Electronic control unit

Abstract

To suppress increase of the processing load of the whole system and properly deal with generation of abnormalities.SOLUTION: The first electronic controllers 2 to 4 are connected to second electronic controllers. The electronic controllers include: monitoring units 14a to 16b for monitoring one of the second electronic controllers as a monitoring target; abnormality generation detection units 14b to 16b for detecting the generation of an abnormality in the monitoring target electronic controller; and monitoring target changing units 14c to 16c for changing a predetermined monitoring target electric controller when an abnormality generation is detected in the monitoring target electronic controller.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to an electronic control device. [Background technology]

[0002] For example, in a vehicle control system installed in a vehicle, multiple electronic control devices are connected via an in-vehicle network. For example, Patent Document 1 discloses a configuration in which, when an abnormality is detected in one of the multiple devices, a normal device takes over the processing of the abnormal device, thereby continuing vehicle control and implementing fail-safe processing. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-121043 Summary of the Invention [Problem to be solved by the invention]

[0004] One configuration for detecting abnormalities in devices is one in which two devices monitor each other. However, if the above-mentioned two-device configuration for monitoring three devices is adopted, the first device and the second device will monitor each other, the second device and the third device will monitor each other, and the third device and the first device will monitor each other. In this case, monitoring from one device to the other device will be two-way, which may increase the processing load on the entire system.

[0005] The present invention has been made in consideration of the above-mentioned circumstances, and its purpose is to provide an electronic control device that can appropriately deal with abnormalities while suppressing an increase in the processing load on the entire system. [Means for solving the problem]

[0006] According to the invention described in claim 1, the monitoring unit (14a to 16a, 38a to 41a) monitors one of a plurality of other electronic control units as a monitoring target. The abnormality occurrence detection unit (14b to 16b, 38b to 41b) detects the occurrence of an abnormality in the monitoring target electronic control unit. When the abnormality occurrence in the monitoring target electronic control unit is detected, the monitoring target change unit (14c to 16c, 38c to 41c) The occurrence of the abnormality is confirmed by an electronic control device other than the electronic control device to be monitored, and the occurrence of the abnormality in the electronic control device to be monitored is determined based on the confirmation result. Change the monitoring target of a specified electronic control unit.

[0007] Even if the normal monitoring direction of each of the multiple electronic control devices is set to one direction rather than a combination of two electronic control devices monitoring each other, if an abnormality is detected in the monitored electronic control device, the monitoring target of the specified electronic control device can be changed, allowing for an appropriate response to the abnormality. This makes it possible to appropriately respond to the abnormality while suppressing an increase in the processing load on the entire system. [Brief explanation of the drawings]

[0008] [Figure 1] Functional block diagram showing the overall configuration of the first embodiment [Figure 2] Diagram explaining when an abnormality occurs in device A [Figure 3] Diagram explaining when an abnormality occurs in device B [Figure 4] Diagram explaining when an abnormality occurs in device C [Figure 5] Functional block diagram of device C [Figure 6] flowchart [Figure 7] Functional block diagram showing the overall configuration of a second embodiment [Figure 8] A diagram explaining when an abnormality occurs in device E [Figure 9] Functional block diagram of device D [Figure 10] flowchart [Figure 11] flowchart DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, several embodiments will be described with reference to the drawings. In the following embodiments, the description of parts common to the preceding embodiments will be omitted.

[0010] (First embodiment) The first embodiment will be described with reference to Fig. 1 to Fig. 6. As shown in Fig. 1, the vehicle control system 1 has three devices 2 to 4, devices A to C, that are interconnected. The present invention can also be applied to a case where the vehicle control system 1 is made up of four or more devices, three of which are interconnected. That is, the number of devices included in the vehicle control system 1 can be any number greater than or equal to three, as long as the three devices are interconnected. In this embodiment, the device A will be described as the main control device 2, the device B as the monitoring device 3, and the device C as the sub-control device 4.

[0011] Each of the devices 2 to 4 is composed of an electronic control unit (hereinafter referred to as an ECU (Electronic Control Unit)). Each of the devices 2 to 4 is connected via a continuous monitoring line that is always enabled and an abnormality monitoring line that is enabled only when an abnormality occurs. The main control device 2 and the monitoring device 3 are connected via a continuous monitoring line 5 and an abnormality monitoring line 6. The monitoring device 3 and the sub-controller 4 are connected via a continuous monitoring line 7 and an abnormality monitoring line 8. The sub-controller 4 and the main control device 2 are connected via a continuous monitoring line 9 and an abnormality monitoring line 10. The continuous monitoring lines 5, 7, 9 and the abnormality monitoring lines 6, 8, 10 may each be wired or wireless.

[0012] The main control unit 2 is an ECU that normally controls the vehicle. During normal operation, the main control unit 2 monitors the monitoring unit 3 via a constant monitoring line 5, determines the operating state of the monitoring unit 3, and detects the occurrence of an abnormality in the monitoring unit 3. When an abnormality occurs in the monitoring unit 3, the main control unit 2 monitors the sub-control unit 4 via an abnormality monitoring line 10, determines the operating state of the sub-control unit 4, and detects the occurrence of an abnormality in the sub-control unit 4.

