wire differential method. The communication bus B1 may also be referred to as the CAN bus. CAN is the abbreviation of Controller Area Network. CAN is a registered trademark.

[0075] As described above, the ECU 200 and the drive device 100 communicate with each other via the CAN bus as the communication bus B1. Therefore, the ECU 200 and the drive device 100 can send and receive a plurality of data via substantially a single line. That is, the ECU 200 and the drive device 100 communicate in a different method from, for example, SPI communication that requires three or more copper wires.

[0076] In the drive system 1000 of this embodiment, the priority of the messages sent by the ECU 200 and the drive device 100 is preset according to the importance level, type, etc. of the messages. When each message is sent, first, the priority information (ID code) indicating the priority order of each message is sent. In this case, when a conflict occurs in the transmission of the priority information of a plurality of messages, arbitration is performed on the priority information of each message, and the priority information with a higher priority obtains the transmission right.

[0077] The ECU 200 and the drive device 100 are connected to the first signal line L1 and the second signal line L2. Different from the CAN bus, the first signal line L1 and the second signal line L2 are not used for sending and receiving messages. The first signal line L1 and the second signal line L2 are copper wires used in SPI communication, copper wires used in serial communication without parallel conversion, etc. Therefore, the ECU 200 and the drive device 100 can send and receive signals without using the CAN transceiver 203 etc. described later.

[0078] When performing SPI communication via the first signal line L1 or the second signal line L2, the ECU 200 and the drive device 100 transmit and receive serial data, and convert the received serial data into parallel data to obtain signals. When performing serial communication without parallel conversion via the first signal line L1 or the second signal line L2, the ECU 200 and the drive device 100 obtain signals by detecting the level of the terminal to which the first signal line L1 or the second signal line L2 is connected.

[0079] <ecu>

[0080] The ECU 200 corresponds to a control device. That is, the ECU 200 is a control device provided outside the drive device 100. The ECU 200 includes a first microcomputer 201 (MC) and a second microcomputer 202 (MC). The ECU 200 also includes a CAN transceiver 203 (TRC) for performing communication via the communication bus B1. The first microcomputer 201 is a microcomputer including a CPU 2011, a CAN controller 2012, a ROM, a RAM, registers, and the like. In the first microcomputer 201, the CPU 2011 executes various types of control by using the temporary storage functions of the RAM or the registers according to a control program stored in the ROM in advance. The CPU 2011 uses data acquired from outside the ECU 200, such as detection signals from sensors, to execute control. The CPU 2011 of the present embodiment executes control of each actuator 40n and thus executes control of the automatic transmission. The first microcomputer 201 and the CAN transceiver 203 correspond to a transmission unit.

[0081] The CPU 2011 sets the shift speed of the automatic transmission. The CPU 2011 gives an instruction of the shift speed to the drive device 100. The CPU 2011 outputs a load control signal indicating the shift speed and thus gives an instruction of the shift speed to the drive device 100. The load control signal includes signals (values) indicating the energized state (drive state) of each actuator 40n. In other words, the load control signal includes signals indicating the energized states respectively corresponding to each actuator 40n. Moreover, in other words, the load control signal includes signals indicating the drive states of each actuator 40n.

[0082] The CPU 2011 can set a target current value by executing a predetermined calculation. The target current value is a current value applied to each of the actuators 40n to bring each of the actuators 401 to 40n into a target state. The first microcomputer 201 acquires the state of the automatic transmission and calculates a target hydraulic pressure, which is a necessary value of the output hydraulic pressure of each actuator 40n. The first microcomputer 201 calculates the target hydraulic pressure based on, for example, the rotational speed on the input side and the rotational speed on the output side of the automatic transmission. The first microcomputer 201 sets the target current value based on the calculated target hydraulic pressure. The relationship between the target hydraulic pressure and the target current value is preset as, for example, a map or a function. The ECU 200 gives an instruction of the target current value to the drive device 100.

[0083] The CPU 2011 can set the duty ratio based on the state of the automatic transmission. The first microcomputer 201 sets the duty ratio to limit current fluctuations, such as overshooting or current ripples, during the initial period of gear shifting. The duty ratio is the duty ratio of the PWM signal to be output to the gate of the drive switch 30n, which will be described later.

[0084] The first microcomputer 201 sets the duty ratio based on at least one of, for example, the pressure of the hydraulic oil in the hydraulic circuit, the temperature of the hydraulic oil, and the value of the actual current flowing through each actuator 40n. The ECU 200 gives an instruction of the duty ratio to the drive device 100. The ECU 200 can give an instruction of the duty ratio during the power-on period of the ECU 200, or can give an instruction of the duty ratio only during a temporary period, such as the initial period of gear shifting.

[0085] The CPU 2011 determines whether an abnormality has occurred based on the state of the automatic transmission. The first microcomputer 201, for example, compares the pressure of the hydraulic oil with a hydraulic threshold value to determine whether an abnormality has occurred. The first microcomputer 201, for example, compares the temperature of the hydraulic oil with a temperature threshold value to determine whether an abnormality has occurred.

[0086] When the CPU 2011 determines that an abnormality has occurred, the ECU 200 outputs an emergency instruction to the drive device 100 to set the energization of all actuators 40n to a predetermined abnormal handling state. The ECU 200 of the present embodiment outputs an emergency blocking instruction as an emergency instruction to the drive device 100 to block the energization of all actuators 40n. Even when an abnormal signal is input from the drive device 100, the CPU 2011 can output an emergency blocking instruction. In this case, the abnormal signal is input to the CPU 2011 via the second signal line L2, for example.

[0087] Incidentally, as will be described later, when an abnormal signal is input from the drive device 100, the communication bus B1 may be attacked from the outside. That is, when an emergency blocking instruction is transmitted via the communication bus B1, the emergency blocking instruction may be tampered with. Therefore, even if the CPU 2011 transmits an emergency blocking instruction via the CAN transceiver 203, the drive device 100 may not receive the emergency blocking instruction.

[0088] Therefore, preferably, the CPU 2011 outputs an emergency blocking instruction via the first signal line L1 without using the CAN transceiver 203. Therefore, the CPU 2011 can reliably output an emergency blocking instruction to the drive device 100.

[0089] The first microcomputer 201 includes a CAN controller 2012 for transmitting and receiving messages via a communication bus B1. The CAN controller 2012 performs communication control according to the CAN protocol. The CAN controller 2012 performs, for example, transmission control, reception control, and arbitration control.

[0090] A CAN transceiver 203 is electrically connected to the CAN controller 2012 and is also electrically connected to the communication bus B1. The CAN transceiver 203 converts electrical characteristics between the communication bus B1 and the CAN controller 2012, enabling two-way transmission of communication messages between the communication bus B1 and the CAN controller 2012. For example, the bus level signal of the communication bus B1 is converted into a digital signal that can be processed by the CAN controller 2012, enabling the recognition of dominant and recessive states. That is, the CAN controller 2012 is connected to the communication bus B1 via the CAN transceiver 203, enabling the transmission of communication messages to the communication bus B1 and the reception of communication messages from the communication bus B1.

[0091] The CAN controller 2012 includes message boxes for storing messages. The CAN controller 2012 includes transmission message boxes and reception message boxes. The CAN controller 2012 sequentially stores the transmission messages obtained via the communication interface into the message boxes. The CAN controller 2012 performs the process of transmitting the stored messages according to the priority of the ID code. The CAN controller 2012 generates a frame based on the messages stored in the message boxes and transmits the frame to the communication bus B1 via the CAN transceiver 203.

[0092] The CPU 2011 stores data representing, for example, a load control signal into the transmission message box of the CAN controller 2012. Therefore, the CAN controller 2012 generates a frame including the data representing the load control signal and transmits the frame to the communication bus B1 via the CAN transceiver 203.

[0093] The CAN controller 2012 receives a frame from the communication bus B1 via the CAN transceiver 203, extracts messages, etc., and sequentially stores the extracted messages into the message boxes. The CAN controller 2012 outputs the received messages to the transmission destination according to the priority of the ID code. When a conflict occurs in the frame on the communication bus B1, the CAN controller 2012 arbitrates the transmission right (bit-by-bit non-destructive arbitration). The CAN controller 2012 performs the detection, notification, etc. of errors that occur in association with the transmission and reception of frames. The CAN transceiver 203 and the CAN controller 2012 may be referred to as a control-side communication unit.

[0094] The ECU 200 may further include a second microcomputer 202, as Figure 1 shown. The second microcomputer 202 monitors whether the first microcomputer 201 is operating normally. The first microcomputer 201 may be referred to as the main microcomputer, and the second microcomputer 202 may be referred to as the monitoring microcomputer. The second microcomputer 202 monitors, for example, watchdog anomalies, communication anomalies, or anomalies in the computing function of the first microcomputer 201. In addition to the above monitoring functions, the second microcomputer 202 may also have a function of assisting the control executed by the first microcomputer 201. The second microcomputer 202 may execute controls different from those of the drive system 1000. The second microcomputer 202 may further include a CAN controller (not shown) and is configured to be able to send and receive messages via the communication bus B1.

[0095] In this embodiment, the monitoring unit of the first microcomputer 201 is configured as the second microcomputer 202, and the microcomputers 201 and 202 mutually monitor whether they are operating normally. The monitoring unit of the first microcomputer 201 is not limited to the second microcomputer 202. A monitoring IC may be provided instead of the second microcomputer 202. The ECU 200 may not include a monitoring unit such as the second microcomputer 202.

[0096] <Configuration of the drive device>

[0097] The drive device 100 will be described. In Figure 2 , for convenience, only the part corresponding to one actuator 401 is shown.

[0098] The drive device 100 is a circuit that powers and drives a plurality of actuators 40n. The drive device 100 controls a plurality of drive switches 30n to power and drive the plurality of actuators 40n. Different from the ECU 200, the drive device 100 does not include a microcomputer. That is, the drive device 100 powers and drives the plurality of actuators 40n by using hardware logic. Each of the first to eighth drive switches 301 to 308 corresponds to a semiconductor switch.

