Control system

Abstract

The first control device detects a communication abnormality with the second control device.SOLUTION: The control system includes a first control device and a second control device. The second control device periodically transmits, to the first control device, a transmission frame including a value of a first counter that is counted up for each transmission. The first control device sets a value of a second counter to a value of a third counter when validity of the value of the second counter can be confirmed by comparison between a value of a first counter included in the transmission frame and the value of the second counter counted up every time the transmission frame is received, sets the value of the first counter to the value of the second counter and the value of the third counter when the validity cannot be confirmed, and determines whether communication with the second control device is disrupted based on comparison between the value of the third counter and a value obtained by adding 1 to a previous value of the third counter.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to control systems. [Background technology]

[0002] A control system has been proposed in the past in which an engine ECU sends a test signal carrying a timestamp to an ECU to be diagnosed, and when a timeout occurs without receiving a corresponding signal from the ECU to be diagnosed, the engine ECU increments an error counter and the timestamp and sends a test signal, and when a corresponding signal is received and the timestamp of the test signal matches the timestamp of the corresponding signal, the engine ECU increments the timestamp without incrementing the error counter and sends a test signal, and when the timestamp reaches a specified number of times, the engine ECU diagnoses communication abnormalities with the ECU to be diagnosed based on the error counter for the timestamp (number of times the test signal has been sent) (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-40886 Summary of the Invention [Problem to be solved by the invention]

[0004] In such a control system, it would be useful to improve the technology by devising a method different from the above-described method for detecting a communication abnormality between a first control unit such as an engine ECU and a second control unit that is an ECU to be diagnosed. The control system disclosed herein has a main purpose of detecting a communication abnormality between the first control unit and the second control unit. [Means for solving the problem]

[0005] The control system of the present disclosure employs the following measures to achieve the above-described primary object. The control system of the present disclosure is a control system including a first control device and a second control device, wherein the second control device periodically transmits to the first control device a transmission frame including a first counter that is incremented with each transmission, and the first control device, when the validity of the second counter is confirmed based on a comparison result between the first counter included in the transmission frame and a second counter that is incremented with each reception of the transmission frame, sets the second counter to a third counter, and determines whether communication with the second control device has been interrupted based on a comparison result between the third counter and a value obtained by incrementing the previous value of the third counter. In the control system of the present disclosure, this process enables the first control device to detect a communication abnormality with the second control device. [Brief explanation of the drawings]

[0006] [Figure 1] 1 is a schematic configuration diagram of a control system 10 according to an embodiment of the present disclosure. [Figure 2] 10 is a flowchart illustrating an example of a second counter value validity confirmation process. [Figure 3] 10 is a flowchart showing an example of a first ignition information validity confirmation process. [Figure 4] 10 is a flowchart illustrating an example of a process for detecting a breakdown of communication between C-ECUs. [Figure 5] 10 is a time chart showing an example of a state in which the A-ECU 20 determines whether or not communication with the C-ECU 42 has been interrupted. DETAILED DESCRIPTION OF THE INVENTION

[0007] A mode (embodiment) for carrying out the present disclosure will be described with reference to the drawings. FIG. 1 is a schematic configuration diagram of a control system 10 according to an embodiment of the present disclosure. As shown in the figure, the control system 10 according to the embodiment is mounted on a vehicle and includes three control devices: an A-ECU 20 (first control device), a B-ECU 40, and a C-ECU 42 (second control device). The A-ECU 20 and the B-ECU 40 exchange information (communication frames) with each other via a communication line 60 (e.g., a communication line for CAN communication). The A-ECU 20 and the C-ECU 42 exchange information with each other via a communication line 62 (e.g., a communication line for CAN communication). Ignition information IG relating to the on / off state of an ignition switch is input to the A-ECU 20, the B-ECU 40, and the C-ECU 50 via a communication line 50 (e.g., a direct line).

[0008] The A-ECU 20, B-ECU 40, and C-ECU 50 each include a microcomputer with a CPU, ROM, RAM, flash memory, input / output ports, and communication ports, various drive circuits, and various logic ICs. The B-ECU 40 periodically (every predetermined time ΔT1) transmits a first transmission frame including ignition information IG to the A-ECU 20. The C-ECU 42 periodically (every predetermined time ΔT2) transmits a second transmission frame including a first counter value C1 to the A-ECU 20. The first counter value C1 is counted up each time a second transmission frame is transmitted. The second transmission frame includes, for example, data, the first counter value C1 (e.g., 4 bits), and a checksum (e.g., 8 bits).

