Vehicle control system, vehicle control device, and method for detecting deterioration of communication line

Abstract

The purpose of the the present invention is to provide a vehicle control system, a vehicle control device, and a communication line deterioration detection method with which it is possible to detect the deterioration state of a communication line with high accuracy. For this purpose, a vehicle control system 700 comprises a plurality of vehicle control devices 702-707 connected via a communication line 701. Each of the plurality of vehicle control devices 702-707 samples a bus level 301 of a communication line 701 at a sample point 204 generated in an one-bit time period when communicating with another vehicle control device. One or more predetermined vehicle control devices included in the plurality of vehicle control devices 702-707 determine whether or not a variation 205 from an one-bit time period of the sample point 204 is equal to or greater than a predetermined threshold, and determines whether or not the communication line 701 is deteriorated on the basis of the frequency at which the variation amount 205 is determined to be equal to or greater than the threshold.

Description

Vehicle control system, vehicle control device, and communication line deterioration detection method

[0001] The present invention relates to a vehicle control system, a vehicle control device, and a method for detecting deterioration of a communication line.

[0002] The Control Area Network (CAN) communication method is one of the network protocols widely used in in-vehicle networks. This communication method is also widely used in industrial equipment, agricultural machinery, medical equipment, railways, elevators, and the like. If CAN communication stops for some reason, it may affect safety in applications such as the above-mentioned in-vehicle equipment. Therefore, a method for detecting signs of communication malfunctions has been proposed to prevent unintended CAN communication stoppages (Patent Document 1).

[0003] Patent document 1 discloses a communication device that transmits and receives data with other communication devices via a communication line based on a CAN communication protocol, and that includes a control unit that controls the transmission and reception of data, a delay time calculation unit that receives as input transmission data output from the control unit and reception data output from the other communication device in response to the transmission data, and calculates the delay time of the communication path from the transmission data and an ACK signal included in the reception data, and a delay determination unit that compares the delay time with a threshold value and outputs delay determination information.

[0004] Japanese Patent Application Laid-Open No. 2022-102238

[0005] The multiple vehicle control units (ECUs) installed in a vehicle are connected and communicate via communication lines. Therefore, there is a risk of communication line disconnection when communicating between ECUs, and there have been cases where communication line disconnections have actually occurred (example: a certain company recalled a product due to cable damage, which may have caused it to no longer function properly). Although detection of communication line disconnections has been implemented to address the risk of disconnections, it is desirable to be able to detect abnormalities in the communication line before they are disconnected in order to prevent disconnections in advance.

[0006] Furthermore, conventional CAN communication is slow, and the delay time caused by deterioration of the communication line is extremely short compared to the time required for one bit of data to be transmitted and received, making it difficult to detect deterioration of the communication line. However, with the recent increase in speed of CAN communication, such as CAN-FD, deterioration detection has become increasingly important. Furthermore, when considering installing an ECU on a motorcycle, the communication line is more susceptible to the effects of external environmental factors such as outside temperature and humidity than in an automobile, and the risk of the communication line being disconnected increases. If deterioration could be detected in advance, safety could be further improved.

[0007] On the other hand, the communication device described in Patent Document 1 is configured to calculate the delay time of the communication line based on the ACK signal included in the transmitted data and the received data, and therefore cannot detect the delay until one data transmission / reception is completed, making it difficult to detect the deterioration state of the communication line with high accuracy.

[0008] The present invention has been made in consideration of the above-mentioned problems, and its purpose is to provide a vehicle control system, a vehicle control device, and a communication line degradation detection method that are capable of detecting the degradation state of a communication line with high accuracy.

[0009] In order to achieve the above-mentioned object, the present invention provides a vehicle control system comprising a plurality of vehicle control devices connected via a communication line, each of which samples the bus level of the communication line at a sample point that occurs in a one-bit time period when communicating with another vehicle control device. One or more predetermined vehicle control devices included in the plurality of vehicle control devices determine whether the amount of variation from one bit time period of the sample point is greater than or equal to a predetermined threshold, and determine whether the communication line is degraded based on the frequency at which the amount of variation is determined to be greater than or equal to the threshold.

