CONTROL DEVICE AND CONTROL SYSTEM

Abstract

Control device that controls multiple loads by controlling multiple semiconductor switches corresponding to the respective loads, wherein the control device comprises: a receiving unit (1, 2) which receives a load control signal, which contains a signal indicating a control state of each load, from an external control device; a control storage unit (11) that stores the load control signal received by the receiving unit; a control unit (20) that controls the semiconductor switches according to the load control signal stored in the control memory unit; a procurement unit that procures a current control state, which is the control state of each load at a current time, or a current vehicle state; a determination storage unit (50) which stores a transition determination value for determining whether the load control signal received by the receiving unit is abnormal, wherein the transition determination value correlates with a control transition starting from the current control state or the current vehicle state; and a determination unit (30, 40) that compares a correlated control state of each of the loads, which correlates with the load control signal received by the receiving unit, with the transition determination value and determines that the load control signal received by the receiving unit is abnormal if the correlated control state and the transition determination value satisfy a predetermined corresponding relationship.

Description

[0001] The present invention relates to a control device and a control system.

[0002] As described in JP 2019-115 067 A, there is a technique relating to the cybersecurity of a vehicle's own communication network.

[0003] Furthermore, DE 10 2009 047 114 A1 discloses a memory diagnostic device for a control unit of a device installed in a vehicle, comprising: a control program installation section in which a control program for controlling the device installed in a vehicle is installed; and a reference data memory section in which several data elements are stored. The control program is configured to refer to at least one of the several data elements during execution of the control program.The memory diagnostic device further comprises a reference data selection section configured to select from the multiple data sets the data to which the control program should refer, based on a vehicle's driving condition; and a data anomaly diagnostic section configured to diagnose, during a time interval between the point in time at which the reference data selection section has just selected the data and the point in time at which the control program actually refers to the selected data, whether the selected data is in an anomalous state.

[0004] DE 11 2013 001 459 T5 discloses a vehicle-internal communication system suitable for controlling the system's power supply according to a user's preferences. A control element of a gateway device extracts information required for controlling the power supply of multiple loads from CAN messages received via first to third communication elements, specifies a vehicle state based on the extracted information, determines the power supply states in which the loads should be (previously stored in a power supply state table) by mapping the states to the specified vehicle state, and then sends control information to the power supply control device to provide instructions regarding the specified power supply state.The power supply status table in the memory element is rewritable, and an element of the power supply status table can be updated according to the preference of a vehicle user.

[0005] DE 10 2018 204 071 A1 discloses a vehicle-integrated communication system comprising: a plurality of vehicle control devices which are connected to a network which is set up in a vehicle and which carry out mutual communication in order to control respective units of the vehicle;and a communication management device connected to the network, which manages communication between the vehicle control units, wherein, during communication between the vehicle control units, information transmitted by any of the vehicle control units is received by other vehicle control units through the communication management device, the communication management device comprising: an abnormality detection unit, which detects an abnormality and an abnormality type based on reception information received by any of the vehicle control units during communication between the vehicle control units; an abnormality notification unit, which informs the other vehicle control units of the abnormality type according to the abnormality type;and a transmission control unit which transmits the received information to the other vehicle control devices according to the type of abnormality, and wherein the vehicle control devices perform a predetermined control according to the type of abnormality given in the notification from the communication management device.

[0006] Furthermore, according to one conceivable technique, a load control signal indicating the control of a load can be transmitted and received via a communication bus. To prevent falsification of such a load control signal, complex processing such as authentication and encryption of the communication by a microcomputer must be performed.

[0007] The object of the invention is to create a control device and a control system that are able to prevent a change to a prohibition transition pattern due to a falsification of a load control signal without having to carry out complicated processing.

[0008] The problem is solved by a control device having the features of independent claim 1 and by a control system having the features of independent claim 9. The dependent claims are directed to advantageous further developments of the invention.

[0009] The control device according to the invention controls multiple loads by controlling several semiconductor switches corresponding to the respective loads. The control device comprises: a receiver unit that receives a load control signal, which contains a signal indicating a control state of each load, from an external control device; a control memory unit that stores the load control signal received by the receiver unit; a control unit that controls several semiconductor switches according to the load control signal stored in the control memory unit; and a procurement unit that procures a current control state, which is the control state of the respective loads at the current time, or a current vehicle state.a determination storage unit that stores a transition determination value for determining whether the load control signal received by the receiving unit is abnormal, wherein the transition determination value correlates with a control transition starting from the current control state or the current vehicle state; and a determination unit that compares a correlated control state of each of the loads, which correlates with the load control signal received by the receiving unit, with the transition determination value and determines that the load control signal received by the receiving unit is abnormal if the correlated control state and the transition determination value satisfy a predetermined corresponding relationship.

[0010] As described above, the control device stores the transition determination value to determine whether the load control signal received by the receiver is abnormal. This transition determination value correlates with the control transition based on the current control state or vehicle state. By comparing the correlated control state of each load, which corresponds to the load control signal received by the receiver, with the transition determination value, the control device can determine whether the load control signal received by the receiver is abnormal. Thus, the control device is able to prevent a change or transition to the prohibition transition pattern due to a falsification of the load control signal without performing complex processing.

[0011] Furthermore, the control system according to the invention comprises: a control device that controls multiple loads by controlling several semiconductor switches corresponding to the respective loads; and a control device designed to communicate with the control device. The control device comprises: a transmission unit that transmits a load control signal containing a signal indicating the control state of each of the loads. The control device comprises: a receiver that receives the load control signal; a control storage unit that stores the load control signal received by the receiver; and a control unit that controls several semiconductor switches according to the load control signal stored in the control storage unit.a procurement unit that procures a current control state, indicating a control state of each of the loads at a current time, or a vehicle state; a determination storage unit that stores a transition determination value for determining whether the load control signal received by the receiving unit is abnormal, wherein the transition determination value correlates with a control transition starting from the current control state or the current vehicle state; and a determination unit that compares a correlated control state of each of the loads, which correlates with the load control signal received by the receiving unit, with the transition determination value and determines that the load control signal received by the receiving unit is abnormal if the correlated control state and the transition determination value satisfy a predetermined corresponding relationship.

[0012] As described above, the control system is able to prevent a change or transition to the prohibition transition pattern due to a falsification of the load control signal without performing complicated processing.

[0013] The above and further problems, features and advantages of the present invention will become clear with reference to the following detailed description and the accompanying drawings. These show: Fig. 1 a circuit diagram showing a schematic configuration of a control device according to a first embodiment; Fig. 2 a circuit diagram showing a schematic configuration of a control IC section according to the first embodiment; Fig. 3 a diagram illustrating a schematic configuration of a current flow pattern of the first embodiment; Fig. 4 a pictorial diagram representing a schematic configuration of a transition prohibition pattern of the first embodiment; Fig. 5 a diagram showing a schematic configuration of a control register according to the first embodiment; Fig. 6 a diagram illustrating a schematic configuration of a monitoring register of the first embodiment; Fig. 7 a flowchart showing the operation of the control device according to the first embodiment; Fig. 8 a block diagram showing the operation of a sequence circuit according to the first embodiment; Fig. 9 a diagram illustrating a setting operation of the current pattern according to the first embodiment; Fig. 10 a pictogram representing a setting operation of a control pattern (previous value) according to the first embodiment; Fig. 11 a pictogram representing a setting operation of a control pattern (updated value) according to the first embodiment; Fig. 12 a pictorial diagram illustrating a setting operation of a transition prohibition pattern according to the first embodiment; Fig. 13 a pictogram illustrating a transition prohibition pattern according to a modification example; Fig. 14 a pictogram illustrating a transition prohibition pattern according to a modification example 2; Fig. 15 a flowchart showing the operation of the control device according to a second embodiment; Fig. 16 a flowchart showing the operation of the control device according to a third embodiment; Fig. 17 a flowchart showing the operation of the control device according to a fourth embodiment; Fig. 18 a flowchart showing an operation of the control device according to a fifth embodiment; Fig. 19 a flowchart showing the operation of the control device according to a sixth embodiment; Fig. 20 a flowchart showing an operation of the control device according to a seventh embodiment; Fig. 21 a flowchart showing an operation of the control device according to an eighth embodiment; Fig. 22 a circuit diagram showing a schematic configuration of a control device according to a ninth embodiment; Fig. 23 a flowchart showing the operation of the control device according to the ninth embodiment; Fig. 24 a flowchart illustrating the operation of an ECU of the ninth embodiment; and Fig. 25 a circuit diagram showing a schematic configuration of a control device according to a tenth embodiment.

[0014] Several embodiments of the present invention are described below with reference to the drawings. In each embodiment, sections corresponding to those described in a previous embodiment are designated by the same reference numerals, and their description is not repeated in some cases. If only part of the configuration is explained in the respective embodiments, reference may be made to another previously described embodiment with regard to the remaining parts of the embodiment. First embodiment

[0015] In the following, a control device 100 of the present embodiment is described with reference to the Fig. 1, Fig. 2, Fig. 3, Fig. 4, Fig. 5, Fig. 6, Fig. 7, Fig. 8, Fig. 9, Fig. 10, Fig. 11 to Fig. 12. The control device 100 can be used, for example, in a circuit for controlling a load mounted on a vehicle. The following is an example in which the control device 100 is used for an automatic transmission of a vehicle.

[0016] The control device 100 and the control system 1000 of the present embodiment are described with reference to the Fig. 1, Fig. 2, Fig. 3, Fig. 4, Fig. 5, Fig. 6, Fig. 7, Fig. 8, Fig. 9, Fig. 10, Fig. 11 to Fig. The control system 1000 comprises the control device 100 and an ECU 200 capable of communicating with the control device 100. The control device 100 can be used, for example, in a circuit for controlling a load mounted on a vehicle. An example is described below in which the control device 100 is used for an automatic transmission in a vehicle. automatic transmission

[0017] The following is a schematic description of the automatic transmission configuration. The automatic transmission includes, for example, a valve body, a transmission mechanism, an oil pump, and a parking detent mechanism. The transmission mechanism contains several friction elements, including, for example, a clutch and a brake. The transmission mechanism is capable of changing the gear ratio step by step by selectively engaging each friction element.

[0018] The valve body incorporates a hydraulic circuit that regulates the pressure of the hydraulic oil supplied to the transmission mechanism. The valve body contains several solenoid valves that control the pressure of the hydraulic oil pumped by the oil pump and supplying it to the friction elements. Each solenoid valve contains a solenoid, which can also be referred to as a coil. The current flowing through the solenoid is controlled, thus regulating the hydraulic oil pressure.

[0019] The solenoid valve corresponds to a load. In the present embodiment, solenoid valves are used as actuators 401 to 40n, as described later. Thus, a state of energizing the load is the same as a state of energizing the solenoid valve (solenoid). The solenoid valve can be a linear solenoid valve. Actuators 401 to 40n are also referred to as actuators 40n when no distinction needs to be made between them.

[0020] The parking lock mechanism engages a parking lock to prevent the rotation of an output shaft (axle) of the automatic transmission when a parking range or gear is selected. If a different shift range or gear is selected from the parking lock state, the parking lock mechanism releases the parking lock, thus unlocking the output shaft. However, the configuration of the automatic transmission is not limited to the configuration described above. Control system

[0021] As it is in Fig. As shown in Figure 1, the control system 1000 includes at least the control device 100, the ECU 200, and a communication bus B1. In the present embodiment, a control system 1000 is used as an example, which includes a first signal line L1 and a second signal line L2, which are different from the communication bus B1.

[0022] Control system 1000 controls the actuators 40n. In control system 1000, the control device 100 is located on the valve body. That is, the control device 100 has an electromechanical structure that is integrally integrated with the automatic transmission. The ECU 200 is mechanically separate from the automatic transmission. The automatic transmission, which contains the valve body, can also be considered a load. Fig. Figure 1 shows simplified representations of the current paths of actuators 401 to 40n.