[0009] The A-ECU 20 includes, as functional blocks, a first counter value extraction unit 22, a second counter value generation unit 24, a second counter value validity confirmation unit 26, an ignition information validity confirmation unit 28, a third counter previous value storage unit 30, and an inter-C-ECU communication interruption detection unit 32, through cooperation between hardware such as a CPU and multiple programs (software) installed in a ROM or flash memory. The first counter value extraction unit 22 extracts a first counter value C1 included in a second transmission frame received from the C-ECU 42 via the communication line 62. The second counter value generation unit 24 counts up a second counter value C2 every time the second transmission frame is received from the C-ECU 42 via the communication line 62. The second counter value C2 may be updated by the second counter value validity confirmation unit 26.

[0010] 2. In this process, the second counter value validity confirmation unit 26 acquires the first counter value C1 from the first counter value extraction unit 22 (step S100), acquires the second counter value C2 from the second counter value generation unit 24 (step S110), and compares the first counter value C1 with the second counter value C2 (step S120). If it is determined that the first counter value C1 and the second counter value C2 match, it determines that the validity of the second counter value C2 is OK (step S130), sets the second counter value C2 to the third counter value C3 (step S140), and ends this process. When it is determined that the first counter value C1 and the second counter value C2 do not match, the validity of the second counter value C2 is determined to be NG (step S150), the first counter value C1 is set to the second counter value C2 to be updated by the second counter value generation unit 24 (step S160), and the first counter value C1 is set to the third counter value C3 (step S170), and this process ends. In this manner, the validity of the second counter value C2 can be determined. The third counter value C3 is a value used to ensure functional safety (ASIL) based on the validity of the second counter value C2, specifically, to determine whether communication with the C-ECU 42 has been interrupted.

[0011] 3 while receiving a first transmission frame from B-ECU 40 via communication line 60. In this process, ignition information validity confirmation unit 28 acquires ignition information IG input via communication line 50 as first ignition information IG1 (step S200), and acquires ignition information IG included in the first transmission frame received from B-ECU 40 via communication line 60 as second ignition information IG2 (step S210). Next, it determines whether the first and second ignition information IG1, IG2 are both on and whether they are both off (steps S220, S230). When it is determined that the first and second ignition information IG1, IG2 are both on, it is determined that the validity of the first ignition information IG1 is OK (step S240), the third ignition information IG3 is turned on (step S250), and this process ends. When it is determined that the first and second ignition information IG1, IG2 are both off, it is determined that the validity of the first ignition information IG1 is OK (step S260), the third ignition information IG3 is turned off (step S270), and this process ends. When it is determined that one of the first and second ignition information IG1, IG2 is on and the other is off, it is determined that the validity of the first ignition information IG1 is NG (step S280), the third ignition information IG3 is turned off (step S290), and this process ends. In the embodiment, the third ignition information IG3 is set to OFF, but the third ignition information IG3 may be set to ON depending on the design specifications. In this manner, the validity of the first ignition information IG1 can be determined. This makes it possible to more appropriately determine the validity of the first ignition information IG1 when the timings at which the A-ECU 20 and the B-ECU 40 complete their activation (the timings at which communication becomes possible) after the ignition switch is turned ON are different. The third ignition information IG3 is used to ensure functional safety (ASIL) based on the validity of the first ignition information IG1, specifically, to determine whether communication with the C-ECU 42 has been interrupted.

[0012] The previous value storage unit 30 stores the previous value C3m of the third counter. The C-ECU communication disruption detection unit 32 executes the C-ECU communication disruption detection process shown in FIG. 4. In this process, first, the third ignition information IG3 is acquired from the ignition information validity confirmation unit 28 (step S300), and it is determined whether the third ignition information IG3 is ON (step S310). If it is determined that the third ignition information IG3 is ON, it is determined whether this state continues for a mask time or longer (step S312). Here, the mask time is predetermined as a time for masking the process of determining a communication disruption with the C-ECU 42. The processes of steps S310 and S312 are processes of determining whether a prerequisite condition for the process of determining a communication disruption with the C-ECU 42 is satisfied.

