Electronic control system
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Patents
- Current Assignee / Owner
- ASTEMO LTD
- Filing Date
- 2022-12-08
- Publication Date
- 2026-07-23
AI Technical Summary
In in-vehicle ECUs, communication errors occur between the main and sub-microcontrollers due to false detection of the communication start signal during software resets, leading to deadlock states, especially when the ignition switch is turned on before hardware reset completion, or due to noise interference.
The main microcontroller monitors the sub-microcontroller and retries the communication start signal if the sub-microcontroller does not operate normally, ensuring normal operation is maintained by checking for normal functioning and initiating retries before a timeout occurs.
This approach prevents communication abnormalities by establishing communication between the main and sub-microcontrollers, even in the presence of false signal detection, noise interference, or increased processing speed, thereby ensuring reliable data transmission.
Smart Images
Figure 0007894312000001 
Figure 0007894312000002 
Figure 0007894312000003
Abstract
Description
Technical Field
[0001] The present invention relates to an electronic control system that is used, for example, in an in-vehicle control unit (in-vehicle ECU), establishes communication between a main microcomputer and a sub-microcomputer, and transmits and receives data.
Background Art
[0002] Patent Document 1 describes an electronic device system in which a plurality of electronic devices are connected via a data bus in a predetermined communication format to transmit and receive information between the electronic devices.
Prior Art Documents
Patent Documents
[0003]
Patent Document 1
Summary of the Invention
Problems to be Solved by the Invention
[0004] By the way, in an in-vehicle ECU, in the communication between the main microcomputer and the sub-microcomputer (main-sub communication), the start of processing is determined using a communication start signal. The communication start signal is output from the main microcomputer to the sub-microcomputer after the initial processing of the main microcomputer. When the sub-microcomputer receives the communication start signal, it transmits a fail-safe signal (FS signal) to the main microcomputer.
[0005] The communication start signal is a signal that goes from a high level ("H") to a low level ("L") for a predetermined time. On the other hand, the failsafe signal indicates the status of main-sub communication and checks whether the failsafe signal is fixed at a certain level, or is so-called "stuck." To do this, it goes to a "H" level immediately after receiving the communication start signal and goes to a "L" level after a predetermined time has elapsed. The main microcontroller receives this failsafe signal and outputs a synchronization signal. When the sub-microcontroller receives the synchronization signal, the failsafe signal remains at a constant "H" level. This establishes main-sub communication, and data is transmitted and received in synchronization with the synchronization signal.
[0006] Generally, the initial processing of an in-vehicle ECU uses both hardware reset and software reset. When the ignition switch is turned off, a hardware reset is performed. If the ignition switch is turned on while the ignition switch is off and the hardware reset process is running (before the self-shutdown is completed), a software reset is performed.
[0007] During a hardware reset, the communication start signal is always at the "H" level. It is only switched to the "L" level before outputting at the "H" level ("L" → "H" output) when communication is to begin. Therefore, false detection of the communication start signal does not occur.
[0008] In contrast, during a software reset, the change from the ignition switch off to on causes the communication start signal to temporarily become "L" level before the communication start timing, and then the communication start signal becomes "H" level due to port initialization. The sub-microcontroller interprets this change in the level of the communication start signal as the start of communication (output of communication start signal from "L" to "H") before the communication start control is initiated and outputs a fail-safe signal. If the main microcontroller outputs a normal communication start signal in this state, both the main microcontroller and the sub-microcontroller will be in a state of waiting for communication to be established (deadlock state), resulting in a communication error.
[0009] The software reset operation described above is unavoidable due to the system configuration. Furthermore, improvements in the main microcontroller's speed may shorten the initial time, and noise superimposed on the communication start signal may cause false detection of the communication start signal, potentially leading to communication errors.
