Automotive electronic control device and inspection method

Abstract

To provide an in-vehicle electronic control unit that can perform tests on multiple functions with minimal impact on vehicle control. [Solution] Based on the operating state of the on-board electronic control unit 20 while it is installed in the vehicle, it is determined whether each of the multiple functions can transition from the normal operation mode, which performs normal operation, to the inspection mode, which performs inspection. Therefore, functions that do not need to operate in the normal operation mode can be switched to the inspection mode and inspected. As a result, inspections of the multiple functions of the on-board electronic control unit can be performed with minimal impact on vehicle control.

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle electronic control unit that executes inspections of a plurality of functions in a state of being mounted on a vehicle, and an inspection method executed by the in-vehicle electronic control unit.

Background Art

[0002] For example, Patent Document 1 discloses that by connecting a connector of a failure diagnostic device to an OBD2 connector, failure diagnosis information and the like output from each electronic control unit (hereinafter referred to as ECU) included in a system that performs vehicle control is acquired and displayed.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of Invention

Problems to be Solved by the Invention

[0004] Normally, the failure diagnosis information output from each ECU is a failure code corresponding to an abnormality item when any abnormality is detected by the self-diagnosis function of each ECU. However, the abnormality items that can be confirmed by such failure codes are limited.

[0005] Therefore, a technique capable of inspecting a wider range of the various functions possessed by each ECU is desired. However, the various functions possessed by each ECU are normally used for various controls in the vehicle. For this reason, when attempting to inspect the various functions possessed by each ECU, it is necessary to take care not to affect the vehicle control using those functions as much as possible.

[0006] This disclosure has been made in view of the above-mentioned points, and aims to provide an in-vehicle electronic control device that can perform inspections of multiple functions with minimal impact on vehicle control, and an inspection method performed by the in-vehicle electronic control device. [Means for solving the problem]

[0007] To achieve the above objective, the in-vehicle electronic control device (20) according to this disclosure is: An on-board electronic control unit that performs tests on multiple functions it possesses while mounted in a vehicle, An acquisition unit (S100) acquires information regarding the operating status of an in-vehicle electronic control unit, Based on the operating status acquired by the acquisition unit, a determination unit (S110, S120) determines whether or not to transition for each of the multiple functions from a normal operation mode in which normal operation is performed to an inspection mode in which inspection is performed. The system includes an inspection unit (S130) that, for functions determined by the determination unit to be able to transition to inspection mode, transitions to inspection mode and performs the inspection.

[0008] Furthermore, the inspection method described in this disclosure is An inspection method for an on-board electronic control unit (20) to inspect multiple functions of the on-board electronic control unit while it is installed in a vehicle, To obtain information regarding the operating status of the in-vehicle electronic control unit (S100), Based on the acquired operating status, for each of the multiple functions, it is determined whether or not to transition from the normal operating mode, which performs normal operation, to the inspection mode, which performs inspection (S110, S120), and For functions that have been determined to be able to transition to inspection mode, the system includes the step of transitioning to inspection mode and performing the inspection (S130).

[0009] Thus, according to the in-vehicle electronic control device and inspection method disclosed herein, based on the operating state of the in-vehicle electronic control device in its vehicle-mounted state, it is determined whether each of the multiple functions can transition from a normal operation mode, which performs normal operation, to an inspection mode, which performs inspection. Therefore, functions that do not need to operate in the normal operation mode can be switched to the inspection mode and inspected. As a result, inspection of the multiple functions of the electronic control device can be performed with minimal impact on vehicle control.

[0010] The reference numbers in parentheses above are merely examples of correspondences with specific configurations in embodiments described later, in order to facilitate understanding of this disclosure, and are not intended to limit the scope of this disclosure in any way.

[0011] Furthermore, technical features described in each claim of the patent claims, other than those described above, will become clear from the description of the embodiments and the accompanying drawings, which will be discussed later. [Brief explanation of the drawing]

[0012] [Figure 1] This diagram conceptually shows the in-vehicle ECU according to this embodiment mounted in a vehicle. [Figure 2] This block shows an example of the configuration of an in-vehicle ECU. [Figure 3] This flowchart shows an example of a process for testing the various functions of an in-vehicle ECU. [Figure 4] Figures (a) to (c) are explanatory diagrams illustrating how the operating state of the onboard ECU in a vehicle is determined based on factors such as whether or not a user is in the vehicle, whether or not it is being charged, whether or not the driver is operating the vehicle, and the shift position in the transmission. [Figure 5] This diagram shows the configuration for testing the power supply function using a power supply circuit in an in-vehicle ECU. [Figure 6] This diagram shows that the first SoC and second SoC of the in-vehicle ECU perform PCI communication. [Figure 7] (a) is a diagram illustrating an example of how a communication signal changes during normal operation, and (b) is a diagram illustrating an example of how a communication signal changes during degradation. [Figure 8] (a) is a diagram illustrating an example of how a communication signal changes during normal operation when the communication speed is increased compared to the example shown in Fig. 7(a), and (b) is a diagram illustrating an example of how a communication signal changes during degradation when the communication speed is increased compared to the example shown in Fig. 7(a). [Figure 9] This is a configuration diagram illustrating an example of the configuration of a gyro sensor. [Figure 10] This is a diagram illustrating an example of hardware flags associated with a plurality of functions in the in-vehicle ECU according to the second embodiment. [Figure 11] This is a diagram illustrating an example of conditions for permitting transition to an inspection mode for one function possessed by an in-vehicle ECU. [Figure 12] This is a diagram illustrating that the state of Fig. 10 has changed to a state in which the PCI hardware flag is turned off. [Figure 13] This is a diagram illustrating that the conditions for permitting transition to the inspection mode are satisfied in response to the PCI hardware flag in Fig. 12 being turned off. [Mode for Carrying Out the Invention]