[0013] The monitoring device 3 is an ECU with a monitoring function. Under normal circumstances, the monitoring device 3 constantly monitors the sub-controller 4 via a monitoring line 7, determines the operating state of the sub-controller 4, and detects the occurrence of an abnormality in the sub-controller 4. When an abnormality occurs in the sub-controller 4, the monitoring device 3 monitors the main controller 2 via a monitoring line 6 during abnormality occurrence, determines the operating state of the main controller 2, and detects the occurrence of an abnormality in the main controller 2.

[0014] The sub-controller 4 is an ECU that executes evacuation driving control in place of the main controller 2 when an abnormality occurs in the main controller 2. Under normal circumstances, the sub-controller 4 monitors the main controller 2 via a constant monitoring line 9, determines the operating state of the main controller 2, and detects the occurrence of an abnormality in the main controller 2. When an abnormality occurs in the main controller 2, the sub-controller 4 monitors the monitoring device 3 via an abnormality monitoring line 8, determines the operating state of the monitoring device 3, and detects the occurrence of an abnormality in the monitoring device 3.

[0015] Each of the devices 2 to 4 monitors one device in the clockwise direction in FIG. 1 under normal circumstances. In FIG. 1, the arrows of the continuous monitoring lines 5, 7, and 9 indicate the monitoring direction under normal circumstances. The monitoring method under normal circumstances in each of the devices 2 to 4 may be any method capable of determining whether the operating status of the monitored device is normal, and well-known methods such as checking whether the calculation results between the devices match or using a watchdog timer can be adopted. Furthermore, as will be described in detail later, each of the devices 2 to 4 monitors one device in the counterclockwise direction in FIG. 1 under abnormality occurrence, and the arrows of the abnormality occurrence monitoring lines 6, 8, and 10 under FIG. 1 indicate the monitoring direction under abnormality occurrence. The monitoring method under abnormality occurrence in each of the devices 2 to 4 may be any method capable of determining whether the operating status of the monitored device is normal, and well-known methods such as checking whether the calculation results between the devices match or using a watchdog timer can be adopted.

[0016] In addition to the constant monitoring lines 5, 7, and 9 and the abnormality monitoring lines 6, 8, and 10, data communication lines are connected between each of the devices 2 to 4 to notify abnormality detection, which indicates the detection of an abnormality, and abnormality confirmation, which indicates the confirmation of an abnormality. The main control device 2 and the monitoring device 3 are connected via a data communication line 11. The monitoring device 3 and the sub-controller 4 are connected via a data communication line 12. The sub-controller 4 and the main control device 2 are connected via a data communication line 13. The data communication lines 11 to 13 may also be either wired or wireless.

[0017] 2, an explanation will be given of what happens when an abnormality occurs in the main control device 2. When an abnormality occurs in the main control device 2 (t1), the sub-control device 4 detects the occurrence of the abnormality in the main control device 2 (t2), executes evacuation travel control in place of the main control device 2 (t3), and notifies the monitoring device 3 of the abnormality detection via the data communication line 12 (t4). When the monitoring device 3 is notified of the abnormality detection by the sub-control device 4, it temporarily activates the abnormality monitoring line 6, determines the operating state of the main control device 2, confirms the occurrence of an abnormality in the main control device 2, and notifies the sub-control device 4 of the abnormality confirmation result via the data communication line 12.

[0018] When the sub-controller 4 is notified of the abnormality confirmation result from the monitoring device 3, it selects whether to confirm or not confirm the occurrence of the abnormality based on the notified abnormality confirmation result. When the sub-controller 4 confirms from the abnormality confirmation result from the monitoring device 3 that the abnormality in the main control device 2 has also been detected by the monitoring device 3, it confirms the occurrence of an abnormality in the main control device 2 (t5). When the sub-controller 4 confirms the occurrence of an abnormality in the main control device 2, it notifies the monitoring device 3 via the data communication line 12 that the abnormality has been confirmed (t6), activates the abnormality monitoring line 8, and monitors the monitoring device 3 in place of the main control device 2 (t7).

[0019] 3, an abnormality occurs in the monitoring device 3. When an abnormality occurs in the monitoring device 3 (t11), the main control device 2 detects the abnormality in the monitoring device 3 (t12), and notifies the sub-control device 4 of the abnormality detection via the data communication line 13 (t13). When the sub-control device 4 is notified of the abnormality detection by the main control device 2, it temporarily activates the abnormality monitoring line 8, determines the operating state of the monitoring device 3, confirms that an abnormality has occurred in the monitoring device 3, and notifies the main control device 2 of the abnormality confirmation result via the data communication line 13.

