Monitoring management of electronic circuit elements for motor land vehicles

Abstract

The present invention relates to the management of the programmed temporary stop of an electronic circuit element (ECU) monitored by a monitoring device (VSM), said circuit element and said device being comprised in a motor land vehicle.

Description

Technical Field

[0001] This invention claims priority to French application 2010747, filed on October 20, 2020, the contents of which (text, drawings, and claims) are incorporated herein by reference. This invention belongs to the field of in-vehicle electronics technology in motorized land vehicles. Specifically, this invention relates to the monitoring and management of the electronic circuitry of a vehicle in the event of a planned temporary cessation of the circuitry. Background Technology

[0002] "Motorized land vehicles" can be understood as any type of vehicle, such as motor vehicles, motorized bicycles, motorcycles, storage robots in warehouses, etc.

[0003] The vehicle's electronic architecture includes monitoring devices that are connected to various internal vehicle networks (Ethernet, CAN, Controller Area Network). (This is a reference to a document or document, which is included below.) Figure 1 (Description) Connection. The monitoring device can monitor all circuit components of the vehicle and generate a fault code when a circuit component fails to communicate with the monitoring device in an agreed manner.

[0004] Specifically, network monitoring is a mechanism that enables the monitoring device to monitor the presence of another circuit element by verifying the continuous reception of periodic (or mixed) frames sent by the monitored circuit element. When the reception of the periodic (or mixed) frames is interrupted for a certain period of time, the monitoring device indicates a fault.

[0005] Such monitoring is necessary for the proper functioning of components (brakes, powertrain, lights, etc.) that are occasionally responsible for the safety of vehicle occupants. In particular, the operational reliability requirements associated with such circuit elements and monitoring devices are very important and can occasionally lead to redundancy in some of these circuit elements / monitoring devices.

[0006] With the advent of new vehicle functions (such as remote updates to the software, operating system, or microsoftware of the circuitry), the circuitry includes a stop phase (typically during firmware updates). During these planned stop phases, the circuitry can no longer be effectively monitored (e.g., periodic frames are no longer sent). The monitoring device thus erroneously detects a fault.

[0007] It may have been suggested that the monitoring be stopped during such a planned shutdown. However, such a shutdown would require ceasing monitoring of all circuit elements, and is therefore incompatible with remote updates intended to be as transparent as possible. Summary of the Invention

[0008] The present invention will improve the situation described.

[0009] Therefore, a first aspect of the present invention relates to a management method for managing the planned temporary shutdown of electronic circuit elements monitored by a monitoring device, the circuit elements and the device being included in a motorized land vehicle, the method comprising the following steps:

[0010] - A planned temporary halt is identified by the circuit elements;

[0011] - The circuit element generates a predicted stop message, the predicted stop message including information on the stop duration of the circuit element during the planned temporary stop;

[0012] - The prediction message is transmitted from the circuit element toward the monitoring device;

[0013] - During the stop duration indicated, for example, by the stop duration information of the prediction message, the monitoring of the circuit element by the monitoring device is stopped.

[0014] Therefore, a simple yet reliable mechanism was established that takes into account the diversity and asynchronous nature of the planned temporary stops.

[0015] In fact, the transmission of the predicted message is carried out dynamically and initiated by the relevant circuit element without affecting the monitoring of other circuit elements.

[0016] The planned stopping of the circuit element is thus made possible in the most transparent way possible (unless, of course, the circuit element is involved in the operation of the vehicle when the stopping is planned), and in no case is it necessary for other circuit elements not involved in the planned stopping to stop or operate in degraded mode.

[0017] Furthermore, the method meets safety requirements while maintaining low cost, making it well-suited for mobile land vehicles. In fact, for sensitive circuit elements, the transmission of the predicted message may be redundant, and the method does not require allocating additional memory for execution (only the duration information is temporarily retained by the monitoring device).

[0018] In an embodiment, the prediction message further includes at least one of the following elements:

[0019] - Identifiers of the circuit elements;

[0020] - Configure information to explain the reasons for the temporary stop.

[0021] In another embodiment, the method further includes the following steps:

[0022] - When the circuit element detects a restart, a recovery information message is sent from the circuit element toward the monitoring device;

[0023] - Upon receiving the recovery message by the monitoring device, the monitoring of the circuit element by the monitoring device is resumed.

[0024] Therefore, in practice, planned stops with shorter durations will not unreasonably hinder the monitoring.

[0025] In another embodiment, the monitoring performed by the monitoring device includes periodically receiving verification messages from the circuit element, the verification messages being configured to notify the monitoring device of the normal operation of the circuit element.