[0013] Hereinafter, embodiments of the in-vehicle electronic control device and the inspection method according to the present disclosure will be described with reference to the drawings. However, the present disclosure is not limited to the following embodiments, and various modified examples described later are also included in the technical scope of the present disclosure. Furthermore, various modifications and implementations other than those described below can be made without departing from the gist of the present disclosure. The embodiments and various modified examples can be appropriately combined and implemented within a range that does not cause technical inconsistency. In the following description, identical or similar configurations may be assigned the same reference numerals across a plurality of drawings, and descriptions thereof may be omitted. When only a part of a configuration is mentioned, the descriptions set forth in other sections can be applied to the other parts of the configuration.

[0014] (First Embodiment) Figure 1 is a diagram conceptually illustrating a state where an on-vehicle electronic control device (hereinafter referred to as on-vehicle ECU) 20 according to the present embodiment is mounted on a vehicle 1. Although an automobile is depicted as the vehicle 1 in Figure 1, the application target of the on-vehicle ECU 20 according to the present embodiment is not limited to automobiles. For example, the on-vehicle ECU 20 according to the present embodiment may be applied to various vehicles such as motorcycles, transportation vehicles, construction vehicles, agricultural vehicles, and railway vehicles.

[0015] Figure 2 is a block diagram illustrating an example of the configuration of the on-vehicle ECU 20. As shown in Figure 1, the on-vehicle ECU 20 may include, for example, a plurality of System on Chips (hereinafter referred to as SoCs). Figure 2 shows an example in which the on-vehicle ECU 20 includes two SoCs, namely a first SoC 30 and a second SoC 40. However, the on-vehicle ECU 20 may include only one SoC, or may include three or more SoCs.

[0016] Each of the first SoC 30 and the second SoC 40 is formed by integrating a plurality of electronic circuits such as a processor including a CPU (Central Processing Unit) and a GPU (Graphic Processing Unit), a memory including a DRAM (Dynamic Random Access Memory), a storage including an eMMC (Embedded Multi Media Card) and an SSD (Solid State Drive), and a communication module on a single semiconductor chip. The first SoC 30 and the second SoC 40 may be configured to be capable of communicating with each other via PCI (Peripheral Component Interconnect) communication such as PCI-Express, for example.

[0017] Figure 1 shows an example in which the video ICs 31, 32, 33, 44, the wireless IC 41, and the peripheral device interfaces (IFs) 34, 35, 42, 43, and 45 are located outside the first SoC 30 and the second SoC 40. However, the video ICs 31, 32, 33, 44, the wireless IC 41, and the peripheral device IFs 34, 35, 42, 43, and 45 may also be integrated within the first SoC 30 or the second SoC 40.

[0018] The in-vehicle ECU 20 has a power supply circuit 21 for supplying drive voltage to the first SoC 30 and the second SoC 40, etc. The power supply circuit 21 has a power supply IC that converts the power supply voltage supplied from the power supply 2, which is a battery mounted on the vehicle 1, into the drive voltage of the supply destination and outputs it. Multiple power supply ICs can be provided in the power supply circuit 21, for example, corresponding to each part integrated in the first SoC 30 and the second SoC 40.

[0019] The first SoC 30 is connected to a perimeter surveillance camera 3 via a video IC 31. The perimeter surveillance camera 3 is installed, for example, inside or outside the vehicle 1 and captures images of the area in front of and / or behind the vehicle 1. The perimeter surveillance camera 3 repeatedly outputs the captured video data to the first SoC 30. The first SoC 30 is also connected to a side camera 4 via a video IC 32. The side camera 4 is built into, for example, the door mirror of the vehicle 1 and captures images of the area to the side of the vehicle 1. The side camera 4 repeatedly outputs the captured video data to the first SoC 30. Furthermore, the first SoC 30 is connected to a driver status monitor (DSM) camera 5 via a video IC 33. The DSM camera 5 is mounted, for example, on the dashboard in front of the driver's seat of the vehicle 1 and captures images of the driver's face. The DSM camera 5 repeatedly outputs the captured video data to the first SoC 30.

[0020] The first SoC 30 can, for example, generate a bird's-eye view image of the area around the vehicle 1 from above, based on video data output from the surrounding surveillance camera 3 and video data output from the side camera 4. The generated bird's-eye view image can be transmitted from the first SoC 30 to the second SoC 40 and displayed on the display 11 via the video IC 44.

[0021] Furthermore, the first SoC 30 can acquire information about obstacles present around the vehicle 1 by performing image recognition processing on the video data output from the surrounding surveillance camera 3. The acquired information about obstacles can be transmitted to a safety control ECU (not shown) via the second SoC 40 and IFs 42 and 43 through CAN communication 9 or ETHERNET communication 10. CAN and ETHERNET are registered trademarks. In the following description, the registered trademarks CAN and ETHERNET will not be mentioned. Based on the received information about obstacles, the safety control ECU can perform controls such as warning the driver, braking the vehicle 1, and / or steering the vehicle 1 to avoid the obstacle.

[0022] Furthermore, the first SoC30 can detect driver distraction or drowsiness while driving by performing image analysis based on video data output from the DSM camera 5. Based on the detection results, the first SoC30 can sound a buzzer 7 to warn the driver using a drive signal transmitted via IF35, display a message on the display 11 using image data transmitted via the second SoC40 and video IC44, and / or issue an audio warning from the audio circuit 12 using audio data transmitted via the second SoC40 and IF45.