[0023] Here, n is a natural number of 2 or greater. In the present embodiment, for example, n = 8 is used. Therefore, the present embodiment uses an example in which the first actuator 401 to the eighth actuator 408 are energized and controlled. In the present embodiment, an example is used in which the automatic transmission is shifted or changed between first speed or first gear up to fifth speed or fifth gear, the P range or P gear, the R range or R gear, and the N range or N gear by controlling the actuation of the first to eighth actuators 401 to 408.

[0024] However, the present invention is not limited to this. The present invention can also be used when the gear of the automatic transmission is shifted or changed between first and fifth gear by controlling the actuators 40n. The present invention can also be used when the automatic transmission is shifted, for example, between P, R, N, and D gears by controlling the actuators 40n. The actuator 40n can be an on / off solenoid valve.

[0025] The control system 1000 controls the actuators 40n by controlling several control switches 301 to 30n. The control switches 301 to 30n are arranged in the current paths of the actuators 40n, corresponding individually to their respective actuators. Therefore, in the present embodiment, an example is used in which the first to eighth control switches 301 to 308 are arranged. The control switches 301 to 308 are also referred to as control switches 30n when no distinction needs to be made between them. The control switch 30n can be included in the control IC 20, which is described later.

[0026] When the control switch 30n is switched on, current is supplied to the corresponding actuator 40n. When the control switch 30n is switched off, the current supply to the corresponding actuator 40n is blocked or interrupted. In other words, each actuator 40n is energized when the corresponding control switch 30n is switched on. Each actuator 40n is disconnected from the power supply, i.e., no longer energized, by switching off the corresponding control switch 30n.

[0027] As it is in the Fig. 1 and Fig. As shown in Figure 2, the load control system includes a power supply switch 500. The load control system may include various sensors. However, the load control system does not necessarily have to include the power supply switch 500 and the sensor, and the power supply switch 500 and the sensor may be located outside the load control system.

[0028] The power supply switch 500 is located in the current path of the actuator 40n. A single (common) power supply switch 500 is provided for the actuators 40n. When the power supply switch 500 is open, current can be supplied to each of the actuators 40n. When the power supply switch 500 is open, the current supply to each of the actuators 40n is interrupted.

[0029] The power supply switch 500 can be arranged on a high side relative to the actuators 40n, i.e., on a power supply side, or on a low side, i.e., on the ground (GND) side. The power supply switch 500 of the present embodiment is arranged on the high side. For example, a semiconductor switch such as a MOSFET can be used as the power supply switch 500. The power supply switch 500 is arranged in the control device 100.

[0030] The sensor outputs a signal indicating the state of the load. That is, the sensor detects the state of the automatic transmission, including the valve body. The present embodiment uses an example in which a rotation sensor 600 (RS) is arranged as an example of the sensor. The rotation sensor 600 includes, for example, a sensor that outputs a signal indicating the rotational speed of an input side of the automatic transmission and a sensor that outputs a signal indicating the rotational speed of its output side.

[0031] The ECU 200 and the control device 100 are connected to the common communication bus B1. A device (not shown) that differs from the ECU 200 and the control device 100 can also be connected to the communication bus B1. In the present embodiment, the ECU 200 and the control device 100 are able to communicate with each other via the communication bus B1 of a vehicle-specific network that conforms to the CAN protocol. In other words, the ECU 200 and the control device 100 perform mutual data communication based on a two-wire differential method via the communication bus B1. The communication bus B1 can also be referred to as the CAN bus. CAN is an abbreviation for Controller Area Network. CAN is a registered trademark.

[0032] As mentioned above, the ECU 200 and the control unit 100 communicate with each other via the CAN bus, specifically the communication bus B1. This allows the ECU 200 and the control unit 100 to transmit and receive multiple data points over essentially a single line. In other words, the ECU 200 and the control unit 100 communicate using a method different from SPI communication, which requires three or more copper wires or cables (SPI: Serial Peripheral Interface).

[0033] In the control system 1000 of the present embodiment, priority ranks of messages transmitted by the ECU 200 and the control device 100 are preset according to the importance, type, and other characteristics of the messages. When a message is transmitted, priority rank information (ID code) indicating the priority rank of that message is transmitted first. If, in this case, the transmission of priority rank information for several messages conflicts, the priority rank information of the messages is arbitrated, and the priority rank information with the higher or highest priority rank is granted the right of transmission.

[0034] The ECU 200 and the control device 100 are connected via a first signal line L1 and a second signal line L2. Unlike the CAN bus, the first signal line L1 and the second signal line L2 are not used to transmit and receive messages. Instead, the first signal line L1 and the second signal line L2 are copper wires or cables used in SPI communication, copper wires or cables used in serial communication without parallel conversion, and similar methods. Therefore, the ECU 200 and the control device 100 can transmit and receive signals without using a CAN transceiver 203, which will be described later.

[0035] When SPI communication is performed over the first signal line L1 or the second signal line L2, the ECU 200 and the control device 100 transmit and receive serial data and convert the received serial data into parallel data to obtain a signal. When serial communication without parallel conversion is performed over the first signal line L1 or the second signal line L2, the ECU 200 and the control device 100 obtain a signal by detecting a level from a terminal to which the first signal line L2 or the second signal line L2 is connected. ECU

[0036] The ECU 200 corresponds to a control device. That is, the ECU 200 is a control device located outside the control device 100. The ECU 200 contains a first microcomputer 201 (MC) and a second microcomputer 202 (MC). The ECU 200 also contains a CAN transceiver 203 (TRC) for communication via the communication bus B1. The first microcomputer 201 is a microcomputer containing a CPU 2011, a CAN controller (CTR) 2012, a ROM, a RAM, a register, and similar components. In the first microcomputer 201, the CPU 2011 executes various types of control according to a control program that is pre-stored in the ROM, using a temporary storage function of the RAM or the register. The CPU 2011 performs control using data obtained from the outside of the ECU 200, for example, using a detection signal from the sensor.The CPU 2011 of the present embodiment performs control of a respective actuator 40n and thus of the automatic transmission. The first microcomputer 201 and the CAN transceiver 203 correspond to a transmission unit.

[0037] CPU 2011 selects a gear for the automatic transmission. CPU 2011 issues a gear command to control device 100. CPU 2011 outputs a load control signal specifying a gear, thus issuing a gear command to control device 100. The load control signal contains a signal (value) indicating the energizing state (control state) of each actuator 40n. In other words, the load control signal contains a signal that specifies an energizing state individually for each actuator 40n.

[0038] The CPU 2011 can set a target current value by performing a predefined calculation. The target current value is a current value that is applied to the respective actuators 401 to 40n to bring the respective actuators 40n into a target state. The first microcomputer 201 obtains a state of the automatic transmission and calculates a target hydraulic pressure, which is a required value for the output hydraulic pressure of each actuator 40n. The first microcomputer 201 calculates the target hydraulic pressure based on, for example, the input and output speeds of the automatic transmission. The first microcomputer 201 sets the target current value based on the calculated target hydraulic pressure. A relationship between the target hydraulic pressure and the target current value is predefined, for example, as a characteristic curve or a function.The ECU 200 sends a command for the target current value to the control device 100.

[0039] The CPU 2011 can set a duty cycle based on the state of the automatic transmission. The first microcomputer 201 sets the duty cycle in such a way as to limit current fluctuations, such as overshoot or current ripple, during the initial period of shifting. The duty cycle is the duty cycle of a PWM signal that is to be output to a gate of the control switch 30n, as described later.

[0040] The first microcomputer 201 sets the duty cycle based on, for example, at least one of the hydraulic oil pressure of the hydraulic circuit, the hydraulic oil temperature, and the value of the actual current flowing through a respective actuator 40n. The ECU 200 issues a duty cycle command to the control device 100. The ECU 200 can issue a duty cycle command during a period when the ECU 200 is powered on, or it can issue a duty cycle command only during a temporary period, such as the initial switching period.

[0041] The CPU 2011 determines whether an abnormality has occurred based on the state of the automatic transmission. For example, the first microcomputer 201 compares the hydraulic oil pressure to a hydraulic pressure threshold and determines whether an abnormality has occurred. Similarly, the first microcomputer 201 compares the hydraulic oil temperature to a temperature threshold and determines whether an abnormality has occurred.

[0042] If the CPU 2011 determines that an abnormality has occurred, the ECU 200 issues an emergency command to the control device 100 to adjust the current supply to all actuators 40n to a predetermined abnormality handling state. The ECU 200 of this embodiment issues an emergency block command to the control device 100 to block or interrupt the current supply to all actuators 40n. The CPU 2011 can also issue the emergency block command if an abnormality signal is input from the control device 100. In this case, the abnormality signal is input to the CPU 2011 via, for example, the second signal line L2.

[0043] As will be described later, the communication bus B1 can be attacked from the outside if the abnormal signal is input from the control device 100. This means that if the emergency shutdown command is transmitted via the communication bus B1, it may be forged. Therefore, even if the CPU 2011 transmits the emergency shutdown command via the CAN transceiver 203, the control device 100 may not receive the emergency shutdown command.

[0044] Therefore, it is advantageous for the CPU 2011 to output the emergency shutdown command via the first signal line L1 without using the CAN transceiver 203. Consequently, the CPU 2011 can reliably output the emergency shutdown command to the control device 100.

[0045] The first microcomputer 201 contains the CAN controller 2012 to transmit and receive messages via the communication bus B1. The CAN controller 2012 performs communication control according to the CAN protocol. For example, the CAN controller 2012 performs transmit control, receive control, and arbitration control.

[0046] The CAN transceiver 203 is electrically connected to the CAN controller 2012 and also to the communication bus B1. The CAN transceiver 203 converts electrical characteristics between the communication bus B1 and the CAN controller 2012, thus enabling bidirectional communication messages between these two systems. For example, a bus-level signal from the communication bus B1 is converted into a digital signal that the CAN controller 2012 can process, allowing it to detect dominant and recessive frequencies. In other words, the CAN controller 2012 is connected to the communication bus B1 via the CAN transceiver 203 and can therefore transmit and receive communication messages to and from the communication bus B1.

[0047] The CAN controller 2012 contains a message box that stores messages. The CAN controller 2012 includes a transmit message box and a receive message box. The CAN controller 2012 sequentially stores transmit messages, acquired via the communication interface, in the message box. The CAN controller 2012 performs a process to transmit the stored messages according to the priority ranks of ID codes. The CAN controller 2012 generates a frame based on the messages stored in the message box and transmits the frame to the communication bus B1 via the CAN transceiver 203.

[0048] For example, the CPU 2011 stores data specifying the load control signal in the transmission message box of the CAN controller 2012. Therefore, the CAN controller 2012 generates a frame containing the data specifying the load control signal and transmits the frame to the communication bus B1 via the CAN transceiver 203.

[0049] The CAN controller 2012 receives a frame from the communication bus B1 via the CAN transceiver 203, extracts a message, and stores the extracted message in the message box. The CAN controller 2012 outputs the received message to a transmission destination according to the priority rank of an ID code. The CAN controller 2012 arbitrates transmission rights (bitwise non-destructive arbitration) when frames collide on the communication bus B1. The CAN controller 2012 detects, reports, and handles errors that occur during the transmission and reception of frames. The CAN transceiver 203 and the CAN controller 2012 can also be referred to as the control-side communication unit.

[0050] The ECU 200 can also contain the second microcomputer 202, as shown in Fig. Figure 1 shows the second microcomputer 202 monitoring whether the first microcomputer 201 is operating normally. The first microcomputer 201 can also be referred to as the main microcomputer, and the second microcomputer 202 can also be referred to as the monitoring microcomputer. The second microcomputer 202 monitors, for example, the first microcomputer 201 for a watchdog abnormality, a communication abnormality, or an abnormality in a computational function. In addition to the monitoring function described above, the second microcomputer 202 may have a function to assist in the control performed by the first microcomputer 201. The second microcomputer 202 may perform a different control function than that of the control system 1000. The second microcomputer may also include a CAN controller (not shown) and be configured to transmit and receive messages via the communication bus B1.