[0010] In addition, the present invention relates to a vehicle control device that is connected to another vehicle control device via a communication line and, when communicating with the other vehicle control device, samples the bus level of the communication line at a sample point that occurs in a one-bit time period.The vehicle control device determines whether the amount of variation from one bit time period of the sample point is greater than or equal to a predetermined threshold, and determines whether the communication line is degraded based on the frequency at which it is determined that the amount of variation is greater than or equal to the threshold.

[0011] The present invention also provides a method for detecting deterioration of a communication line in a vehicle control system that includes a plurality of vehicle control devices connected via a communication line, each of which samples the bus level of the communication line at a sample point that occurs in a one-bit time period when communicating with another vehicle control device.The method determines whether the amount of variation from one bit time period of the sample point is greater than or equal to a predetermined threshold, and determines whether the communication line has deteriorated based on the frequency at which the amount of variation is determined to be greater than or equal to the threshold.

[0012] According to the present invention, it is possible to detect the deterioration state of a communication line with high accuracy by determining whether the communication line is deteriorated or not based on the frequency at which it is determined that the amount of variation from one bit time period of a sample point is equal to or greater than a predetermined threshold.

[0013] 1 is a diagram showing the configuration of a vehicle control system; 1 is a diagram showing divisions of bit time; 2 is a diagram showing the state of CAN communication when no abnormal delay occurs; 3 is a diagram showing the state of CAN communication when an abnormal delay occurs continuously; 4 is a diagram showing the state of CAN communication when an abnormal delay occurs temporarily; 5 is a diagram showing the amount of variation in sample points when a regular data string is received via a communication line in a deteriorated state; 6 is a diagram showing the amount of variation in sample points when a random data string is received via a communication line in a deteriorated state; 7 is a diagram showing the state of delay occurring in low-speed communication; 8 is a diagram showing the state of delay occurring in high-speed communication; 9 is a diagram showing an example of the configuration of a vehicle control system relating to communication line deterioration detection; 10 is a diagram showing another example of the configuration of a vehicle control system relating to communication line deterioration detection;

[0014] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In each drawing, the same reference numerals are used to designate the same components, and redundant description will be omitted.

[0015] FIG. 1 is a configuration diagram of a vehicle control system. In FIG. 1, the vehicle control system 100 includes sensor units 103-107, vehicle control devices 108-111, a first communication unit 112, and a second communication unit 113. The sensor units 103-107 are connected to one of the vehicle control devices 108-110 via the first communication unit 112 or the second communication unit 113, and transmit data to the connected vehicle control device. The vehicle control devices 108-111 are connected to other vehicle control devices via the first communication unit 112 or the second communication unit 113, and transmit and receive data to the other vehicle control devices. The vehicle control device 108 and the sensor units 103 and 104 constitute a first group 101, and the vehicle control devices 109-111 and the sensor units 105-107 constitute a second group 102. Note that although two groups are shown in FIG. 1, the number of groups is not limited.

[0016] The groups 101 and 102 are, for example, groups that are supplied with power from independent power supply systems. When one of the groups 101 and 102 becomes inoperable, the other group complements the operation that the other group was performing.

[0017] The sensor units 103 and 105 are, for example, cameras for forward detection, rearward detection, side detection, vehicle periphery detection, driver monitoring, etc. Note that they may be cameras for either long-distance or near-distance detection. The sensor units 103 and 105 belong to different groups, but the sensor units 103 and 105 may be the same camera. Furthermore, multiple cameras may belong to one group.

[0018] The sensor unit 104 is, for example, a LiDAR sensor for forward detection, rearward detection, side detection, or vehicle periphery detection. In Fig. 1, the LiDAR sensor 104 belongs to the first group 101, but information from the LiDAR sensor 104 may be input to a vehicle control device of another group. Furthermore, multiple LiDAR sensors may belong to one group.

[0019] The sensor unit 106 is, for example, a radar sensor for detecting forward, backward, side, or surroundings of the vehicle. It may be either a long-distance or near-distance detection sensor. In FIG. 1 , the radar sensor 106 belongs to the second group 102, but information from the radar sensor 106 may be input to a vehicle control device of another group. Furthermore, multiple radar sensors may belong to one group.