[0010] This invention has been made in view of the above circumstances, and its objective is to provide an electronic control system that can suppress communication abnormalities between the main microcontroller and the sub-microcontroller even when a communication start signal is falsely detected. [Means for solving the problem]
[0011] According to one aspect of the present invention, an electronic control system is provided for use in an in-vehicle control unit, comprising a main microcontroller and a sub-microcontroller that monitors the main microcontroller and controls a controlled object, wherein the main microcontroller outputs a communication start signal to the sub-microcontroller after initial processing, and the sub-microcontroller outputs a fail-safe signal to the main microcontroller upon receiving the communication start signal, thereby establishing communication between the main microcontroller and the sub-microcontroller to send and receive data, characterized in that the main microcontroller monitors the sub-microcontroller and outputs a communication start signal to retry communication if the sub-microcontroller does not operate normally. [Effects of the Invention]
[0012] According to the present invention, the main microcontroller monitors the sub-microcontroller, and if the sub-microcontroller does not operate normally, it outputs a communication start signal to retry communication. Therefore, even if the communication start signal is falsely detected, communication abnormalities between the main microcontroller and the sub-microcontroller can be suppressed. [Brief explanation of the drawing]
[0013] [Figure 1] This block diagram shows a schematic configuration of an electronic control system according to an embodiment of the present invention. [Figure 2]This is a flowchart illustrating the operation of the electronic control system shown in Figure 1. [Figure 3] This timing chart explains the operation of the electronic control system shown in Figure 1 when a software reset occurs. [Figure 4] This timing chart explains the operation of the electronic control system shown in Figure 1 when the initial processing time is reduced due to increased speed of the main microcontroller. [Figure 5] This timing chart illustrates the operation of the electronic control system shown in Figure 1 when noise is introduced into the communication start signal during a software reset. [Modes for carrying out the invention]
[0014] Embodiments of the present invention will be described below with reference to the drawings. Figure 1 shows a schematic configuration of an electronic control system according to an embodiment of the present invention. This electronic control system is used in an in-vehicle ECU and comprises a main microcontroller (main IC) 11 and a sub-microcontroller (monitoring IC) 12 that monitors the main microcontroller 11 and controls the engine, steering, transmission, etc., which are the controlled objects. After initial processing, the main microcontroller 11 outputs a communication start signal POWER_S to the sub-microcontroller 12. Upon receiving the communication start signal POWER_S, the sub-microcontroller 12 outputs a fail-safe signal ETCENA to the main microcontroller 11, establishing communication between the main microcontroller 11 and the sub-microcontroller 12 to send and receive data TX and RX. The main microcontroller 11 monitors the sub-microcontroller 12 and is configured to output the communication start signal POWER_S if the sub-microcontroller 12 does not operate normally, thereby retrying communication.
[0015] Figure 2 is a flowchart illustrating the operation of the electronic control system shown in Figure 1. First, when the vehicle's ignition switch is turned off (step S1), the main microcontroller 11 performs an initial process (step S2). This initial process is a hardware reset.
[0016] In the next step S3, it is determined whether the initial processing has finished. If it is determined that the initial processing has finished, the main microcontroller 11 outputs a communication start signal POWER_S (step S4). If it is determined that the initial processing has not finished, it is determined whether the ignition switch has been turned on (step S5). If the ignition switch has not been turned on, the process returns to step S2 and the initial processing continues. Steps S2, S3, and S5 are repeated until the initial processing is completed.
[0017] If the ignition switch is turned on before the hardware reset is complete, step S5 determines that the ignition switch is on and a software reset is performed (step S6). Once the software reset in step S6 is complete, the main microcontroller 11 outputs a communication start signal POWER_S (step S4).
[0018] When the sub-microcontroller 12 receives the communication start signal POWER_S (step S7), the sub-microcontroller 12 starts controlling the controlled object (step S8). Also, the sub-microcontroller 12 outputs a fail-safe signal ETCENA to the main microcontroller 11 (step S9). When the main microcontroller 11 receives the fail-safe signal ETCENA, it determines whether the output signal of the sub-microcontroller 12 is normal or not (step S10). If it determines that it is operating normally, the main microcontroller 11 outputs a synchronization signal ASYNC (step S11). When the sub-microcontroller 12 receives the synchronization signal ASYNC, it fixes the fail-safe signal ETCENA to the "H" level, and communication between the main microcontroller 11 and the sub-microcontroller 12 is established (step S12). As a result, data TX and RX are transmitted and received between the main microcontroller 11 and the sub-microcontroller 12.