[0020] When the main control unit 2 is notified of the abnormality confirmation result from the sub-controller 4, it selects whether to confirm or not confirm the occurrence of the abnormality based on the notified abnormality confirmation result. When the main control unit 2 confirms from the abnormality confirmation result from the sub-controller 4 that the abnormality in the monitoring device 3 has also been detected by the sub-controller 4, it confirms the occurrence of the abnormality in the monitoring device 3 (t14). When the main control unit 2 confirms the occurrence of the abnormality in the monitoring device 3, it notifies the sub-controller 4 of the confirmation of the abnormality via the data communication line 13 (t15), activates the abnormality monitoring line 10, and monitors the sub-controller 4 in place of the monitoring device 3 (t16).

[0021] 4, an abnormality occurring in the sub-controller 4 will be described. When an abnormality occurs in the sub-controller 4 (t21), the monitoring device 3 detects the occurrence of the abnormality in the sub-controller 4 (t22), and notifies the main control device 2 of the abnormality detection via the data communication line 11 (t23). When the main control device 2 is notified of the abnormality detection from the monitoring device 3, it temporarily activates the abnormality monitoring line 10, determines the operating state of the sub-controller 4, confirms the occurrence of the abnormality in the sub-controller 4, and notifies the monitoring device 3 of the abnormality confirmation result via the data communication line 11.

[0022] When the monitoring device 3 is notified of the abnormality confirmation result from the main control device 2, it selects whether to confirm or not confirm the occurrence of the abnormality based on the notified abnormality confirmation result. When the monitoring device 3 confirms from the abnormality confirmation result from the main control device 2 that the abnormality occurrence in the sub-controller 4 has also been detected by the main control device 2, it confirms the occurrence of an abnormality in the sub-controller 4 (t24). When the monitoring device 3 confirms the occurrence of an abnormality in the sub-controller 4, it notifies the main control device 2 of the confirmation of the abnormality occurrence via the data communication line 11 (t25), activates the abnormality monitoring line 6, and monitors the main control device 4 in place of the sub-controller 4 (t26).

[0023] As shown in Fig. 5, the devices 2 to 4 each include a control unit 14 to 16. Each control unit 14 to 16 is mainly composed of a microcomputer including a CPU, ROM, RAM, I / O, and bus lines connecting these components. Each control unit 14 to 16 controls the operation of each device 2 to 4 by executing software processing by running a program stored in advance in the CPU and hardware processing by dedicated electronic circuits.

[0024] The control unit 14 includes a monitoring unit 14a, an abnormality detection unit 14b, and a monitoring destination change unit 14c for each function. The monitoring unit 14a constantly monitors the monitoring device 3 via the monitoring line 5. The abnormality detection unit 14b determines the operating state of the monitoring device 3 and detects the occurrence of an abnormality in the monitoring device 3. The abnormality detection unit 14b detects the occurrence of an abnormality in the monitoring device 3 when it determines, for example, a discrepancy in the calculation results between the main control unit 2 and the monitoring device 3, or a timeout of the watchdog timer.

[0025] When the abnormality occurrence detection unit 14b detects the occurrence of an abnormality in the monitoring device 3, the monitoring destination change unit 14c notifies the sub-controller 4 of the abnormality occurrence detection via the data communication line 13. When the sub-controller 4 is notified of the abnormality occurrence detection from the main control device 2, it temporarily activates the abnormality occurrence monitoring line 8, confirms the occurrence of an abnormality in the monitoring device 3, and notifies the main control device 2 of the abnormality occurrence confirmation result via the data communication line 13. When the monitoring destination change unit 14c is notified of the abnormality occurrence confirmation result from the sub-controller 4 and confirms the occurrence of an abnormality in the monitoring device 3 based on the notified abnormality occurrence confirmation result, it notifies the sub-controller 4 of the abnormality occurrence confirmation via the data communication line 13. The monitoring destination change unit 14c activates the abnormality occurrence monitoring line 10, changes the monitoring destination from the monitoring device 3 to the sub-controller 4, and monitors the sub-controller 4 instead of the monitoring device 3.

[0026] The control unit 15 includes a monitoring unit 15a, an abnormality detection unit 15b, and a monitoring destination change unit 15c for each function. The monitoring unit 15a constantly monitors the sub-control unit 4 via the monitoring line 7. The abnormality detection unit 15b determines the operating state of the sub-control unit 4 and detects the occurrence of an abnormality in the sub-control unit 4. The abnormality detection unit 15b detects the occurrence of an abnormality in the sub-control unit 4 when it determines, for example, a discrepancy in the calculation results between the monitoring device 3 and the sub-control unit 4 or a timeout of the watchdog timer.