[0013] If it is determined in step S310 that the third ignition information IG3 is off, or if it is determined in step S310 that the third ignition information IG3 is on and if it is determined in step S312 that this state has not continued for the mask time or longer, it is determined that the preconditions for the determination process of communication disruption with the C-ECU 42 are not met (step S314), and the process returns to step S300. If it is determined in step S310 that the third ignition information IG3 is on and if it is determined in step S312 that this state has continued for the mask time or longer, it is determined that the preconditions for the determination process of communication disruption with the C-ECU 42 are met (step S316). In this case, after waiting for the transmission period of the second transmission frame of C-ECU 42 (the above-mentioned predetermined time ΔT2) to elapse (step S320), the value C3 of the third counter is obtained from second counter value validity confirmation unit 26 (step S330), and the previous value C3m of the third counter is obtained from previous value storage unit 30 (step S340). Subsequently, the value C3 of the third counter is compared with the value obtained by adding 1 to the previous value C3m (step S350).

[0014] If it is determined in step S350 that the value C3 of the third counter matches the value C3 of the previous counter C3m plus one, it is determined that no communication disruption has occurred with the C-ECU 42, and the communication disruption flag Fc is turned off (step S360). The value C3 of the third counter is set to its previous value C3m, which is updated in the previous value storage unit 30 (step S370), and the process returns to step S300. If it is determined in step S350 that the value C3 of the third counter matches the value C3 of the previous counter C3m plus one, it is determined whether this state has continued for a detection time or longer (step S352). Here, the detection time is predetermined as the time required for the A-ECU 20 to detect (confirm) a communication disruption with the C-ECU 42. This detection time is determined, for example, as a natural number multiple of the transmission period of the second transmission frame (the predetermined time ΔT2 described above). If it is determined in step S352 that the state in which the value C3 of the third counter and the value obtained by adding 1 to its previous value C3m do not match has continued for the detection time or longer, the process proceeds to step S360 and subsequent steps. If it is determined in step S352 that the state in which the value C3 of the third counter and the value obtained by adding 1 to its previous value C3m do not match has continued for the detection time or longer, the A-ECU 20 detects a communication disruption with the C-ECU 42, turns on a communication disruption flag Fc (step S380), sets the value C3 of the third counter to its previous value C3m, and updates the previous value storage unit 30 (step S390), and terminates this process. In this way, the A-ECU 20 can detect a communication disruption with the C-ECU 42. When the communication disruption flag Fc is turned on, the A-ECU 20 restricts the drive of a controlled object (such as an engine or a motor), for example.

[0015] FIG. 5 is a time chart showing an example of how the A-ECU 20 determines whether communication with the C-ECU 42 has been interrupted. In the diagram, times t11 to t14 and t[1] to t[n+2] are chronological times. As shown in the diagram, when the first ignition information IG1 is switched from off to on at time t11, the A-ECU 20 executes initialization processing and then transitions to periodic processing at time t12. During the initialization processing, the A-ECU 20 is unable to communicate with the B-ECU 40 or the C-ECU 42, but is able to communicate with them during the periodic processing. At time t12, when the ignition information validity confirmation unit 28 acquires the second ignition information IG2 as on, the A-ECU 20 switches the third ignition information IG3 from off to on. At time t13 when the third ignition information IG3 is on and continues for more than the mask time, the C-ECU communication disruption detection unit 32 determines that the preconditions for the process of determining whether communication with the C-ECU 42 has been disrupted are met.