[0019] On the other hand, if it is determined that there is an abnormality in step S10, it is determined whether or not the communication start signal POWER_S has been repeated a predetermined number of times (step S13). If the predetermined number of times has not been reached, the process returns to step S4, the communication start signal POWER_S is output from the main microcomputer 11, and a retry is performed. In step S13, if it is determined that the communication start signal POWER_S has been repeated a predetermined number of times, it is determined whether the communication timeout time, for example, is within 50 ms (step S14). If it is not a timeout, the process returns to step S4, the communication start signal POWER_S is output from the main microcomputer 11, and a retry is performed. If it is determined that there is a timeout in step S13, since the communication cannot be established, the process ends.
[0020] In the electronic control system configured as described above, when the ignition switch is turned on during the process of performing the hardware reset, a "L" level output is performed before the communication start timing, and the communication start signal POWER_S is output at the "H" level by port initialization or the like. However, in step S10, it is determined whether the sub-microcomputer 12 is operating normally. If it is not operating normally, the process returns to step S4 and the communication start signal POWER_S is output again to perform a communication retry. Therefore, even if the communication start signal POWER_S is erroneously detected, a deadlock state will not occur, and communication between the main microcomputer 11 and the sub-microcomputer 12 can be established, and data TX and RX can be transmitted and received in synchronization with the synchronization signal ASYNC.
[0021] FIG. 3 shows the operation when a software reset occurs in the electronic control system shown in FIG. 1. When the ignition switch of the vehicle is turned on at the timing of time t0, the ignition signal IGNSW changes from the "L" level to the "H" level. Since the sub-microcomputer reset signal / STBY and the main microcomputer reset signal / RESET are at the "H" level, the initial processing of the sub-microcomputer 12 and the main microcomputer 11 is executed. In this state, since the output signal is not determined, the error output signal ERROROUT is at the "H" level.
[0022] When a software reset occurs, the communication start signal POWER_S changes from the "H" level to the "L" level and from the "L" level to the "H" level (time t1). Although this level change of the communication start signal POWER_S does not actually mean the start of communication, the sub-microcomputer 12 outputs the "H" level for checking the sticking of the fail-safe signal ETCENA for a predetermined time (6 ms in this example) in response to this level change (time t1 - t2). When the original communication start signal POWER_S is generated after the output of the "H" level fail-safe signal ETCENA for this sticking check, the sticking check is performed again and communication is established.
[0023] That is, when the initialization process of the main microcomputer 11 ends, the communication start signal POWER_S changes from the "H" level to the "L" level and from the "L" level to the "H" level (time t3 - t4). Thereby, the sub-microcomputer 12 sets the fail-safe signal ETCENA to the "H" level again for sticking check (time t4 - t5). When the main microcomputer 11 receives the "H" level of the fail-safe signal ETCENA, it outputs the synchronization signal ASYNC. When the sub-microcomputer 12 receives the synchronization signal ASYNC, it establishes communication by setting the fail-safe signal ETCENA to the "H" level (after time t6).
[0024] When the communication between the main microcomputer 11 and the sub-microcomputer 12 is established, as shown by the signal SPI, data transmission and reception are performed at a predetermined time interval (for example, 10 ms) synchronized with the synchronization signal ASYNC. This communication is executed while monitoring for timeout. The state of the main microcomputer 11 is initial processing from time t1 to t3, power stage start from time t3 - t4, waiting for the fail-safe signal ETCENA from time t4 - t5, synchronization signal ASYNC transmission from time t5 - t6, and EGAS control after time t6. Meanwhile, the state of the sub-microcontroller 12 is as follows: from time t0 to t4, it is waiting for the power stage to start; between time t4 and t5, it is controlling the fail-safe signal ETCENA; between time t5 and t6, it is waiting for the synchronization signal ASYNC; and from time t6 onwards, it is controlling EGAS.