[0099] The drive device 100 mainly includes a CAN transceiver 1, a CAN controller 2, an SPI circuit 10 including a control register 11, a drive IC 20, a first comparator 40, and a ROM 50. The drive device 100 further includes a timing circuit 30, a register unit 60, a power feed circuit 70, a current detection resistor 81, an amplifier 82, a second comparator 83, a monitor register 84, a waveform analysis circuit 90, etc.

[0100] The CAN transceiver 1 is electrically connected to the CAN controller 2 and is also electrically connected to the communication bus B1. The CAN transceiver 1 converts electrical characteristics between the communication bus B1 and the CAN controller 2, enabling two-way transmission of communication messages between the communication bus B1 and the CAN controller 2. The CAN controller 2 is connected to the communication bus B1 via the CAN transceiver 1, and thus can send communication messages to the communication bus B1 and receive communication messages from the communication bus B1.

[0101] The CAN controller 2 includes message boxes for storing messages. The CAN controller 2 includes transmit message boxes and receive message boxes. The CAN controller 2 sequentially stores the transmit messages obtained via the communication interface into the message boxes. The CAN controller 2 performs the process of transmitting the stored messages according to the priority of the ID codes. The CAN controller 2 generates a frame based on the messages stored in the message boxes and sends the frame to the communication bus B1 via the CAN transceiver 1.

[0102] The CAN controller 2 receives a frame from the communication bus B1 via the CAN transceiver 1, extracts messages, etc., and sequentially stores the extracted messages into the message boxes. The CAN controller 2 outputs the received messages to the transmission destination according to the priority of the ID codes. When a collision occurs on the communication bus B1 for a frame, the CAN controller 2 arbitrates the transmission right (bit-by-bit lossless arbitration). The CAN controller 2 detects and notifies errors associated with the transmission and reception of frames. The CAN transceiver 1 and the CAN controller 2 correspond to the receiving unit.

[0103] For example, when receiving a frame including data representing a load control signal, the CAN controller 2 extracts the data representing the load control signal and sequentially stores the extracted data into the message boxes. The CAN controller 2 may include an SPI communication register. In this case, the CAN controller 2 can store the data representing the load control signal from the message box into a register, etc. As described above, the CAN controller 2 temporarily stores the load control signal sent from the ECU200.

[0104] The load control signal stored in the CAN controller 2 includes, for example, 1 as a signal representing power-on and 0 as a signal representing power-off. Therefore, the load control signal can be represented by 0 and 1. In this embodiment, as shown in the upper part of Figure 5 , an 8-bit load control signal is taken as an example. However, the present disclosure is not limited thereto, and any load control signal with multiple bits can be used.

[0105] The load control signal is a signal for controlling the driving of a plurality of actuators 40n. Therefore, the load control signal stored in the CAN controller 2 can also be referred to as a control pattern. The control pattern stored in the CAN controller 2 is the current control pattern for controlling the driving of a plurality of actuators 40n. Therefore, the control pattern stored in the CAN controller 2 can also be referred to as the updated value of the control pattern.

[0106] The updated value of the control pattern corresponds to the driving state (next driving state) after the driving transition of each actuator 40n. Therefore, by switching the control pattern from the previous value to the updated value, each actuator 40n undergoes a driving state transition. The previous value of the control pattern will be described in detail later.

[0107] As Figure 5 shown in the upper part of, in this embodiment, as an example, the CAN controller 2 in a state where 11100100 (first gear speed) is written as the updated value of the control pattern is adopted. The updated value of the control pattern is compared with a transition prohibition pattern 52 as a conversion determination value. Therefore, the control pattern can also be referred to as a comparison pattern. The transition prohibition pattern 52 can also be referred to as a determination pattern.

[0108] Figure 5 The first bit 211 in the upper part of corresponds to the first actuator 401. The second bit 212 corresponds to the second actuator 402. The third bit 213 corresponds to the third actuator 403. The fourth bit 214 corresponds to the fourth actuator 404. The fifth bit 215 corresponds to the fifth actuator 405. The sixth bit 216 corresponds to the sixth actuator 406. The seventh bit 217 corresponds to the seventh actuator 407. The eighth bit 218 corresponds to the eighth actuator 408.

[0109] In this embodiment, the updated value of the control pattern is used as the relevant driving state of each actuator 40n associated with the load control signal received by the CAN transceiver 1 and the CAN controller 2. The relevant driving state can be regarded as the driving state after the driving transition. Therefore, the relevant driving state can also be referred to as the next driving state.

[0110] The CAN controller 2 outputs the updated value of the control map to the SPI circuit 10. In this case, the CAN controller 2 outputs the updated value of the control map to the SPI circuit 10 only when the updated value of the control map is normal. That is, when a normal signal is output from a first comparator 40 described later, the CAN controller 2 outputs the updated value of the control map to the SPI circuit 10. When an abnormal signal is output from the first comparator 40, the CAN controller 2 discards the current value of the control map without outputting the current value to the SPI circuit 10.

[0111] The SPI circuit 10 (SPIC) is connected to the CAN controller 2, the drive IC 20, and the timing circuit 30. The SPI circuit 10 includes a control register 11 (CREG). The control register 11 corresponds to a control storage unit. SPI is the Serial Peripheral Interface, which is the abbreviation of the English Serial Peripheral Interface.

[0112] The control register 11 stores the control map output from the CAN controller 2. As will be described later, in the drive device 100, the drive IC 20 controls the driving of each actuator 40n according to the control map stored in the control register 11. That is, the control register 11 stores the control map for driving control by the drive IC 20. Therefore, the control map stored in the control register 11 is the previous value of the control map. That is, the previous value of the control map corresponds to the current drive state indicating the current drive state of each actuator 40n. As described above, the SPI circuit 10 acquires the previous value of the control map. Therefore, the SPI circuit 10 corresponds to an acquisition unit.

[0113] As Figure 5 shown in the lower part of, in this embodiment, as an example, the control register 11 in a state where 01110100 (fourth gear speed) is written as the previous value of the control map is adopted. The control register 11 has address bits 111 to 118 corresponding to the actuator 40n respectively. In the control register 11, the signal indicating the drive state of each actuator 40n in the load control signal is written into the bits of each address.

[0114] Figure 5 The first bit 111 in the lower part of corresponds to the first actuator 401. The second bit 112 corresponds to the second actuator 402. The third bit 113 corresponds to the third actuator 403. The fourth bit 114 corresponds to the fourth actuator 404. The fifth bit 115 corresponds to the fifth actuator 405. The sixth bit 116 corresponds to the sixth actuator 406. The seventh bit 117 corresponds to the seventh actuator 407. The eighth bit 118 corresponds to the eighth actuator 408.

[0115] As Figure 1 and Figure 2 As shown, the driving IC 20 (DIC) corresponds to the driving unit. The driving IC 20 is connected to a plurality of driving switches 30n. The driving IC 20 controls the plurality of driving switches 30n according to a control map. That is, the driving IC 20 outputs driving signals for individually turning on and off each driving switch 30n according to the control map stored in the control register 11. The driving IC 20 selectively turns on and off the plurality of driving switches 301 to 308 according to the control map stored in the control register 11.

[0116] For convenience, Figure 1 only one driving IC 20 is shown. However, the driving device 100 includes a plurality of driving ICs 20 individually connected to respective driving switches 30n. That is, the driving device 100 includes the same number of driving ICs 20 as the number of driving switches 30n.

[0117] Therefore, each driving IC 20 turns on and off the driving switch 30n connected thereto according to the value corresponding to it in the control map. For example, when the first driving IC 20 and the first driving switch 301 are connected to each other, the first driving IC 20 turns on and off the first driving switch 301 according to the value stored in the first bit 111 of the control register 11.

[0118] As the driving signal, a PWM signal can be used. In this case, the driving IC 20 can change the current flowing through the actuator 40n (i.e., the supply current) by changing the duty ratio of the PWM signal. PWM is the abbreviation of Pulse Width Modulation, that is, Pulse Width Modulation.

[0119] For example, when the control map is 11100100, the driving IC 20 turns on the first to third driving switches 301 to 303 and the sixth driving switch 306. Therefore, the driving IC 20 energizes the first actuator 401 to the third actuator 403 and the sixth actuator 406. In this case, the driving IC 20 turns off the fourth driving switch 304, the fifth driving switch 305, the seventh driving switch 307, and the eighth driving switch 308. Therefore, the driving IC 20 de-energizes the fourth actuator 404, the fifth actuator 405, the seventh actuator 407, and the eighth actuator 408.

[0120] As Figure 8 shown, the timing circuit 30 (SQC) includes a first data loader 31, a second data loader 32, a third data loader 33, a fourth data loader 34, a third comparator 41, etc. The timing circuit 30 includes a plurality of switching elements, etc. The timing circuit 30 operates in synchronization with the clock. The timing circuit 30 operates to compare the updated value of the control map with the determination map. The timing circuit 30 corresponds to the determination unit.

[0121] As Figure 11 As shown, the first data loader 31 writes the updated value of the control map stored in the CAN controller 2 into the first data register 61. That is, the first data loader 31 copies the signal of each bit in the CAN controller 2 and writes the copied signal into each bit in the first data register 61.

[0122] As Figure 10 shown, the second data loader 32 writes the previous value of the control map stored in the control register 11 into the second data register 62. That is, the second data loader 32 copies the signal of each bit in the control register 11 and writes the copied signal into each bit in the second data register 62.

[0123] As Figure 9 shown, the third data loader 33 sequentially writes the multiple energization maps 51 stored in the ROM 50 into the third data register 63. That is, the third data loader 33 copies the signal of each bit of the energization map 51 and writes the copied signal into each bit in the third data register 63. The energization map 51 will be described in detail later.

[0124] The third comparator 41 sequentially compares the control map set in the second data register 62 with the energization map 51 set in the third data register 63. The third comparator 41 selects the energization map 51 that matches the previous value of the control map from the multiple energization maps 51. This enables the selection of the transition inhibition map 52 corresponding to the previous value of the control map. The third comparator 41 outputs a signal representing the energization map 51 corresponding to the previous value of the control map.