[0023] Each of the peripheral surveillance cameras 3, side camera 4, and DSM camera 5 is equipped with a serializer that converts parallel video data into serial signals. This can reduce the number of signal lines between the peripheral surveillance cameras 3, side camera 4, and DSM camera 5 and the in-vehicle ECU 20. The video ICs 31, 32, and 33 connected to the peripheral surveillance cameras 3, side camera 4, and DSM camera 5, respectively, are equipped with deserializers that convert the video data transmitted as serial signals back into parallel signals. The video ICs 31, 32, and 33 output the video signals converted back into parallel signals to the first SoC 30. Differential communication is performed between the peripheral surveillance cameras 3, side camera 4, and DSM camera 5 and their respective video ICs 31, 32, and 33, for example, according to the MIPI (Mobile Industry Processor Interface) standard.

[0024] The first SoC30 is connected to the sonar 6 via the IF34. The sonar 6 is positioned, for example, at each of the four corners of the vehicle 1, and transmits ultrasonic waves and receives ultrasonic waves reflected by nearby reflectors. For example, when the vehicle 1 is reversing or driving at a low speed, the first SoC30 instructs the sonar 6 via the IF34 to detect reflectors. In response to this detection instruction, the sonar 6 starts emitting ultrasonic waves. When a reflector is found around the vehicle 1 and the reflected ultrasonic waves are received, the area where the reflector is located and the distance to the reflector are transmitted to the first SoC30 via the IF34.

[0025] The first SoC30 is connected to the buzzer 7 via the IF35. As described above, the buzzer 7 can output a warning sound in response to receiving a drive signal from the first SoC30 via the IF35.

[0026] The first SoC 30 is connected to a gyro sensor 36. The gyro sensor 36 detects the rotational angular velocity of the vehicle 1. The gyro sensor 36 incorporates a BIST (Built in Self Test) circuit. The rotational angular velocity detected by the gyro sensor 36 is input to the first SoC 30. The first SoC 30 transmits the rotational angular velocity of the vehicle 1 to the safety control ECU and the car navigation ECU, for example, via CAN communication 9 or ETHERNET communication 10. Based on the rotational angular velocity of the vehicle 1, the safety control ECU can detect when the vehicle 1's behavior becomes unstable due to sudden steering or slipping. In this case, the safety control ECU can control the braking force and driving force to stabilize the vehicle 1's behavior. The car navigation ECU can also use the rotational angular velocity of the vehicle 1 to calculate its own position using autonomous navigation.

[0027] The second SoC40 is connected to the antenna 8 via the wireless IC41. The wireless IC41 can communicate wirelessly, for example, with a portable terminal carried by the occupants of vehicle 1, including the driver, using Bluetooth or WiFi. Bluetooth and WiFi are registered trademarks. In the following description, the registered trademarks Bluetooth and WiFi will not be mentioned.

[0028] The second SoC40 can perform CAN communication 9 with other ECUs via IF42. That is, IF42 is a CAN transceiver and can communicate with CAN transceivers installed in other ECUs according to the CAN communication protocol. Furthermore, the second SoC40 can perform ETHERNET communication 10 with other ECUs via IF43. That is, IF43 is an ETHERNET transceiver and can communicate with ETHERNET transceivers installed in other ECUs according to the ETHERNET communication protocol.

[0029] The second SoC 40 is connected to the display 11 via the video IC 44. The second SoC 40 can display any image on the display 11 by outputting video data via the video IC 44. In this case, the video IC 44 has a serializer, and the display 11 has a deserializer.

[0030] The second SoC40 is connected to the audio circuit 12 via IF45. The audio circuit includes a speaker. The second SoC40 can output arbitrary audio from the audio circuit 12 by outputting audio data via IF45.

[0031] As described above, the in-vehicle ECU 20 has a variety of functions, including power supply, video data reception, reflective object data reception, warning sound generation, rotational acceleration data detection, communication, video display, and audio output. These functions may deteriorate with use. Therefore, there is a need for technology that can inspect the various functions of the in-vehicle ECU 20 while it is installed in a vehicle for abnormalities such as failures that interfere with normal operation, or signs of failure that indicate a high probability of failure, even if failure has not yet occurred.

[0032] However, the diverse functions of the in-vehicle ECU 20 are typically used for various control functions in the vehicle 1. When attempting to test each of these functions, it is highly likely that the function being tested will become unavailable for control in the vehicle 1. Therefore, when attempting to test the diverse functions of the in-vehicle ECU 20, care must be taken to minimize any impact on the control functions in the vehicle 1 that utilize those functions.

[0033] Therefore, the in-vehicle ECU 20 in this embodiment determines, based on the operating state of the in-vehicle ECU 20 mounted in the vehicle 1, whether or not to transition from a normal operation mode, which performs normal operation, to an inspection mode, which performs inspection, for each of the multiple functions. This makes it possible to transition to the inspection mode and perform inspection for functions that do not need to operate in the normal operation mode. Consequently, inspection of the multiple functions of the in-vehicle ECU 20 can be performed with minimal impact on the control of the vehicle 1.

[0034] The following describes an example of a process for inspecting multiple functions of the in-vehicle ECU 20, with reference to the flowchart in Figure 3. The in-vehicle ECU 20 executing the processes shown in the flowchart in Figure 3 corresponds to executing the inspection method of this disclosure.

