Electronic Control System

Abstract

To grasp status of entire vehicle at occurrence of communication error after restoration of communication even if communication error occurs in Zone architecture.SOLUTION: An electronic control system 1 according to the invention includes a first electronic control device 100, and a plurality of second electronic control devices 210, 220. The first electronic control device 100 receives signals outputted from the plurality of second electronic control devices 210, 220, generates processed data by processing the signals received from the plurality of second electronic control devices 210, 220, overwrites a first storage part 140 with the generated processed data, and if a communication error occurs in communication with at least one of the second electronic control devices 210, 220, the first electronic control device stores, as data at error occurrence without using it for overwriting, the processed data that was generated from signals outputted from all of the second electronic control devices 210, 220 and stored onto the first storage device 140 when the communication error was detected.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an electronic control system that controls the memory storage of vehicle / diagnostic data. [Background technology]

[0002] As automobiles become more powerful, the number of electronic control units (ECUs) required to perform various functions is also on the rise. A large number of ECUs complicates the network configuration between ECUs, potentially resulting in problems such as signal delays. To address these issues, in recent years, the introduction of a "zone architecture" configuration has been considered, in which ECUs are grouped by function and controlled collectively by a centralized electronic control unit (Central ECU). Furthermore, with the trend toward autonomous driving, vehicle and diagnostic data is on the rise. In addition, demands for miniaturization and low cost are driving a need to limit the growth of internal memory in ECUs other than the central ECU (hereafter referred to as "other ECUs"), creating a growing demand for the Central ECU to manage and store various data processed by other ECUs.

[0003] When the above-described Zone Architecture configuration is adopted, vehicle / diagnostic data collected from other ECUs to the central ECU does not pass through the other ECUs, i.e., it is not stored within the other ECUs. Therefore, if a communication error occurs between at least one other ECU on the same functional system and the central ECU, the update timing of the data managed and stored by the central ECU may differ among the other ECUs. In other words, the vehicle / diagnostic data of the other ECU where the communication error occurred is not updated, but the vehicle / diagnostic data of the other ECUs is updated. As a result, the vehicle / diagnostic data of the other ECUs at the time of the communication error is overwritten, making it impossible to obtain information about the entire vehicle at the time of the communication error. This makes it difficult to analyze the cause of the problem using the data stored in the central ECU. Patent Document 1, for example, describes a method for securing data when an abnormality occurs.

[0004] Patent Document 1 describes the problem as "reliably storing the vehicle state at the time of abnormality occurrence even if the vehicle state detection process is executed several times from the time of abnormality occurrence until the execution of the storage process." As a solution to this problem, it describes that "vehicle abnormality state storage device 10 stores, in first storage unit 13, the vehicle state detected by vehicle state detection process unit 21 at each detection cycle, together with the index number assigned by index number assignment process unit 22 in association with each vehicle state, by first vehicle state storage process unit 23, and when abnormality determination process unit 24 determines that an abnormality has occurred in the vehicle state, index number extraction process unit 25 extracts the index number corresponding to the vehicle state, and second vehicle state storage process unit 26 stores, in second storage unit 14, the vehicle state corresponding to the index number extracted by index number extraction process unit 25 at each predetermined storage cycle set longer than the detection cycle." [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-142617 Summary of the Invention [Problem to be solved by the invention]

[0006] However, in the invention described in Patent Document 1, constant indexing processing is performed on vehicle / diagnosis data, which results in a high computational processing load. Also, when multiple ECUs are connected to a central ECU, only the vehicle data of the ECU in which an abnormality has occurred is stored in the second storage unit, which causes an update mismatch with vehicle data of ECUs other than the ECU in which the abnormality has occurred, and when factor analysis is performed using the vehicle data stored in the central ECU, the vehicle data of each ECU is not complete, making the analysis difficult. [Means for solving the problem]

[0007] In order to solve the above problems, the electronic control system of the present invention has a first electronic control device and a plurality of second electronic control devices, wherein the first electronic control device receives signals output from the plurality of second electronic control devices, processes the signals received from the plurality of second electronic control devices to generate processed data, overwrites and saves the generated processed data in a memory unit, and when a communication error occurs with at least one second electronic control device, saves the processed data generated from the signals received from all second electronic control devices that was saved in the memory unit at the time the communication error was detected as data at the time of error occurrence without overwriting it. [Effects of the Invention]

