Vehicle control system, information processing device, and master electron control device

Abstract

To enable share of a determination result whether an abnormality occurs in a time synchronization between ECUs, in a whole ECU.SOLUTION: A vehicle control system 100 comprises: a master ECU 10; a plurality of slave ECUs 20; and a validator ECU 30. The validator ECU 30 executes: acquisition of accuracy related information as information in regard to an accuracy of time synchronization with the master ECU 10 and each slave ECU 20 from the master ECU 10 and the plurality of slave ECUs 20; and transmission of list information based on the acquired accuracy related information to the master ECU 10 and the plurality of slave ECUs 20.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a vehicle control system, an information processing device, and a master electronic control unit. [Background technology]

[0002] Patent Document 1 discloses a time synchronization system including an upstream packet transmission device and a plurality of downstream packet transmission devices, in which the downstream packet transmission devices perform time synchronization with the upstream packet transmission device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2013-243651 A Summary of the Invention [Problem to be solved by the invention]

[0004] In recent years, development of a vehicle control system equipped with multiple electronic control devices connected to each other via an in-vehicle network has been progressing. In this system, one of the multiple electronic control devices functions as a master electronic control device, and the remaining electronic control devices function as slave electronic control devices. By coordinating these multiple electronic control devices, advanced vehicle control can be realized.

[0005] To realize advanced vehicle control, it is necessary to perform time synchronization between the master electronic control unit and the slave electronic control units. However, an abnormality may occur in the time synchronization between any of the slave electronic control units and the master electronic control unit. [Means for solving the problem]

[0006] A vehicle control system for solving the above problem includes a master control unit and a plurality of slave control units configured to be able to communicate with the master control unit via an in-vehicle network. The vehicle control system executes the following operations: acquiring accuracy-related information, which is information related to accuracy of time synchronization between the master control unit and the slave control units, from the master control unit and the plurality of slave control units; and transmitting list information based on the accuracy-related information acquired from the master control unit and the plurality of slave control units to the master control unit and the plurality of slave control units.

[0007] The information processing device for solving the above problem is an electronic control device communicatively connected to a master electronic control device and a plurality of slave electronic control devices via an in-vehicle network, which executes the following operations: receiving accuracy-related information, which is information relating to the accuracy of time synchronization between the master electronic control device and the slave electronic control devices, from the master electronic control device and the plurality of slave electronic control devices; and transmitting list information based on the accuracy-related information acquired from the master electronic control device and the plurality of slave electronic control devices to the master electronic control device and the plurality of slave electronic control devices.

[0008] A master electronic control unit for solving the above problem is an electronic control unit communicatively connected to a plurality of slave electronic control units via an in-vehicle network, and executes the following operations: receiving accuracy-related information, which is information relating to the accuracy of time synchronization between the master electronic control unit and the slave electronic control units, from the plurality of slave electronic control units; and transmitting list information based on the accuracy-related information acquired from the plurality of slave electronic control units to the plurality of slave electronic control units. Effect of the Invention

[0009] To enable all electronic control devices to share a determination result as to whether or not an abnormality occurs in time synchronization between the electronic control devices. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing a vehicle control system according to an embodiment. [Diagram 2] FIG. 2 is a sequence diagram showing the flow of processing for the validator electronic control unit to collect accuracy-related information from the master electronic control unit and the slave electronic control unit. [Diagram 3] FIG. 3 is a sequence diagram showing a process flow when a validator electronic control unit determines whether or not an abnormality has occurred in time synchronization and transmits the determination result to a master electronic control unit and a plurality of slave electronic control units. [Figure 4] FIG. 4 is a flowchart illustrating a processing routine executed by the validator electronic control device to determine whether or not an abnormality has occurred in the time synchronization. [Diagram 5] FIG. 5 is a block diagram showing a vehicle control system according to a modified example. [Figure 6] FIG. 6 is a block diagram showing a vehicle control system according to a modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of a vehicle control system and an information processing device will be described with reference to FIGS. <Vehicle control system> 1, the vehicle control system 100 includes a plurality of electronic control devices configured to be able to communicate with each other via an in-vehicle network. An example of the in-vehicle network is Ethernet (registered trademark).