[0035] In step S100, the on-board ECU 20 acquires information regarding the operating status of the on-board ECU 20 mounted on the vehicle 1. The processing in S100 corresponds to the acquisition unit in this disclosure. As shown in Figures 4(a) to (c), the information regarding the operating status of the on-board ECU 20 mounted on the vehicle 1 may include whether or not a user is in the vehicle, whether or not it is being charged, whether or not the driver is operating the vehicle 1, and the shift position in the transmission. Note that whether or not it is being charged may be considered if the vehicle 1 is equipped with an electric motor as a drive source and a high-voltage battery that supplies power to the electric motor, and the high-voltage battery is externally rechargeable.

[0036] In step S110, the in-vehicle ECU 20 determines, based on the information regarding the operating status acquired in step S100, which of its multiple functions will be used and which will not be used.

[0037] For example, in status A shown in Figure 4(a), the user is not in vehicle 1, vehicle 1 is charging, and the shift position is in parking (P). Since the user is not in vehicle 1, multimedia-related functions such as the video display function using display 11 and the audio output function using audio circuit 12 do not need to operate and can be determined to be unused functions. Also, since there is no need for communication between the first SoC 30 and the second SoC 40, the PCI communication function between the first SoC 30 and the second SoC 40 can also be determined to be an unused function.

[0038] Furthermore, in Status A shown in Figure 4(a), Vehicle 1 is stopped and there is no user inside. Therefore, it is considered unnecessary for the various cameras 3, 4, 5, sonar 6, buzzer 7, and gyro sensor 36, which are used to support safe driving, to operate. For this reason, the functions of receiving video data using the various cameras 3, 4, and 5, receiving reflective object data using sonar 6, generating warning sounds using buzzer 7, and receiving data from gyro sensor 36 can be determined to be unused functions. In addition, since there is no user inside, it is considered unnecessary to communicate with the user's mobile device. For this reason, the communication function using wireless IC 41 and antenna 8 can be determined to be unused functions.

[0039] On the other hand, while the vehicle is parked, for example, the verification ECU may periodically send a request signal to the key fob carried by the driver to attempt to communicate with the key fob. If the verification ECU receives a response signal from the key fob and that response signal contains an identifier corresponding to the identifier of the legitimate key fob, it can detect that the driver carrying the legitimate key fob is in the vicinity of the vehicle. In response to this detection, or in response to the driver attempting to open the door, the verification ECU communicates with other ECUs, including the on-board ECU 20, via CAN communication 9 or ETHERNET communication 10 to unlock the doors and prepare for the user to enter the vehicle. Therefore, in status A shown in Figure 4(a), the communication functions of the on-board ECU 20 using CAN communication and ETHERNET communication are determined to be functions that are used.

[0040] However, as mentioned above, CAN communication 9 and / or ETHERNET communication 10 are unlikely to be used until the user gets in the vehicle. Therefore, for example, if the in-vehicle ECU 20 can confirm that it is unlikely that other ECUs that communicate with CAN communication 9 and / or ETHERNET communication 10 will use CAN communication 9 and / or ETHERNET communication 10, it may determine that the communication functions using CAN communication and ETHERNET communication are functions that will not be used.

[0041] In Figure 4(a), peripheral devices related to unused functions in the in-vehicle ECU 20 are shaded with dotted lines. Conversely, peripheral devices related to functions used in the in-vehicle ECU 20 are not shaded. The same applies to Figures 4(b) and (c).

[0042] In status B shown in Figure 4(b), the user is in vehicle 1 and the shift position is in parking (P). Since the user is in vehicle 1, the multimedia-related functions, such as the video display function using display 11 and the audio output function using audio circuit 12, are determined to be functions that will be used. In addition, the PCI communication function between the first SoC 30 and the second SoC 40 is also determined to be a function that will be used. Furthermore, in order to enable communication with the mobile terminal carried by the user, the communication function using wireless IC 41 and antenna 8 is also determined to be a function that will be used.

[0043] On the other hand, in status B shown in Figure 4(b), the shift position is in parking, and vehicle 1 is stopped. Therefore, it is considered that the various cameras 3, 4, 5, sonar 6, buzzer 7, and gyro sensor 36, which are used to support the driver's safe driving, do not need to operate. For this reason, the functions of receiving video data using the various cameras 3, 4, and 5, receiving reflective object data using sonar 6, generating warning sounds using buzzer 7, and receiving data from gyro sensor 36 are determined to be unused functions.

[0044] In status C shown in Figure 4(c), the user is in vehicle 1, the shift position is in drive (D), and the user is driving vehicle 1. Therefore, all functions of the onboard ECU 20 are determined to be functions that are being used.

[0045] In step S120 of the flowchart in Figure 3, the in-vehicle ECU 20 determines, based on the determination result in step S110, whether to transition from the normal operation mode, which performs normal operation, to the inspection mode, which performs inspection, for each of the multiple functions that the in-vehicle ECU 20 has. The processing in steps S110 and S120 corresponds to the determination unit of this disclosure. More specifically, in step S110, the in-vehicle ECU 20 determines that it is possible to transition to the inspection mode for functions that were determined to be unused. Conversely, in step S110, the in-vehicle ECU 20 determines whether or not to transition to the inspection mode for functions that were determined to be used. This makes it possible to inspect multiple functions with minimal impact on the control of the vehicle that utilizes each of the multiple functions.

[0046] If, in step S120, there is a function that is determined to be able to transition to inspection mode, the vehicle ECU 20 proceeds to step S130. On the other hand, if there is no function that is determined to be able to transition to inspection mode, the vehicle ECU 20 proceeds to the process in step S160.

[0047] In step S130, the in-vehicle ECU 20 enters inspection mode and performs inspections for functions that it has determined are eligible to enter inspection mode. The process in step S130 corresponds to the inspection unit in this disclosure. The following describes how some inspections are performed.