[0008] According to the present invention, vehicle data from each ECU at the time of / just before a communication error can be saved in the storage of the central ECU, making it possible to grasp the overall state of the vehicle when a communication error occurs and analyze the cause. Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. Furthermore, problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a block diagram showing the configuration of an electronic control system according to a first embodiment of the present invention. [Figure 2] FIG. 2 is a flowchart showing a process performed by the electronic control system according to the first embodiment of the present invention. [Figure 3] FIG. 6 is a block diagram showing the configuration of an electronic control system according to a second embodiment of the present invention. [Figure 4] FIG. 6 is a flowchart showing a process performed by an electronic control system according to a second embodiment of the present invention. [Figure 5] FIG. 10 is a block diagram showing the configuration of an electronic control system according to a third embodiment of the present invention. [Figure 6] FIG. 1 is a diagram showing an example of a connection configuration between electronic control units according to a first embodiment of the present invention. [Figure 7] FIG. 4 is a diagram showing another example of the connection configuration between electronic control devices according to the first embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the electronic control system and test method will be described with reference to the drawings. However, the embodiment shown below is merely an example, and it is not intended to exclude various modifications and application of techniques not explicitly stated in the embodiment. In other words, the present embodiment can be implemented with various modifications within the scope of its purpose. Furthermore, each figure does not intend to include only the components shown in the figure, but may include other functions, etc.

[0011] [Example 1] FIG. 1 is a block diagram showing the overall configuration of an electronic control system 1 according to a first embodiment. The electronic control system 1 mounted on a vehicle includes a first electronic control unit (central ECU 100) and multiple second electronic control units (ECUs 210 and 220). The central ECU 100 includes a transceiver 110, an error detection unit 120, a signal processing unit 130, a first memory unit (cache 140), a data transfer instruction unit 150, and a second memory unit (storage 160). The ECUs 210 and 220 are various devices mounted on the vehicle (e.g., cameras, radar sensing devices such as LiDAR), and acquire information related to the vehicle's control status and safety status to generate vehicle / diagnosis data. Note that, although the present embodiment describes a case in which there are two ECUs, the number of ECUs is not limited as long as there is more than one.

[0012] The transmitter / receiver 110 transmits and receives data between the ECU 210 and the ECU 220. The error detector 120 detects an error that occurs during data transmission and reception between the transmitter / receiver 110 and the ECU 210 and the ECU 220. In this embodiment, the error is a communication error that interrupts communication between the transmitter / receiver 110 and the ECU 210 and the ECU 220. The signal processor 130 processes the signals received by the transmitter / receiver 110 and processed by the ECU 210 and the ECU 220 to generate processing data.

[0013] The cache 140 and the storage 160 store the processed data generated by the signal processing unit 130. In this embodiment, the storage capacity of the cache 140 is smaller than the storage capacity of the storage 160. This is similar to other embodiments. In this embodiment, the storage 160 is built into the central ECU 100, but it may be mounted in another area in the vehicle in which the central ECU 100 is mounted. The data transfer instruction unit 150 transmits a transfer instruction signal to the signal processing unit 130 to instruct the signal processing unit 130 to transfer the processed data stored in the cache 140 to the storage 160. In this embodiment, the data transfer instruction unit 150 transmits a data transfer signal to the signal processing unit 130 upon receiving an error detection signal from the error detection unit 120, as will be described in detail later.

[0014] By connecting the multiple ECUs 210, 220 to the central ECU 100 so that they can communicate with each other as in this embodiment, it becomes possible to store and manage vehicle / diagnostic data within the central ECU 100, rather than storing all the data in non-volatile memories of the multiple ECUs 210, 220. Note that the ECUs 210, 220 may each have a volatile memory, and store all the data in that memory before transmitting it to the central ECU 100.

[0015] 2 is a flowchart showing the processing performed by the electronic control system according to this embodiment. While the transceiver 110 is communicating with the ECUs 210 and 220, the error detector 120 monitors whether an error has occurred in the communication between the transceiver 110 and the ECUs 210 and 220 (step S201). If the error detector 120 does not detect an error (step S201: No), the vehicle / diagnosis data processed by the ECUs 210 and 220 is transferred to the signal processor 130, which processes the data to generate processed data (step S202). The generated processed data is first sent to the cache 140, which may be a volatile memory, and overwritten (step S203). Furthermore, at any timing, the data stored in the cache 140 is transferred to and stored in the storage 160, which may be a nonvolatile memory, without being overwritten (step S204). The above flow is repeated thereafter until an error occurs. Since the data to be stored in the cache 140 is overwritten, the previously stored data is erased. Therefore, by storing the processed data for each predetermined time in the storage 160 having a larger storage capacity than the cache 140, it becomes possible to store the processed data for each predetermined time.