[0027] When the abnormality occurrence detection unit 15b detects the occurrence of an abnormality in the sub-controller 4, the monitoring destination change unit 15c notifies the main control unit 2 of the abnormality occurrence detection via the data communication line 11. When the main control unit 2 is notified of the abnormality occurrence detection from the monitoring device 3, it temporarily activates the abnormality occurrence monitoring line 10, checks the occurrence of an abnormality in the sub-controller 4, and notifies the monitoring device 3 of the abnormality occurrence confirmation result via the data communication line 11. When the monitoring destination change unit 15c is notified of the abnormality occurrence confirmation result from the main control unit 2 and determines that an abnormality has occurred in the sub-controller 4 based on the notified abnormality occurrence confirmation result, it notifies the main control unit 2 of the abnormality occurrence confirmation via the data communication line 11. The monitoring destination change unit 15c activates the abnormality occurrence monitoring line 6, changes the monitoring destination from the sub-controller 4 to the main control unit 2, and monitors the main control unit 2 instead of the sub-controller 4.

[0028] The control unit 16 includes a monitoring unit 16a, an abnormality detection unit 16b, and a monitoring destination change unit 16c for each function. The monitoring unit 16a constantly monitors the main control unit 2 via the monitoring line 9. The abnormality detection unit 16b determines the operating state of the main control unit 2 and detects the occurrence of an abnormality in the main control unit 2. The abnormality detection unit 16b detects the occurrence of an abnormality in the main control unit 2, for example, when it determines that there is a discrepancy in the calculation results between the sub-control unit 4 and the main control unit 2, or a timeout of the watchdog timer, etc.

[0029] When the abnormality occurrence detection unit 16b detects the occurrence of an abnormality in the main control device 2, the monitoring destination change unit 16c notifies the monitoring device 3 of the abnormality occurrence detection via the data communication line 12. When the monitoring device 3 is notified of the abnormality occurrence detection from the sub-controller 4, it temporarily activates the abnormality occurrence monitoring line 6, confirms the occurrence of an abnormality in the main control device 2, and notifies the sub-controller 4 of the abnormality occurrence confirmation result via the data communication line 12. When the monitoring destination change unit 16c is notified of the abnormality occurrence confirmation result from the monitoring device 3 and determines that an abnormality has occurred in the main control device 2 based on the notified abnormality occurrence confirmation result, it notifies the monitoring device 3 of the abnormality occurrence confirmation via the data communication line 12. The monitoring destination change unit 16c activates the abnormality occurrence monitoring line 8, changes the monitoring destination from the main control device 2 to the monitoring device 3, and monitors the monitoring device 3 instead of the main control device 2.

[0030] Next, the operation of the above-described configuration will be described with reference to FIG. 6. Here, a case where the control unit 16 of the sub-controller 4 detects an abnormality in the main control unit 2 will be described. As shown in FIG. 4, when the sub-controller 4 detects an abnormality in the main control unit 2, the main control unit 2, which is the monitoring target under normal circumstances, functions as the second device (corresponding to the second electronic control unit), and the monitoring device 3, which is the monitoring target of the main control unit 2 under normal circumstances, functions as the first device (corresponding to the first electronic control unit). As shown in FIG. 2, when the main control unit 2 detects an abnormality in the monitoring device 3, the monitoring device 3, which is the monitoring target under normal circumstances, functions as the second device, and the sub-controller 4, which is the monitoring target of the monitoring device 3 under normal circumstances, functions as the first device. As shown in FIG. 3, when the monitoring device 3 detects an abnormality in the sub-controller 4, the sub-controller 4, which is the monitoring target under normal circumstances, functions as the second device, and the main control unit 2, which is the monitoring target of the sub-controller 4 under normal circumstances, functions as the first device.

[0031] In the sub-control device 4, the control unit 16 executes a monitoring process at a predetermined interval. When a start condition for the monitoring process is met, the control unit 16 starts the monitoring process and determines whether an abnormality has been detected in the second device (S1). When the control unit 16 determines that an abnormality has not been detected in the second device (S1: NO), the control unit 16 determines whether the second device has not notified the detection of an abnormality in the first device (S2). When the control unit 16 determines that the second device has not notified the detection of an abnormality in the first device (S2: NO), the control unit 16 determines whether the second device has not notified the confirmation of an abnormality in the first device (S3). When the control unit 16 determines that the second device has not notified the confirmation of an abnormality in the first device (S3: NO), the control unit 16 ends the monitoring process and waits for the start condition for the next monitoring process to be met.

[0032] When the control unit 16 determines that an abnormality has occurred in the second device (S1: YES), it notifies the first device of the detection of the abnormality occurrence in the second device (S4) and waits for a notification of the abnormality occurrence confirmation result from the first device (S5).When the control unit 16 determines that the abnormality occurrence confirmation result has not been notified from the first device, or that the abnormality occurrence confirmation result has been notified from the first device but the notified abnormality occurrence confirmation result has not confirmed the occurrence of an abnormality in the second device (S5: NO), it ends the monitoring process without confirming the occurrence of an abnormality in the second device and waits for the establishment of a start condition for the next monitoring process.

[0033] On the other hand, when the control unit 16 receives a notification of the abnormality confirmation result from the first device and determines that the abnormality in the second device has been confirmed based on the notified abnormality confirmation result (S5: YES), it confirms that an abnormality has occurred in the second device and notifies the first device of the confirmation of the abnormality in the second device (S6).The control unit 16 then activates the corresponding abnormality monitoring line, activates monitoring of the first device (S7), ends the monitoring process, and waits for the start condition for the next monitoring process to be met.