[0051] In the present embodiment, a monitoring unit of the first microcomputer 201 is configured as the second microcomputer 202, and the microcomputers 201 and 202 monitor each other to ensure they are operating normally. The monitoring unit of the first microcomputer 201 is not limited to the second microcomputer 202. A monitoring IC can be provided instead of the second microcomputer 202. The ECU 200 does not need to include the monitoring unit, such as the second microcomputer 202. Configuration of the control device

[0052] The following describes the control device 100. Fig. For the sake of simplicity, only a part of the image assigned to actuator 401 is shown in Figure 2.

[0053] The control device 100 is a circuit that powers and controls the actuators 40n. The control device 100 controls the control switches 30n to power and control the actuators 40n. In contrast to the ECU 200, the control device 100 does not contain a microcomputer. That is, the control device 100 powers and controls the actuators 40n using hardware logic. Each of the first through eighth control switches 301 to 308 corresponds to a semiconductor switch.

[0054] The control device 100 mainly comprises a CAN transceiver (TRC) 1, a CAN controller (CTR) 2, an SPI circuit (SPIC) 10 containing a control register (CREG) 11, a control IC (DIC) 20, a first comparator (1CMP) 40, and a ROM 50. The control device 100 also includes a sequencer circuit (SQC) 30, a register unit (REG) 60, a power supply circuit (PSC) 70, a current sensing resistor 81, an amplifier 82, a second comparator (2CMP) 83, a monitoring register (MREG) 84, a waveform analyzer circuit (WFA) 90, and similar components.

[0055] CAN transceiver 1 is electrically connected to CAN controller 2 and communication bus B1. CAN transceiver 1 converts the electrical characteristics between communication bus B1 and CAN controller 2, thus enabling bidirectional communication messages to be transmitted between these two systems. CAN controller 2 is connected to communication bus B1 via CAN transceiver 1 and can therefore transmit and receive communication messages to and from communication bus B1.

[0056] The CAN controller 2 contains a message box that stores messages. The CAN controller 2 includes a transmit message box and a receive message box. The CAN controller 2 sequentially stores transmission messages, acquired via the communication interface, in the message box. The CAN controller 2 performs a process to transmit the stored messages according to priority ranks of ID codes. The CAN controller 2 generates a frame based on the messages stored in the message box and transmits the frame to the communication bus B1 via the CAN transceiver 1.

[0057] CAN controller 2 receives a frame from communication bus B1 via CAN transceiver 1, extracts a message, and stores the extracted message in the message box. CAN controller 2 outputs the received message to a transmission destination according to the priority rank of an ID code. CAN controller 2 arbitrates transmission rights (bitwise non-destructive arbitration) when frames collide on communication bus B1. CAN controller 2 detects, reports, and handles errors that occur during the transmission and reception of frames. CAN transceiver 1 and CAN controller 2 together constitute a receiving unit.

[0058] For example, when a frame containing data specifying a load control signal is received, CAN controller 2 extracts the data specifying the load control signal and stores the extracted data in the message box. CAN controller 2 may include an SPI communication register. In this case, CAN controller 2 can store the data specifying the load control signal from the message box in this register or similar. As described above, CAN controller 2 temporarily stores the load control signal transmitted by ECU 200.

[0059] The load control signal stored in the CAN controller 2 contains, for example, 1 as a signal indicating current and 0 as a signal indicating no current. Therefore, the load control signal can be represented by 0 and 1. In the present embodiment, an 8-bit load control signal is used as an example, as described in the upper part of the Fig. Figure 5 is shown. However, the present invention is not limited to this, and any load control signal having multiple bits can be used.

[0060] The load control signal is a signal used to control the actuators 40n. Therefore, the load control signal stored in CAN controller 2 can also be referred to as the control pattern. The control pattern stored in CAN controller 2 is the current control pattern used to control the actuators 40n. Therefore, the control pattern stored in CAN controller 2 can also be referred to as the updated value of the control pattern.

[0061] The updated value of the control pattern corresponds to the control state (next control state) after the control transition of each actuator 40n. Therefore, each of the actuators 40n undergoes a control state transition by changing the control pattern from the previous value to the updated value. The previous value of the control pattern will be described in more detail later.

[0062] As seen in the upper part of the Fig. As shown in Figure 5, in the present embodiment, a CAN controller 2 is used as an example in a state where 11100100 (first gear or first speed) is written as the updated value of the control pattern. The updated value of the control pattern is compared with a transition prohibition pattern 52 as a transition determination value. Therefore, the control pattern can also be referred to as the comparison pattern. The transition prohibition pattern 52 can also be referred to as the determination pattern.

[0063] A first bit 211 in the upper part of the Fig. Bit 5 corresponds to the first actuator 401. A second bit 212 corresponds to the second actuator 402. A third bit 213 corresponds to the third actuator 403. A fourth bit 214 corresponds to the fourth actuator 404. A fifth bit 215 corresponds to the fifth actuator 405. A sixth bit 216 corresponds to the sixth actuator 406. A seventh bit 217 corresponds to the seventh actuator 407. An eighth bit 218 corresponds to the eighth actuator 408.

[0064] In the present embodiment, the updated value of the control pattern is used as a correlated control state of each actuator 40n, which correlates with the load control signal received by the CAN transceiver 1 and the CAN controller 2. The correlated control state can also be considered the control state after a control transition. Therefore, the correlated control state can also be considered the next control state.

[0065] CAN controller 2 outputs the updated value of the control pattern to SPI circuit 10. Specifically, CAN controller 2 only outputs the updated value of the control pattern to SPI circuit 10 if the updated value is normal. That is, if a normal signal is output by the first comparator 40, as described later, CAN controller 2 outputs the updated value of the control pattern to SPI circuit 10. If an abnormal signal is output by the first comparator 40, CAN controller 2 ignores the current value of the control pattern and does not output it to SPI circuit 10.

[0066] The SPI circuit 10 is connected to the CAN controller 2, the control IC 20, and the sequence circuit 30. The SPI circuit 10 contains a control register 11. The control register 11 corresponds to a control memory unit. SPI is an abbreviation for Serial Peripheral Interface.

[0067] Control register 11 stores a control pattern output by CAN controller 2. As described later, the control IC 20 in the control device 100 controls the actuation of each actuator 40n according to the control pattern stored in control register 11. That is, control register 11 stores a control pattern used to control actuation by control IC 20. Therefore, the control pattern stored in control register 11 is the previous value of the control pattern. That is, the previous value of the control pattern corresponds to the current actuation state, which specifies the actuation state of each actuator 40n at the current time. As described above, SPI circuit 10 obtains the previous value of the control pattern. Therefore, SPI circuit 10 corresponds to a procurement unit.

[0068] As it is in the lower part of the Fig. As shown in Figure 5, in the present embodiment, a control register 11 is used as an example in a state in which 01110100 (fourth gear or fourth speed) is written as the previous value of the control pattern. The control register 11 has bits 111 to 118 of addresses corresponding to the respective actuators 40n. A signal indicating a control state of each actuator 40n in the load control signal is written into the control register 11 in bits of the respective addresses.

[0069] The first bit 111 in the lower part of the Fig. Bit 5 corresponds to the first actuator 401. Bit 112 corresponds to the second actuator 402. Bit 113 corresponds to the third actuator 403. Bit 114 corresponds to the fourth actuator 404. Bit 115 corresponds to the fifth actuator 405. Bit 116 corresponds to the sixth actuator 406. Bit 117 corresponds to the seventh actuator 407. Bit 118 corresponds to the eighth actuator 408.

[0070] As it is in the Fig. 1 and Fig. As shown in Figure 2, the control IC 20 corresponds to a control unit. The control IC 20 is connected to the control switches 30n. The control IC 20 controls the control switches 30n according to the control pattern. That is, the control IC 20 outputs a control signal for individually switching the respective control switches 30n on and off according to the control pattern stored in the control register 11. The control IC 20 selectively switches the control switches 301 to 308 on and off according to the control pattern stored in the control register 11.

[0071] For the sake of simplicity, in Fig. Figure 1 shows only a single control IC 20. However, the control device 100 contains several control ICs 20, which are assigned to and connected with the respective control switches 30n. That is, the control device 100 contains control ICs 20, the number of which is the same as the number of control switches 30n.

[0072] Therefore, each control IC 20 switches the control switch 30n connected to it on and off according to a value assigned to it in the control pattern. For example, if the first control IC 20 and the first control switch 301 are connected to each other, the first control IC 20 switches the first control switch 301 on and off according to a value stored in the first bit 111 of the control register 11.

[0073] A PWM signal can be used as the control signal. In this case, the control IC 20 can change the current (i.e., the supplied current) flowing through the actuator 40n by changing the duty cycle of the PWM signal. PWM is an abbreviation for pulse width modulation.

[0074] For example, if the control pattern is 11100100, the control ICs 20 switch on the first to third control switches 301 to 303 and the sixth control switch 306. Consequently, the control ICs 20 energize the first actuator 401 to the third actuator 403 and the sixth actuator 406. In this case, the control ICs 20 switch off the fourth control switch 304, the fifth control switch 305, the seventh control switch 307, and the eighth control switch 308. Consequently, the control ICs 20 do not energize the fourth actuator 404, the fifth actuator 405, the seventh actuator 407, and the eighth actuator 408.

[0075] As it is in Fig. As shown in Figure 8, the sequence circuit 30 contains a first data loader (data loading device) 31, a second data loader 32, a third data loader 33, a fourth data loader 34, a third comparator 41, and similar components. The sequence circuit 30 contains several switching elements and similar components. The sequence circuit 30 is operated synchronously to a clock signal. The sequence circuit 30 is operated to compare the updated value of the control pattern with the determination pattern. The sequence circuit 30 corresponds to a determination unit.

[0076] As it is in Fig. As shown in Figure 11, the first data loader 31 writes the updated value of the control pattern, which is stored in the CAN controller 2, into the first data register 61. That is, the first data loader 31 copies a signal of the respective bits in the CAN controller 2 and writes the copied signal into the respective bits in the first data register 61.

[0077] As it is in Fig. As shown in Figure 10, the second data loader 32 writes the previous value of the control pattern, which is stored in the control register 11, into the second data register 62. That is, the second data loader 32 copies a signal of the respective bits in the control register 11 and writes the copied signal into the respective bits in the second data register 62.

[0078] As it is in Fig. As shown in Figure 9, the third data loader 33 writes several sequencing patterns 51, which are stored in the ROM 50, successively into the third data register 63. That is, the third data loader 33 copies a signal from the respective bits of the sequencing patterns 51 and writes the copied signal into the respective bits in the third data register 63. The sequencing patterns 51 will be described in more detail later.

[0079] The third comparator 41 compares the control pattern set in the second data register 62 with the current patterns 51 set in the third data register 63. The third comparator 41 selects the current pattern 51 that matches the previous value of the control pattern from among the current patterns 51. That is, the transition prohibition pattern 52 that corresponds to or is associated with the previous value of the control pattern is selected. The third comparator 41 outputs a signal indicating the current pattern 51 that corresponds to the previous value of the control pattern.

[0080] It can be said that the third comparator 41 detects that the previous value of the control pattern is a control pattern indicating fourth gear. Furthermore, it can be said that the third comparator 41 determines a control transition from a control state specified by the previous value of the control pattern to a control state specified by the updated value of the control pattern.

[0081] As it is in Fig. As shown in Figure 12, the fourth data loader 34 writes the transition prohibition pattern 52, which is stored in ROM 50, into the fourth data register 64. The fourth data loader 34 writes the transition prohibition pattern 52, which corresponds to the signal output by the third comparator 41, into the fourth data register 64. If there are multiple transition prohibition patterns 52, the fourth data loader 34 writes the transition prohibition patterns 52 sequentially into the fourth data register 64. That is, the fourth data loader 34 copies a signal of each bit in the transition prohibition pattern 52 and writes the copied signal to the respective bits in the fourth data register 64. As described above, the fourth data loader 34 obtains the transition prohibition pattern 52, which is associated with the control pattern, from ROM 50.