[0048] Figure 5 shows a configuration for testing the power supply function using a power supply circuit 21 in an in-vehicle ECU 20. In the example shown in Figure 5, the power supply circuit 21 has a power supply IC 22 for supplying the CPU drive voltage 30a and a power supply IC 23 for supplying the GPU drive voltage 30b. The power supply circuit 21 also has a capacitor 24 for smoothing the output voltage of power supply IC 22 and a capacitor 25 for smoothing the output voltage of power supply IC 23. Note that the number of power supply ICs 22 and 23 in the power supply circuit 21 may be three or more, not just two.

[0049] The use of the automotive ECU 20 may cause capacitors 24 and 25 to degrade. However, even if capacitor 25 degrades due to the use of the automotive ECU 20, if the GPU of the first SoC 30 operates under normal load and a normal amount of current flows from the power supply IC 23 to the first SoC 30, the power supply IC 23 may be able to supply a drive voltage within the normal range. However, if capacitor 25 is degraded, and the automotive ECU 20 operates under high load and a relatively large current flows from the power supply IC 23 to the GPU of the first SoC 30, the power supply IC 23 may not be able to supply a drive voltage within the normal range.

[0050] Therefore, the in-vehicle ECU 20 according to this embodiment has a test circuit for testing the power supply function using the power supply circuit 21, which includes a load 51 to which a current larger than the normal current flows when a drive voltage supplied from the power supply IC 23 and capacitor 25 is applied, and an A / D converter 37 that monitors the voltage applied to the load 51. In this case, the power supply IC 23 and capacitor 25 correspond to the functional circuit of this disclosure. Furthermore, the in-vehicle ECU 20 has a switching circuit 50 that switches the connection destination of the power supply IC 23, which is a functional circuit for realizing the power supply function using the power supply circuit 21, to the load 51. The switching circuit 50 can be configured, for example, by an FPGA (Field Programmable Gate Array). By using an FPGA, dynamic circuit switching can be performed regardless of the circuit configuration.

[0051] In the in-vehicle ECU 20, for example, if the first SoC 30 determines that the power supply function to the GPU is not being used, it considers it possible to switch from normal operation mode to test mode and instructs the switching circuit 50 to switch its connection destination to load 51. In this case, a current larger than the current that flows when the GPU is operating under a normal load flows from the power supply IC 23 to load 51. Therefore, if the capacitor 25 is degraded, the power supply IC 23 may not be able to supply a drive voltage within the normal range.

[0052] The voltage applied to the load 51, i.e., the drive voltage supplied from the power supply IC 23, is monitored by the A / D converter 37. If the voltage monitored by the A / D converter 37 falls below the normal range of the drive voltage, the first SoC 30 can determine that the power supply function to the GPU has failed or is showing signs of failing due to the deterioration of the capacitor 25.

[0053] In this way, by operating the function under test under a higher load than that during normal operation in test mode, it becomes possible to test for signs of failure that would not be detectable during normal operation.

[0054] Next, we will describe the inspection of the PCI communication function between the first SoC30 and the second SoC40 in the in-vehicle ECU20. As shown in Figure 6, in normal operating mode, the first SoC30 and the second SoC40 perform PCI communication to send and receive various data.

[0055] Over time, prolonged use of the in-vehicle ECU20 can cause impedance shifts, such as changes in the contact resistance of the PCI communication line connector between the first SoC30 and the second SoC40. In this case, the change in communication signals may become sluggish, potentially degrading communication performance.

[0056] Figure 7(a) shows an example of how the communication signal changes under normal conditions, and Figure 7(b) shows an example of how the communication signal changes under degradation conditions. As shown in Figures 7(a) and (b), under degradation conditions, the change in the communication signal slows down compared to normal conditions, and as a result, the aperture of the so-called eye pattern becomes smaller.

[0057] However, if the communication speed is not very high, even if the communication performance is degraded, the communication signal may still satisfy the standard values ​​such as voltage difference, as shown in Figure 7(b). Therefore, the frequency of communication errors may be low, or even if communication errors occur, they may be compensated for by correction processing, and normal communication operation may not be affected.

[0058] In this embodiment, in test mode, communication is performed at a higher communication speed than in normal operation mode. For example, communication is performed at the upper limit of PCI communication speed between the first SoC30 and the second SoC40. In this case, as shown in Figure 8(a), if the communication performance is normal, the communication signal will satisfy the standard value and communication will be possible. On the other hand, if the communication performance is degraded, as shown in Figure 8(b), the communication signal will no longer satisfy the standard value due to the slowing of changes in the communication signal, and the frequency of communication errors will increase.

[0059] Thus, the in-vehicle ECU 20 according to this embodiment can also inspect for signs of failure (deterioration of communication function) in the PCI communication function between the first SoC 30 and the second SoC 40, to the extent that it does not interfere with normal communication operation.

[0060] An example of the specific procedure for testing PCI communication functionality is shown below. First, the ability to transition to PCI communication functionality test mode can be determined by either the first SoC30 or the second SoC40. When either the first SoC30 or the second SoC40 determines that it is possible to transition to PCI communication functionality test mode, it notifies the other SoC40 of the transition to test mode. This notification triggers the first SoC30 and the second SoC40 to transition to test mode and perform the test. Specifically, the first SoC30 and the second SoC40 send and receive test data at the maximum communication speed for PCI communication. The SoC that receives the test data can determine, for example, whether the error frequency is above a predetermined value, whether the communication was performed successfully or not.

[0061] Thus, when testing PCI communication functions, operating the PCI communication function under test under a communication load higher than that used during normal communication operations makes it possible to test for signs of failure that would not be detectable during normal communication operations. However, testing PCI communication functions is not limited to testing under a communication load higher than that used during normal communication operations. In other words, PCI communication functions may be tested under a communication load equivalent to that used during normal communication operations.