[0125] It can be considered that the third comparator 41 detects that the previous value of the control map is a control map representing the fourth gear speed. In addition, it can be considered that the third comparator 41 determines the drive transition from the drive state represented by the previous value of the control map to the drive state represented by the updated value of the control map.

[0126] As Figure 12 shown, the fourth data loader 34 writes the transition inhibition map 52 stored in the ROM 50 into the fourth data register 64. The fourth data loader 34 writes the transition inhibition map 52 corresponding to the signal output from the third comparator 41 into the fourth data register 64. When there are multiple transition inhibition maps 52, the fourth data loader 34 sequentially writes the transition inhibition maps 52 into the fourth data register 64. That is, the fourth data loader 34 copies the signal of each bit in the transition inhibition map 52 and writes the copied signal into each bit in the fourth data register 64. As described above, the fourth data loader 34 obtains the transition inhibition map 52 associated with the control map from the ROM 50.

[0127] In this embodiment, the transition prohibition map 52 is used as a determination map. The transition prohibition map 52 corresponds to a transition determination value and a prohibition determination value. The transition prohibition map 52 will be described in detail later.

[0128] The first comparator 40 (1CMP) includes an operational amplifier or the like. The first comparator 40 compares the transition prohibition map 52 with the updated value of the control map. The first comparator 40 sequentially compares each signal of the transition prohibition map 52 with each signal in the updated value of the control map. The first comparator 40 compares the transition prohibition map 52 with the updated value of the control map to determine whether the transition prohibition map 52 and the updated value of the control map satisfy a predetermined correspondence relationship. When the predetermined correspondence relationship is satisfied, the first comparator 40 determines that the updated value of the control map is abnormal. The first comparator 40 corresponds to a determination unit.

[0129] As described above, in this embodiment, the transition prohibition map 52 is used as a transition determination value. Therefore, when the transition prohibition map 52 and the updated value of the control map match each other, the first comparator 40 determines that the predetermined correspondence relationship is satisfied. When the transition prohibition map 52 and the updated value of the control map match each other, it means that the updated value of the control map is included in the transition prohibition map 52. On the other hand, when the transition prohibition map 52 and the updated value of the control map do not match each other, the first comparator 40 determines that the predetermined correspondence relationship is not satisfied.

[0130] The updated value of the control map that matches the transition prohibition map 52 is a control map indicating a drive transition from the current drive state to the prohibited drive state. Therefore, the updated value of the control map is an abnormal control map. The reason why the CAN controller 2 receives the abnormal control map may be message spoofing or the like. That is, in the drive system 1000, for example, the communication bus B1 is attacked and the load control signal is tampered with, so that the abnormal control map is sent to the drive device 100.

[0131] On the other hand, the updated value of the control map that does not match the transition prohibition map 52 is a control map indicating a drive transition from the current drive state to a non-prohibited drive state. Therefore, the updated value of the control map is a normal control map.

[0132] Therefore, when the transition prohibition map 52 matches the updated value of the control map, the first comparator 40 determines that the updated value of the control map is abnormal. On the other hand, when the transition prohibition map 52 does not match the updated value of the control map, the first comparator 40 determines that the updated value of the control map is normal.

[0133] When it is determined that there is a match and when it is determined that there is no match, the first comparator 40 outputs different signals. When it is determined that there is a match, the first comparator 40 outputs an abnormal signal indicating that the updated value of the control map is abnormal. The abnormal signal indicates that the updated value of the control map is abnormal and also indicates a communication abnormality using the communication bus B1.

[0134] On the other hand, when it is determined that there is no match, the first comparator 40 outputs a normal signal indicating that the control map is normal. The abnormal signal and the normal signal are output to the CAN controller 2, the power supply circuit 70, the ECU 200, etc. The normal signal indicates that the updated value of the control map is normal and indicates that the communication using the communication bus B1 is normal.

[0135] The first comparator 40 outputs the abnormal signal to the CAN controller 2 and thus notifies the CAN controller 2 of the abnormality of the updated value of the control map. The first comparator 40 notifies the CAN controller 2 of the abnormality and thus commands the CAN controller 2 to discard the updated value of the control map. The first comparator 40 outputs the abnormal signal to the power supply circuit 70 or the ECU 200 and thus gives an instruction to set the power supply state of the actuator 40n to the blocking state. When an instruction to cut off the power supply is given, the first comparator 40 may output the abnormal signal to at least one of the power supply circuit 70 or the ECU 200.

[0136] The first comparator 40 outputs the normal signal to the CAN controller 2 and thus commands the CAN controller 2 to output the updated value of the control map. The first comparator 40 outputs the normal signal to the power supply circuit 70 or the ECU 200 and thus gives an instruction to set the power supply state of the actuator 40n to the power feed state.

[0137] As described above, the communication bus B1 may be attacked from the outside. That is, when an abnormal signal or a normal signal is transmitted via the communication bus B1, the signal may be tampered with. Therefore, even if the drive device 100 transmits an abnormal signal or a normal signal via the CAN transceiver 203, the ECU 200 may not receive such a signal.

[0138] Therefore, preferably, the first comparator 40 outputs the abnormal signal or the normal signal to the ECU 200 via the second signal line L2. Therefore, even if the communication bus B1 is attacked, the first comparator 40 can output the abnormal signal or the normal signal to the ECU 200.

[0139] The ROM 50 stores the energization map 51 (EZP) and the conversion prohibition map 52 (PHP). That is, the ROM 50 includes an energization map memory that stores the energization map 51 and a conversion prohibition map memory that stores the conversion prohibition map 52. The ROM 50 corresponds to the determination storage unit.

[0140] As Figure 3 shown, the energization map 51 is a control map corresponding to each of all drive states that can be the drive state of each actuator 40n. Therefore, the ROM 50 stores a plurality of energization maps 51. Each of the energization maps 51 includes signals representing the drive states of each actuator 40n. The energization maps 51 are respectively associated with the states of the automatic transmission. When the previous value of the control map and the updated value of the control map are normal, these values are some parts of the energization map 51. In Figure 3 etc., the actuators 401 to 408 are respectively represented by ACT1 to ACT8.

[0141] As Figure 4 shown, the shift inhibition map 52 is an energization map 51 representing the drive states of each actuator 40n. The shift inhibition map 52 is a value associated with the drive shift from the current drive state. The shift inhibition map 52 is a determination value for determining whether the updated value of the control map is abnormal. The ROM 50 stores the control map and the shift inhibition map 52 in an associated manner.

[0142] The shift inhibition map 52 represents such a drive state that the drive shift from the drive state represented by the previous value of the control map is prohibited. That is, the shift inhibition map 52 is an energization map 51 representing a drive shift that causes an unexpected operation in the automatic transmission.

[0143] In Figure 4 the example of, as an example, a shift inhibition map 52 associated with the control map representing the fourth gear speed is shown. When the automatic transmission is in the fourth gear speed, downshifting to the first gear speed causes an unexpected rapid deceleration. Shifting to the R gear causes an unexpected reverse gear speed. Shifting to the P gear causes an unexpected parking lock. Therefore, the control map corresponding to the fourth gear speed is associated with the energization maps corresponding to each of the first gear speed, the R gear, and the P gear as shift inhibition maps. Different from the control map, the shift inhibition map 52 is pre-stored in the ROM 50.

[0144] The ROM 50 has address bits corresponding to the actuators 401 to 408 respectively. In the ROM 50, signals (values) representing the drive states of each of the actuators 401 to 408 in the shift inhibition map 52 are written to each address bit. In this embodiment, an 8-bit control map is taken as an example. Therefore, each shift inhibition map 52 has the same 8 bits as the control map. Each shift inhibition map 52 includes 1 as a signal representing energization and 0 as a signal representing non-energization. Therefore, each shift inhibition map 52 can be represented by 0 and 1.

[0145] The ROM 50 is preferably configured to be inaccessible via the CAN controller 2. That is, the ROM 50 cannot be rewritten from the outside of the drive device 100 via the CAN controller 2. In other words, communication for the ROM 50 is provided independently using the communication bus B1. Thus, the power-on pattern 51 and the conversion prohibition pattern 52 are written into the ROM 50 by a factory, a dealer, etc. In the above manner, the drive device 100 can restrict accidental rewriting of the power-on pattern 51 or the conversion prohibition pattern 52.

[0146] The register unit 60 (REG) includes a first data register 61 (1REG), a second data register 62 (2REG), a third data register 63 (3REG), and a fourth data register 64 (4REG). The above values are set in each of the data registers 61 to 64.

[0147] As Figure 1 and 2 shown, the power supply circuit 70 (PSC) corresponds to the power supply unit. The power supply circuit 70 is a circuit that turns on and off the power supply switch 500. The power supply circuit 70 switches the power supply states of the plurality of actuators 401 to 408 by turning on and off the power supply switch 500.

[0148] For example, when an emergency blocking instruction is input from the ECU 200, the power supply circuit 70 outputs a signal indicating that the power supply switch 500 is turned off. In other words, the power supply circuit 70 turns off the power supply switch 500 to set the power supply state of each actuator 40n to the blocking state. That is, the power supply circuit 70 turns off the power supply switch 500 in order to prevent each actuator 40n from being driven by an abnormal control pattern. On the other hand, when the updated value of the control pattern is normal, the power supply circuit 70 turns on the power supply switch 500 to set the power supply state of each actuator 40n to the power supply state.

[0149] When an abnormal signal is input from the first comparator 40, the power supply circuit 70 may output a signal indicating that the power supply switch 500 is turned off. That is, the emergency blocking instruction and the abnormal signal are signals indicating that the power supply switch 500 is turned off.

[0150] The current detection resistor 81 and the amplifier 82 together form a current detection unit. The current detection unit is provided separately for each actuator 40n. Therefore, in the present embodiment, eight current detection units are provided in the drive device 100. In Figure 1 it, as a representative example, only the current detection unit corresponding to the first actuator 401 is shown.

[0151] Each current detection unit detects the current actually flowing through the corresponding actuator 40n. In other words, each current detection unit detects the drive state of the corresponding actuator 40n. That is, the current detection units respectively monitor the energization states of the actuators 40n.