[0082] In the present embodiment, the transition prohibition pattern 52 is used as a determination pattern. The transition prohibition pattern 52 corresponds to a transition determination value and a prohibition determination value. The transition prohibition pattern 52 will be described in more detail later.

[0083] The first comparator 40 contains an operational amplifier and similar components. The first comparator 40 compares the transition prohibition pattern 52 with the updated value of the control pattern. The first comparator 40 compares each signal of the transition prohibition pattern 52 with each signal in the updated value of the control pattern. The first comparator 40 compares the transition prohibition pattern 52 with the updated value of the control pattern to determine whether the transition prohibition pattern 52 and the updated value of the control pattern satisfy a predetermined corresponding relationship. The first comparator 40 determines that the updated value of the control pattern is abnormal if the predetermined corresponding relationship is satisfied. The first comparator 40 corresponds to a determination unit.

[0084] As described above, in the present embodiment, the transition prohibition pattern 52 is used as a transition determination value. Therefore, if the transition prohibition pattern 52 and the updated value of the control pattern match, the first comparator 40 determines that the predetermined corresponding relationship is satisfied. If the transition prohibition pattern 52 and the updated value of the control pattern match, the latter indicates that the updated value of the control pattern is contained in the transition prohibition pattern 52. Conversely, if the transition prohibition pattern 52 and the updated value of the control pattern do not match, the first comparator 40 determines that the predetermined corresponding relationship is not satisfied.

[0085] The updated value of the control pattern, which matches the transition prohibition pattern 52, is a control pattern indicating a control transition from the current control state to a prohibited control state. Therefore, the updated value of the control pattern is an abnormal control pattern. The reason why CAN controller 2 receives an abnormal control pattern could be message spoofing, message manipulation, or something similar. That is, for example, in control system 1000, the communication bus B1 is attacked, and the load control signal is falsified, thus transmitting an abnormal control pattern to control device 100.

[0086] On the other hand, the updated value of the control pattern, which does not match the transition prohibition pattern 52, is a control pattern that indicates a control transition from the current control state to a control state that is not prohibited. Therefore, the updated value of the control pattern is a normal control pattern.

[0087] If the transition prohibition pattern 52 matches the updated value of the control pattern, the first comparator 40 determines that the updated value of the control pattern is abnormal. Conversely, if the transition prohibition pattern 52 does not match the updated value of the control pattern, the first comparator 40 determines that the updated value of the control pattern is normal.

[0088] The first comparator 40 outputs a different signal depending on whether a match is detected or not. If a match is detected, the first comparator 40 outputs an abnormality signal indicating that the updated value of the control pattern is abnormal. This abnormality signal also indicates that communication using communication bus B1 is abnormal.

[0089] If, on the other hand, no match is found, the first comparator 40 outputs a normality signal indicating that the control pattern is normal. The abnormality and normality signals are output to the CAN controller 2, the power supply circuit 70, the ECU 200, and similar devices. The normality signal indicates that the updated value of the control pattern is normal and confirms that communication using the communication bus B1 is functioning normally.

[0090] The first comparator 40 outputs an abnormality signal to CAN controller 2, informing it that the updated value of the control pattern is abnormal. By reporting the abnormality, the first comparator 40 instructs CAN controller 2 to disregard the updated value of the control pattern. The first comparator 40 also outputs an abnormality signal to power supply circuit 70 or ECU 200, issuing a command to set the power supply state for actuator 40n to a disabled or open state. When a power-off command is issued, the first comparator 40 may output an abnormality signal to power supply circuit 70 and / or ECU 200.

[0091] The first comparator 40 outputs a normality signal to the CAN controller 2, thus instructing the CAN controller 2 to output the updated value of the control pattern. The first comparator 40 outputs a normality signal to the power supply circuit 70 or the ECU 200, thus issuing a command to set the power supply state for the actuator 40n to a power supply state.

[0092] As described above, the communication bus B1 can be attacked from the outside. This means that if an abnormal or normal signal is transmitted via the communication bus B1, the signal can be falsified. Even if the control device 100 transmits an abnormal or normal signal via the CAN transceiver 203, the ECU 200, for example, cannot receive such a signal.

[0093] Therefore, it is advantageous if the first comparator 40 outputs an abnormality signal or a normality signal to the ECU 200 via the second signal line L2. Consequently, even if the communication bus B1 is attacked, the first comparator 40 can still output an abnormality signal or a normality signal to the ECU 200.

[0094] The ROM 50 stores the current pattern 51 (EZP) and the transition prohibition pattern 52 (PHP). That is, the ROM 50 contains a current pattern memory in which the current pattern 51 is stored, and a transition prohibition pattern memory in which the transition prohibition pattern 52 is stored. The ROM 50 corresponds to a destination memory unit.

[0095] As it is in Fig. As shown in Figure 3, the current pattern 51 is a control pattern that corresponds to the respective control states, which can be the control states of the actuators 40n. Therefore, the ROM 50 stores multiple current patterns 51. Each of the current patterns 51 contains a signal that indicates a control state of each of the actuators 40n. The current patterns 51 each correlate with states of the automatic transmission. If the previous value of the control pattern and the updated value of the control pattern are normal, the values ​​are parts of the current patterns 51. Fig. 3 and similar, actuators 401 to 408 are each designated ACT1 to ACT8.

[0096] As it is in Fig. As shown in Figure 4, the transition prohibition pattern 52 is the current pattern 51, which specifies a control state of each actuator 40n. The transition prohibition pattern 52 is a value that correlates with a control transition from the current control state. The transition prohibition pattern 52 is a determining value used to ascertain whether the updated value of the control pattern is abnormal. The ROM 50 stores the control pattern and the transition prohibition pattern 52 in association with each other. The transition prohibition pattern 52 specifies a control state according to which a control transition from the control state specified by the previous value of the control pattern is prohibited. That is, the transition prohibition pattern 52 is the current pattern 51, which specifies a control transition that would result in undesired operation of the automatic transmission.

[0097] In the example of the Fig. Figure 4 shows an example of a transition prohibition pattern 52, which is assigned to a control pattern indicating fourth gear (fourth speed). When the automatic transmission is in fourth gear, downshifting to first gear (first speed) results in an unintended rapid deceleration. Shifting into reverse (R) results in an unintended reverse speed. Shifting into park (P) results in an unintended parking (P) lock-up. Therefore, the control pattern corresponding to fourth gear is assigned to the current pattern as the transition prohibition pattern corresponding to first gear, reverse (R), and park (P), respectively. The transition prohibition pattern(s) 52 is / are pre-stored in the ROM 50, unlike the control pattern.

[0098] ROM 50 contains bits of addresses corresponding to actuators 401 to 408. A signal (value) indicating the control state of each actuator 401 to 408 in the transition prohibition pattern 52 is written to the bits of the respective addresses in ROM 50. In the present embodiment, an 8-bit control pattern is used as an example. Therefore, each transition prohibition pattern 52, like the control pattern, has 8 bits. Each transition prohibition pattern 52 contains 1 as a signal indicating current and 0 as a signal indicating no current. Therefore, each transition prohibition pattern 52 can be represented by 0 and 1.

[0099] ROM 50 is preferably not accessible via CAN control 2. That is, ROM 50 cannot be overwritten from outside the control device 100 via CAN control 2. In other words, ROM 50 is located independently of the communication using communication bus B1. Therefore, the power-on pattern 51 and the transition prohibition pattern 52 are written to ROM 50 by the manufacturer, a distributor, or similar entity. In the manner described above, the control device 100 can prevent unintentional overwriting of the power-on pattern 51 or the transition prohibition pattern 52.

[0100] Register unit 60 contains a first data register 61 (1REG), a second data register 62 (2REG), a third data register 63 (3REG), and a fourth data register 64 (4REG). The values ​​described above are set in the respective data registers 61 to 64.

[0101] As it is in the Fig. 1 and Fig. As shown in Figure 2, the power supply circuit (PSC) 70 corresponds to a power supply unit. The power supply circuit 70 is a circuit that switches the power supply switch 500 on and off. The power supply circuit 70 changes the power supply state of the actuators 401 to 408 by switching the power supply switch 500 on and off.

[0102] For example, if an emergency lock command is entered by the ECU 200, the power supply circuit 70 outputs a signal indicating that the power supply switch 500 is being turned off. In other words, the power supply circuit 70 turns off the power supply switch 500 to set the power supply state of each actuator 40n to a locked or open state. That is, the power supply circuit 70 turns off the power supply switch 500 to prevent the respective actuators 40n from being driven by an abnormal control pattern. Conversely, if the updated value of the control pattern is normal, the power supply circuit 70 turns on the power supply switch 500 to set the power supply state of each actuator 40n to a powered state.

[0103] If an abnormal signal is input from the first comparator 40, the power supply circuit 70 can output a signal indicating that the power supply switch 500 is being switched off. That is, the emergency shutdown command and the abnormal signal are signals that indicate the switching off of the power supply switch 500.

[0104] The current sensing resistor 81, together with the amplifier 82, forms a current sensing unit. The current sensing unit is arranged individually for each actuator 40n. Therefore, in the present embodiment, eight current sensing units are arranged in the control device 100. Fig. Figure 1 is shown as a representative example of a current sensing unit that corresponds to or is assigned to the first actuator 401.

[0105] Each current sensing unit detects a current that actually flows through the corresponding actuator 40n. In other words, each current sensing unit detects a control state of the corresponding actuator 40n. That is, the current sensing units monitor the respective current states of the actuators 40n.

[0106] In addition to the current sensing resistor 81 and the amplifier 82, the current sensing unit can include a filter that removes noise from a voltage amplified by the amplifier 82. The filter can, for example, contain a resistor and a capacitor.

[0107] The current sensing resistor 81 is connected in series with the actuator 401. The current sensing resistor 81 is located on the ground side (current-down side) with respect to the first actuator 401. The amplifier 82 amplifies a voltage generated across the current sensing resistor 81 that is proportional to the current. Therefore, the amplifier 82 outputs a voltage signal that is proportional to the current flowing through the first actuator 401. Thus, each current sensing unit outputs a voltage signal that is proportional to the current flowing through the corresponding actuator 401.

[0108] The second comparator 83 (2CMP) contains an operational amplifier and similar components. The second comparator 83 is arranged individually for each actuator 40n. The second comparator 83 is arranged in a set together with the current sensing resistor 81 and the amplifier 82. In the present embodiment, eight second comparators 83 are arranged in the control device 100. Fig. Figure 1 is a representative example of only the second comparator 83, which corresponds to or is assigned to the first actuator 401.

[0109] The second comparator 83 compares the voltage signal output by the amplifier 82 with a reference value. The second comparator 83 outputs a positive value if the voltage signal is greater than the reference value and a negative value if the voltage signal is less than the reference value. That is, the second comparator 83 outputs a monitoring result indicating the energization state of a respective actuator 40n, which is monitored by the corresponding current sensing unit. For example, the second comparator 83 outputs a positive value if the first actuator 401 is energized. Conversely, the second comparator 83 outputs a negative value if the first actuator 401 is not energized.

[0110] As it is in Fig. As shown in Figure 6, the output of every second comparator 83 is written to the monitoring register 84 (MREG). That is, the monitoring register 84 stores a monitoring pattern as a result of monitoring the current state of each actuator 40n. The monitoring pattern can be considered the current control state. The monitoring pattern can also be considered a correlated control state. The monitoring register 84 can also be referred to as the monitoring memory unit. Fig. 6 is used as an example a monitoring register 84 in which a monitoring pattern is stored that indicates the fourth gear.

[0111] As described above, the control device 100 can obtain the current control state of a respective actuator 40n using the current sensing resistor 81, the amplifier 82, the second comparator 83, and the monitoring register 84. In the present embodiment, a monitoring pattern can be used as the current control state instead of the previous value of the control pattern. These elements 81 to 84 correspond to a procurement unit. However, the elements 81 to 84 can also be omitted. In particular, the monitoring register 84 need not be present.