[0012] The electronic control devices include a master electronic control device 10, a plurality of slave electronic control devices 20, and a validator electronic control device 30. Each of the electronic control devices includes a processor and a memory. The memory includes a memory that stores a control program executed by the processor, and a memory that temporarily stores data.

[0013] In this embodiment, the master electronic control unit 10 corresponds to the "master control unit." The slave electronic control unit 20 corresponds to the "slave control unit." The validator electronic control unit 30 corresponds to the "information processing device."

[0014] Hereinafter, the electronic control units are referred to as "ECUs." Therefore, the master electronic control unit 10 is referred to as the "master ECU 10." The slave electronic control unit 20 is referred to as the "slave ECU 20." The validator electronic control unit 30 is referred to as the "validator ECU 30."

[0015] The vehicle control system 100 realizes advanced vehicle control by coordinating these multiple ECUs connected via an in-vehicle network. Therefore, the vehicle control system 100 needs to monitor whether an abnormality occurs in the time synchronization between the ECUs. The process for determining whether an abnormality occurs in the time synchronization is repeatedly executed in parallel with the vehicle control process.

[0016] The in-vehicle network is configured with a switch ECU 40 and a bus 50. The master ECU 10, the plurality of slave ECUs 20, and the validator ECU 30 are each connected to the switch ECU 40 via the bus 50.

[0017] The master ECU 10 outputs first time information that serves as a reference. The multiple slave ECUs 20 are each connected to the switch ECU 40 via a bus 50. The multiple slave ECUs 20 acquire the first time information through signal exchange with the master ECU 10 and calculate a transmission delay time pDelay in the in-vehicle network. The multiple slave ECUs 20 then output second time information that has been time-synchronized using the delay time pDelay. The calculation of the delay time pDelay will be described later.

[0018] The multiple slave ECUs 20 are ECUs that realize various functions of the vehicle. Examples of such ECUs include an engine ECU, a motor generator ECU, a brake ECU, and a driving assistance ECU. The engine ECU controls the engine. The motor generator ECU controls the motor generator. The brake ECU controls the brake device. The driving assistance ECU is an ECU that realizes advanced driving assistance.

[0019] <Information collection for diagnosing synchronization abnormalities> In the vehicle control system 100, signals are periodically exchanged between the master ECU 10 and the slave ECU 20, and each ECU acquires time information for when it transmits a signal and when it receives a signal. The validator ECU 30 periodically determines whether or not a synchronization anomaly has occurred between the first time information and the second time information.

[0020] 2 is a sequence diagram showing a process flow in which the validator ECU 30 collects information required for determining whether or not an abnormality has occurred in the time synchronization between the master ECU 10 and the slave ECU 20 from the master ECU 10 and the slave ECU 20. The vehicle control system 100 periodically executes this sequence during operation in parallel with the process related to the control of the vehicle. Note that this sequence is executed by the validator ECU 30, the master ECU 10, and each of the multiple slave ECUs 20. Note that only one of the multiple slave ECUs 20 is shown in FIG. 2.

[0021] In the first step S101, the master ECU 10 transmits a first signal Sync to the slave ECU 20. In the next step S103, the master ECU 10 acquires first time information at the time when the first signal Sync is transmitted as a first time t_1. The first time information is time information measured by the master ECU 10.

[0022] When the slave ECU 20 receives the first signal Sync, the process proceeds to step S201. In step S201, the slave ECU 20 acquires second time information at the time when the slave ECU 20 receives the first signal Sync as a second time t_2. The second time information is time information measured by the slave ECU 20.

[0023] After transmitting the first signal Sync to the slave ECU 20, the master ECU 10 shifts the process to step S105. In step S105, the master ECU 10 transmits a fourth signal FoUp to the slave ECU 20. For example, the master ECU 10 transmits a timestamp of the first time t_1 as the fourth signal FoUp.

[0024] The slave ECU 20 receives the first signal Sync to acquire the first time t_1. After acquiring the first time t_1, the slave ECU 20 shifts the process to step S203. In step S203, the slave ECU 20 transmits a second signal Req to the master ECU 10. In the following step S205, the slave ECU 20 acquires second time information at the time when the second signal Req is transmitted as a third time t_3.