[0034] Furthermore, when the control unit 16 determines that the second device has notified it of the detection of an abnormality in the first device (S2: YES), it temporarily activates the corresponding abnormality monitoring line, temporarily activates monitoring of the first device, confirms the occurrence of an abnormality in the first device (S8), and notifies the second device of the confirmation result of the occurrence of an abnormality in the first device (S9).

[0035] Furthermore, when the control unit 16 determines that the second device has notified it that an abnormality has occurred in the first device (S3: YES), it transitions to a monitoring state from the second device (S10), terminates the monitoring process, and waits for the start condition for the next monitoring process to be met.

[0036] As described above, according to the first embodiment, the following advantageous effects can be obtained. When the sub-controller 4 detects and confirms the occurrence of an abnormality in the main control unit 2, it changes the monitoring target of the sub-controller 4 from the main control unit 2 to the monitoring device 3, and the sub-controller 4 monitors the monitoring device 3 instead of the main control unit 2. When the main control unit 2 detects and confirms the occurrence of an abnormality in the monitoring device 3, the same occurs except that the operations of the devices 2 to 4 are switched. When the main control unit 2 detects and confirms the occurrence of an abnormality in the monitoring device 3, it changes the monitoring target from the monitoring device 3 to the sub-controller 4, and the sub-controller 4 is monitored instead of the monitoring device 3. When the monitoring device 3 detects and confirms the occurrence of an abnormality in the sub-controller 4, the same occurs except that the operations of the devices 2 to 4 are switched. When the monitoring device 3 detects and confirms the occurrence of an abnormality in the sub-controller 4, it changes the monitoring target from the sub-controller 4 to the main control unit 2, and the main control unit 2 is monitored instead of the sub-controller 4.

[0037] Even if the normal monitoring direction of each of the multiple devices 2 to 4 is set to one direction rather than a combination of two devices monitoring each other, if an abnormality is detected in the monitored device, the monitoring target of the specified device can be changed to deal with the abnormality appropriately. This makes it possible to deal with the abnormality appropriately while suppressing an increase in the processing load on the entire system.

[0038] When the sub-controller 4 detects an abnormality in the main controller 2, it notifies the monitoring device 3 of the abnormality detection, indicating that an abnormality has been detected. By notifying the monitoring device 3 of the abnormality detection, it is possible to cause the monitoring device 3 to perform an operation in response to the abnormality detection notification. That is, the monitoring device 3 can temporarily activate the abnormality monitoring line 6, monitor the main control device 2 via the abnormality monitoring line 6, and determine the operating state of the main control device 2 to confirm that an abnormality has occurred in the main control device 2. The same applies when the main control device 2 notifies the sub-controller 4 of the abnormality detection and when the monitoring device 3 notifies the main control device 2 of the abnormality detection.

[0039] When the monitoring device 3 confirms that an abnormality has occurred in the main control device 2, the sub-controller 4 confirms that an abnormality has occurred in the main control device 2 and notifies the monitoring device 3 of the confirmation of the abnormality. By notifying the monitoring device 3 of the confirmation of the abnormality, the monitoring device 3 can be made to perform an operation in response to the notification of the confirmation of the abnormality. In other words, the monitoring line 8 at the time of abnormality occurrence can be activated, and the monitoring device 3 can be monitored in place of the main control device 2. The same applies when the main control device 2 notifies the sub-controller 4 of the confirmation of the abnormality, and when the monitoring device 3 notifies the main control device 2 of the confirmation of the abnormality.

[0040] (Second embodiment) The second embodiment will be described with reference to Figures 7 to 11. In the first embodiment described above, three devices, devices A to C, are interconnected, but in the second embodiment, as shown in Figure 7, a vehicle control system 21 has four devices, devices D to G, 22 to 25, interconnected. This case can also be applied to a case where the vehicle control system 21 is made up of five or more devices, four of which are interconnected. In this embodiment, the device D will be described as device 22, device E as device 23, device F as device 24, and device G as device 25.

[0041] Each of the devices 22 to 25 is connected via a constant monitoring line that is always enabled and an abnormality monitoring line that is enabled only when an abnormality occurs. 23are connected via a continuous monitoring line 26 and an abnormality monitoring line 27. Devices 23 and 24 are connected via a continuous monitoring line 28 and an abnormality monitoring line 29. Devices 24 and 25 are connected via a continuous monitoring line 30 and an abnormality monitoring line 31. Devices 25 and 22 are connected via a continuous monitoring line 32 and an abnormality monitoring line 33. Devices 22 and 24 are connected via abnormality monitoring lines 34 and 36. Devices 23 and 25 are connected via abnormality monitoring lines 35 and 37. As in the first embodiment, data communication lines (not shown) are connected between devices 22 to 25 in addition to the continuous monitoring lines 26, 28, 30, and 32 and the abnormality monitoring lines 27, 29, 31, and 33 to 37 for notifying abnormality detection indicating the detection of an abnormality and abnormality confirmation indicating the confirmation of an abnormality.