[0112] The monitoring register 84 contains address bits corresponding to, or assigned to, the respective actuators 401 to 408. Signals (values) indicating the power-on states of actuators 401 to 408 are written to the respective address bits in monitoring register 84. The signal indicating the power-on state of each actuator 401 to 408 is an output from the corresponding second comparator 83.

[0113] For example, the monitoring register 84 is written with a 1 indicating current and a 0 indicating no current. Thus, the monitoring pattern can be represented by 0 and 1. In the present embodiment, an 8-bit control pattern is used as an example. Therefore, the monitoring pattern, like the control pattern, has 8 bits.

[0114] The first bit 841 in the monitoring register 84 corresponds to the first actuator 401. Similarly, the second to eighth bits 842 to 848 correspond to the respective second to eighth actuators 402 to 408.

[0115] A rotation sensor signal, which is an output from the rotation sensor 600, is input into the waveform analysis circuit 90. The waveform analysis circuit 90 determines a vehicle speed based on the rotation sensor signal [pulses / s]. The waveform analysis circuit 90 determines, for example, whether the vehicle speed is high, low, or equal to 0 (stopped).

[0116] The waveform analysis circuit 90 determines that the vehicle speed is high when the rotation sensor signal reaches (or has reached) a preset threshold. The waveform analysis circuit 90 determines that the speed is low when the rotation sensor signal does not reach the preset threshold and is not equal to 0. The waveform analysis circuit 90 determines that a vehicle is stopped when the rotation sensor signal is equal to 0.

[0117] Therefore, the vehicle speed can be considered the current control state of each actuator 40n. Thus, the waveform analysis circuit 90 corresponds to a procurement unit. However, the waveform analysis circuit 90 can also be omitted. Operation of the control device

[0118] The following describes the operation of the control device 100. When a load control signal is received, the control device 100 starts the process shown in the flowchart of the Fig. The operation is shown in Figure 7. In this case, it is assumed that the power supply circuit 70 outputs a signal indicating that the power supply switch 500 is switched on. This means that current can be supplied to each actuator 40n.

[0119] In step S10a, a transition prohibition pattern is set. As described above, the second data loader 32, the third data loader 33, and the fourth data loader 34 select the transition prohibition pattern 52, which corresponds to the previous value of the control pattern, from ROM 50 and place the transition prohibition pattern 52 into the fourth data register 64.

[0120] If several transition prohibition patterns 52 are stored in the ROM 50, the fourth data loader 34 writes the transition prohibition patterns 52 stored in the ROM 50 successively into the fourth data register 64. When the transition prohibition pattern 52 written to the fourth data register 64 is output to the first comparator 40, the fourth data loader 34 writes the next transition prohibition pattern 52 into the fourth data register 64.

[0121] In step S11, the load control signal is set. As described above, the first data loader 31 loads the updated value of the control pattern, i.e., the load control signal, from the CAN controller 2. The first data loader 31 sets the loaded updated value of the control pattern in the first data register 61. Once the control pattern is set in the first data register 61, it is output to the first comparator 40.

[0122] In step S12a, the received signal is compared with the transition prohibition pattern. The received signal is the updated value of the control pattern. The first comparator compares the updated value of the control pattern, which is set in the first data register 61, with the transition prohibition pattern 52, which is set in the fourth data register 64. If multiple transition prohibition patterns 52 are stored in the ROM 50, the first comparator 40 successively compares the updated value of the control pattern with the respective transition prohibition patterns 52. Thus, the comparator 40 compares the updated value of the control pattern with all transition prohibition patterns 52.

[0123] If the first comparator 40 determines that the updated value of the control pattern does not match any of the transition prohibition patterns 52, the process proceeds to step S13. In this case, the updated value of the control pattern is considered normal.

[0124] On the other hand, if the first comparator 40 determines that the updated value of the control pattern matches a transition prohibition pattern 52, the process proceeds to step S14. That is, if the first comparator 40 determines that at least one of the transition prohibition patterns 52 matches the updated value of the control pattern, the process proceeds to step S14. In this case, the updated value of the control pattern can be considered abnormal.

[0125] In the present embodiment, 11100100 is used as the updated value of the control pattern. In the present embodiment, there are three transition prohibition patterns, as described in the Fig. 4 and Fig. Figure 12 are shown, which are used as the transition prohibition patterns 52. Accordingly, the updated value of the control pattern matches the third transition prohibition pattern 52. Therefore, the first comparator 40 determines that the updated value of the control pattern matches a transition prohibition pattern 52.

[0126] In step S13, current is supplied according to the load control signal. The first comparator 40 outputs a normality signal indicating that the updated value of the control pattern is normal. When the normality signal is received, the control IC 20 supplies current to the actuator 40n according to the load control signal written to control register 11. That is, the CAN controller 2 stores the updated value of the control pattern in control register 11. The control IC 20 selectively switches the control switches 301 to 308 on and off according to the updated value of the control pattern stored in control register 11. Consequently, the control IC 20 selectively supplies current to the actuators 40n.

[0127] In step S14, a notification regarding an abnormality is provided. The first comparator 40 outputs an abnormality signal to the ECU 200, indicating that the updated value of the control pattern is abnormal. Thus, the first comparator 40 reports the abnormality to the ECU 200. As described above, the control device 100 is able to quickly notify the ECU 200 of the abnormality using the first comparator 40, without using a calculation by a microcomputer. That is, the control device 100 is able to notify the ECU 200 of the abnormality earlier by using the first comparator 40 than in a configuration that uses a calculation by the microcomputer.

[0128] In step S15, the power supply is interrupted. The first comparator outputs an abnormality signal to the power supply circuit 70, indicating that the updated value of the control pattern is abnormal. The first comparator 40 outputs the abnormality signal to the power supply circuit 70, thus issuing a command to interrupt the power supply to the actuator 40n. When the abnormality signal is received, the power supply circuit 70 switches off the power supply switch 500 to interrupt the power supply to the respective actuators 40n. Consequently, the control device 100 is able to prevent the actuators 40n from being controlled by an abnormal control pattern.

[0129] Only one of the steps from S14 and S15 can be performed.

[0130] The first comparator 40 can output the abnormality signal to the control IC 20 instead of to the power supply circuit 70. In this case, the control IC 20 selectively switches the control switches 301 to 308 on and off according to the previous value of the control pattern. Consequently, the control IC 20 selectively energizes the actuators 40n. Effect

[0131] As described above, the control device 100 stores the transition prohibition pattern 52. The updated value of the control pattern is compared with the transition prohibition pattern 52, and thus the control device 100 is able to determine whether the updated value of the control pattern is abnormal and indicates a switch into the prohibited transition pattern.

[0132] More precisely, the control device 100 can determine whether the updated value of the control pattern received by the CAN controller 2 is abnormal, instead of determining the current value of the control pattern stored in the control register 11. Therefore, the control device 100 is able to determine whether the load control signal contained in the frame transmitted over the communication bus B1 is falsified due to spoofing or similar manipulation. Consequently, the control device 100 is able to take measures against falsification of the updated value of the control pattern without performing complex processing such as authentication or encryption of communication using a microcomputer.

[0133] The control device 100 can determine whether the received updated value of the control pattern is abnormal before controlling a respective actuator 40n. That is, the control device 100 is able to prevent the actuators 40n from being controlled by an abnormal control pattern.

[0134] One countermeasure against forgery can be authentication or encryption of communication using a microcomputer, as described above. However, this countermeasure, based on authentication or encryption, requires constant updates. Therefore, this method necessitates updating the microcomputer's program, which increases costs.

[0135] Another countermeasure against forgery can be monitoring communication using a microcomputer. However, monitoring communication increases the communication capacity due to the encryption of messages or communications, thus reducing the communication speed. Therefore, this method increases costs due to the increased communication speed.

[0136] On the other hand, since the control device 100 does not use a microcomputer, the increase in costs can be limited. That is, the control device 100 is able to prevent switching to the prohibited transition pattern due to counterfeiting at a lower cost than if a microcomputer were used.

[0137] A transition permission pattern can be used as the determination pattern, specifying a control state according to which a control transition from the control state specified by the previous value of the control pattern is permitted. However, the control device 100 stores the transition prohibition pattern 52 in the ROM 50 as the determination pattern. The transition prohibition pattern 52 has a smaller number of patterns than the number of transition permission patterns. Therefore, the control device 100 is able to reduce the capacity occupied by the determination pattern in the ROM 50.

[0138] Compared to the ECU 200, the control device 100 does not contain a microcomputer. Therefore, the control device 100 can be smaller than a configuration that includes a microcomputer. The control device 100 can reduce its energy consumption and heat generation compared to a configuration containing a microcomputer. Consequently, the size and mounting limitations of the control device 100 due to heat generation are less pronounced compared to a configuration containing a microcomputer. This means that the control device 100 offers greater mounting flexibility compared to a configuration containing a microcomputer. The control device 100 also requires fewer measures for operational safety compared to a configuration containing a microcomputer.

[0139] The control system 1000 contains the control device 100. Thus, the control system 1000 is able to take measures against falsification of the updated value of the control pattern in the control device 100 without performing complex processing such as authentication or encryption of communication using a microcomputer. The control system 1000 can prevent a switch to a prohibited transition pattern due to falsification at a lower cost than using a control device containing a microcomputer. The control system 1000 is able to reduce the memory capacity occupied by the determination pattern in ROM 50.The 1000 control system is able to increase the degree of freedom for assembly and reduce measures relating to functional safety compared to when using a control device that contains a microcomputer.

[0140] The transitional prohibition pattern 52 and the comparison objective of transitional prohibition pattern 52 are not limited to those mentioned above. As can be seen, for example, in modification example 1 of the Fig. As shown in Figure 13, a transition pattern in which a previous value and an updated value of a control pattern are arranged can be used as a comparison target for the transition prohibition pattern 52. In this case, the transition prohibition pattern 52 can use a pattern obtained by arranging the previous value of the control pattern and a current pattern that specifies a control state according to which a control transition starting from a control state specified by the previous value is prohibited. The first comparator 40 compares the transition pattern with the transition prohibition pattern 52.

[0141] In the example of the Fig. Figure 13 shows a transition pattern in which a control pattern indicating fourth gear as the previous value of the control pattern and a control pattern indicating first gear as the updated value are arranged. In this case, the transition prohibition pattern 52 uses a pattern obtained by arranging a control pattern indicating fourth gear and a control pattern indicating P gear, arranging a control pattern indicating fourth gear and a control pattern indicating R gear, and arranging a control pattern indicating fourth gear and a control pattern indicating first gear.

[0142] The transition prohibition pattern 52 and the comparison target of transition prohibition pattern 52 can even use patterns that are converted into identifiers. As shown, for example, in modification example 2 of the Fig. Figure 14 shows that a control pattern (an updated value and a previous value) and the transition prohibition pattern 52 are used as patterns converted into 4-bit identifiers. The first comparator 40 compares an identifier into which the updated value of the control pattern has been converted with an identifier into which the transition prohibition pattern 52 has been converted.

[0143] Modification Examples 1 and 2 can also be implemented in combination. In this case, the transition pattern is a pattern obtained by proposing an identifier into which the previous value of the control pattern has been converted, together with an identifier into which an updated value of the control pattern has been converted. Similarly, the transition prohibition pattern 52 is a pattern obtained by proposing an identifier into which the previous value of the control pattern has been converted, together with an identifier into which a current pattern specifying a control state, according to which a control transition starting from a control state specified by the previous value is prohibited, has been converted.

[0144] A preferred embodiment of the present invention has been described above. However, the present invention is not limited to the embodiment described above, and various modifications within the scope of the present invention are possible. Further forms of the present invention are described below as embodiments two through ten. The embodiment described above and embodiments two through ten can be implemented independently of one another or in suitable combinations. The present invention is not limited to the combinations described in the embodiments but can be implemented in further different combinations. Second embodiment

[0145] A control device 100 and a control system 1000 according to a second embodiment are described with reference to Fig. 15. In the present embodiment, the description focuses on parts that differ from those described above. The description of the same parts in the embodiment described above also applies here as needed. This also applies to the following embodiments.