[0016] If the error detection unit 120 detects a communication error ("Yes" in step S201), the error detection unit 120 issues an error detection signal indicating that an error has been detected and transmits it to the data transfer instruction unit 150 (step S205). In the following, it is assumed that a communication error has occurred between the ECU 210 and the transceiver unit 110, for example. Upon receiving the error detection signal, the data transfer instruction unit 150 issues a transfer instruction signal to instruct the data stored in the cache 140 to be transferred to the storage 160 and transmits it to the signal processing unit 130.

[0017] Then, upon receiving the transfer instruction signal, the signal processing unit 130 transfers and stores, to the storage 160 as data at the time of error occurrence, the processing data corresponding to the vehicle / diagnosis data generated by all ECUs 210, 220 that was stored in the cache 140 from the time when the data transfer instruction unit 150 received the error detection signal until a predetermined time prior (step S207).

[0018] Specifically, for example, if the data transfer instruction unit 150 receives an error detection signal at time T, the signal processing unit 130 transfers the processing data generated by processing the signals received from each of the ECUs 210 and 220 between time T and time T-Δt, which is Δt before time T, from the cache 140 to the storage 160.

[0019] Thereafter, it is determined whether the communication error has been resolved (step S208). If the communication error has been resolved ("Yes" in step S208), the process returns to step S201. If the communication error has not been resolved ("No" in step S208), the process proceeds to step S209, where safety control such as stopping the vehicle or degrading (such as lowering the autonomous driving level) is performed.

[0020] In this embodiment, the error is described as a communication error, but it is not limited to this and may be a signal abnormality or an ECU malfunction. There are many methods for detecting errors, and possible methods include a CRC check or a packet loss counter.

[0021] In this embodiment, when a communication error occurs in an electronic control system, the above configuration allows any data stored in the cache memory up to the time of the error to be saved in storage. This allows the overall vehicle status to be grasped when analyzing the cause of the error, making the analysis easier. This is because, as in-vehicle systems become increasingly electronic and complex, it is difficult to analyze the cause of the error using only the vehicle / diagnosis data of the ECU in which the communication error occurred. For example, if the ECU in which the communication error occurred is responsible for managing each area / zone (front, rear, left, right), it is necessary to understand the status of each area / zone and then understand the basis and situation of vehicle control. The same applies when the ECU is responsible for each function (automatic driving control, driver assistance control, powertrain, vehicle body control, etc.).

[0022] In light of the above, the present embodiment can solve the following problem. That is, for an ECU 210 whose communication with the transceiver unit 110 is interrupted, the vehicle / diagnostic data generated by the ECU 210 cannot be updated after time T. However, the vehicle / diagnostic data generated by an ECU 220 whose communication with the transceiver unit 110 is not interrupted continues to be transmitted to the central ECU 100 after time T. Data continues to be overwritten and saved in the cache 140, which is a volatile memory. That is, data previously saved is erased. Therefore, if a communication error continues for a certain period of time, even if the communication error between the ECU 210 and the transceiver unit 110 is resolved, the vehicle / diagnostic data generated by the ECU 220 at time T is not saved, and it is therefore impossible to analyze what event occurred at time T that caused the error.

[0023] However, according to this embodiment, the vehicle / diagnosis data generated by ECUs 210 and 220 at time T is reliably stored in storage 160. Therefore, when the communication error in ECU 210 is resolved, it becomes possible to grasp the overall state of the vehicle at time T, which can be useful in analyzing the cause of the communication error that occurred in ECU 210 and any associated problems.

[0024] In this embodiment, communication between the ECUs 210, 220 and the transceiver unit 110 is performed via separate paths (for example, Ethernet, CAN, or SerDes), but the connection method is not limited to this. Specifically, as shown in FIG. 6, the ECUs 210, 220 may be connected to the transceiver unit 110 via a communication bus 700 shared by them. Alternatively, as shown in FIG. 7, the ECUs may be connected via a switching device 800. In either case, the communication path configuration can be simplified, and data management can be made easier by, for example, connecting ECUs belonging to the same functional system together to the transceiver unit 110 via a common bus or switching device.

[0025] [Example 2] Next, an electronic control system according to a second embodiment will be described with reference to Fig. 3 and Fig. 4. Fig. 3 is a block diagram showing an example of the configuration of an electronic control system 1 according to this embodiment. The configuration of the central ECU 100 in this embodiment is the same as that in the first embodiment, and therefore a description thereof will be omitted. This embodiment differs from the first embodiment in that data is stored in the cache not only on the central ECU 100 side but also on the ECUs 210 and 220 side.

[0026] In this embodiment, the ECU 210 includes a transmitting / receiving unit 111, an error detecting unit 121, an information processing unit 131, a third storage unit (cache 141), and an information acquiring unit 300. The ECU 220 has a similar configuration.