[0152] In addition to including the current detection resistor 81 and the amplifier 82, the current detection unit may include a filter that removes noise from the voltage amplified by the amplifier 82. The filter may include, for example, a resistor and a capacitor.

[0153] The current detection resistor 81 is connected in series to the actuator 401. The current detection resistor 81 is provided on the ground side (downstream side) with respect to the first actuator 401. The amplifier 82 amplifies the voltage proportional to the current generated across the current detection resistor 81. Accordingly, the amplifier 82 outputs a voltage signal proportional to the current flowing through the first actuator 401. Thus, each current detection unit outputs a voltage signal proportional to the current flowing through the corresponding actuator 40n.

[0154] The second comparator 83 (2CMP) includes an operational amplifier or the like. The second comparator 83 is provided individually for each actuator 40n. The second comparator 83 is provided in the kit together with the current detection resistor 81 and the amplifier 82. In the present embodiment, eight second comparators 83 are provided in the drive device 100. In Figure 1 which, as a representative example, only the second comparator 83 corresponding to the first actuator 401 is shown.

[0155] The second comparator 83 compares the voltage signal output from the amplifier 82 with a reference value. The second comparator 83 outputs a positive value when the voltage signal is greater than the reference value, and outputs a negative value when the voltage signal is less than the reference value. That is, the second comparator 83 outputs a monitoring result indicating the energization state of each actuator 40n monitored by the corresponding current detection unit. For example, when the first actuator 401 is energized, the second comparator 83 outputs a positive value. For example, when the first actuator 401 is not energized, the second comparator 83 outputs a negative value.

[0156] As Figure 6 shown, the output from each second comparator 83 is written to the monitor register 84 (MREG). That is, the monitor register 84 stores a monitor map as a result of monitoring the energization state of each actuator 40n. The monitor map can be regarded as the current drive state. The monitor map can also be regarded as the relevant drive state. The monitor register 84 may also be referred to as a monitor storage unit. In Figure 6 which, as an example, a monitor register 84 in which a monitor map representing the fourth gear speed is stored is adopted.

[0157] As described above, by using the current detection resistor 81, the amplifier 82, the second comparator 83, and the monitor register 84, the drive device 100 can obtain the current drive state of each actuator 40n. In the present embodiment, as the current drive state, a monitor map can be used instead of the previous value of the control map. These constituent devices 81 to 84 correspond to the acquisition unit. However, in the present disclosure, the constituent devices 81 to 84 can be omitted. In particular, it is not necessary to provide the monitor register 84.

[0158] The monitor register 84 has address bits corresponding to the actuators 401 to 408. In the monitor register 84, signals (values) indicating the energized states of the actuators 401 to 408 are respectively written to the address bits. The signals indicating the energized states of each of the actuators 401 to 408 are outputs from the corresponding second comparator 83.

[0159] In the monitor register 84, for example, 1 is written as the signal indicating energization, and 0 is written as the signal indicating non-energization. Therefore, the monitor map can be represented by 0 and 1. In the present embodiment, an 8-bit control map is taken as an example. Therefore, the monitor map has the same 8 bits as the control map.

[0160] The first bit 841 in the monitor register 84 corresponds to the first actuator 401. Similarly, the second to eighth bits 842 to 848 respectively correspond to the second to eighth actuators 402 to 408.

[0161] A rotation sensor signal as an output from the rotation sensor 600 is input to the waveform analysis circuit 90. The waveform analysis circuit 90 determines the vehicle speed based on the rotation sensor signal [pls / s]. The waveform analysis circuit 90 determines, for example, whether the vehicle speed is high, low, or 0 (stopped).

[0162] When the rotation sensor signal reaches a preset threshold value, the waveform analysis circuit 90 determines that the vehicle speed is high. When the rotation sensor signal does not reach the preset threshold value and is not 0, the waveform analysis circuit 90 determines that the vehicle speed is low. When the rotation sensor signal is 0, the waveform analysis circuit 90 determines that the vehicle is stopped.

[0163] Therefore, the vehicle speed can be regarded as the current drive state of each actuator 40n. Therefore, the waveform analysis circuit 90 corresponds to the acquisition unit. However, in the present disclosure, the waveform analysis circuit 90 can be omitted.

[0164] <Operation of the drive device>

[0165] The operation of the drive device 100 will be described. When receiving a load drive signal, the drive device 100 starts Figure 7 The operations shown in the flowchart. In this case, it is assumed that the power supply circuit 70 outputs a signal indicating that the power supply switch 500 is turned on. That is, each actuator 40n can supply current.

[0166] In step S10a, a conversion prohibition map is set. As described above, the second data loader 32, the third data loader 33, and the fourth data loader 34 select the conversion prohibition map 52 corresponding to the previous value of the control map from the ROM 50 and set the conversion prohibition map 52 in the fourth data register 64.

[0167] When multiple conversion prohibition maps 52 are stored in the ROM 50, the fourth data loader 34 sequentially writes the conversion prohibition map 52 stored in the ROM 50 into the fourth data register 64. When the conversion prohibition map 52 written into the fourth data register 64 is output to the first comparator 40, the fourth data loader 34 writes the next conversion prohibition map 52 into the fourth data register 64.

[0168] In step S11, a load control signal is set. As described above, the first data loader 31 loads the updated value of the control map as the load control signal from the CAN controller 2. The first data loader 31 sets the loaded updated value of the control map in the first data register 61. When the control map is set in the first data register 61, the control map is output to the first comparator 40.

[0169] In step S12a, the received signal is compared with the conversion prohibition map. The received signal is the updated value of the control map. The first comparator 40 compares the updated value of the control map set in the first data register 61 with the conversion prohibition map 52 set in the fourth data register 64. When multiple conversion prohibition maps 52 are stored in the ROM 50, the first comparator 40 sequentially compares the updated value of the control map with each conversion prohibition map 52. Therefore, the first comparator 40 compares the updated value of the control map with all the conversion prohibition maps 52.

[0170] When the first comparator 40 determines that the updated value of the control map does not match any of the conversion prohibition maps 52, the process proceeds to step S13. In this case, it can be considered that the updated value of the control map is normal.

[0171] On the other hand, when the first comparator 40 determines that the updated value of the control map matches the conversion prohibition map 52, the process proceeds to step S14. That is, when the first comparator 40 determines that at least one of the conversion prohibition maps 52 matches the updated value of the control map, the process proceeds to step S14. In this case, it can be considered that the updated value of the control map is abnormal.

[0172] In this embodiment, 11100100 is used as the update value of the control map. In this embodiment, Figure 4 and Figure 12 The three conversion inhibition maps shown are used as the conversion inhibition map 52. Therefore, the update value of the control map matches the third conversion inhibition map 52. Therefore, the first comparator 40 determines that the update value of the control map matches the conversion inhibition map 52.

[0173] In step S13, power is supplied according to the load control signal. The first comparator 40 outputs a normal signal indicating that the update value of the control map is normal. When the normal signal is input, the driving IC 20 energizes the actuator 40n according to the load control signal written in the control register 11. That is, the CAN controller 2 stores the update value of the control map in the control register 11. The driving IC 20 selectively turns on and off the driving switches 301 to 308 according to the update value of the control map stored in the control register 11. Therefore, the driving IC 20 selectively energizes the actuator 40n.

[0174] In step S14, an abnormality notification is provided. The first comparator 40 outputs an abnormal signal indicating that the update value of the control map is abnormal to the ECU 200. Therefore, the first comparator 40 notifies the ECU 200 of the abnormality. As described above, by using the first comparator 40 instead of the calculation of the microcomputer, the driving device 100 can quickly notify the ECU 200 of the abnormality. That is, the driving device 100 can notify the ECU 200 of the abnormality earlier than the configuration using the calculation of the microcomputer by using the first comparator 40.

[0175] In step S15, the power supply is cut off. The first comparator 40 outputs an abnormal signal indicating that the update value of the control map is abnormal to the power supply circuit 70. The first comparator 40 outputs an abnormal signal to the power supply circuit 70, and thus gives an instruction to cut off the power supply to the actuator 40n. When the abnormal signal is input, the power supply circuit 70 turns off the power supply switch 500 to block the current supply to each actuator 40n. Therefore, the driving device 100 can prevent the actuator 40n from being driven by an abnormal control map.

[0176] In the present disclosure, at least one of step S14 and step S15 can be executed.

[0177] The first comparator 40 can output the abnormal signal to the driving IC 20 instead of outputting the abnormal signal to the power supply circuit 70. In this case, the driving IC 20 selectively turns on and off the driving switches 301 to 308 according to the previous value of the control map. Therefore, the driving IC 20 selectively energizes the actuator 40n.

[0178] <Effect>

[0179] As described above, the drive device 100 stores the transition prohibition map 52. By comparing the updated value of the control map with the transition prohibition map 52, the drive device 100 can determine whether the updated value of the control map is abnormal and indicates a transition to the prohibited transition map.

[0180] More specifically, the drive device 100 can determine whether the updated value of the control map received by the CAN controller 2 is abnormal, rather than the current value of the control map stored in the control register 11. Therefore, the drive device 100 can determine whether the load control signal included in the frame transmitted via the communication bus B1 has been tampered with, such as by spoofing. Therefore, the drive device 100 can take measures to prevent the updated value of the control map from being tampered with without performing complex processes such as authentication or encryption of communication using a microcomputer.

[0181] The drive device 100 can determine whether the updated value of the received control map is abnormal before controlling the drive of each actuator 40n. That is, the drive device 100 can limit the actuator 40n from being driven by an abnormal control map.

[0182] Countermeasures against tampering can be authentication or encryption of communication using a microcomputer as described above. However, countermeasures based on authentication or encryption always need to be updated. Therefore, in this method, the program of the microcomputer needs to be updated, thus increasing the cost.

[0183] Another countermeasure against tampering can be to monitor communication using a microcomputer. However, in order to monitor communication, the communication capacity increases due to the encryption of messages or communication, and thus the communication speed decreases. Therefore, using this method, the cost of improving the communication speed is required.