[0146] The control device 100 and the control system 1000 of the present embodiment have the same configurations as in the first embodiment. Therefore, the same reference numerals are used in the present embodiment as in the first embodiment. The present embodiment differs from the first embodiment in that a transitional permit design is used instead of the transitional prohibition design 52.

[0147] ROM 50 stores a current pattern 51 and a transition permission pattern. That is, ROM 50 contains a current pattern memory in which the current pattern 51 is stored, and a transition permission pattern memory in which the transition permission pattern is stored. ROM 50 corresponds to a destination memory unit.

[0148] The transition permission pattern is a current pattern that specifies a control state for each actuator 40n. The transition permission pattern is a value that correlates with a control transition starting from the current control state. The transition permission pattern is a determining value used to ascertain whether an updated value of a control pattern is abnormal. The ROM 50 stores the control pattern and the transition permission pattern in relation to each other.

[0149] The transition permission pattern specifies a control state where a control transition from a control state defined by the previous value of the control pattern is permitted. That is, the transition permission pattern specifies a control transition permission starting from a current control state. In other words, the transition permission pattern is a current pattern that specifies a control transition resulting in an operation permitted for the automatic transmission. The transition permission pattern corresponds to a transition determination value or a permission determination value.

[0150] When a load control signal is received, the control device 100 starts the process shown in the flowchart of the Fig. 15 depicted operations. In Fig. 15 will use the same step counts for the same processes as in Fig. 7 used.

[0151] In step S10b, a transition permission pattern is set. The sequence circuit 30 sets the transition permission pattern in the fourth data register 64 in the same way as when setting the transition prohibition pattern 52. That is, the sequence circuit 30 selects the transition permission pattern that corresponds to or is assigned to the previous value of the control pattern from ROM 50 and sets the transition permission pattern in the fourth data register 64.

[0152] In step S12b, the received signal is compared with the transition permission pattern. The received signal corresponds to the updated value of the control pattern. The first comparator 40 compares the updated value of the control pattern, which is set in the first data register 61, with the transition permission pattern, which is set in the fourth data register 64 (determining unit). If multiple transition permission patterns are stored in the ROM 50, a comparison is performed in the same way as in the embodiment described above.

[0153] If the first comparator 40 determines that the updated value of the control pattern matches at least one transition allow pattern, the process proceeds to step S13. In this case, the updated value of the control pattern can be considered normal. As described above, the first comparator 40 determines that a predetermined corresponding relationship is not satisfied if the updated value of the control pattern matches at least one transition allow pattern.

[0154] If, on the other hand, the first comparator 40 determines that the updated value of the control pattern does not match any transition allow pattern, the process proceeds to step S14. In this case, the updated value of the control pattern can be considered abnormal. As described above, the first comparator 40 determines that the predetermined corresponding relationship is satisfied if the updated value of the control pattern does not match any of the transition allow patterns. If the transition allow pattern and the updated value of the control pattern do not match, this indicates that the updated value of the control pattern is not included in the transition allow patterns.

[0155] The control device 100 of the second embodiment can achieve the same effects as the control device 100 of the first embodiment. The control system 1000 of the second embodiment can achieve the same effects as the control system 1000 of the first embodiment. Third embodiment

[0156] A control device 100 and a control system 1000 according to a third embodiment are below referred to as Fig. 16. The control device 100 and the control system 1000 of the present embodiment, for example, have the same configurations as in the first embodiment. Therefore, the same reference numerals are used in the present embodiment as in the first embodiment.

[0157] The present embodiment differs from the first embodiment in that a vehicle speed determined by the waveform analysis circuit 90 is used as the current control state instead of the previous value of the control pattern. Therefore, the control device 100 of the present embodiment must include the waveform analysis circuit 90.

[0158] The transition prohibition pattern 52 is stored in association with a vehicle speed determined by the waveform analysis circuit 90, which is the current control state. The transition prohibition pattern 52 is stored in association with signals indicating respective vehicle speeds, for example, represented by 0 and 1. The transition prohibition pattern 52 associated with a high speed, for example, uses a current pattern indicating first gear, P gear, and R gear. The transition prohibition pattern 52 associated with a low speed uses a current pattern indicating P gear and R gear. The transition prohibition pattern 52 associated with the stop state uses a current pattern indicating third gear and fourth gear. The transition prohibition pattern 52 corresponds to a transition determination value or a prohibition determination value.

[0159] When a load control signal is received, the control device 100 starts the process shown in the flowchart of the Fig. The operation shown in Figure 16 is the same as step S11. Step S26a is the same as step S12a. Steps S27 to S29 are the same as steps S13 to S15.

[0160] In step S20, a rotation sensor signal is received. The waveform analysis circuit 90 receives the rotation sensor signal from the rotation sensor 600.

[0161] In step S21, the vehicle speed is determined. The waveform analysis circuit 90 determines the vehicle speed from the received rotation sensor signal. If the waveform analysis circuit 90 determines that the vehicle speed is high, the process proceeds to step S22. If the waveform analysis circuit 90 determines that the vehicle speed is low, the process proceeds to step S23. If the waveform analysis circuit 90 determines that the vehicle is stopped, the process proceeds to step S24.

[0162] In step S22, a transition prohibition pattern associated with high speed is set from memory. The sequence circuit 30 sets the transition prohibition pattern 52, associated with high speed, from ROM 50 into the fourth data register 64.

[0163] In step S23, the transition prohibition pattern associated with the low speed is set from memory. The sequence circuit 30 sets the transition prohibition pattern 52, associated with the low speed, from ROM 50 into the fourth data register 64.

[0164] In step S24, a transition prohibition pattern associated with the stop state is set from memory. The sequence circuit 30 sets the transition prohibition pattern 52, which is associated with the stop state, from ROM 50 into the fourth data register 64.

[0165] As described above, the sequence circuit 30 obtains the transition prohibition pattern 52, which is associated with the vehicle speed obtained by the waveform analysis circuit 90, from the ROM 50. The memory in steps S22 to S24 is a transition prohibition pattern memory in the ROM 50.

[0166] The control device 100 of the third embodiment can achieve the same effects as the control device 100 of the first embodiment. The control system 1000 of the third embodiment can achieve the same effects as the control system 1000 of the first embodiment. Fourth embodiment

[0167] A control device 100 and a control system 1000 according to a fourth embodiment are below referred to as follows: Fig. 17. The control device 100 and the control system 1000 of the present embodiment have the same configurations as in the first embodiment. Therefore, the same reference numerals are used in the present embodiment as in the first embodiment. In the present embodiment, a vehicle speed determined by the waveform analysis circuit 90 is used as the current control state in the same way as in the third embodiment. Therefore, the control device 100 of the present embodiment must include the waveform analysis circuit 90. In the present embodiment, a transitional permit pattern is used as a transitional determination value in the same way as in the second embodiment.

[0168] The transition permission pattern is stored in association with a vehicle speed determined by waveform analysis circuit 90, which is the current control state. The transition permission pattern is stored in association with signals specified by respective vehicle speeds, indicated, for example, by 0 and 1. The transition permission pattern associated with high speed uses a current pattern indicating second gear, third gear, and fourth gear. The transition permission pattern associated with low speed uses a current pattern associated with first gear, second gear, and third gear. The transition permission pattern associated with the stop state uses a current pattern associated with first gear, second gear, park (P), and reverse (R).The transitional permit template corresponds to a transitional determination value or a permit determination value.

[0169] When a load control signal is received, the control device 100 starts the process shown in the flowchart of the Fig. 17 depicted operations. In Fig. 17 will use the same step counts for the same processes as in Fig. 16 is used. Note that step S26b is the same as step S12b.

[0170] In step S22a, a transition enable pattern associated with high speed is set from memory. The sequence circuit 30 sets the transition enable pattern associated with high speed from ROM 50 into the fourth data register 64.

[0171] In step S23a, the transition enable pattern associated with the low speed is set from memory. Sequence circuit 30 sets the transition enable pattern associated with the low speed from ROM 50 into the fourth data register 64.

[0172] In step S24a, the transition enable pattern associated with the stop state is set from memory. Sequence circuit 30 sets the transition enable pattern associated with the stop state from ROM 50 into the fourth data register 64.

[0173] As described above, the sequence circuit 30 obtains the transition permission pattern associated with the vehicle speed, which is obtained by the waveform analysis circuit 90, from the ROM 50. The memory in steps S22a to S24a is a transition permission pattern memory in the ROM 50.

[0174] The control device 100 of the fourth embodiment can achieve the same effects as the control devices 100 of the first, second, and third embodiments. The control system 1000 of the fourth embodiment can achieve the same effects as the control systems 1000 of the first, second, and third embodiments. Fifth embodiment

[0175] A control device 100 and a control system 1000 according to a fifth embodiment are described with reference to Fig. 18. The control device 100 and the control system 1000 of the present embodiment have the same configurations as in the first embodiment. Therefore, the same reference numerals are used in the present embodiment as in the first embodiment. The present embodiment differs from the first embodiment in that a monitoring pattern stored in the monitoring register 84 is used as a correlated control state instead of the updated value of the control pattern. Therefore, the control device 100 of the present embodiment must include the current sensing resistor 81, the amplifier 82, the second comparator 83, and the monitoring register 84. The transition prohibition pattern 52 of the present embodiment is the same as in the first embodiment.

[0176] When a load control signal is received, the control device 100 starts the process shown in the flowchart of the Fig. 18 depicted operations. In Fig. 18 will use the same step counts for the same processes as in Fig. 7 used.

[0177] In step S12c, the control process is started. The CAN controller 2 stores the updated value of the control pattern in the control register 11. The control IC 20 selectively switches the control switches 301 to 308 on and off according to the updated value of the control pattern stored in the control register 11. Consequently, the control IC 20 (or control ICs 20) selectively energizes the actuators 40n. It can be said that the control IC 20 performs a control operation to obtain the monitoring pattern.

[0178] In step S12d, the control result is monitored. The control device 100 stores the monitoring pattern in the monitoring register 84 by operating the current sensing resistor 81, the amplifier 82, and the second comparator 83, as described above.

[0179] In step S12e, the monitoring result is compared with the transition prohibition pattern. The monitoring result corresponds to the monitoring pattern. The first comparator 40 compares the monitoring pattern set in the first data register 61 with the transition prohibition pattern 52 set in the fourth data register 64. If multiple transition prohibition patterns 52 are stored in the ROM 50, a comparison is performed in the same way as in the embodiment described above.

[0180] If the first comparator 40 determines that the monitoring pattern does not match any of the transition prohibition patterns 52, the process proceeds to step S13. In this case, the monitoring pattern is considered normal. Since the monitoring pattern is normal, the updated value of the control pattern is also considered normal.

[0181] On the other hand, if the first comparator 40 determines that the monitoring pattern matches the transition prohibition pattern 52, the process proceeds to step S14. That is, if the first comparator 40 determines that at least one of the transition prohibition patterns 52 matches the monitoring pattern, the process proceeds to step S14. In this case, the monitoring pattern is considered abnormal. As described above, the first comparator 40 determines that the predetermined corresponding relationship is satisfied if at least one of the transition prohibition patterns 52 matches the monitoring pattern. Since the monitoring pattern is abnormal, the updated value of the control pattern is also considered abnormal.