[0025] Figure 4 is a timing chart showing the operation of the electronic control system shown in Figure 1 when the initial processing time is shortened due to the increased speed of the main microcontroller 11. Due to the shortened initial processing time caused by the increased speed of the microcontroller, if the original communication start signal POWER_S is output during the fixation check of the failsafe signal ETCENA due to a false detection of the communication start signal POWER_S, communication will fail to be established. However, as shown in Figure 4, retry control can be performed to suppress communication establishment failures due to false detection.
[0026] The process is basically the same as in Figure 3, but after control is initiated by the "L" level of the communication start signal POWER_S (between times t2 and t3), if the fail-safe signal ETCENA remains at the "L" level without any change after a certain period of time, the system determines that the power stage is deadlocked and initiates a retry (between times t4 and t5). As a result, the fail-safe signal ETCENA becomes "H" level between times t5 and t6, and the main microcontroller 11 receives this "H" level of the fail-safe signal ETCENA and outputs the synchronization signal ASYNC. When the sub-microcontroller 12 receives this synchronization signal ASYNC, it fixes the fail-safe signal ETCENA to "H" level (from time t7 onwards). This establishes main-sub communication, and data TX and RX are transmitted and received between the main microcontroller 11 and the sub-microcontroller 12. However, retries must be initiated before the communication timeout occurs in sub-microcontroller 12.
[0027] At this time, the state of the main microcontroller 11 is as follows: initial processing between time t1 and t2, power stage start between time t2 and t3, waiting for fail-safe signal ETCENA between time t3 and t4, power stage retry between time t4 and t5, waiting for fail-safe signal ETCENA between time t5 and t6, synchronization signal ASYNC output between time t6 and t7, and EGAS control from time t7 onwards. Meanwhile, the state of the sub-microcontroller 12 is as follows: from time t0 to t1, it is waiting for the power stage to start; from time t1 to t2, it is controlling the fail-safe signal ETCENA; from time t2 to t5, it is waiting for the synchronization signal ASYNC; from time t5 to t6, it is controlling the fail-safe signal ETCENA; from time t6 to t7, it is waiting for the synchronization signal ASYNC; and from time t7 onwards, it is controlling EGAS.
[0028] Figure 5 shows the operation of the electronic control system shown in Figure 1 when noise is superimposed on the communication start signal POWER_S during a software reset. When the vehicle's ignition switch is turned on at time t0, the ignition signal IGNSW changes from "L" level to "H" level. At the next time t1, the sub-microcontroller reset signal / STBY becomes "H" level, and at time t2, the main microcontroller reset signal / RESET becomes "H" level, at which point the initial processing of the sub-microcontroller 12 and the main microcontroller 11 are executed, respectively.
[0029] If noise is introduced into the communication start signal POWER_S between times t2 and t3, the fail-safe signal ETCENA will be output (at a predetermined "H" level) even though communication has not started. When the original communication start signal POWER_S is output (at a predetermined "L" level) between times t4 and t5, the sub-microcontroller 12 will not output the fail-safe signal ETCENA because the fail-safe signal ETCENA has already been output, and this signal ETCENA will remain fixed at a "L" level. After a predetermined time has elapsed, a retry is performed, and the communication start signal POWER_S becomes "L" for a predetermined time (between times t6 and t7). Upon receiving this communication start signal POWER_S, the fail-safe signal ETCENA output from the sub-microcontroller 12 becomes "H" for a predetermined time (between times t7 and t8). The main microcontroller 11 receives the failsafe signal ETCENA at an "H" level and outputs the synchronization signal ASYNC. The sub-microcontroller 12, upon receiving the synchronization signal ASYNC, fixes the failsafe signal ETCENA at an "H" level (after time t9) and establishes communication with the main microcontroller 11.