[0062] Next, we will describe the inspection of the data detection function using the gyro sensor 36 in the in-vehicle ECU 20. As shown in Figure 9, the gyro sensor 36 incorporates a BIST 38, which is an inspection circuit that checks whether or not the angular velocity data of the gyro sensor 36 can be detected normally. In this case, the gyro sensor 36 corresponds to the functional circuit of this disclosure.

[0063] For example, BIST38 can be configured to activate the gyro sensor 36 as if an angular velocity were being applied to it by inputting a test signal to the test input terminal. BIST38 can then determine from the detection signal output from the gyro sensor 36 whether the sensor part and detection circuit of the gyro sensor 36 have operated in response to the test signal.

[0064] During inspection by BIST38, the gyro sensor 36 cannot detect the angular velocity of the vehicle 1. Therefore, in the in-vehicle ECU 20 according to this embodiment, for example, if the first SoC 30 determines that it is not using the data reception function using the gyro sensor 36 and determines that it is possible to switch to inspection mode, the first SoC 30 is configured to instruct BIST38 to perform a self-test. BIST38 performs an inspection of the gyro sensor 36 in response to the inspection instruction from the first SoC 30.

[0065] The above describes in detail the testing of three of the multiple functions of the in-vehicle ECU20. The in-vehicle ECU20 can also perform tests on functions other than the three mentioned above.

[0066] For example, the in-vehicle ECU 20 can read various adjustment values ​​(e.g., voltage values ​​of communication signals and data reading timing) for sending and receiving video signals between the serializer and deserializer from the registers of the serializer and / or deserializer in order to test the video data reception function from each of the cameras 3, 4, and 5 and the video display function using the display 11. In this case, if the read adjustment values ​​fall within the normal range, the in-vehicle ECU 20 can consider the video data reception function and video display function to be normal. On the other hand, if those adjustment values ​​deviate from the normal range, depending on the degree of deviation, signs of failure can be detected in the video data reception function and video display function, and it can be determined that they may fail.

[0067] Alternatively, the in-vehicle ECU 20 may transmit and receive test images at a higher speed than normal (i.e., a higher communication load), similar to the PCI communication function between the first SoC 30 and the second SoC 40, in order to test the video data reception function and video display function. In this case, if the test images are transmitted and received normally, the in-vehicle ECU 20 can consider the video data reception function and video display function to be normal. On the other hand, if the frequency of communication errors in the transmission and reception of test images is higher than a predetermined value, the in-vehicle ECU 20 may detect signs of failure in the video data reception function and video display function and determine that they may fail.

[0068] Regarding the function of receiving reflective object data using sonar 6, for example, the in-vehicle ECU 20 can have sonar 6 transmit a test pattern indicating the measurement result, and then check whether or not the test pattern was received correctly to verify the function of receiving reflective object data. Furthermore, regarding the warning sound generation function using buzzer 7 and the audio output function using audio circuit 12, for example, the in-vehicle ECU 20 can detect the impedance of each circuit when a test signal is output, and then check each function based on the change from the initial impedance. In addition, when testing communication functions using Bluetooth / WiFi, CAN communication, and ETHERNET communication, the in-vehicle ECU 20 can test them using the same method as in the case of PCI communication.

[0069] Returning to the flowchart in Figure 3, in step S130, the vehicle ECU 20 enters inspection mode and performs an inspection, then proceeds to step S140. In step S140, the vehicle ECU 20 determines whether or not at least signs of a malfunction were detected during the inspection. If signs of a malfunction are detected, the vehicle ECU 20 proceeds to step S150. On the other hand, if no signs of a malfunction are detected, the vehicle ECU 20 proceeds to step S160.

[0070] In step S150, the in-vehicle ECU 20 notifies the user of the vehicle 1 of at least the functions for which signs of failure have been detected, for example, using the display 11 or the audio circuit 12. The processing in step S150 corresponds to the notification unit of this disclosure. In step S160, the in-vehicle ECU 20 causes multiple functions to perform normal operation in normal operation mode.

[0071] In the flowchart of Figure 3, the process in step S100 is executed periodically. Therefore, if the operating state of the vehicle 1 transitions to an operating state that is determined not to transition to the inspection mode of at least one function during the inspection mode of at least one function, the on-board ECU 20 can terminate the inspection of at least one function and transition from the inspection mode to the normal operating mode.

[0072] (Second Embodiment) Next, an in-vehicle ECU 20 according to the second embodiment of this disclosure will be described. The in-vehicle ECU 20 according to this embodiment is configured in the same way as the in-vehicle ECU 20 according to the first embodiment. Therefore, a description of the configuration will be omitted.

[0073] In the first embodiment, an example was described in which the operating state of the on-board ECU 20 mounted on the vehicle 1 is determined based on whether or not a user is in the vehicle, whether or not it is charging, whether or not the driver is operating the vehicle 1, and the shift position in the transmission. However, in addition to, or instead of, determining the operating state of the on-board ECU 20 in the first embodiment, the on-board ECU 20 may perform the processes described below in order to determine the operating state of the on-board ECU 20.

[0074] As shown in Figure 10, the in-vehicle ECU 20 according to this embodiment can execute multiple applications (App1, App2, App3, App4, ...). Each of the multiple applications is executed using at least one of the multiple functions of the in-vehicle ECU 20. In Figure 10, "I2C" is an abbreviation for Inter-Integrated Circuit, and in the in-vehicle ECU 20, it corresponds to the communication function via each IF.