[0042] Each of the devices 22 to 25 normally monitors one device in the clockwise direction in Fig. 7. In Fig. 7, the arrows of the regular monitoring lines 26, 28, 30, and 32 each indicate the monitoring direction in normal times. Furthermore, in the event of an abnormality, each of the devices 22 to 25 monitors one device in the counterclockwise direction in Fig. 7 or one device in the diagonal direction as its monitoring target, as will be described in detail later. In Fig. 7, the arrows of the abnormality monitoring lines 27, 29, 31, and 33 to 37 each indicate the monitoring direction in the event of an abnormality.

[0043] 8 when it detects the occurrence of an abnormality in device 23. When an abnormality occurs in device 23 (t31), device 22 detects the occurrence of the abnormality in device 23 (t32), and notifies both devices 24 and 25 of the abnormality detection via the data communication line (t33). When devices 24 and 25 are notified of the abnormality detection from device 22, they temporarily activate abnormality monitoring lines 29 and 37, determine the operating state of device 23, confirm the occurrence of an abnormality in device 23, and notify device 22 of the abnormality confirmation result via the data communication line.

[0044] When the device 22 is notified of the abnormality occurrence confirmation result from the devices 24 and 25, it selects whether the abnormality occurrence is confirmed or unconfirmed based on the notified abnormality occurrence confirmation result. In this case, since there are multiple sources of notification of the abnormality occurrence confirmation result, the device 22 selects whether the abnormality occurrence is confirmed or unconfirmed as follows.

[0045] In the case of an interconnected relationship between four devices as in this embodiment, as described above, abnormality confirmation results are notified from two devices 24 and 25, and the two abnormality confirmation results may or may not match. If the abnormality confirmation results from both devices 24 and 25 match and confirm the occurrence of an abnormality, device 22 determines that an abnormality has occurred in device 23. If the abnormality confirmation results from both devices 24 and 25 match and confirm that an abnormality has not occurred, device 22 does not determine that an abnormality has occurred in device 23.

[0046] If one abnormality occurrence confirmation result from devices 24 and 25 indicates confirmation of an abnormality occurrence and the other abnormality occurrence confirmation result indicates no confirmation of an abnormality occurrence, and the two abnormality occurrence confirmation results are a confirmation of an abnormality occurrence and no confirmation and do not match, device 22 selects one of them, for example, as a requirement of the system design items. If confirmation of both abnormality occurrences is a requirement of the system design items, device 22 does not determine that an abnormality has occurred in device 23 if the two abnormality occurrence confirmation results are a confirmation of an abnormality occurrence and no confirmation and do not match. If confirmation of at least one abnormality occurrence is a requirement of the system design items, device 22 determines that an abnormality has occurred in device 23 even if the two abnormality occurrence confirmation results are a confirmation of an abnormality occurrence and no confirmation and do not match.

[0047] Device 22 determines that an abnormality has occurred in device 23 based on the abnormality confirmation results from devices 24 and 25 (t34). Device 22 notifies device 25 of the abnormality confirmation via the data communication line (t35). Upon receiving the abnormality confirmation notification from device 22, device 25 activates abnormality monitoring line 31 and monitors device 24 instead of device 23 (t26).

[0048] While the above describes a case in which four devices are interconnected and two abnormality confirmation results are notified, if, for example, five devices are interconnected, three abnormality confirmation results will be notified, and therefore majority voting can be adopted as a system design requirement. That is, if two or more abnormality confirmation results indicate a confirmed abnormality and the number of abnormality confirmation results indicating a confirmed abnormality exceeds the number of abnormality confirmation results indicating no confirmation of an abnormality, an abnormality is confirmed in the device to be detected. On the other hand, if two or more abnormality confirmation results indicate no confirmation of an abnormality and the number of abnormality confirmation results indicating no confirmation of an abnormality exceeds the number of abnormality confirmation results indicating a confirmed abnormality, an abnormality is not confirmed in the device to be detected.

[0049] That is, if the number of notifications of abnormality confirmation results is odd, a majority vote can be adopted as a system design requirement. If the number of notifications of abnormality confirmation results is even, one of the notifications can be excluded, and the number of notifications of abnormality confirmation results used for the determination can be changed to an odd number, and then a majority vote can be adopted. Furthermore, a requirement for determining an abnormality in a detection target device can be that all abnormality confirmation results indicate confirmation of an abnormality, regardless of whether the number of notifications of abnormality confirmation results is odd or even, or that at least one or more abnormality confirmation results indicate confirmation of an abnormality.

[0050] Furthermore, it is also possible to limit the number of devices used in the judgment, or to assign priorities to the abnormality confirmation results notified from each device. For example, regardless of whether the number of abnormality confirmation results notified is odd or even, the abnormality confirmation result from the device with the highest priority may be used, and the abnormality confirmation results from the other devices may be discarded. For example, instead of adopting a majority vote among the abnormality confirmation results from all devices, it is also possible to adopt a majority vote among the abnormality confirmation results from several devices with higher priorities.