[0026] In another embodiment, the vehicle further includes a secondary circuit element that monitors the operation of the monitored circuit element, and the method further includes the following steps:

[0027] - Upon receiving the prediction message from the monitoring device, a secondary information message is transmitted from the monitoring device toward the secondary circuit element, the secondary information message including the stop duration information of the circuit element.

[0028] Specifically, in this embodiment, the management method further includes the following steps:

[0029] - During the stop duration indicated, for example, by the stop duration information of the prediction message, the secondary circuit element stops monitoring the monitored circuit element.

[0030] The interconnections between circuit elements are therefore taken into consideration, and the method can thus be implemented in complex environments where circuit elements are mutually monitored.

[0031] For example, the junction box undergoing planned shutdown is monitored by other circuitry, which in turn receives data from the junction box. If the planned shutdown is inaccurate, these other circuitry may unreasonably and for an extended period enter a degraded operating mode. Furthermore, these other circuitry may produce inconsistencies in their own monitoring, thus leading to incorrect replacements by after-sales service.

[0032] A second aspect of the invention relates to a computer program comprising instructions for implementing the method according to the first aspect of the invention when executed by a processor.

[0033] A third aspect of the invention relates to a system configured to manage the planned temporary shutdown of electronic circuitry elements monitored by a monitoring device, the system including the monitoring device and the monitored electronic circuitry elements, the system being configured to be included in a motorized land vehicle.

[0034] - The monitored circuit elements include at least one processor and at least one memory configured to perform the following operations:

[0035] ○Identification of a planned temporary halt;

[0036] ○ Generate a predicted stop message, the predicted stop message including information on the stop duration of the circuit element during the planned temporary stop;

[0037] ○ The prediction message is transmitted toward the monitoring device;

[0038] - The monitoring device includes at least one processor and at least one memory configured to perform the following operations:

[0039] ○ During the stop duration indicated, for example, by the stop duration information in the prediction message, the monitoring of the circuit element by the monitoring device is stopped.

[0040] A fourth aspect of the invention relates to a vehicle configured to include a system according to a third aspect of the invention. Attached Figure Description

[0041] Other features and advantages of the invention will become more apparent from the following detailed description and accompanying drawings, in which:

[0042] - Figure 1 This is a schematic diagram illustrating the steps of a method according to an embodiment of the present invention;

[0043] - Figure 2 The structure of an apparatus according to an embodiment of the present invention is shown. Detailed Implementation

[0044] The invention is described below in its non-limiting application in motor vehicles, including electronic circuit elements, monitoring devices, and secondary circuit elements. This application is merely illustrative and simplified to a few circuit elements for clarity; however, in practice, the invention is used by dozens or hundreds of circuit elements (especially computers) present in a vehicle. Furthermore, the invention can be implemented in any type of motorized land vehicle (e.g., motorcycles, buses, or robots in factories).

[0045] Figure 1 A method according to an embodiment of the present invention is shown.

[0046] The method relates to the management of planned temporary shutdowns of electronic circuit components monitored by a monitoring device.

[0047] The electronic circuit element corresponds to any type of circuit element present in the vehicle and connected to the monitoring device via an internal network.

[0048] A vehicle's internal network corresponds to any communication network configured for exchanging data between at least two electronic circuit elements within the vehicle. Examples of wired internal networks include CAN networks (also known as Controller Area Networks or Réseau des Beaux-Arts). Ethernet networks, FlexRay networks, or LIN networks (Local Interconnect Network in English, or Réseau interconnectélocal in French). Examples of internal radio frequency networks include LoRa networks, Bluetooth networks, or Wi-Fi networks.

[0049] The electronic circuit element corresponds to any circuit element configured to process any data related to the operation of the vehicle. Examples of such circuit elements include a computer (further called an ECU, or "Electronic Control Unit" in French, or "Unité de Commande Electronique" in French). This computer can be responsible for various functions in the vehicle (e.g., driver assistance management, windshield wiper actuation, or music playback in the passenger compartment). Another example of a circuit element is a junction box (also called a TCU, or "Telematic Control Unit" in French, or "Unite de Controle Telematique" in French).

[0050] The monitoring device (VSM) corresponds to any device configured to verify the proper functioning of at least one electronic circuit element. Specifically, in an embodiment, monitoring performed by the monitoring device includes periodically receiving verification messages from the circuit element, the verification messages being configured to notify the monitoring device of the normal operation of the circuit element. Thus, the monitoring is a mechanism that enables the monitoring device to monitor the presence of another circuit element by verifying the continuous reception of periodic (or mixed) frames sent by the monitored circuit element. When the frame is not received, an error is generated and submitted to the entity responsible for tracking the fault (after-sales, etc.). The monitoring device may (especially as a simple software module) be included in the electronic circuit element (e.g., BSI, i.e., "boitier de servitude intelligent").