[0075] Each application turns on (i.e., "1") the hardware flag corresponding to the function it is using during execution, and turns off (i.e., "0") the hardware flag corresponding to the function it was using when execution ends. However, for functions used by multiple applications, the corresponding hardware flag is turned off when all of the applications have finished execution. The on or off status of these hardware flags indicates the operating state of the on-board ECU 20 installed in vehicle 1 as described in this disclosure.

[0076] The in-vehicle ECU 20 defines transition permission conditions for each of its multiple functions, including the condition that the hardware flag is turned off, as shown in Figure 11. The in-vehicle ECU 20 then determines that a function can transition to inspection mode if the transition permission conditions are satisfied, and that a function cannot transition to inspection mode if the transition permission conditions are not satisfied.

[0077] For example, in the example shown in Figure 11, the condition that the PCI hardware flag is "0" is not met, so the in-vehicle ECU 20 determines that it is not possible to transition to inspection mode for the function for which the transition permission conditions in Figure 11 are defined.

[0078] When App2, an application using PCI communication functionality, finishes execution and the PCI hardware flag becomes "0" as shown in Figure 12, the in-vehicle ECU 20 determines that the transition permission conditions have been met, as shown in Figure 13, and determines that it is possible to transition to inspection mode for the functions for which the transition permission conditions in Figure 12 are defined.

[0079] As described above, by using hardware flags that correspond to the multiple functions of the in-vehicle ECU 20, it becomes possible to understand the operating status of the in-vehicle ECU 20 in more detail.

[0080] (modified version) While preferred embodiments of this disclosure have been described above, this disclosure is not limited to the embodiments described above and can be implemented in various modified ways without departing from the spirit of this disclosure.

[0081] For example, in the first embodiment described above, the user was notified if a malfunction or signs of malfunction were detected as a result of the inspection. However, the user may also be notified if no malfunction or signs of malfunction are detected.

[0082] Furthermore, for example, the apparatus and method described in this disclosure may be implemented by a dedicated computer comprising a processor programmed to execute one or more functions embodied by a computer program. The apparatus and method described in this disclosure may also be implemented using dedicated hardware logic circuits. The apparatus and method described in this disclosure may also be implemented by one or more dedicated computers comprising a combination of a processor that executes a computer program and one or more hardware logic circuits. For example, some or all of the functions of the first SoC30 and the second SoC40 may be implemented as hardware. Embodiments of implementing a certain function as hardware include embodiments using one or more ICs, etc. Some or all of the functions of the first SoC30 and the second SoC40 may be implemented using either an IC (Integrated Circuit) or an FPGA (Field-Programmable Gate Array). The concept of an IC also includes an ASIC (Application Specific Integrated Circuit). Furthermore, the computer program may be stored as instructions executed by the computer on a computer-readable non-transitory tangible storage medium. As recording media for the program, HDDs (Hard-disk drives), SSDs (Solid State Drives), flash memory, etc., can be used. Furthermore, the scope of this disclosure also includes programs for making the computer function as the first SoC30 and the second SoC40, and non-transitional physical recording media such as semiconductor memory on which these programs are stored.

[0083] (Disclosure of technical ideas) Finally, this specification discloses several technical concepts described in the following sections. Some sections may be written in a polynomial form, selectively referencing several preceding sections. Furthermore, some sections may be written in a multiple polynomial form, referencing several sections, including other sections in a polynomial form. These sections written in polynomial and multiple polynomial forms define several technical concepts. In addition, the several technical concepts described in the following sections also apply to inspection methods performed by on-board electronic control units.

[0084] (Technical thought 1) An on-board electronic control unit (20) that performs tests of multiple functions it possesses while mounted in a vehicle, An acquisition unit (S100) that acquires information regarding the operating status of the in-vehicle electronic control unit, Based on the operating state acquired by the acquisition unit, a determination unit (S110, S120) determines whether or not to transition with respect to each of the multiple functions from a normal operation mode in which normal operation is performed to an inspection mode in which inspection is performed. An in-vehicle electronic control device comprising: an inspection unit (S130) that transitions to the inspection mode and performs an inspection for functions that the determination unit has determined can be transitioned to the inspection mode.

[0085] (Technical thought 2) The determination unit determines the operating state of the on-board electronic control unit based on at least whether a user is in the vehicle and the shift position, and determines whether it is possible to transition to an inspection mode to perform an inspection for each of the multiple functions based on the determined operating state, as described in Technical Concept 1.

[0086] (Technical Thought 3) The aforementioned in-vehicle electronic control unit is capable of executing multiple applications, Each of the multiple applications is executed using at least one of the multiple functions of the in-vehicle electronic control unit. Each application turns on a flag corresponding to the function it is using when it is running, and turns off the flag corresponding to the function it was using when it finishes running. The determination unit defines transition permission conditions for each of the multiple functions, including the operation state of the in-vehicle electronic control unit, which includes the flag being turned off. The determination unit determines that a function can transition to inspection mode if the transition permission conditions are satisfied, and determines that a function cannot transition to inspection mode if the transition permission conditions are not satisfied, as described in Technical Concept 1 or 2.

[0087] (Technical Thought 4) An in-vehicle electronic control device according to any one of technical concepts 1 to 3, wherein, during the inspection mode of at least one function, if the operating state of the in-vehicle electronic control device transitions to an operating state that the determination unit determines is not to transition to the inspection mode of at least one function, the inspection unit terminates the inspection of the at least one function and transitions from the inspection mode to the normal operating mode.

[0088] (Technical Thought 5) An in-vehicle electronic control device according to any one of technical concepts 1 to 4, further comprising a notification unit (S150) for notifying the user of the results of the inspection performed by the aforementioned inspection unit.