[0027] The transmitter / receiver unit 111 communicates with the transmitter / receiver unit 110 on the central ECU 100 side. When the error detector 121 detects a communication error occurring between the transmitter / receiver units 110 and 111, it issues an error detection signal and transmits it to the information processor 131. The information acquirer 300 is a sensing element such as a camera or radar, and acquires information related to vehicle control and safety. The information processor 131 processes the information acquired by the information acquirer unit 300 and generates a processed signal.

[0028] In this embodiment, when the error detection unit 121 detects a communication error, it transmits an error detection signal to the information processing unit 131, and in response to receiving the error detection signal, the information processing unit 131 stores and preserves in the cache 141 information about the processing signal generated within a predetermined time before and after the time when the error detection unit 121 detected the communication error until the communication error is resolved.

[0029] The above processing will be explained using the flowchart in Fig. 4. While the transceiver unit 111 is communicating with the transceiver unit 110 of the central ECU 100, the error detection unit 121 monitors whether an error has occurred in the communication between the transceivers 110 and 111 (step S401). If the error detection unit 121 has not detected an error ("No" in step S401), the information processing unit 131 processes the information acquired by the information acquisition unit 300 to generate a processing signal (step S402). Then, the information processing unit 131 transmits the processed signal to the transceiver unit 111 (step S403). Thereafter, the above flow is repeated until an error occurs.

[0030] If the error detection unit 121 detects a communication error ("Yes" in step S401), the error detection unit 121 issues an error detection signal indicating that a communication error has been detected, and transmits it to the information processing unit 131 (step S404). Upon receiving the error detection signal, the information processing unit 131 stores information about the processing signals generated within a predetermined time before and after the time when the error detection unit 121 detected the error in the cache 141 until the communication error is resolved (step S405).

[0031] Thereafter, the error detection unit 121 monitors whether the communication error has been resolved (step S406). If the communication error has been resolved ("Yes" in step S406), the information processing unit 131 transmits the data stored in the cache 141 to the transmission / reception unit 111. If the communication error has not been resolved ("No" in step S406), the process proceeds to step S408, and safety control such as stopping the vehicle or degrading (such as lowering the autonomous driving level) is performed.

[0032] In this embodiment, by performing the above-described processing, in addition to the effect of the first embodiment, data generated by an ECU in which a communication error occurred after the communication error occurred and that could not be transmitted to the central ECU 100 can be transmitted after communication is restored. Therefore, by analyzing the continuity of data generated before and after the communication error, detailed cause analysis is possible, which makes it possible to facilitate maintenance and provide feedback to design. Note that there may be a time lag in the cache data transmitted from the ECU 210 to the central ECU when communication is restored, but this can be adjusted by the signal processing unit 130 performing synchronization processing using, for example, a timestamp.

[0033] Furthermore, even if the communication error is not resolved or the ECU that caused the error breaks down, according to this embodiment, it is possible to grasp the state of the vehicle at the time the communication error occurred by extracting the ECU and obtaining the data log from the cache.

[0034] [Example 3] 5 is a block diagram showing the configuration of an electronic control system 1 according to a third embodiment of the present invention. This embodiment differs from the first embodiment in that it includes an external communication unit 500 capable of communicating with an external device 600 (such as a management center or a user) outside the vehicle 400 equipped with the central ECU 100. In this embodiment, the external communication unit 500 is configured to be able to communicate with the signal processing unit 130, and can transfer vehicle / diagnosis data at any timing to, for example, a center or a user having a mobile terminal, or can transmit data obtained by integrating and processing the data.

[0035] With the above configuration, in addition to the effects of the first and second embodiments, it becomes possible to notify the center and the driver in real time while the vehicle is in operation, and it becomes possible to provide highly reliable services such as safety control, warnings, logging, and trend analysis.

[0036] According to the embodiment of the present invention described above, the following advantageous effects are achieved. (1) The electronic control system according to the present invention has a first electronic control device and a plurality of second electronic control devices, wherein the first electronic control device receives signals output from the plurality of second electronic control devices, processes the signals received from the plurality of second electronic control devices to generate processed data, overwrites and saves the generated processed data in a memory unit, and when a communication error occurs with at least one second electronic control device, saves the processed data generated from the signals received from all the second electronic control devices that were saved in the memory unit at the time the communication error was detected as data at the time of the error occurrence without overwriting it.

[0037] With the above configuration, vehicle data from each ECU in the event of a communication error can be saved in the central ECU's storage, making it possible to grasp the overall state of the vehicle in the event of a communication error and analyze the cause.