[0051] 9, the devices 22 to 25 each include a control unit 38 to 41. Similar to the control units 14 to 16 described in the first embodiment, the control units 38 to 41 include monitoring units 38 a to 41 a, abnormality occurrence detection units 38 b to 41 b, and monitoring destination change units 38 c to 41 c, for each function. While the control unit 38 of the device 22 will be described below, the control unit 39 of the device 23, the control unit 40 of the device 24, and the control unit 41 of the device 25 also have equivalent functions.

[0052] Next, the operation of the above-described configuration will be described with reference to Fig. 10 and Fig. 11. Here, a case will be described in which the control unit 38 of the device 22 detects the occurrence of an abnormality in the device 23. As shown in Fig. 9, when the device 24 detects the occurrence of an abnormality in the device 23, the device 23 that is the monitoring target in normal times functions as the second device (corresponding to the second electronic control device), the device 24 that is the monitoring target of the device 23 in normal times functions as the first device (corresponding to the first electronic control device), and the device 25 that is the notification target of the detection of the abnormality occurrence in the device 23 and the confirmation of the abnormality occurrence functions as the third device (corresponding to the third electronic control device).

[0053] In the device 22, the control unit 38 executes a monitoring process at a predetermined interval. When a start condition for the monitoring process is met, the control unit 38 starts the monitoring process and determines whether an abnormality has occurred in the second device (S11). If the control unit 38 determines that an abnormality has not been detected in the second device (S11: NO), it determines whether the first device has not notified it of the detection of an abnormality in the third device (S12). If the control unit 38 determines that the first device has not notified it of the detection of an abnormality in the third device (S12: NO), it determines whether the first device has not notified it of the confirmation of the abnormality in the third device (S13). If the control unit 38 determines that the first device has not notified it of the confirmation of the abnormality in the third device (S13: NO), it determines whether the second device has not notified it of the detection of an abnormality in the first device (S14). When the control unit 38 determines that the detection of an abnormality in the first device has not been notified by the second device (S14: NO), it determines whether the confirmation of the abnormality in the first device has been notified by the second device (S15).When the control unit 38 determines that the confirmation of the abnormality in the first device has not been notified by the second device (S15: NO), it ends the monitoring process and waits for the establishment of the start condition for the next monitoring process.

[0054] When the control unit 38 determines that an abnormality has occurred in the second device (S11: YES), it notifies the first device and the third device of the detection of the abnormality occurrence in the second device (S16) and waits for notifications of the abnormality occurrence confirmation results from the first device and the third device (S17).When the control unit 38 determines that the abnormality occurrence confirmation result has not been notified from at least one of the first device and the third device, or that the abnormality occurrence confirmation result has been notified from both the first device and the third device but the notified abnormality occurrence confirmation result has not confirmed the occurrence of an abnormality in the second device (S17: NO), it ends the monitoring process without confirming the occurrence of an abnormality in the second device and waits for the establishment of a start condition for the next monitoring process.

[0055] On the other hand, when the control unit 38 receives abnormality confirmation results from both the first device and the third device and determines that an abnormality has occurred in the third device based on the notified abnormality confirmation results (S17: YES), it confirms that an abnormality has occurred in the second device, notifies the third device of the confirmation of the abnormality in the second device (S18), enables the monitoring function from the third device to the first device (S19), ends the monitoring process, and waits for the start condition for the next monitoring process to be met.

[0056] Furthermore, when the control unit 38 determines that the first device has notified it of the detection of an abnormality occurring in the third device (S12: YES), it temporarily activates the corresponding abnormality monitoring line, temporarily activates monitoring of the third device, confirms the occurrence of an abnormality in the third device (S20), and notifies the first device of the confirmation result of the occurrence of the abnormality in the third device (S21).When the control unit 38 determines that the first device has notified it of the confirmation of the occurrence of an abnormality in the third device (S13: YES), it transitions to a monitoring state from the first device (S22), ends the monitoring process, and waits for the establishment of the start condition for the next monitoring process.

[0057] Furthermore, when the control unit 38 determines that the second device has notified it of the detection of an abnormality occurring in the first device (S14: YES), it temporarily activates the corresponding abnormality monitoring line, temporarily activates monitoring of the first device, confirms the occurrence of an abnormality in the first device (S23), and notifies the second device of the confirmation result of the occurrence of the abnormality in the first device (S24).When the control unit 38 determines that the second device has notified it of the confirmation of the occurrence of an abnormality in the first device (S15: YES), it transitions to a monitoring state from the second device (S25), ends the monitoring process, and waits for the establishment of the start condition for the next monitoring process.