[0184] On the other hand, since the drive device 100 does not use a microcomputer, it is possible to limit the increase in cost as described above. That is, the drive device 100 can prevent the transition to the prohibited transfer map due to tampering at a lower cost than using a microcomputer.

[0185] As the determination map, a transition permission pattern can be adopted. The transition permission pattern represents such a drive state in which a drive transition from the drive state represented by the previous value of the control map is permitted. However, the drive device 100 stores the transition prohibition map 52 in the ROM 50 as the determination map. The transition prohibition map 52 has fewer maps than the transition permission pattern. Therefore, the drive device 100 can reduce the capacity occupied by the determination map in the ROM 50.

[0186] Unlike the ECU 200, the drive device 100 does not include a microcomputer. Therefore, the drive device 100 can be manufactured smaller in size than a configuration including a microcomputer. Compared with a configuration including a microcomputer, the drive device 100 can reduce power consumption and heat generation. Therefore, compared with a configuration including a microcomputer, the drive device 100 can reduce the limitations on the body size and mountability due to heat generation. That is, compared with a configuration including a microcomputer, the drive device 100 can improve the degree of freedom of installation. Compared with a configuration including a microcomputer, the drive device 100 can simplify the functional safety and reliability countermeasures.

[0187] The drive system 1000 includes the drive device 100. Therefore, the drive system 1000 can take measures to prevent the tampering of the updated value of the control map in the drive device 100 without performing complex processes such as authenticating and encrypting communication using a microcomputer. Compared with using a drive device including a microcomputer, the drive system 1000 can increase with less cost and prevent the transformation to a prohibited conversion map due to tampering at a lower cost. The drive system 1000 can reduce the capacity occupied by the determination map in the ROM 50. Compared with using a drive device including a microcomputer, the drive system 1000 can improve the degree of freedom of installation and reduce the functional safety and confidentiality countermeasures.

[0188] The comparison target of the conversion prohibition map 52 and the conversion prohibition map 52 is not limited to the above. For example, as Figure 13 shown in Variant Example 1, the conversion map in which the previous value and the updated value of the control map are arranged can be used as the comparison target of the conversion prohibition map 52. In this case, the conversion prohibition map 52 can adopt the map obtained by arranging the previous value of the control map and the energization map indicating the following drive state, that is, in this drive state, the drive conversion from the drive state represented by the previous value is prohibited. The first comparator 40 compares the conversion map with the conversion prohibition map 52.

[0189] In Figure 13 the example, as an example, a conversion map is shown in which a control map representing the fourth gear speed as the previous value of the control map and a control map representing the first gear speed as the updated value are arranged. In this case, the conversion prohibition map 52 adopts the map obtained by the following arrangement, that is, arranging the control map representing the fourth gear speed and the control map representing the P gear, arranging the control map representing the fourth gear speed and the control map representing the R gear, and arranging the control map representing the fourth gear speed and the control map representing the first gear speed.

[0190] The comparison target of the conversion prohibition map 52 and the conversion prohibition map 52 can adopt an even map converted into identifiers (identifiers). For example, as Figure 14 As shown in Variant Example 2, the control map (updated value and previous value) and the conversion prohibition map 52 adopt maps that are converted into 4-bit identifiers. The first comparator 40 compares the identifier into which the updated value of the control map is converted with the identifier into which the conversion prohibition map 52 is converted.

[0191] Variant Examples 1 and 2 can be implemented in combination. In this case, the conversion map is a map obtained by arranging the identifier into which the previous value of the control map is converted and the identifier into which the updated value of the control map is converted. Similarly, the conversion prohibition map 52 is a map obtained by arranging the identifier into which the previous value of the control map is converted and the identifier into which the energization map is converted, where the energization map represents a drive state in which a drive transition from the drive state represented by the previous value is prohibited.

[0192] Preferred embodiments of the present disclosure have been described above. However, the present disclosure is not limited to the above embodiments, and various modifications can be made without departing from the spirit of the present disclosure. Hereinafter, Second to Tenth Embodiments, which are other forms of the present disclosure, will be described. The above embodiments and the Second to Tenth Embodiments can be implemented independently or in appropriate combination. The present disclosure is not limited to the combinations described in these embodiments, and can be implemented in various combinations.

[0193] (Second Embodiment)

[0194] Reference will be made to Figure 15 Describe the drive device 100 and the drive system 1000 according to the second embodiment. In this embodiment, the description will focus on the parts different from the above embodiments. Parts similar to the above embodiments can be appropriately adopted. This also applies to the following embodiments.

[0195] The drive device 100 and the drive system 1000 of this embodiment have the same configuration as the first embodiment. Therefore, in this embodiment, the same reference numerals as those in the first embodiment are used. The difference between this embodiment and the first embodiment is that a conversion permission map is used instead of the conversion prohibition map 52.

[0196] The ROM 50 stores the energization map 51 and the transition permission map. That is, the ROM 50 includes an energization map memory that stores the energization map 51 and a transition permission map memory that stores the transition permission map. The ROM 50 corresponds to the determination storage unit.

[0197] The transition permission map is an energization map that represents the drive state of each actuator 40n. The transition permission map is a value associated with a drive transition from the current drive state. The transition permission map is a determination value for determining whether the updated value of the control map is abnormal. The ROM 50 stores the control map and the transition permission map in an associated manner.

[0198] The transition permission map represents such a drive state in which a drive transition from the drive state represented by the previous value of the control map is permitted. That is, the transition permission map represents a drive transition permitted from the current drive state. In other words, the transition permission map is an energization map representing drive transitions caused by operations permitted by the automatic transmission. The transition permission map corresponds to a transition determination value or a permission determination value.

[0199] When a load drive signal is received, the drive device 100 starts Figure 15 the operations shown in the flowchart of. In Figure 15 the same step numbers are assigned to the same processes as in Figure 7 .

[0200] In step S10b, the transition permission map is set. The timing circuit 30 sets the transition permission map in the fourth data register 64 in the same manner as the transition prohibition map 52 is set. That is, the timing circuit 30 selects the transition permission map corresponding to the previous value of the control map from the ROM 50 and sets the transition permission map in the fourth data register 64.

[0201] In step S12b, the received signal is compared with the transition permission map. The received signal corresponds to the updated value of the control map. The first comparator 40 compares the updated value of the control map set in the first data register 61 with the transition permission map set in the fourth data register 64 (determination unit). When a plurality of transition permission maps are stored in the ROM 50, the comparison is made in the same manner as in the above-described embodiment.

[0202] When the first comparator 40 determines that the updated value of the control map matches at least one transition permission map, the process proceeds to step S13. In this case, it can be considered that the updated value of the control map is normal. As described above, when the updated value of the control map matches at least one transition permission map, the first comparator 40 determines that a predetermined correspondence relationship is not satisfied.

[0203] On the other hand, when the first comparator 40 determines that the updated value of the control map does not match any transition permission map, the process proceeds to step S14. In this case, it can be considered that the updated value of the control map is abnormal. As described above, when the updated value of the control map does not match any transition permission map, the first comparator 40 determines that a predetermined correspondence relationship is satisfied. When the transition permission map does not match the updated value of the control map, it indicates that the updated value of the control map is not included in the transition permission map.

[0204] The driving device 100 of the second embodiment can achieve the same effects as the driving device 100 of the first embodiment. The driving system 1000 of the second embodiment can achieve the same effects as the driving system 1000 of the first embodiment.

[0205] (Third Embodiment)

[0206] Reference will be made to Figure 16 Describe the driving device 100 and the driving system 1000 according to the third embodiment. For example, the driving device 100 and the driving system 1000 of this embodiment have the same configuration as those in the first embodiment. Therefore, in this embodiment, the same reference numerals as those in the first embodiment are used.

[0207] The difference between this embodiment and the first embodiment is that the vehicle speed determined by the waveform analysis circuit 90 is used as the current driving state instead of the previous value of the control map. Therefore, the driving device 100 of this embodiment needs to include the waveform analysis circuit 90.

[0208] The shift prohibition map 52 is stored in association with the vehicle speed determined by the waveform analysis circuit 90 and which is the current driving state. The shift prohibition map 52 is stored in association with a signal representing each vehicle speed, and each vehicle speed is represented by 0 and 1, for example. For example, the shift prohibition map 52 associated with a high speed adopts an energization map representing the first gear speed, the P range, and the R range. The shift prohibition map 52 associated with a low speed adopts an energization map representing the P range and the R range. The shift prohibition map 52 associated with a stopped state adopts an energization map representing the third gear speed and the fourth gear speed. The shift prohibition map 52 corresponds to a shift determination value or a prohibition determination value.

[0209] When receiving a load driving signal, the driving device 100 starts Figure 16 the operations shown in the flowchart. Step S25 is the same as step S11. Step S26a is the same as step S12a. Steps S27 to S29 are the same as steps S13 to S15.

[0210] In step S20, a rotation sensor signal is received. The waveform analysis circuit 90 receives the rotation sensor signal from the rotation sensor 600.

[0211] In step S21, the vehicle speed is determined. The waveform analysis circuit 90 determines the vehicle speed based on the received rotation sensor signal. When the waveform analysis circuit 90 determines that the vehicle speed is high, the process proceeds to step S22. When the waveform analysis circuit 90 determines that the vehicle speed is low, the process proceeds to step S23. When the waveform analysis circuit 90 determines that the vehicle has stopped, the process proceeds to step S24.

[0212] In step S22, a conversion prohibition map associated with a high speed is set according to the memory setting. The timing circuit 30 sets, in the fourth data register 64, the conversion prohibition map 52 related to the high speed from the ROM 50.

[0213] In step S23, a conversion prohibition map associated with a low speed is set according to the memory setting. The timing circuit 30 sets, in the fourth data register 64, the conversion prohibition map 52 associated with the low speed from the ROM 50.

[0214] In step S24, a conversion prohibition map associated with a stop state is set according to the memory setting. The timing circuit 30 sets, in the fourth data register 64, the conversion prohibition map 52 associated with the stop state from the ROM 50.