[0089] (Technical Thought 6) The in-vehicle electronic control device according to technical concept 5, wherein the notification unit notifies the user when an abnormality is detected by an inspection performed by the inspection unit.

[0090] (Technical Thought 7) The inspection unit includes inspection circuits (37, 51) for inspecting functional circuits (23, 25) for realizing at least one of the multiple functions of the in-vehicle electronic control unit, and a switching circuit (50) for switching the connection destination of the functional circuit to the inspection circuit. The in-vehicle electronic control device according to any one of technical concepts 1 to 6, wherein the inspection unit switches the connection destination of the functional circuit to the inspection circuit using the switching circuit in response to the determination unit determining that it is possible to transition to the inspection mode.

[0091] (Technical Thought 8) For at least one of the multiple functions of the in-vehicle electronic control unit, the function circuit (36) for realizing that function incorporates a test circuit (38) for testing the function circuit. The in-vehicle electronic control device according to any one of technical concepts 1 to 6, wherein the inspection unit instructs the inspection circuit to perform an inspection in response to the determination unit determining that it is possible to transition to the inspection mode.

[0092] (Technical Thought 9) The inspection unit performs the inspection by operating the at least one function at a load higher than the load under which the at least one function performs normal operation, in an inspection mode for the at least one function, as described in any one of technical concepts 1 to 8. [Explanation of Symbols]

[0093] 1: Vehicle, 2: Power supply, 3: Surrounding camera, 4: Side camera, 5: DSM camera, 6: Sonar, 7: Buzzer, 8: Antenna, 11: Display, 12: Audio circuit, 21: Power supply circuit, 30: 1st SoC, 31-33: Video IC, 34-35: IF, 36: Gyro sensor, 40: 2nd SoC, 41: Wireless IC, 42-43: IF, 44: Video IC, 45: IF

Claims

1. An on-board electronic control unit (20) that performs tests of multiple functions it possesses while mounted in a vehicle, An acquisition unit (S100) that acquires information regarding the operating status of the in-vehicle electronic control unit, Based on the operating state acquired by the acquisition unit, a determination unit (S110, S120) determines whether or not to transition with respect to each of the multiple functions from a normal operation mode in which normal operation is performed to an inspection mode in which inspection is performed, An in-vehicle electronic control device comprising: an inspection unit (S130) that transitions to the inspection mode and performs an inspection for functions that the determination unit has determined can be transitioned to the inspection mode.

2. The in-vehicle electronic control device according to claim 1, wherein the determination unit determines the operating state of the in-vehicle electronic control device from at least whether or not a user is in the vehicle and the shift position, and determines whether or not to transition to an inspection mode for each of the multiple functions based on the determined operating state.

3. The aforementioned in-vehicle electronic control unit is capable of executing multiple applications, Each of the multiple applications is executed using at least one of the multiple functions of the in-vehicle electronic control unit. Each application turns on a flag corresponding to the function it is using when it is running, and turns off the flag corresponding to the function it was using when it finishes running. The determination unit defines transition permission conditions for each of a plurality of functions, which include the flag being turned off as the operating state of the in-vehicle electronic control unit, and determines that a function can transition to inspection mode if the transition permission conditions are satisfied, and determines that a function cannot transition to inspection mode if the transition permission conditions are not satisfied, the in-vehicle electronic control unit according to claim 1.

4. The in-vehicle electronic control device according to any one of claims 1 to 3, wherein, during the inspection mode of at least one function, if the operating state of the in-vehicle electronic control device transitions to an operating state that the determination unit determines is not to transition to the inspection mode of at least one function, the inspection unit terminates the inspection of the at least one function and transitions from the inspection mode to the normal operating mode.

5. The in-vehicle electronic control device according to any one of claims 1 to 3, further comprising a notification unit (S150) for notifying the user of the results of the inspection performed by the inspection unit.

6. The in-vehicle electronic control device according to claim 5, wherein the notification unit notifies the user when an abnormality is detected by an inspection performed by the inspection unit.

7. The inspection unit includes inspection circuits (37, 51) for inspecting functional circuits (23, 25) for realizing at least one of the multiple functions of the in-vehicle electronic control device, and a switching circuit (50) for switching the connection destination of the functional circuit to the inspection circuit. The in-vehicle electronic control device according to any one of claims 1 to 3, wherein the inspection unit switches the connection destination of the functional circuit to the inspection circuit using the switching circuit in response to the determination unit determining that it is possible to transition to the inspection mode.

8. For at least one of the multiple functions of the above-mentioned in-vehicle electronic control device, the function circuit (36) for realizing said function incorporates a test circuit (38) for testing said function circuit. The in-vehicle electronic control device according to any one of claims 1 to 3, wherein the inspection unit instructs the inspection circuit to perform an inspection in response to the determination unit determining that it is possible to transition to the inspection mode.

9. The in-vehicle electronic control device according to any one of claims 1 to 3, wherein the inspection unit performs the inspection by operating the at least one function at a load higher than the load under which the at least one function performs normal operation in an inspection mode for at least one function.

10. An inspection method for an on-board electronic control unit (20) to inspect multiple functions of the on-board electronic control unit while it is installed in a vehicle, To obtain information regarding the operating status of the in-vehicle electronic control unit (S100), Based on the acquired operating status, for each of the multiple functions, it is determined whether or not to transition from the normal operation mode, which performs normal operation, to the inspection mode, which performs inspection (S110, S120), and An inspection method comprising the steps of: transitioning to inspection mode and performing inspection (S130) for a function that has been determined to be able to transition to inspection mode.

Images