[0038] (2) The error data includes processed data generated from signals received from all second electronic control units during the period from the time the communication error was detected to a time point a predetermined time prior to the time the communication error was detected, which makes it possible to analyze the continuity of data immediately before the communication error occurred, and facilitates the analysis of the cause of the error.

[0039] (3) The storage unit has a first storage unit that overwrites and saves the processed data, and a second storage unit that saves the processed data without overwriting it, and the first electronic control unit transfers the error data from the first storage unit to the second storage unit in response to detecting the occurrence of a communication error. This makes it possible to use a volatile cache memory with a smaller storage capacity as the first storage unit than the second storage unit, which is a non-volatile storage memory, and thereby makes it possible to miniaturize the device.

[0040] (4) The electronic control system further includes an external communication unit capable of communicating with the outside of the vehicle, and the external communication unit transmits information, including the processed data stored in the memory unit, to the outside of the vehicle. This enables real-time notification to the center and the driver while the vehicle is in operation, and enables the provision of highly reliable services such as safety control, warnings, logging, and trend analysis.

[0041] (5) Each of the plurality of second electronic control units acquires information about the vehicle in which the electronic control system is installed, processes the information to generate a processing signal, and, in the event of a communication error, stores in a third storage unit information about the processing signal generated within a predetermined time before and after the communication error occurred. This makes it possible to acquire data after the communication error by referring to the data log in the storage unit as needed.

[0042] (6) Each of the multiple second electronic control units stores information in a third storage unit until the communication error is resolved, and when the communication error is resolved, transmits the information stored in the third storage unit to the first electronic control unit. This makes it possible to transmit data immediately after the communication error occurs that could not be transmitted to the central ECU during the communication error after the communication error has occurred after communication is restored, enabling more detailed analysis of the cause of the error, facilitating maintenance and providing feedback to the design.

[0043] (7) The second electronic control units are connected to the first electronic control unit via a common communication path or selectively connected via a switching circuit, which simplifies the communication path between the second electronic control units and the first electronic control unit.

[0044] The technical scope of the present invention is not limited to the scope of the above-described embodiments, and various modifications are included without departing from the main features of the present invention. Therefore, the above-described embodiments are merely illustrative and should not be interpreted as limiting. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations, and all of these are within the scope of the present invention. [Explanation of symbols]

[0045] 1 Electronic control system, 100 Central ECU (first electronic control unit), 140 Cache (first memory unit), 141 Cache (third memory unit), 160 Storage (second memory unit), 210, 220 ECU (second electronic control unit), 400 Vehicle, 500 External communication unit, 600 External, 700 Communication bus, 800 Switching device

Claims

1. An electronic control system having a first electronic control unit and a plurality of second electronic control units, The first electronic control device receiving signals output from the plurality of second electronic control units; Processing signals received from the plurality of second electronic control units to generate processed data; The generated processing data is overwritten and saved in the storage unit, When a communication error occurs with at least one of the second electronic control units, the processing data generated from the signals received from all of the second electronic control units and stored in the memory unit at the time the communication error is detected is saved as data at the time of error occurrence without being overwritten; Each of the plurality of second electronic control units is Acquire information about a vehicle in which the electronic control system is installed; processing the information to generate a processed signal; When the communication error occurs, information about the processed signal generated within a predetermined time before and after the time when the communication error occurred is stored in a third storage unit. An electronic control system characterized by:

2. 2. The electronic control system of claim 1, The error occurrence data includes the processing data generated from all signals received from the second electronic control unit during a period from the time when the occurrence of the communication error was detected to a time preceding a predetermined time. An electronic control system characterized by:

3. 2. The electronic control system of claim 1, the storage unit includes a first storage unit that overwrites and stores the processing data, and a second storage unit that stores the processing data without overwriting it; the first electronic control unit, in response to detecting the occurrence of the communication error, transfers the error occurrence data from the first storage unit to the second storage unit; An electronic control system characterized by:

4. 2. The electronic control system of claim 1, an external communication unit capable of communicating with the outside of the vehicle in which the electronic control system is installed; The external communication unit transmits information including the processing data stored in the storage unit to an outside of the vehicle. An electronic control system characterized by:

5. 2. The electronic control system of claim 1, Each of the plurality of second electronic control units stores the information in the third storage unit until the communication error is resolved, and when the communication error is resolved, transmits the information stored in the third storage unit to the first electronic control unit. An electronic control system characterized by:

6. 2. The electronic control system of claim 1, The plurality of second electronic control units are connected to the first electronic control unit via a common communication path or selectively connected via a switching circuit. An electronic control system characterized by:

Images