[0215] As described above, the timing circuit 30 acquires, from the ROM 50, the conversion prohibition map 52 associated with the vehicle speed acquired by the waveform analysis circuit 90. The memory in steps S22 to S24 is the conversion prohibition map memory in the ROM 50.

[0216] The drive device 100 of the third embodiment can achieve the same effect as the drive device 100 of the first embodiment. The drive system 1000 of the third embodiment can achieve the same effect as the drive system 1000 of the first embodiment.

[0217] (Fourth Embodiment)

[0218] will be described with reference to Figure 17 the drive device 100 and the drive system 1000 according to the fourth embodiment. The drive device 100 and the drive system 1000 of this embodiment have the same configuration as those of the first embodiment. Therefore, in this embodiment, the same reference numerals as those in the first embodiment are used. In this embodiment, in the same manner as in the third embodiment, the vehicle speed determined by the waveform analysis circuit 90 is used as the current drive state. Therefore, the drive device 100 of this embodiment needs to include the waveform analysis circuit 90. In this embodiment, in the same manner as in the second embodiment, the conversion permission map is used as the conversion determination value.

[0219] The conversion permission map is stored in association with the vehicle speed determined by the waveform analysis circuit 90 and being the current driving state. The conversion permission map is stored in association with a signal representing each vehicle speed, where each vehicle speed is represented by, for example, 0 and 1. The conversion permission map associated with a high speed adopts the energization maps representing the second gear speed, the third gear speed, and the fourth gear speed. The conversion permission map associated with a low speed adopts the energization maps representing the first gear speed, the second gear speed, and the third gear speed. The conversion permission map associated with the stop state adopts the energization maps representing the first gear speed, the second gear speed, the P gear, and the R gear. The conversion permission map corresponds to a conversion determination value or a permission determination value.

[0220] When receiving the load driving signal, the driving device 100 starts Figure 17 the operation shown in the flowchart of. In Figure 17 the same step numbers are assigned to the same processes as in Figure 16 Note that step S26b is the same as step S12b.

[0221] In step S22a, the conversion permission map associated with a high speed is set according to the memory setting. The timing circuit 30 sets the conversion permission map associated with a high speed from the ROM 50 in the fourth data register 64.

[0222] In step S23a, the conversion permission map associated with a low speed is set according to the memory setting. The timing circuit 30 sets the conversion permission map associated with a low speed from the ROM 50 in the fourth data register 64.

[0223] In step S24a, the conversion permission map associated with the stop state is set according to the memory setting. The timing circuit 30 sets the conversion permission map associated with the stop state from the ROM 50 in the fourth data register 64.

[0224] As described above, the timing circuit 30 acquires the conversion permission map associated with the vehicle speed obtained by the waveform analysis circuit 90 from the ROM 50. The memory in steps S22a to S24a is the conversion permission map memory in the ROM 50.

[0225] The driving device 100 of the fourth embodiment can achieve the same effects as the driving devices 100 of the first, second, and third embodiments. The driving system 1000 of the fourth embodiment can achieve the same effects as the driving systems 1000 of the first, second, and third embodiments.

[0226] (Fifth Embodiment)

[0227] Reference will be made to Figure 18 Describe the drive device 100 and the drive system 1000 according to the fifth embodiment. The drive device 100 and the drive system 1000 of this embodiment have the same configuration as those of the first embodiment. Therefore, in this embodiment, the same reference numerals as those in the first embodiment are used. The difference between this embodiment and the first embodiment is that the monitor map stored in the monitor register 84 is used as the updated value of the relevant drive state instead of the control map. Therefore, the drive device 100 of this embodiment needs to include a current detection resistor 81, an amplifier 82, a second comparator 83, and a monitor register 84. The conversion prohibition map 52 of this embodiment is the same as that in the first embodiment.

[0228] When receiving a load drive signal, the drive device 100 starts Figure 18 the operations shown in the flowchart of. In Figure 18 the same step numbers are assigned to the same processes as those in Figure 17 the same.

[0229] In step S12c, control starts. The CAN controller 2 stores the updated value of the control map in the control register 11. The drive IC 20 selectively turns on and off the drive switches 301 to 308 according to the updated value of the control map stored in the control register 11. Therefore, the drive IC 20 selectively energizes the actuator 40n. It can be considered that the drive IC 20 performs control to obtain the monitor map.

[0230] In step S12d, the control result is monitored. The drive device 100 stores the monitor map in the monitor register 84 by operating the current detection resistor 81, the amplifier 82, and the second comparator 83 as described above.

[0231] In step S12e, the monitoring result is compared with the conversion prohibition map. The monitoring result corresponds to the monitor map. The first comparator 40 compares the monitor map set in the first data register 61 with the conversion prohibition map 52 set in the fourth data register 64. When multiple conversion prohibition maps 52 are stored in the ROM 50, the comparison is performed in the same manner as in the above embodiments.

[0232] When the first comparator 40 determines that the monitor map does not match any of the conversion prohibition maps 52, the process proceeds to step S13. In this case, the monitor map is considered normal. Since the monitor map is normal, the updated value of the control map is considered normal.

[0233] On the other hand, when the first comparator 40 determines that the monitor map matches the conversion prohibition map 52, the process proceeds to step S14. That is, when the first comparator 40 determines that at least one of the conversion prohibition map 52 matches the monitor map, the process proceeds to step S14. In this case, the monitor map is considered abnormal. As described above, when at least one of the conversion prohibition map 52 matches the monitor map, the first comparator 40 determines that a predetermined correspondence relationship is satisfied. Since the monitor map is abnormal, the updated value of the control map is considered abnormal.

[0234] The drive device 100 of the fifth embodiment can achieve the same effects as the drive device 100 of the first embodiment. The drive system 1000 of the fifth embodiment can achieve the same effects as the drive system 1000 of the first embodiment. For example, even when the actual command is to shift the automatic transmission from the fourth gear to the P gear, the automatic transmission does not immediately shift to the P gear due to the response of hydraulic pressure or the like. Therefore, the drive device 100 can use the monitor map instead of the updated value of the control map.

[0235] (Sixth Embodiment)

[0236] will be described with reference to Figure 19 the drive device 100 and the drive system 1000 according to the sixth embodiment. The drive device 100 and the drive system 1000 of this embodiment have the same configuration as those of the first embodiment. Therefore, in this embodiment, the same reference numerals as those in the first embodiment are used. In this embodiment, in the same manner as in the fifth embodiment, the monitor map stored in the monitor register 84 is used as the relevant drive state instead of the updated value of the control map. In this embodiment, in the same manner as in the second embodiment, the conversion permission map is used as the conversion determination value.

[0237] When receiving the load drive signal, the drive device 100 starts Figure 19 the operation shown in the flowchart of Figure 19 In Figure 7 and Figure 15 the same step numbers are assigned to the same processes as those in

[0238] In step S12h, the monitoring result and the conversion permission map are compared with each other. The monitoring result corresponds to the monitor map. The first comparator 40 compares the monitor map set in the first data register 61 with the conversion permission map set in the fourth data register 64. When multiple conversion permission maps are stored in the ROM 50, the comparison is performed in the same manner as in the above embodiments.

[0239] When the first comparator 40 determines that the monitor map matches at least one transition-permitted map, the process proceeds to step S13. In this case, the monitor map is considered normal. As described above, when the monitor map matches at least one transition-permitted map, the first comparator 40 determines that a predetermined correspondence relationship is not satisfied.

[0240] On the other hand, when the first comparator 40 determines that the monitor map does not match any transition-permitted map, the process proceeds to step S14. In this case, the monitor map is considered abnormal. As described above, when the monitor map does not match any transition-permitted map, the first comparator 40 determines that a predetermined correspondence relationship is satisfied. When the transition-permitted map does not match the monitor map, it means that the monitor map is not included in the transition-permitted map.

[0241] The drive device 100 of the sixth embodiment can achieve the same effects as the drive devices 100 of the first, second, and fifth embodiments. The drive system 1000 of the sixth embodiment can achieve the same effects as the drive systems 1000 of the first, second, and fifth embodiments.

[0242] (Seventh Embodiment)

[0243] will be described with reference to Figure 20 the drive device 100 and the drive system 1000 according to the seventh embodiment. The drive device 100 and the drive system 1000 of this embodiment have the same configuration as those of the first embodiment. Therefore, in this embodiment, the same reference numerals as those in the first embodiment are used.

[0244] In this embodiment, in the same manner as in the third embodiment, the vehicle speed determined by the waveform analysis circuit 90 is used as the current driving state. Therefore, the drive device 100 of this embodiment needs to include the waveform analysis circuit 90. The transition-prohibited map 52 of this embodiment is the same as that in the third embodiment.

[0245] In this embodiment, in the same manner as in the fifth embodiment, the monitor map is used as the relevant driving state. Therefore, the drive device 100 of this embodiment needs to include the current detection resistor 81, the amplifier 82, the second comparator 83, and the monitor register 84.

[0246] When receiving the load drive signal, the drive device 100 starts Figure 20 the operations shown in the flowchart of. In Figure 20 , the same step numbers are assigned to the same processes as in Figure 16 and Figure 18 . Steps S26c to S26e are the same as steps S12c to S12e.

[0247] The drive device 100 of the seventh embodiment can achieve the same effects as the drive devices 100 of the first, third, and fifth embodiments. The drive system 1000 of the seventh embodiment can achieve the same effects as the drive systems 1000 of the first, third, and fifth embodiments.

[0248] (Eighth Embodiment)

[0249] Reference will be made to Figure 21 Describe the drive device 100 and the drive system 1000 according to the eighth embodiment. The drive device 100 and the drive system 1000 of this embodiment have the same configuration as those of the first embodiment. Therefore, in this embodiment, the same reference numerals as those in the first embodiment are used.

[0250] In this embodiment, in the same manner as in the fourth embodiment, the vehicle speed determined by the waveform analysis circuit 90 is used as the current driving state. Therefore, the drive device 100 of this embodiment needs to include the waveform analysis circuit 90. The conversion permission map of this embodiment is the same as that of the fourth embodiment.