[0058] As described above, according to the second embodiment, the following advantageous effects can be obtained. When device 22 detects and confirms the occurrence of an abnormality in device 23, the monitoring target of device 25 is changed from device 22 to device 24, and device 25 monitors device 24 instead of device 23. Even in this case, even if two devices are not combined to monitor each other and each of the multiple devices 22 to 25 normally monitors in one direction, when an abnormality is detected in a monitored device, the monitoring target of the specified device can be changed, allowing the abnormality to be dealt with appropriately. This makes it possible to deal with the abnormality appropriately while suppressing an increase in the processing load on the entire system.

[0059] Although the case where device 22 detects and determines an abnormality in device 23 has been described, the same effect can also be obtained when device 23 detects and determines an abnormality in device 24, when device 24 detects and determines an abnormality in device 25, or when device 25 detects and determines an abnormality in device 22, by simply switching the operations of devices 22 to 25.

[0060] (Other embodiments) Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.

[0061] Although the above example illustrates a configuration in which multiple devices included in a vehicle control system monitor each other, the present invention may also be applied to a configuration in which multiple microcomputers or ICs included in a single device monitor each other. It may also be applied to a configuration in which multiple microcomputers or ICs included in separate devices monitor each other. For example, the present invention may be applied to a configuration in which microcomputer A included in device A, microcomputer B included in device B, and microcomputer C included in device C monitor each other.

[0062] The control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium. [Explanation of symbols]

[0063] In the drawing, 1 is a vehicle control system, 2 is a main control device (electronic control device), 3 is a monitoring device (electronic control device), 4 is a sub-control device (electronic control device), 14 to 16 are control devices, 14a to 16a are monitoring devices, 14b to 16b are abnormality detection devices, 14c to 16c are monitoring destination change devices, 21 is a vehicle control system, 22 to 25 are devices (electronic control devices), 38 to 41 are control devices, 38a to 41a are monitoring devices, 38b to 41b are abnormality detection devices, and 38c to 41c are monitoring destination change devices.

Claims

1. An electronic control device connected to a plurality of other electronic control devices, a monitoring unit (14a to 16a, 38a to 41a) that monitors one of the plurality of other electronic control units as a monitoring target; an abnormality occurrence detection unit (14b to 16b, 38b to 41b) that detects an abnormality occurrence in an electronic control device that is a monitoring target; An electronic control device comprising: a monitoring destination change unit (14c to 16c, 38c to 41c) that, when an abnormality is detected in a monitored electronic control device, has the abnormality confirmed by an electronic control device other than the monitored electronic control device, and, when the abnormality in the monitored electronic control device is confirmed based on the confirmation result, changes the monitoring destination of the specified electronic control device.

2. the plurality of other electronic control units include a first electronic control unit and a second electronic control unit that normally monitors the first electronic control unit, The monitoring unit normally monitors the second electronic control unit, An electronic control device as described in claim 1, wherein when an abnormality is detected in the second electronic control device, the monitoring target change unit changes the first electronic control device, which is the normal monitoring target of the second electronic control device that has detected the abnormality, to become the new monitoring target of the electronic control device.

3. 3. The electronic control device according to claim 2, wherein the monitoring destination change unit notifies the first electronic control device of an abnormality detection indicating that an abnormality has occurred in the second electronic control device when an abnormality has occurred in the second electronic control device.

4. When the first electronic control unit is notified of the detection of the abnormality occurrence, the first electronic control unit temporarily changes the monitoring target to the second electronic control unit, determines the operating state of the second electronic control unit, confirms the occurrence of the abnormality in the second electronic control unit, and notifies the electronic control unit of the abnormality occurrence confirmation result; 4. The electronic control device according to claim 3, wherein when the monitoring destination change unit determines that an abnormality has occurred in the second electronic control device based on the abnormality occurrence confirmation result, it notifies the first electronic control device of the abnormality occurrence confirmation indicating that an abnormality has occurred in the second electronic control device.

5. the plurality of other electronic control units include a first electronic control unit, a second electronic control unit that normally monitors the first electronic control unit as a monitoring target, and one or more third electronic control units; The monitoring unit normally monitors the second electronic control unit, An electronic control device as described in claim 1, wherein when an abnormality is detected in the second electronic control device, the monitoring target change unit changes the first electronic control device, which is the monitoring target of the second electronic control device that detected the abnormality, to become the new monitoring target of the third electronic control device.

6. The electronic control device according to claim 5, wherein the monitoring destination change unit notifies the first electronic control device and the third electronic control device of an abnormality detection indicating that an abnormality has occurred in the second electronic control device when an abnormality has occurred in the second electronic control device.

7. the third electronic control unit is configured to change the monitoring target to the second electronic control unit when notified of the confirmation of the occurrence of an abnormality; The electronic control device according to claim 5 or 6, wherein when the monitoring destination change unit determines that an abnormality has occurred in the second electronic control device, it notifies the third electronic control device of the abnormality occurrence confirmation indicating that an abnormality has occurred in the second electronic control device.

8. 8. The electronic control device according to claim 7, wherein the monitoring destination change unit determines that an abnormality has occurred in the second electronic control device by a majority vote of two or more abnormality occurrence confirmation results notified from the first electronic control device and the third electronic control device.

Images