[0051] In step 2, the circuit element ECU recognizes a planned temporary stop (Dstop). This planned temporary stop corresponds, for example, to the restart of the ECU in the context of a microsoftware or firmware update. Other types of planned temporary stops are possible, such as those related to a simple software update or a version upgrade of one of the networks to which the ECU is connected. The circuit element itself recognizes the planned temporary stop, but this can also occur incidentally, for example, because the circuit element responsible for the operation of the ECU is detected to have stopped.

[0052] The shutdown may involve the entire operation of the circuit element, or only a portion of its operation. Typically, refreshing the circuit element requires its restart and therefore its complete shutdown, but other shutdowns involve only some functionality or portions of the circuit element. For example, for some software updates, the circuit element is not stopped, but the update causes a halt to the transmission of the periodic frames to the monitoring device. Normal operation is paused to implement updates for some functions, but the circuit element does not necessarily need to be completely stopped.

[0053] In step 4, a generation step is performed to generate a predicted stop message MS from the circuit element, the predicted stop message including information on the stop duration of the circuit element during the planned temporary stop. In an embodiment, the predicted message further includes at least one of the following elements:

[0054] - Identifier for the ECU circuit element;

[0055] - Configure information to explain the reasons for the temporary stop.

[0056] The identifier of the circuit element corresponds, for example, to the address of the circuit element in the internal network. The configuration information used to explain the reason for the temporary stop is, for example, firmware updates, Flexray network version upgrades, etc.

[0057] The duration of the circuit element's shutdown during the planned temporary stop corresponds to the period during which the circuit element cannot be monitored by the monitoring device. This duration thus takes into account the time required to restart, for example, the software of the ECU responsible for transmitting periodic monitoring frames.

[0058] In step 8, the prediction message is transmitted from the circuit element toward the monitoring device, which receives the prediction message in step 10. The prediction message may be a dedicated message or may be integrated into another message (e.g., a verification message (periodic monitoring frame)). The prediction message may be transmitted redundantly (e.g., 3 times every 10 milliseconds).

[0059] In step 12, during a stop duration Dstop, as indicated by, for example, the stop duration information of the prediction message MS, the monitoring device stops monitoring the circuit element.

[0060] Once the duration Dstop has elapsed, in step 20, the monitoring device VSM resumes monitoring of the circuit element ECU. Thus, for example, if the VSM does not receive a verification message (periodic monitoring frame) after Dstop, an error is detected.

[0061] In optional embodiments (in) Figure 1 In the steps shown above (indicated by dashed lines), the method further includes the following steps:

[0062] - In step 18, when the circuit element detects a restart, a recovery information message is sent from the circuit element to the monitoring device. The recovery information message may include the recovery information, the identifier of the circuit element's ECU, and information configured to explain the reason for the recovery.

[0063] - In step 20, upon receiving the recovery message by the monitoring device, monitoring of the circuit element by the monitoring device resumes. Thus, when the ECU detects a predicted restart, this causes the monitoring to restart before Dstop expires. In this embodiment, the recovery information message is transmitted in all cases (before or after Dstop expires).

[0064] In optional embodiments (in) Figure 1 In the step shown by the dashed line above, the vehicle also includes a secondary circuit element ECU2. The secondary circuit element monitors the operation of the ECU.

[0065] This secondary circuit element typically involves circuit element ECU2, the operation of which is related to the operation of the ECU. For example, this could be the case for circuit element ECU2 (e.g., an autonomous driving computer), which cannot operate without continuous interaction with the ECU (e.g., a junction box TCU). In fact, in the example of the autonomous driving computer, depending on the level of autonomy, ECU2 may need to maintain a continuous functional connection with the junction box to receive the latest environmental data.

[0066] The method thus further includes, in step 10:

[0067] - Upon receiving the prediction message from the monitoring device, a secondary information message is transmitted from the monitoring device toward the secondary circuit element, the secondary information message including the stop duration information of the circuit element. This involves a simple transfer of the prediction message MS or integration of the duration Dstop into any other message used by ECU2.

[0068] Several embodiments can be used to transmit the secondary information messages. The messages can be transmitted by the VSM via broadcast, that is, to any circuit element connected to the VSM within the involved internal network. The messages can also be transmitted to individual circuit elements involved (the connection table between circuit elements is therefore present in the VSM). In another embodiment, the ECU transmits the information directly to ECU2.