[0182] The control device 100 of the fifth embodiment can achieve the same effects as the control device 100 of the first embodiment. The control system 1000 of the fifth embodiment can achieve the same effects as the control system 1000 of the first embodiment. For example, if the automatic transmission is actually instructed to shift from fourth gear to park (P), the automatic transmission does not immediately shift into park (P) due to a reaction of hydraulic pressure or the like. Thus, the control device 100 can use the monitoring pattern instead of the updated value of the control pattern. Sixth embodiment

[0183] A control device 100 and a control system 1000 according to a sixth embodiment are below referred to as follows: Fig. 19. The control device 100 and the control system 1000 of the present embodiment have the same configurations as in the first embodiment. Therefore, the same reference numerals are used in the present embodiment as in the first embodiment. In the present embodiment, the monitoring pattern stored in the monitoring register 84 is used as a correlated control state instead of the updated value of the control pattern, in the same way as in the fifth embodiment. In the present embodiment, a transition permission pattern is used as a transition determination value, in the same way as in the second embodiment.

[0184] When a load control signal is received, the control device 100 starts the process shown in the flowchart of the Fig. 19 depicted operations. In Fig. 19 will use the same step counts for the same processes as in the Fig. 7 and Fig. 15 used. Steps S12f and S12g are the same as steps S12c and S12d.

[0185] In step S12h, the monitoring result and the transition permission pattern are compared. The monitoring result corresponds to the monitoring pattern. The first comparator 40 compares the monitoring pattern set in the first data register 61 with the transition permission pattern set in the fourth data register 64. If multiple transition permission patterns are stored in the ROM 50, a comparison is performed in the same way as in the embodiment described above.

[0186] If the first comparator 40 determines that the monitoring pattern matches at least one transitional permission pattern, the process proceeds to step S13. In this case, the monitoring pattern is considered normal. As described above, the first comparator 40 determines that the predetermined corresponding relationship is not satisfied if the monitoring pattern matches at least one transitional permission pattern.

[0187] If, on the other hand, the first comparator 40 determines that the monitoring pattern does not match any of the transition permission patterns, the process proceeds to step S14. In this case, the monitoring pattern is considered abnormal. As described above, the first comparator 40 determines that the predetermined corresponding relationship is satisfied if the monitoring pattern does not match any of the transition permission patterns. If the transition permission pattern and the monitoring pattern do not match, this indicates that the monitoring pattern is not included in the transition permission patterns.

[0188] The control device 100 of the sixth embodiment can achieve the same effects as the control devices 100 of the first, second, and fifth embodiments. The control system 1000 of the sixth embodiment can achieve the same effects as the control system 1000 of the first, second, and fifth embodiments. Seventh embodiment

[0189] A control device 100 and a control system 1000 according to a seventh embodiment are described with reference to Fig. 20. The control device 100 and the control system 1000 of the present embodiment have the same configurations as in the first embodiment. Therefore, the same reference numerals are used in the present embodiment as in the first embodiment.

[0190] In the present embodiment, a vehicle speed determined by the waveform analysis circuit 90 is used as the current control state in the same way as in the third embodiment. Therefore, the control device 100 of the present embodiment must include the waveform analysis circuit 90. The transitional prohibition pattern 52 of the present embodiment is the same as in the third embodiment.

[0191] In the present embodiment, the monitoring pattern is used as a correlated control state in the same way as in the fifth embodiment. Therefore, the control device 100 of the present embodiment must include the current sensing resistor 81, the amplifier 82, the second comparator 83, and the monitoring register 84.

[0192] When a load control signal is received, the control device 100 starts the process shown in the flowchart of the Fig. 20 depicted operations. In Fig. 20 will use the same number of steps for the same processes as in the Fig. 16 and Fig. 18 used. Steps S26c to S26e are the same as steps S12c to S12e.

[0193] The control device 100 of the seventh embodiment can achieve the same effects as the control devices 100 of the first, third, and fifth embodiments. The control system 1000 of the seventh embodiment can achieve the same effects as the control systems 1000 of the first, third, and fifth embodiments. Eighth embodiment

[0194] A control device 100 and a control system 1000 according to an eighth embodiment are below referred to as Fig. 21. The control device 100 and the control system 1000 of the present embodiment have the same configurations as in the first embodiment. Therefore, the same reference numerals are used in the present embodiment as in the first embodiment.

[0195] In the present embodiment, a vehicle speed determined by the waveform analysis circuit 90 is used as the current control state in the same way as in the fourth embodiment. Therefore, the control device 100 of the present embodiment must include the waveform analysis circuit 90. The transitional patent design of the present embodiment is the same as that of the fourth embodiment.

[0196] In the present embodiment, the monitoring pattern is used as a correlated control state in the same way as in the sixth embodiment. Therefore, the control device 100 of the present embodiment must include the current sensing resistor 81, the amplifier 82, the second comparator 83, and the monitoring register 84.

[0197] When a load control signal is received, the control device 100 starts the process shown in the flowchart of the Fig. 21 depicted operations. In Fig. 21 will use the same step counts for the same processes as in the Fig. 17 and Fig. 19 is used. Steps S26f to S26h are the same as steps S12f to S12h.

[0198] The control device 100 of the eighth embodiment can achieve the same effects as the control devices 100 of the first, fourth, and sixth embodiments. The control system 1000 of the eighth embodiment can achieve the same effects as the control system 1000 of the first, fourth, and sixth embodiments. Ninth embodiment

[0199] A control device 100 and a control system 1000 of a ninth embodiment are below referred to with reference to the Fig. 22, Fig. 23 and Fig. 24. The present embodiment differs from the first embodiment in that each detection result from a sensor detection circuit 91 is used as the current control state instead of the previous value of the control pattern. The control device 100 of the present embodiment differs from the control device 100 of the first embodiment in that the sensor detection circuit (SEND) 91 is provided or arranged. The sensor detection circuit 91 is connected to a sensor 700.

[0200] The sensor 700 of the present embodiment comprises a hydraulic pressure sensor 701 (OPS), a rotation sensor 702 (RS), and an oil temperature sensor 703 (OTS). The hydraulic pressure sensor 701 outputs a signal indicating the pressure of the hydraulic oil in the hydraulic circuit. The rotation sensor 702 is similar to the rotation sensor 600. The oil temperature sensor 703 outputs a signal indicating the temperature of the hydraulic oil in the hydraulic circuit.

[0201] The sensor acquisition circuit 91 acquires a signal from the sensor 700. The sensor acquisition circuit 91 performs predetermined processing, such as waveform acquisition and analog-to-digital conversion, on the input signal from the sensor 700. The sensor acquisition circuit 91 acquires a load state, that is, a state of the automatic transmission including the valve body. Specifically, the state of the automatic transmission including the valve body is considered the current control state, which indicates the control state of each actuator 40n at the current time. Similarly, each acquisition result is considered by the sensor acquisition circuit 91 to be the current control state. The sensor acquisition circuit 91 corresponds to a procurement unit.

[0202] Each measurement result from the sensor acquisition circuit 91 can be represented, for example, by 0 and 1. The sensor acquisition circuit 91 outputs each measurement result to the sequence circuit 30. The sensor acquisition circuit 91 can write each measurement result to the monitoring register 84.

[0203] The ROM 50 stores the data collection results and the transition prohibition pattern 52 in relation to each other. Instead of the transition prohibition pattern 52, a transition permission pattern can be stored in the ROM 50 in relation to a respective data collection result. The transition prohibition pattern 52 is used here as an example.

[0204] The control device 100 starts the process shown in the flowchart of the Fig. 23 depicted operations at predetermined times.

[0205] In step S30, communication data is received. The CAN controller 2 receives a frame from the communication bus B1 via the CAN transceiver 1. The CAN controller 2 extracts the received messages and similar information and stores the extracted messages in the message box.

[0206] In step S31, data is extracted. CAN controller 2 extracts data specifying the load control signal from the message box. CAN controller 2 stores this extracted data in a register. The data stored in this register corresponds to the updated value of the control pattern. Sequence circuit 30 sets the updated value of the control pattern in the first data register 61.

[0207] In step S32, a state is obtained. The sequence circuit 30 sets the previous value of the control pattern, which is stored in the control register 11, into the second data register 62.

[0208] In step S33, a transition is determined. Sequence circuit 30 determines a control transition based on the updated value of the control pattern extracted in step S31 and the previous value of the control pattern obtained in step S32. That is, sequence circuit 30 determines a control transition from the current control state to a control state specified by the updated value of the control pattern.

[0209] As is the case, for example, in Fig. As shown in Figure 13, the sequence circuit 30 determines the control transition by generating a transition pattern as a combination of the updated value of the control pattern and the previous value of the control pattern. As shown in Fig. As shown in Figure 13, the sequence circuit 30 in this case sets the transition prohibition pattern 52, which corresponds to the transition pattern, into the fourth data register 64.

[0210] In step S34, a comparison is performed. The first comparator 40 compares the transition pattern with the transition prohibition pattern 52. If the first comparator determines that the transition pattern does not match any of the transition prohibition patterns 52, the process proceeds to step S35. In this case, the updated value of the control pattern can be considered normal.

[0211] On the other hand, if the first comparator 40 determines that the transition pattern matches the transition prohibition pattern 52, the process proceeds to step S37. That is, if the first comparator 40 determines that at least one of the transition prohibition patterns 52 matches the updated value of the control pattern, the process proceeds to step S37. In this case, the updated value of the control pattern can be considered abnormal.

[0212] In step S35, it is determined that the communication is normal. The first comparator 40 determines that the communication is normal. In this case, the first comparator 40 can output a normality signal to the ECU 200 via the second signal line L2.

[0213] In step S36, the control IC is controlled. Step S36 is the same as step S13.

[0214] In step S37, the data is ignored. As described above, the first comparator 40 outputs an abnormality signal to CAN controller 2, indicating that the updated value of the control pattern is abnormal. When the abnormality signal is received, CAN controller 2 ignores the updated value of the control pattern and does not output it to SPI circuit 10. CAN controller 2 ignores the updated value of the control pattern by not outputting it to SPI circuit 10. CAN controller 2 can also ignore the updated value of the control pattern by deleting the updated value of the control pattern that was stored at the time the abnormality signal was received.

[0215] As described above, the first comparator 40 outputs the abnormality signal to the CAN controller 2, and thus the updated value of the control pattern identified as abnormal is not stored in the control register 11. Therefore, the control device 100 does not write the updated value of the control pattern identified as abnormal to the control register 11. Consequently, the control device 100 can prevent any actuator 40n from being controlled according to the updated value of the control pattern identified as abnormal.

[0216] In step S38, a message regarding the omission of data is provided. The first comparator 40 outputs an abnormality signal to the ECU 200 via the second signal line L2. The abnormality signal indicates that the updated value of the control pattern is abnormal and serves as a notification of data omission. The data in this context is the updated value of the control pattern. In the control device 100, the first comparator 40 outputs an abnormality signal without using a microcomputer or similar device.

[0217] The first comparator 40 does not need to output the abnormality signal to the power supply circuit 70. Steps S37 and S38 can also be used for other embodiments.

[0218] The following describes the operation of the ECU 200. The ECU 200 starts the process shown in the flowchart of the Fig. 24 depicted operations at predetermined times.

[0219] In step S40, a load control transition is determined. The CPU 2011 determines the load control transition by defining a load control signal, for which a command is issued to the control device 100.

[0220] In step S41, a load control command is issued. The CPU 2011 transmits data specifying the load control signal as communication data. In this case, the CPU 2011 stores the data specifying the load control signal, determined in step S40, in the transmission message box of the CAN controller 2012. The CAN controller 2012 generates a frame containing the data specifying the load control signal and transmits the frame to the communication bus B1 via the CAN transceiver 203.

[0221] In step S42, it is determined whether there is a data disregard message. The CPU 2011 determines whether a disregard message exists based on whether the data disregard message was received from the control device 100 via the second signal line L2. If the disregard message was received, the CPU 2011 determines that a disregard message exists, and the process proceeds to step S43. If no disregard message was received, the CPU 2011 determines that there is no disregard message, and the process proceeds to step S44.

[0222] In step S43, normality is determined. CPU 2011 determines that the communication with the control device 100 is normal.

[0223] In step S44, the messages are counted. The CPU 2011 counts the messages that were not considered.

[0224] In step S45, it is determined whether N > 5. If CPU 2011 determines that the number N of disregard messages exceeds five, the process proceeds to step S46. If CPU 2011 determines that the number N does not exceed five, the process returns to step S41. Here, five corresponds to a predetermined number.