[0025] When the master ECU 10 receives the second signal Req, the process proceeds to step S107. In step S107, the master ECU 10 acquires the first time information at the time when the second signal Req is received as a fourth time t_4. In the next step S109, the master ECU 10 transmits a third signal Resp to the slave ECU 20. In the following step S111, the master ECU 10 acquires the first time information at the time when the third signal Resp is transmitted as a fifth time t_5.

[0026] When the slave ECU 20 receives the third signal Resp, the process proceeds to step S207. In step S207, the slave ECU 20 acquires the second time information at the time when the slave ECU 20 receives the third signal Resp as a sixth time t_6.

[0027] When the master ECU 10 acquires the fifth time t_5, the process proceeds to step S113. In step S113, the master ECU 10 transmits a fifth signal RespFoUp to the slave ECU 20. For example, the master ECU 10 transmits a timestamp of the fourth time t_4 and a timestamp of the fifth time t_5 as the fifth signal RespFoUp.

[0028] The slave ECU 20 receives the fifth signal RespFoUp to obtain the fourth time t_4 and the fifth time t_5. When the slave ECU 20 obtains the fourth time t_4 and the fifth time t_5, the slave ECU 20 shifts the process to step S209. In step S209, the slave ECU 20 calculates a delay time pDelay. The delay time pDelay is a signal transmission delay time between the master ECU 10 and the slave ECU 20. The slave ECU 20 calculates the delay time pDelay based on the third time t_3, the fourth time t_4, the fifth time t_5, and the sixth time t_6. For example, the slave ECU 20 calculates a first difference which is the difference obtained by subtracting the third time t_3 from the sixth time t_6. The slave ECU 20 calculates a second difference which is the difference obtained by subtracting the fourth time t_4 from the fifth time t_5. Then, the slave ECU 20 calculates the delay time pDelay by subtracting the second difference from the first difference and dividing the result by two.

[0029] On the other hand, when the master ECU 10 transmits the fifth signal RespFoUp, the process proceeds to step S115. In step S115, the master ECU 10 transmits a master timing record message MTRM to the validator ECU 30. The master timing record message MTRM includes a sequence ID of the transmitted first signal Sync, a timestamp of the first time t_1, a timestamp of the fourth time t_4, and a timestamp of the fifth time t_5. In this embodiment, the master timing record message MTRM corresponds to "accuracy-related information" which is information related to the accuracy of the time synchronization between the master ECU 10 and the slave ECU 20.

[0030] When the slave ECU 20 calculates the delay time pDelay, the process proceeds to step S211. In step S211, the slave ECU 20 transmits a slave timing record message STRM to the validator ECU 30. The slave timing record message STRM includes the ID of the slave ECU 20, the sequence ID of the received first signal Sync, the sequence ID of the received fourth signal FoUp, and the sequence ID of the received fifth signal RespFoUp. The slave timing record message STRM also includes a timestamp of the second time t_2, a timestamp of the third time t_3, and a timestamp of the sixth time t_6. The slave timing record message STRM also includes a value of the delay time pDelay. In this embodiment, the slave timing record message STRM corresponds to the "accuracy-related information".

[0031] That is, the validator ECU 30 acquires the master timing record message MTRM and the slave timing record message STRM from the master ECU 10 and the slave ECU 20 as accuracy-related information through execution of the sequence shown in FIG.

[0032] As described above, the vehicle control system 100 includes a plurality of slave ECUs 20. Therefore, the validator ECU 30 acquires accuracy-related information related to the accuracy of time synchronization between a first slave ECU among the plurality of slave ECUs 20 and the master ECU 10 from the first slave ECU and the master ECU 10. In addition, the validator ECU 30 acquires accuracy-related information related to the accuracy of time synchronization between a second slave ECU among the plurality of slave ECUs 20 and the master ECU 10 from the second slave ECU and the master ECU 10. In addition, the validator ECU 30 acquires accuracy-related information related to the accuracy of time synchronization between a third slave ECU among the plurality of slave ECUs 20 and the master ECU 10 from the third slave ECU and the master ECU 10.

[0033] <Diagnosis of Synchronization Abnormalities> 3 is a sequence diagram showing a process flow when the validator ECU 30 diagnoses synchronization abnormality and transmits the diagnosis result to the master ECU 10 and the multiple slave ECUs 20. Note that only two of the multiple slave ECUs 20 are shown in FIG.