[0251] In this embodiment, in the same manner as in the sixth embodiment, the monitor map is used as the relevant driving state. Therefore, the drive device 100 of this embodiment needs to include the current detection resistor 81, the amplifier 82, the second comparator 83, and the monitor register 84.

[0252] When receiving the load drive signal, the drive device 100 starts Figure 21 the operations shown in the flowchart of. In Figure 21 the same step numbers are assigned to the same processes as those in Figure 17 and Figure 19 The steps S26f to S26h are the same as the steps S12f to S12h.

[0253] The drive device 100 of the eighth embodiment can achieve the same effects as the drive devices 100 of the first, fourth, and sixth embodiments. The drive system 1000 of the eighth embodiment can achieve the same effects as the drive systems 1000 of the first, fourth, and sixth embodiments.

[0254] (Ninth Embodiment)

[0255] The drive device 100 and the drive system 1000 of the ninth embodiment will be described with reference to Figure 22 , Figure 23 and Figure 24 A description will be given. The difference between this embodiment and the first embodiment is that each detection result from the sensor detection circuit 91 is used as the current driving state instead of the previous value of the control map. The driving device 100 of this embodiment is different from the driving device 100 of the first embodiment in that a sensor detection circuit 91 is provided. The sensor detection circuit 91 is connected to the sensor 700.

[0256] The sensor 700 of this embodiment includes a hydraulic sensor 701 (OPS), a rotation sensor 702 (RS), and an oil temperature sensor 703 (OTS). The hydraulic sensor 701 outputs a signal representing the pressure of the hydraulic oil in the hydraulic circuit. The rotation sensor 702 is similar to the rotation sensor 600. The oil temperature sensor 703 outputs a signal representing the temperature of the hydraulic oil in the hydraulic circuit.

[0257] The sensor detection circuit 91 (SEND) detects the signals from the sensor 700. The sensor detection circuit 91 performs predetermined processing such as waveform detection and A / D conversion on the input signals from the sensor 700. The sensor detection circuit 91 detects the state of the state load, that is, the state of the automatic transmission including the valve body. That is, the state of the automatic transmission including the valve body is regarded as the current driving state representing the current driving state of each actuator 40n. Similarly, each detection result from the sensor detection circuit 91 is regarded as the current driving state. The sensor detection circuit 91 corresponds to the acquisition unit.

[0258] Each detection result from the sensor detection circuit 91 can be represented by, for example, 0 and 1. The sensor detection circuit 91 outputs each detection result to the timing circuit 30. The sensor detection circuit 91 can write each detection result into the monitor register 84.

[0259] The ROM 50 stores the detection results and the conversion prohibition map 52 in an associated manner. Instead of the conversion prohibition map 52, a conversion permission map can be stored in the ROM 50 in association with each detection result. Here, as an example, the conversion prohibition map 52 is adopted.

[0260] The driving device 100 starts at each predetermined time Figure 23 the operations shown in the flowchart.

[0261] In step S30, communication data is received. The CAN controller 2 receives a frame from the communication bus B1 via the CAN transceiver 1. The CAN controller 2 extracts the received message, etc., and sequentially stores the extracted message into the message box.

[0262] In step S31, data is extracted. The CAN controller 2 extracts the data representing the load control signal from the message box. The CAN controller 2 stores the extracted data representing the load control signal in a register. The data representing the load control signal stored in the register corresponds to the updated value of the control map. The timing circuit 30 sets the updated value of the control map in the first data register 61.

[0263] In step S32, the status is obtained. The timing circuit 30 sets the previous value of the control map stored in the control register 11 in the second data register 62.

[0264] In step S33, the transition is determined. The timing circuit 30 determines the drive transition based on the updated value of the control map extracted in step S31 and the previous value of the control map obtained in step S32. That is, the timing circuit 30 determines the drive transition from the current drive state to the drive state represented by the updated value of the control map.

[0265] For example, as Figure 13 shown, the timing circuit 30 determines the drive transition by generating a transition map by combining between the updated value of the control map and the previous value of the control map. In this case, as Figure 13 shown, the timing circuit 30 sets the transition inhibition map 52 corresponding to the transition map in the fourth data register 64.

[0266] In step S34, a comparison is made. The first comparator 40 compares the transition map with the transition inhibition map 52. When the first comparator 40 determines that the transition map does not match any transition inhibition map 52, the process proceeds to step S35. In this case, it can be considered that the updated value of the control map is normal.

[0267] On the other hand, when the first comparator 40 determines that the transition map matches the transition inhibition map 52, the process proceeds to step S37. That is, when the first comparator 40 determines that at least one of the transition inhibition maps 52 matches the updated value of the control map, the process proceeds to step S37. In this case, it can be considered that the updated value of the control map is abnormal.

[0268] In step S35, it is determined that the communication is normal. The first comparator 40 determines that the communication is normal. In this case, the first comparator 40 can output a normal signal to the ECU 200 via the second signal line L2.

[0269] In step S36, the drive IC is controlled. Step S36 is the same as step S13.

[0270] In step S37, the data is discarded. As described above, the first comparator 40 outputs an abnormal signal indicating an abnormality in the updated value of the control map to the CAN controller 2. When the abnormal signal is input, the CAN controller 2 discards the updated value of the control map without outputting the updated value to the SPI circuit 10. The CAN controller 2 discards the updated value of the control map by not outputting the updated value of the control map to the SPI circuit 10. The CAN controller 2 can discard the updated value of the control map by erasing the updated value of the control map stored when the abnormal signal is input.

[0271] As described above, the first comparator 40 outputs an abnormal signal to the CAN controller 2, so the updated value of the control map determined to be abnormal is not stored in the control register 11. Therefore, the drive device 100 does not write the updated value of the control map determined to be abnormal to the control register 11. Therefore, the drive device 100 can limit the control of the updated value of the control map determined to be abnormal for driving each actuator 40n.

[0272] In step S38, a notification of data discard is provided. The first comparator 40 outputs an abnormal signal to the ECU 200 via the second signal line L2. The abnormal signal indicates that the updated value of the control map is abnormal and is a signal for providing a notification of data discard. The data here is the updated value of the control map. In the drive device 100, the first comparator 40 outputs an abnormal signal without using a microcomputer or the like.

[0273] The first comparator 40 does not necessarily output an abnormal signal to the power supply circuit 70. Steps S37 and S38 can also be applied to other embodiments.

[0274] The operation of the ECU 200 will be described. The ECU 200 starts the operation shown in the flowchart at each predetermined time Figure 24 as shown.

[0275] In step S40, it is determined whether there is a load drive conversion. The CPU 2011 determines whether there is a load drive conversion by determining the load control signal that gives an instruction to the drive device 100.

[0276] In step S41, an instruction for load drive is given. The CPU 2011 transmits data representing the load control signal as communication data. In this case, the CPU 2011 stores the data representing the load control signal determined in step S40 in the transmission message box of the CAN controller 2012. The CAN controller 2012 generates a frame including the data representing the load control signal and transmits the frame to the communication bus B1 via the CAN transceiver 203.

[0277] In step S42, it is determined whether there is a notification of data discard. The CPU 2011 determines whether there is a discard notification based on whether it has received a notification of data discard from the drive device 100 via the second signal line L2. When the discard notification has been received, the CPU 2011 determines that there is a discard notification, and the process proceeds to step S43. When the discard notification has not been received, the CPU 2011 determines that there is no discard notification, and the process proceeds to step S44.

[0278] In step S43, the determination is normal. The CPU 2011 determines that the communication with the drive device 100 is normal.

[0279] In step S44, the notifications are counted. The CPU 2011 counts the discard notifications.

[0280] In step S45, it is determined whether N>5. When the CPU 2011 determines that the count N of the discard notifications exceeds 5, the process proceeds to step S46. When the CPU 2011 determines that the count N does not exceed 5, the process returns to step S41. Here, five corresponds to a predetermined number of times.

[0281] When the process returns to step S41, the CPU 2011 sends the load control signal again. Therefore, the CPU 2011 sends the provided notification and the load control signal that is abnormal again until the count of the discard notifications reaches five.

[0282] Here, the predetermined count as the counting threshold is five. However, the present disclosure is not limited thereto. The smaller the threshold, the faster the communication abnormality can be determined. On the other hand, the larger the threshold, the fewer determination errors of the occurrence of the communication abnormality.

[0283] In step S46, the communication abnormality is determined. The CPU 2011 determines that the communication with the drive device 100 using the communication bus B1 is abnormal. That is, the CPU 2011 determines that the communication bus B1 is under attack from the outside and cannot normally send the load control signal to the drive device 100.

[0284] In step S47, an emergency blocking is executed. The CPU 2011 outputs an emergency blocking instruction to the power supply circuit 70 via the first signal line L1. That is, the CPU 2011 outputs the emergency blocking instruction to the power supply circuit 70 without using the CAN controller 2012 and the CAN transceiver 203. Therefore, the CPU 2011 can limit the driving of each actuator 40n to be controlled based on the load control signal transmitted via the communication bus B1 where the communication abnormality has occurred. Figure 24 The flowchart can also be applied to other embodiments. The CPU 2011 can output an instruction for converting to a specific shift state via the first signal line L1. In other words, as long as the CPU 2011 outputs an instruction for setting the energization of the load to a predetermined abnormal processing state via the first signal line L1, the CPU 2011 can be adopted.

[0285] The drive device 100 of the ninth embodiment can achieve the same effect as the drive device 100 of the first embodiment. The drive system 1000 of the ninth embodiment can achieve the same effect as the drive system 1000 of the first embodiment. In the drive system 1000 of the ninth embodiment, when a communication abnormality occurs, the ECU 200 can set the power supply state of each actuator 40n to the blocking state. Therefore, in the drive system 1000 of the ninth embodiment, the drive device 100 can be configured more simply.

[0286] (Tenth Embodiment)

[0287] Reference will be made to Figure 25 describe the drive device 100 and the drive system 1000 of the tenth embodiment. In this embodiment, for convenience, the same reference numerals as those in the first embodiment are used.