[0030] Once communication is established between the main microcontroller 11 and the sub-microcontroller 12, data is sent and received at predetermined time intervals, synchronized with the synchronization signal ASYNC, as shown by the signal SPI. This communication is performed while monitoring for timeouts. The state of the main microcontroller 11 is as follows: initial processing from time t2 to t4, power stage start between time t4 and t5, waiting for fail-safe signal ETCENA between time t5 and t6, power stage retry between time t6 and t7, waiting for fail-safe signal ETCENA between time t7 and t8, synchronization signal ASYNC transmission between time t8 and t9, and EGAS control from time t9 onwards. Meanwhile, the state of the sub-microcontroller 12 is as follows: initialization starts at time t1, from the end of initialization until time t3 it waits for the power stage to start, between times t3 and t4 it is controlled by the fail-safe signal ETCENA, between times t4 and t7 it waits for the synchronization signal ASYNC, between times t7 and t8 it is controlled by the fail-safe signal ETCENA, between times t8 and t9 it waits for the synchronization signal ASYNC, and from time t9 onwards it is controlled by EGAS.
[0031] As described above, in the electronic control system of the present invention, in an in-vehicle ECU equipped with a main microcontroller and a sub-microcontroller, the main microcontroller monitors the output signal from the sub-microcontroller to determine whether the sub-microcontroller is functioning normally or abnormally, and if abnormal, retries the communication start signal. Furthermore, retries of the communication start signal are performed multiple times until the sub-microcontroller's timeout period expires. This allows the main microcontroller and sub-microcontroller to establish communication if they fail to establish communication at startup. By outputting a communication start signal and performing a retry process, a deadlock state can be avoided, and communication between the main microcontroller and sub-microcontroller can be established.
[0032] Furthermore, if the sub-microcontroller fails to operate correctly, it will perform a communication retry process. This ensures that communication between the main microcontroller and the sub-microcontroller can be established even if the initial time is faster due to an improvement in the speed of the main microcontroller, or if noise is superimposed on the communication start signal. Therefore, even if the communication start signal is falsely detected, an electronic control system can be obtained that can suppress communication abnormalities between the main microcontroller and the sub-microcontroller.
[0033] The configurations and methods described in the embodiments described above are merely schematic representations to the extent that the present invention can be understood and implemented. Therefore, the present invention is not limited to the embodiments described, and can be modified in various forms as long as it does not deviate from the scope of the technical idea set forth in the claims.
[0034] For example, you could always retry the communication start signal. Alternatively, the main microcontroller could send two consecutive communication start signals, treating the first transmitted signal as a dummy and retrying with the second signal.
[0035] Furthermore, during the initial processing, it is possible to determine whether the main microcontroller and sub-microcontroller have been reset. If only the main microcontroller is initialized, it is determined to be a software reset, and a communication start signal is output to retry communication. Furthermore, to reduce the load on the microcontroller, it would be good to allow users to set the number of retries. [Explanation of symbols]
[0036] 11...Main microcontroller, 12...Sub microcontroller, POWER_S...Communication start signal, ETCENA...Failsafe signal
Claims
1. An electronic control system used in an in-vehicle control unit, comprising a main microcontroller and a sub-microcontroller that monitors the main microcontroller and controls the controlled object, wherein the main microcontroller outputs a communication start signal to the sub-microcontroller after initial processing, and the sub-microcontroller outputs a fail-safe signal to the main microcontroller upon receiving the communication start signal, thereby establishing communication between the main microcontroller and the sub-microcontroller to send and receive data, An electronic control system characterized in that the main microcontroller monitors the sub-microcontroller, and if the sub-microcontroller does not operate normally, outputs a communication start signal to retry communication.
2. The electronic control system according to claim 1, characterized in that the sub-microcontroller performs multiple communication retries within a predetermined timeout period until communication is established after receiving the communication start signal.
3. The electronic control system according to claim 1, characterized in that the main microcontroller transmits two consecutive communication start signals, the first transmitted communication start signal is treated as a dummy signal, and a retry is performed with the second communication start signal.
4. The electronic control system according to claim 1, characterized in that, in the initial processing, it is determined whether the main microcontroller and the sub-microcontroller have been reset, and if only the main microcontroller has been reset, it is determined that it is a software reset, and a communication start signal is output to retry communication.