[0034] In step S301, the validator ECU 30 diagnoses a synchronization abnormality. 4 is a flowchart showing a processing routine for diagnosing a synchronization abnormality. In the first step S11, the validator ECU 30 sets a coefficient N to 1. In the following step S13, the validator ECU 30 calculates judgment-required information. The judgment-required information is information required to determine whether or not an abnormality has occurred in the time synchronization between the master ECU 10 and the Nth slave ECU. The validator ECU 30 calculates the judgment-required information based on the accuracy-related information.

[0035] For example, the validator ECU 30 calculates a period deviation. The period deviation is a deviation between the calculation period of the master ECU 10 and the calculation period of the N-th slave ECU. For example, the validator ECU 30 calculates a third difference obtained by subtracting the first time t_1 obtained in the sequence executed previously from the first time t_1 obtained in the sequence executed currently. This third difference corresponds to the period of the processing in the master ECU 10. Similarly, the validator ECU 30 calculates a fourth difference obtained by subtracting the second time t_2 obtained in the sequence executed previously from the second time t_2 obtained in the sequence executed currently. This fourth difference corresponds to the period of the processing in the N-th slave ECU. Then, the validator ECU 30 calculates a calculated value by subtracting the fourth difference from the third difference. This calculated value corresponds to the period deviation. Hereinafter, the calculated value is referred to as a "value equivalent to period deviation."

[0036] Next, the validator ECU 30 calculates an offset between the first time information and the second time information. For example, the validator ECU 30 calculates a fifth difference obtained by subtracting the delay time pDelay from the second time t_2. Then, the validator ECU 30 calculates the absolute value of the difference obtained by subtracting the fifth difference from the first time t_1. This absolute value is the offset. Hereinafter, this absolute value is referred to as an "offset equivalent value."

[0037] In this embodiment, the periodic deviation equivalent value and the offset equivalent value are the above-mentioned information required for determination. After calculating the periodic deviation equivalent value and the offset equivalent value, the validator ECU 30 shifts the process to step S15.

[0038] In step S15, the validator ECU 30 executes a determination process to determine whether or not an abnormality occurs in the time synchronization between the master ECU 10 and the N-th slave ECU based on the accuracy-related information. Here, the validator ECU 30 executes the determination process using the determination-required information calculated in step S13. As described above, the determination-required information is information calculated based on the accuracy-related information.

[0039] An example of the determination process will be described. When at least one of the following two conditions (A1) and (A2) is satisfied, the validator ECU 30 determines that an abnormality has occurred in the time synchronization between the master ECU 10 and the Nth slave ECU. On the other hand, when neither of the two conditions (A1) nor (A2) is satisfied, the validator ECU 30 determines that no abnormality has occurred in the time synchronization between the master ECU 10 and the Nth slave ECU.

[0040] (A1) It is possible to determine that there is a periodic shift. (A2) It can be determined that there is an offset deviation. For example, the validator ECU 30 determines whether the absolute value of the period deviation equivalent value is equal to or greater than the period deviation judgment value. The criterion for determining whether or not there is a period deviation is set as the period deviation judgment value. That is, when the absolute value of the period deviation judgment value is equal to or greater than the period deviation judgment value, the validator ECU 30 determines that there is a period deviation. On the other hand, when the absolute value of the period deviation judgment value is less than the period deviation judgment value, the validator ECU 30 determines that there is no period deviation.

[0041] For example, the validator ECU 30 determines whether the offset equivalent value is equal to or greater than the offset judgment value. The criterion for determining whether there is an offset deviation is set as the offset judgment value. That is, when the offset equivalent value is equal to or greater than the offset judgment value, the validator ECU 30 determines that there is an offset deviation. On the other hand, when the offset equivalent value is less than the offset judgment value, the validator ECU 30 determines that there is no offset deviation.