[0288] The difference between the tenth embodiment and the above embodiments is that the drive device 100 controls the drive of the motor 800 in the shift-by-wire system. Therefore, the actuators 401 to 403 correspond to the U-phase winding, the V-phase winding, and the W-phase winding of the motor 800, respectively.

[0289] The drive device 100 of this embodiment is different from the drive device 100 of the first embodiment in that a sensor detection circuit 92 is provided. The difference between this embodiment and the first embodiment is that each detection result from the sensor detection circuit 92 is used as the current drive state instead of the previous value of the control map. The difference between this embodiment and the first embodiment is that the conversion determination value is a value related to the drive conversion from the current drive state and the vehicle state.

[0290] The difference between this embodiment and the first embodiment is that the signal indicating the drive state of each of the actuators 401 to 403 in the load control signal is written into the bits at the corresponding addresses in the control register 11. In this embodiment, the updated value of the control map is adopted as the relevant drive state of each of the actuators 401 to 408 related to the updated value of the control map stored in the control register 11.

[0291] In addition to the motor 800, the by-wire shift system further includes a parking lock (P lock) mechanism, a gear shift mechanism, etc. When power is supplied from a battery (not shown) installed in a vehicle, the motor 800 rotates and serves as a drive source for the gear shift mechanism. The motor 800 can supply current to each actuator 40n by turning on the power feed switch 500. When the power feed switch 500 is turned off, the current supply to each actuator 40n is blocked.

[0292] The updated value of the control map can adopt, for example, a value indicating the release of the parking lock. That is, the ECU 200 causes the load control signal for the drive device 100 to include not only a signal indicating the rotation of the motor 800 but also a signal indicating the release of the parking lock.

[0293] The sensors in this embodiment include a brake switch 704 and a parking lock sensor 705. The brake switch 704 (BS) outputs a signal indicating whether the brake pedal is depressed. The brake switch 704 can output a signal corresponding to the depression amount of the brake pedal. The parking lock sensor 705 (PLS) outputs a signal indicating whether the parking lock is in a locked state or an unlocked state.

[0294] The sensor detection circuit 92 (SEND) detects the signals from the sensors 700. The sensor detection circuit 92 performs predetermined processing such as waveform detection and A / D conversion on the input signals from the sensors 700. The sensor detection circuit 92 detects the state of the load, that is, the state of the by-wire shift system. That is to say, the state of the by-wire shift system is regarded as the current drive state indicating the current drive state of each actuator 40n. Similarly, the detection result from the sensor detection circuit 92 is regarded as the current drive state. The sensor detection circuit 92 detects the depression state of the brake pedal of the vehicle. The depression state of the brake pedal of the vehicle is regarded as the vehicle state. The sensor detection circuit 92 corresponds to the acquisition unit.

[0295] Each detection result from the sensor detection circuit 92 can be represented by, for example, 0 and 1. The sensor detection circuit 92 outputs each detection result to the timing circuit 30. The sensor detection circuit 92 can write each detection result into the monitor register 84.

[0296] The ROM 50 stores the detection results from the sensor detection circuit 92 and the conversion prohibition map 52 in an associated manner. That is, the conversion prohibition map 52 is associated with the current drive state and the vehicle state. Instead of the conversion prohibition map 52, a conversion permission map can be stored in the ROM 50 in association with each detection result. Here, as an example, the conversion prohibition map 52 is adopted.

[0297] The sequential circuit 30 determines the current driving state and the vehicle state based on each detection result. The sequential circuit 30 sets the transition prohibition map 52 associated with each detection result in the fourth data register 64. The transition prohibition map 52 can adopt, for example, an updated value of a control map indicating the release of the parking lock in a state where the parking lock is locked and the brake pedal is not depressed.

[0298] The first comparator 40 compares the updated value of the control map with the transition prohibition map 52 in the same manner as in the above-described embodiment. When the updated value of the control map matches the transition prohibition map 52, the first comparator 40 determines that the updated value of the control map is abnormal, and when the updated value does not match the transition prohibition map 52, it determines that the updated value of the control map is normal.

[0299] The drive device 100 of the tenth embodiment can achieve the same effects as the drive device 100 of the first embodiment. The drive system 1000 of the tenth embodiment can achieve the same effects as the drive system 1000 of the first embodiment.

[0300] The controllers and methods described in this disclosure can be implemented by a special-purpose computer created by configuring a memory and a processor programmed to execute one or more specific functions embodied in a computer program. Alternatively, the controllers and methods described in this disclosure can be implemented by a special-purpose computer created by configuring a processor provided by one or more dedicated hardware logic circuits. Alternatively, the controllers and methods described in this disclosure can be implemented by one or more special-purpose computers created by configuring a combination of a memory, a processor programmed to execute one or more specific functions, and a processor provided by one or more hardware logic circuits. The computer program can be stored as instructions executed by a computer in a tangible non-transitory computer-readable medium.

[0301] It should be noted that the flowcharts or the processing of the flowcharts in this application include blocks (also referred to as steps), and each block is represented as, for example, S10a. In addition, each block (section) can be divided into several sub-blocks, and several blocks can be combined into a single block. In addition, each of the blocks configured in this way can also be referred to as a device, a module, or an institution.

[0302] Although the present disclosure has been described with reference to the embodiments of the present disclosure, it should be understood that the present disclosure is not limited to these embodiments and configurations. The present disclosure aims to cover various modifications and equivalent arrangements. In addition, although various combinations and configurations, including other combinations and configurations with more, fewer, or only a single element, are also within the spirit and scope of the present disclosure.< / ecu>

Claims

1. A driving device that drives a plurality of loads by controlling a plurality of semiconductor switches corresponding to the plurality of loads, the driving device comprising: A receiving unit (1, 2) that receives a load control signal from an external control device, the load control signal including a signal indicating the driving state of each load; A control storage unit (11) that stores the load control signal received by the receiving unit; A driving unit (20) that controls the plurality of semiconductor switches according to the load control signal stored in the control storage unit; An acquisition unit that acquires a current driving state as the driving state of each load at the current moment or acquires a current vehicle state; A determination storage unit (50) that stores a conversion determination value for determining whether the load control signal received by the receiving unit is abnormal, the conversion determination value being associated with a driving conversion from the current driving state or the current vehicle state; And A determination unit (30, 40) that compares the relevant driving state of each load associated with the load control signal received by the receiving unit with the conversion determination value, and determines that the load control signal received by the receiving unit is abnormal when the relevant driving state and the conversion determination value satisfy a predetermined correspondence relationship.

2. The driving device according to claim 1, wherein: The determination unit does not store the load control signal determined to be abnormal in the control storage unit.

3. The driving device according to claim 1, wherein: The determination storage unit is configured to be inaccessible via the receiving unit.

4. The driving device according to claim 1, wherein: The determination storage unit stores a prohibition determination value indicating a prohibition of driving conversion from the current driving state or the current vehicle state as the conversion determination value; And When the relevant driving state is included in the prohibition determination value, the determination unit determines that the predetermined correspondence relationship is satisfied, and the load control signal received by the receiving unit is abnormal.

5. The driving device according to claim 1, wherein: The determination storage unit stores a permission determination value indicating a permission of driving conversion from the current driving state or the current vehicle state as the conversion determination value; And When the relevant driving state is not included in the permission determination value, the determination unit determines that the predetermined correspondence relationship is satisfied, and the load control signal received by the receiving unit is abnormal.

6. The driving device according to claim 1, wherein: The determination storage unit stores the load control signal and the conversion determination value in an associated manner; And The determination unit acquires the conversion determination value associated with the load control signal received by the receiving unit from the determination storage unit.

7. The driving device according to claim 1, wherein: The determination storage unit stores the current driving state and the conversion determination value in an associated manner; And The determination unit acquires the conversion determination value associated with the current driving state acquired by the acquisition unit from the determination storage unit.

8. The drive device according to any one of claims 1-7, wherein: the drive device drives the plurality of loads mounted on a vehicle; the acquisition unit acquires the current vehicle state of the vehicle in addition to acquiring the current drive state; and the determination storage unit stores a value for determining whether the load control signal received by the reception unit is abnormal as a conversion determination value, the value being associated with a drive conversion from the current drive state and the current vehicle state.

9. A drive system, comprising: a drive device that drives the plurality of loads by controlling a plurality of semiconductor switches corresponding to the plurality of loads; and a control device configured to communicate with the drive device, wherein: the control device includes: a transmission unit (201, 203) that transmits a load control signal, the load control signal including a signal indicating a drive state of each load; the drive device includes: a reception unit (1, 2) that receives the load control signal; a control storage unit (11) that stores the load control signal received by the reception unit; a drive unit (20) that controls the plurality of semiconductor switches according to the load control signal stored in the control storage unit; an acquisition unit (10, 81 to 84, 90 to 92) that acquires a current drive state indicating a drive state of each load at the current moment or acquires a current vehicle state; a determination storage unit (50) that stores a conversion determination value for determining whether the load control signal received by the reception unit is abnormal, the conversion determination value being associated with a drive conversion from the current drive state or the current vehicle state; and a determination unit (30, 40) that compares a relevant drive state of each load associated with the load control signal received by the reception unit with the conversion determination value, and determines that the load control signal received by the reception unit is abnormal when the relevant drive state and the conversion determination value satisfy a predetermined correspondence relationship.

10. The drive system according to claim 9, wherein: when the determination unit determines that the load control signal is abnormal, the determination unit provides a notification to the control device indicating that the load control signal transmitted by the transmission unit is abnormal.

11. The drive system according to claim 10, wherein: the control device counts the number of notifications provided by the determination unit, and when the counted number of notifications does not reach a predetermined number, re-transmits the load control signal notified as abnormal.

12. The drive system according to claim 10, wherein: the drive device further includes a power supply unit (70) that switches a power supply state of the plurality of loads; and the control device counts the number of notifications provided by the determination unit, and when the counted number of notifications reaches a predetermined number, outputs an instruction to the power supply unit without using the transmission unit to set the power-on of the load to a predetermined abnormal processing state.

Images