[0069] Once the secondary information message is received in step 14, in step 16, monitoring of the monitored circuit element ECU by the secondary circuit element ECU2 is stopped during a stop duration Dstop, as indicated by, for example, the stop duration information in the predicted message. Monitoring is resumed after Dstop in step 22. In an embodiment, the predicted restart (step 18) is also considered by ECU2 via a transfer of VSM messages.

[0070] Figure 2 An example of device D included in a system is shown, the system being configured to manage planned temporary shutdowns of electronic circuit elements monitored by a monitoring device, the system being used to implement the references above. Figure 1 The method is described and includes a monitoring device VSM, a monitored electronic circuit element ECU, and, in an embodiment, a circuit element ECU2.

[0071] The device D can take the form of a box including printed circuits, any type of computer, or a smartphone.

[0072] Apparatus D includes random access memory 100 for storing instructions for processor 200 to perform at least one step of the method as described above. The apparatus also includes mass storage memory 300 for storing data to be retained after the method has been performed.

[0073] Device D may also include a digital signal processor (DSP) 400. The DSP 400 receives data and then shapes, demodulates, and amplifies the data in a manner known per se.

[0074] The device further includes an input interface 500 and an output interface 600, the input interface being used to receive data by means of the method according to the invention, and the output interface being used to transmit the data by means of the method.

[0075] This invention is not limited to the embodiments described above as examples; the invention extends to other variations.

[0076] Therefore, embodiments corresponding to exemplary electronic architectures (ECU circuit elements, VSM instruments, etc.) for motor vehicles have been described. The invention is also applicable to other electronic architectures (different numbers of computers, etc.).

Claims

1. A management method for managing the planned temporary shutdown of an electronic circuit element (ECU) monitored by a monitoring device (VSM), the electronic circuit element and the monitoring device being included in a motorized land vehicle, the management method comprising the following steps: - A planned temporary halt is identified by the aforementioned electronic circuit elements; - The electronic circuit element generates a predicted stop message, the predicted stop message including information on the stop duration of the electronic circuit element during the planned temporary stop; - The predicted stop message is transmitted from the electronic circuit element toward the monitoring device; - During the stop duration indicated by the stop duration information in the predicted stop message, monitoring of the electronic circuit element by the monitoring device is stopped. The vehicle also includes secondary circuitry that monitors the operation of the monitored electronic circuitry. The management method further includes the following steps: - Upon receiving the predicted stop message from the monitoring device, a secondary information message is transmitted from the monitoring device toward the secondary circuit element, the secondary information message including the stop duration information of the electronic circuit element. - During the stop duration indicated by the stop duration information in the predicted stop message, the secondary circuit element ceases monitoring of the monitored electronic circuit element.

2. The management method according to claim 1, wherein, The prediction stop message also includes at least one of the following elements: - Identifiers of the electronic circuit elements; - Configure information to explain the reasons for the temporary stop.

3. The management method according to claim 1 or 2, further comprising the following steps: - When the electronic circuit element detects a restart, a recovery information message is sent from the electronic circuit element toward the monitoring device; - Upon receiving the recovery information message by the monitoring device, the monitoring of the electronic circuit element by the monitoring device is resumed.

4. The management method according to claim 1 or 2, wherein, The monitoring performed by the monitoring device includes periodically receiving verification messages from the electronic circuit element, the verification messages being configured to notify the monitoring device of the normal operation of the electronic circuit element.

5. A computer program comprising instructions for implementing the management method according to any one of claims 1 to 4 when executed by a processor.

6. A system configured to manage planned temporary shutdowns of electronic circuitry elements monitored by a monitoring device, the system including the monitoring device (D, VSM) and the monitored electronic circuitry elements (D, ECU), the system being configured to be included in a motorized land vehicle. - The monitored electronic circuit elements include at least one processor and at least one memory configured to perform the following operations: The plan has been temporarily suspended. Generate a predicted stop message, the predicted stop message including information on the duration of the stop of the electronic circuit element during the planned temporary stop; The predicted stop message is transmitted toward the monitoring device; - The monitoring device includes at least one processor and at least one memory configured to perform the following operations: During the stop duration indicated by the stop duration information in the predicted stop message, monitoring of the electronic circuit element by the monitoring device ceases. The system also includes secondary circuitry that monitors the operation of the monitored circuitry, the secondary circuitry including at least one processor and at least one memory configured to perform the following operations: Upon receiving the predicted stop message from the monitoring device, a secondary information message is transmitted from the monitoring device toward the secondary circuit element. This secondary information message includes information about the stop duration of the electronic circuit element. During the stop duration indicated by the stop duration information in the predicted stop message, the secondary circuit element ceases monitoring of the monitored electronic circuit element.

7. A motorized land vehicle comprising the system according to claim 6.

Images