[0042] After executing the determination process, the validator ECU 30 shifts the process to step S17. In step S17, the validator ECU 30 updates the coefficient N so that the coefficient N is increased by 1. In the following step S19, the validator ECU 30 judges whether the coefficient N is greater than the judgment coefficient Nth. The number of the slave ECUs 20 constituting the vehicle control system 100 is set as the judgment coefficient Nth. That is, the validator ECU 30 judges whether the determination process has been executed for all the slave ECUs 20. If the coefficient N is equal to or less than the judgment coefficient Nth, there is a slave ECU 20 among the Nth slave ECUs 20 for which the determination process has not been executed. Therefore, if the coefficient N is equal to or less than the judgment coefficient Nth (S19: NO), the validator ECU 30 shifts the process to step S13. On the other hand, if the coefficient N is greater than the judgment coefficient Nth, the determination process has been executed for all the Nth slave ECUs 20. Therefore, when the coefficient N is greater than the determination coefficient Nth (S19: YES), the validator ECU 30 shifts the process to step S21.

[0043] In step S21, the validator ECU 30 creates list information. The list information is information based on accuracy-related information acquired from the master ECU 10 and the multiple slave ECUs 20. In this embodiment, the validator ECU 30 creates the list information of the determination results of the determination process for the multiple slave ECUs 20. Thereafter, the validator ECU 30 ends the processing routine shown in FIG.

[0044] 3, after creating the list information, the validator ECU 30 advances the process to step S303. In step S303, the validator ECU 30 transmits the list information to the master ECU 10 and the plurality of slave ECUs 20.

[0045] <Actions and Effects of the Present Embodiment> (1) The validator ECU 30 acquires accuracy-related information related to the accuracy of time synchronization between the master ECU 10 and the slave ECU 20 from the master ECU 10 and the multiple slave ECUs 20. Then, the validator ECU 30 transmits list information based on the accuracy-related information acquired from the master ECU 10 and the multiple slave ECUs 20 to the master ECU 10 and the multiple slave ECUs 20. Therefore, the vehicle control system 100 can cause the master ECU 10 and the multiple slave ECUs 20 to share the determination result of whether or not an abnormality has occurred in the time synchronization between the master ECU 10 and the slave ECU 20.

[0046] (2) In the vehicle control system 100, the determination process is executed in the validator ECU 30. Then, the validator ECU 30 transmits the determination results of the determination process for the plurality of slave ECUs 20 to the master ECU 10 and the plurality of slave ECUs 20 as list information.

[0047] Here, consider a case where the validator ECU 30 calculates the determination-required information but does not execute the determination process. In this case, the validator ECU 30 transmits the determination-required information as a list information to the master ECU 10 and the multiple slave ECUs 20. Then, the master ECU 10 and the multiple slave ECUs 20 each execute the determination process based on the received determination-required information. This allows the master ECU 10 and the multiple slave ECUs 20 to share the determination result of whether or not an abnormality has occurred in the time synchronization between the master ECU 10 and the slave ECUs 20. However, since the determination process is executed in each of the master ECU 10 and the multiple slave ECUs 20, the control load of the master ECU 10 and the multiple slave ECUs 20 increases.

[0048] In response to this, the validator ECU 30 executes the determination process in the vehicle control system 100. The validator ECU 30 transmits the determination results of the determination process for the plurality of slave ECUs 20 to the master ECU 10 and the plurality of slave ECUs 20 as list information.

[0049] Therefore, the vehicle control system 100 enables the master ECU 10 and the multiple slave ECUs 20 to share the determination result of whether or not an abnormality has occurred in the time synchronization between the ECUs, without increasing the control load on the master ECU 10 and the multiple slave ECUs 20.

[0050] <Example of change> The above embodiment can be modified as follows: The above embodiment and the following modifications can be combined with each other to the extent that no technical contradiction occurs.

[0051] In the above embodiment, an example was shown in which the master ECU 10, the multiple slave ECUs 20, and the validator ECU 30 were connected to the switch ECU 40 via the bus 50. The configuration of the vehicle control system is not limited to this configuration.

[0052] 5 illustrates a vehicle control system 100A according to a modified example. In the vehicle control system 100A, the master ECU 10A may function as the master control unit 11 and the switch unit 14. In this case, the master control unit 11 is a virtual machine configured on the master ECU 10A, and is a functional unit that functions in the same manner as the master ECU 10 described above. The switch unit 14 is a virtual machine configured on the master ECU 10A, and is a functional unit that functions in the same manner as the switch ECU 40 described above.