[0016] Furthermore, the C-ECU 42 transmits second transmission frames including the first counter value C1 to the A-ECU 20 at periodic times t[1], . . . , t[n+2]. In the A-ECU 20, at times t[1], t[2], and t[3], the A-ECU 20 receives the second transmission frames, the first counter value extraction unit 22 extracts the first counter value C1 included in the second transmission frame as 1, 2, and 3, the second counter value generation unit 24 sets the second counter value C2 to 1, 2, and 3, and the second counter value validity confirmation unit 26 determines that the validity of the second counter value C2 is OK and sets the third counter value C3 to 1, 2, and 3. In these cases, C-ECU communication disruption detection unit 32 determines that value C3 of the third counter matches the value obtained by adding 1 to its previous value C3m, turns off communication disruption flag Fc, and sets value C3 of the third counter to its previous value C3m to update it in previous value storage unit 30. Even if C-ECU 42 transmits the second transmission frame at time t[4] when an abnormality occurs in communication line 62, A-ECU 20 does not receive it. Therefore, first counter value extraction unit 22 holds value C1 of the first counter at 3, second counter value generation unit 24 holds value C2 of the second counter at 3, second counter value validity confirmation unit 26 holds value C3 of the third counter at 3, and C-ECU communication disruption detection unit 32 determines that value C3 of the third counter matches the value obtained by adding 1 to its previous value C3m. Then, at time t14 when the state in which the value C3 of the third counter and the value obtained by adding 1 to the previous value C3m of the third counter do not match continues for at least the detection time, the C-ECU communication disruption detection unit 32 turns on the communication disruption flag Fc. In this way, the A-ECU 20 can detect a disruption of communication with the C-ECU 42. In this embodiment, the A-ECU 20 determines whether or not there is a disruption of communication with the C-ECU 42 based on the result of checking the validity of the value C2 of the second counter, thereby preventing erroneous determination of a communication abnormality.

[0017] When the C-ECU 42 transmits the second transmission frame at time t[n] when the abnormality in the communication line 62 has been resolved, the A-ECU 20 receives the second transmission frame, and the first counter value extraction unit 22 sets the first counter value C1 to n, and the second counter value generation unit 24 sets the second counter value C2 to 4. At this time, the second counter value validity confirmation unit 26 determines that the validity of the second counter value C2 is NG, and sets the first counter value C1 (n) to the second counter value C2, causing the second counter value generation unit 24 to update, and sets the first counter value C1 to the third counter value C3. The C-ECU communication disruption detection unit 32 determines that the third counter value C3 (n) does not match the previous value C3m plus 1 (4), and keeps the communication disruption flag Fc on, and sets the third counter value C3 to its previous value C3m, causing the previous value storage unit 30 to update. At time t[n+1], the C-ECU 42 transmits the second transmission frame. The A-ECU 20 receives the frame, and the first counter value extractor 22 sets the first counter value C1 to n+1, the second counter value generator 24 sets the second counter value C2 to n+1, and the second counter value validity checker 26 determines that the validity of the second counter value C2 is OK and sets the third counter value C3 to n+1. The C-ECU communication disruption detector 32 determines that the third counter value C3 (n+1) matches the previous counter value C3m plus 1 (n+1), turns off the communication disruption flag Fc, and sets the third counter value C3 to its previous value C3m, updating the previous value storage unit 30. In this way, the A-ECU 20 can detect the end of the communication disruption with the C-ECU 42.

[0018] In the control system 10 of the embodiment described above, the A-ECU 20 compares the value C1 of the first counter included in the second transmission frame with the value C2 of the second counter, which is incremented each time the second transmission frame is received, and if the validity of the value of the second counter is confirmed, sets the value C2 of the second counter to the value C3 of the third counter, and if the validity cannot be confirmed, sets the value C1 of the first counter to the values ​​C2 and C3 of the second and third counters, and determines whether or not communication with the C-ECU 42 has been interrupted based on a comparison between the value C3 of the third counter and its previous value C3m plus 1. This enables the A-ECU 20 to detect that the interruption of communication with the C-ECU 42 has been resolved.

[0019] The above describes the forms for implementing the present disclosure using embodiments, but the present disclosure is not limited to these embodiments in any way, and it goes without saying that the present disclosure can be implemented in various forms within the scope that does not deviate from the gist of the present disclosure. [Industrial Applicability]

[0020] The present disclosure is applicable to the control system manufacturing industry and the like. [Explanation of symbols]

[0021] 10 control systems, 20 A-ECU, 42 C-ECU.

Claims

[Claim 1] A control system including a first control device and a second control device, the second control device periodically transmits to the first control device a transmission frame including a value of a first counter that is counted up for each transmission; the first control device compares the value of the first counter included in the transmission frame with the value of a second counter which is counted up each time the transmission frame is received, and when the validity of the value of the second counter can be confirmed, sets the value of the second counter to the value of the third counter, and when the validity cannot be confirmed, sets the value of the first counter to the value of the second counter and the value of the third counter, and determines whether or not communication with the second control device has been interrupted based on a comparison between the value of the third counter and a value obtained by adding 1 to the previous value of the third counter; Control system.

Images