[0225] When the process returns to step S41, CPU 2011 retransmits the load control signal. Therefore, CPU 2011 retransmits the load control signal, for which a notification was provided and which is abnormal, until the number of ignore notifications reaches five.

[0226] Here, a predetermined number, set as a threshold for counting, is five. However, the present invention is not limited to this. The smaller the threshold, the faster a communication abnormality can be detected. Conversely, the larger the threshold, the smaller the error in detecting a communication abnormality.

[0227] In step S46, it is determined that the communication is abnormal. The CPU 2011 determines that the communication with the control device 100 using communication bus B1 is abnormal. That is, the CPU 2011 determines that communication bus B1 is being attacked from the outside and cannot transmit the load control signal normally to the control device 100.

[0228] In step S47, an emergency lockout is performed. The CPU 2011 issues an emergency lockout command to the power supply circuit 70 via the first signal line L1. This means that the CPU 2011 issues the emergency lockout command to the power supply circuit 70 without using the CAN controller 2012 and the CAN transceiver 203. Consequently, the CPU 2011 can prevent the control of any actuator 40n based on the load control signal transmitted via the communication bus B1 where the communication abnormality occurred or is occurring. The flowchart of the Fig. 24 can also be used for other embodiments. The CPU 2011 can issue an instruction to transition to a specific switching state via the first signal line L1. In other words, the CPU 2011 can be used as long as the CPU 2011 issues an instruction to set the current supply to the load to a predetermined abnormality handling state via the first signal line L1.

[0229] The control device 100 of the ninth embodiment can achieve the same effects as the control device 100 of the first embodiments. The control system 1000 of the ninth embodiment can achieve the same effects as the control system 1000 of the first embodiment. In the control system 1000 of the ninth embodiment, the ECU 200 is able to set the power supply state for each actuator 40n to a disabled state if a communication abnormality has occurred. Thus, the control device 100 in the control system 1000 of the ninth embodiment can be designed more simply. Tenth embodiment

[0230] A control device 100 and a control system 1000 of a tenth embodiment are described with reference to Fig.25 described. In the present embodiment, for the sake of simplicity, the same reference numerals are used as in the first embodiment.

[0231] The tenth embodiment differs from the embodiments described above in that the control device 100 controls the operation of a motor 800 in a shift-by-wire system (electronic switching). Therefore, the actuators 401 to 403 correspond to a U-phase winding, a V-phase winding, and a W-phase winding of the motor 800.

[0232] The control device 100 of the present embodiment differs from the control device 100 of the first embodiment in that a sensor detection circuit (SEND) 92 is provided. The present embodiment differs from the first embodiment in that each detection result from the sensor detection circuit 92 is used as the current control state instead of the previous value of the control pattern. The present embodiment differs from the first embodiment in that the transition determination value is a value that correlates with a control transition starting from the current control state and a vehicle state.

[0233] The present embodiment differs from the first embodiment in that a signal indicating a control state of each of the actuators 401 to 403 in a load control signal is written in bits of corresponding addresses in the control register 11. In the present embodiment, the updated value of the control pattern is used as a correlated control state of the actuators 401 to 408, which correlates with the updated value of the control pattern stored in the control register 11.

[0234] In addition to the motor 800, the shift-by-wire system includes a parking detent mechanism (P-detent mechanism), a gear-shifting mechanism, and similar components. The motor 800 rotates when electrical power is supplied to it from a battery mounted on a vehicle (not shown) and serves as a drive source for the gear-shifting mechanism. The motor 800 can supply power to each actuator 40n by energizing the power supply switch 500. When the power supply switch 500 is off, the power supply to the actuators 40n is blocked or interrupted.

[0235] The updated value of the control pattern can, for example, use a value indicating the release of the P-lock. That is, the ECU 200 causes a load control signal for the control device 100 to contain not only a signal indicating rotation of the motor 800, but also a signal indicating the release (unlocking) of the P-lock.

[0236] The sensor of the present embodiment includes a brake switch (BS) 704 and a P-lock sensor (PLS) 705. The brake switch 704 outputs a signal indicating whether a brake pedal is pressed or actuated. The brake switch 704 can output a signal corresponding to the actuation value of the brake pedal. The P-lock sensor 705 outputs a signal indicating whether the P-lock is in a locked or unlocked state.

[0237] The sensor acquisition circuit 92 (SEND) acquires a signal from the sensor 700. The sensor acquisition circuit 92 performs predetermined processing, such as waveform acquisition and analog-to-digital conversion, on the input signal from the sensor 700. The sensor acquisition circuit 92 acquires a load state, that is, a state of the shift-by-wire system. Specifically, the state of the shift-by-wire system is considered the current control state, indicating the control state of each actuator 40n at the current time. Similarly, an acquisition result from the sensor acquisition circuit 92 is considered the current control state. The sensor acquisition circuit 92 acquires an actuation state of the vehicle's brake pedal. The actuation state of the vehicle's brake pedal is considered a vehicle state. The sensor acquisition circuit 92 corresponds to a procurement unit.

[0238] Each measurement result from the sensor acquisition circuit 92 can be represented, for example, by 0 and 1. The sensor acquisition circuit 92 outputs the respective measurement result to the sequence circuit 30. The sensor acquisition circuit 92 can write the respective measurement result to the monitoring register 84.

[0239] The ROM 50 stores the acquisition results from the sensor acquisition circuit 92 and the transition prohibition pattern 52 in relation to each other. That is, the transition prohibition pattern 52 is assigned to the current control state and a vehicle state. Instead of the transition prohibition pattern 52, a transition permission pattern can be stored in the ROM 50 in relation to a respective acquisition result. The transition prohibition pattern 52 is used here as an example.

[0240] Sequence circuit 30 determines the current control state and a vehicle state based on a given detection result. Sequence circuit 30 sets the transition prohibition pattern 52, which is assigned to a given detection result, in the fourth data register 64. The transition prohibition pattern 52 can, for example, use an updated value of a control pattern that indicates the release of the P-lock in a state where the P-lock is engaged and the brake pedal is not depressed.

[0241] The first comparator 40 compares the updated value of the control pattern with the transition prohibition pattern 52 in the same way as in the embodiments above. The first comparator 40 determines that the updated value of the control pattern is abnormal if the updated value of the control pattern matches the transition prohibition pattern 52, and determines that the updated value of the control pattern is normal if the updated value does not match the transition prohibition pattern 52.

[0242] The control device 100 of the tenth embodiment can achieve the same effects as the control device 100 of the first embodiment.

[0243] The control system 1000 of the tenth embodiment can achieve the same effects as the control system 1000 of the first embodiment.

[0244] The controls and procedures described here can be implemented by a dedicated associated computer, created by configuring a memory and a processor programmed to execute one or more specific functions defined in computer programs. Alternatively, the controls and procedures described here can be implemented by a dedicated associated computer, created by configuring a processor provided by one or more dedicated associated hardware logic circuits.Alternatively, the controls and procedures described here can be implemented by one or more dedicated computers, created by configuring a combination of memory and a processor programmed to perform one or more specific functions, and a processor provided by one or more hardware logic circuits. The computer programs can be stored as instructions executed by a computer on a non-volatile, physical, computer-readable medium.

[0245] Note that a flowchart or the processing of the flowchart of the present application contains sections (also referred to as steps), each designated, for example, as S10a. Furthermore, each section can be divided into several subsections, and several sections can also be combined into a single section. Each section thus configured can also be referred to as a device, module, or setup.

Claims

[1] Control device for controlling multiple loads by controlling multiple semiconductor switches corresponding to the respective loads, wherein the control device comprises: a receiving unit (1, 2) which receives a load control signal, which contains a signal indicating a control state of each load, from an external control device; a control storage unit (11) that stores the load control signal received by the receiving unit; a control unit (20) that controls the semiconductor switches according to the load control signal stored in the control memory unit; a procurement unit that procures a current control state, which is the control state of each load at a current time, or a current vehicle state; a determination storage unit (50) which stores a transition determination value for determining whether the load control signal received by the receiving unit is abnormal, wherein the transition determination value correlates with a control transition starting from the current control state or the current vehicle state; and a determination unit (30, 40) that compares a correlated control state of each of the loads, which correlates with the load control signal received by the receiving unit, with the transition determination value and determines that the load control signal received by the receiving unit is abnormal if the correlated control state and the transition determination value satisfy a predetermined corresponding relationship. [2] Control device according to claim 1, wherein the determination unit does not store the load control signal that is determined to be abnormal in the control storage unit. [3] Control device according to claim 1 or 2, wherein the destination storage unit is not accessible via the receiving unit. [4] Control device according to one of claims 1 to 3, wherein the determination storage unit stores a prohibition determination value as the transition determination value, which indicates a prohibition of the control transition based on the current control state or the current vehicle state; and If the correlated control state is included in the prohibition determination value, the determination unit determines that the predetermined corresponding relationship is satisfied and the load control signal received by the receiving unit is abnormal. [5] Control device according to one of claims 1 to 3, wherein the determination storage unit stores a permission determination value as the transition determination value, which indicates permission for the control transition based on the current control state or the current vehicle state; and If the correlated control state is not included in the permission determination value, the determination unit determines that the predetermined corresponding relationship is satisfied and the load control signal received by the receiving unit is abnormal. [6] Control device according to any one of claims 1 to 5, wherein the determination storage unit stores the load control signal and the transition determination value in relation to each other; and The determination unit obtains the transition determination value, which is assigned to the load control signal received by the receiving unit, from the determination storage unit. [7] Control device according to any one of claims 1 to 5, wherein The determination storage unit stores the current control state and the transition determination value in relation to each other; and The determination unit obtains the transitional determination value, which is assigned to the current control state, from the determination storage unit via the procurement unit. [8] Control device according to any one of claims 1 to 7, wherein the control device controls the loads that are mounted on a vehicle; the procurement unit procures the current vehicle state of the vehicle in addition to the current control state; and The determination storage unit stores a value as the transition determination value to determine whether the load control signal received by the receiving unit is abnormal, the value being correlated with the control transition based on the current control state and the current vehicle state. [9] Control system which features: a control device that controls multiple loads by controlling multiple semiconductor switches corresponding to the respective loads; and a control device designed to communicate with the control device, wherein the control device contains: a transmission unit (201, 203) which transmits a load control signal which contains a signal indicating a control state of each of the loads; The control device contains: a receiving unit (1, 2) that receives the load control signal; a control storage unit (11) that stores the load control signal received by the receiving unit; a control unit (20) that controls the semiconductor switches according to the load control signal stored in the control memory unit; a procurement unit (10, 81 to 84, 90 to 92) that procures a current control state, which specifies a control state of each of the loads at a current time, or a current vehicle state; a determination storage unit (50) which stores a transition determination value for determining whether the load control signal received by the receiving unit is abnormal, wherein the transition determination value correlates with a control transition starting from the current control state or the current vehicle state; and a determination unit (30, 40) that compares a correlated control state of each of the loads, which correlates with the load control signal received by the receiving unit, with the transition determination value and determines that the load control signal received by the receiving unit is abnormal if the correlated control state and the transition determination value satisfy a predetermined corresponding relationship. [10] Control system according to claim 9, wherein when the determining unit determines that the load control signal is abnormal, the determining unit provides a message to the control device indicating that the load control signal transmitted by the transmission unit is abnormal. [11] Control system according to claim 10, wherein the control device counts a numerical number of messages provided by the determining unit and retransmits the load control signal, the abnormality of which is communicated, if the counted numerical number of messages does not reach a predetermined numerical number. [12] Control system according to claim 10, wherein the control device also includes a power supply unit (70) that changes the power supply state of the loads; and The control device counts the numerical number of messages provided by the destination unit and issues a command to the power supply unit to set the current supply to the loads to a predetermined abnormality handling state without using the transmission unit when the counted numerical number of messages reaches a predetermined numerical number.

Images