[0053] 6 illustrates a modified vehicle control system 100B. In the vehicle control system 100B, the master ECU 10B may function as the master control unit 11, the switch unit 14, and the validator unit 13. In this case, the validator unit 13 is a virtual machine configured on the master ECU 10B, and is a functional unit that functions in the same manner as the validator ECU 30 described above.

[0054] The determination process may be a process that can determine whether or not an abnormality has occurred in the time synchronization between the master ECU 10 and the slave ECU 20 using a method different from the method described in the above embodiment, as long as it can determine whether or not an abnormality has occurred in the time synchronization between the master ECU 10 and the slave ECU 20.

[0055] The validator ECU does not have to execute the determination process. In this case, the validator ECU transmits the determination-required information as list information to the master ECU and the plurality of slave ECUs. Then, the determination process is executed in each of the master ECU and the plurality of slave ECUs.

[0056] The ECU is not limited to an ECU that has a CPU and a ROM and executes software processing. In other words, the ECU may have any of the following configurations (a), (b), and (c). (a) The ECU has one or more processors that execute various processes according to a computer program. The processor includes a CPU and memory such as RAM and ROM. The memory stores program codes or instructions that are configured to cause the CPU to execute processes. The memory, i.e., computer-readable medium, includes any available medium that can be accessed by a general-purpose or special-purpose computer.

[0057] (b) The ECU is equipped with one or more dedicated hardware circuits that execute various processes. Examples of the dedicated hardware circuits include application specific integrated circuits, i.e., ASIC and FPGA. ASIC is an abbreviation for "Application Specific Integrated Circuit" and "FPGA" is an abbreviation for "Field Programmable Gate Array."

[0058] (c) The ECU includes a processor that executes some of the various processes in accordance with a computer program, and a dedicated hardware circuit that executes the remaining processes among the various processes. [Explanation of symbols]

[0059] 10, 10A, 10B... master ECU (master electronic control unit), 11... master control unit, 13... validator unit, 14... switch unit, 20... slave ECU (slave electronic control unit), 30... validator ECU (validator electronic control unit), 40... switch ECU, 50... bus, 100, 100A, 100B... vehicle control system.

Claims

1. A vehicle control system including a master control unit and a plurality of slave control units configured to be able to communicate with the master control unit via an in-vehicle network, acquiring accuracy-related information, which is information regarding accuracy of time synchronization between the master control unit and the slave control units, from the master control unit and the plurality of slave control units; and transmitting list information based on the accuracy-related information acquired from the master control unit and the plurality of slave control units to the master control unit and the plurality of slave control units. Vehicle control system.

2. performing a determination process for each of the slave control units to determine whether or not an abnormality has occurred in time synchronization between the master control unit and the slave control unit based on the accuracy-related information; and transmitting the determination results obtained by the determination process for the plurality of slave control units as the list information to the master control unit and the plurality of slave control units. The vehicle control system of claim 1 .

3. the master control unit is a master electronic control unit, and the slave control unit is a slave electronic control unit; an information processing device configured to be able to communicate with the master electronic control unit and the slave electronic control unit via the in-vehicle network; The information processing device includes: acquiring the accuracy-related information from the master electronic control unit and the plurality of slave electronic control units; Transmitting the list information to the master electronic control unit and the plurality of slave electronic control units. The vehicle control system according to claim 1 or 2.

4. An information processing device that is communicably connected to the master electronic control device and the plurality of slave electronic control devices via an in-vehicle network, receiving accuracy-related information, which is information regarding accuracy of time synchronization between the master electronic control unit and the slave electronic control units, from the master electronic control unit and the plurality of slave electronic control units; and transmitting list information based on the accuracy-related information acquired from the master electronic control unit and the plurality of slave electronic control units to the master electronic control unit and the plurality of slave electronic control units. Information processing device.

5. The slave electronic control units are a master electronic control unit communicatively connected via an in-vehicle network, receiving accuracy-related information from the plurality of slave electronic control devices, the accuracy being information relating to accuracy of time synchronization between the master electronic control device and the slave electronic control device; Transmitting list information based on the accuracy-related information acquired from the plurality of slave electronic control devices to the plurality of slave electronic control devices. Master Electronic Control Unit.

Images