[0020] The sensor unit 107 is a sensor other than a camera, LiDAR, or radar, such as an ultrasonic sensor, a microphone, or a GNSS antenna. In addition, although the sensor unit 107 belongs to the second group 102 in FIG. 1 , information from the sensor unit 107 may be input to a vehicle control device in another group.

[0021] The vehicle control devices 108 to 111 are devices that perform predetermined operations based on information received from the sensor units and other vehicle control devices, and are composed of a plurality of microcomputers, memories, and the like.

[0022] The first communication unit 112 indicates a CAN connection and performs communication in accordance with the CAN and CAN-FD communication protocols. Note that the communication protocols referred to here also include next-generation CAN communication protocols based on the CAN and CAN-FD protocols.

[0023] The second communication unit 113 is a communication unit that performs communication other than CAN communication, such as Ethernet, LIN, or LVDS.

[0024] FIG. 2 shows the divisions of the time (1 bit time) allocated to each bit of a data string transmitted and received by the vehicle control devices 108-111 via CAN communication. Starting from the beginning, 1 bit time is divided into a synchronization segment 201 (denoted as "SS" in the figure), a first time segment 202 (denoted as "TSEG1" in the figure), and a second time segment 203 (denoted as "TSEG2" in the figure). The boundary between the first time segment 202 and the second time segment 203 is a sample point 204. These segments 201-203 are set in units called time quantum (TQ). The time quantum is set in each vehicle control device by the baud rate prescaler (BRP) for the oscillator / internal clock. In other words, 1 bit time is a multiple of the time quantum.

[0025] The synchronization segment 201 is a segment used to synchronize with the signal level (bus level) of the communication line (bus), and all nodes (vehicle control devices) connected to the communication line transmit and receive data based on the timing of the synchronization segment 201. Therefore, it is desirable for the synchronization segment 201 to be located at the edge of the bus level (to be in a synchronized state). If the synchronization segment 201 is not located at the edge of the bus level, it is not synchronized with the bus level (it is in an asynchronous state), and in that case, the position of the synchronization segment 201 is aligned with the edge of the bus level by synchronization processing performed in accordance with the CAN protocol.

[0026] The first time segment 202 is a segment for compensating for physical delays on the CAN network and phase errors that occur during resynchronization. The physical delay here refers to, for example, delay times due to an output buffer, a CAN bus, and an input buffer. The phase error here refers to a deviation between nodes that occurs during signal transmission and reception due to, for example, a deviation in oscillator frequency or a delay in a transmission path. The first time segment 202 may also be further subdivided into a propagation time segment and a first phase buffer segment. In this case, the role of each segment is such that the propagation time segment compensates for physical time, and the first phase buffer segment compensates for phase errors.

[0027] The second time segment 203 is a segment for compensating for a phase error that occurs during resynchronization. The phase error here refers to a deviation between nodes that occurs during signal transmission and reception due to, for example, a deviation in oscillator frequency or a delay in a transmission path. The second time segment 203 may also be a second phase buffer segment.

[0028] The sample point 204 is located at the boundary between the first time segment 202 and the second time segment 203, and the bus level (dominant or recessive) is determined at the timing where the sample point 204 is located. The size (width) of the first time segment 202 and the second time segment 203 varies when compensating for delay and phase error. The position of the sample point 204 also varies in accordance with this variation. Note that the sample point 204 is synonymous with a sampling point.

[0029] Information about each segment 201-203 and sample point 204 is stored in the memory of each vehicle control device. The segment information here refers to, for example, the size of each segment 201-203 (how many TQ), the position of sample point 204, etc. The segment information can be set by the designer, and the values ​​set by the designer are stored as initial values.

[0030] 3 shows the state of CAN communication when no abnormal delay occurs. The bus level 301 of the communication line is either dominant (logical value 0) or recessive (logical value 1). The bus level 301 is divided into 1-bit units, and the period shown as 1 bit time 304 is the size of 1 bit (1-bit width).

[0031] 2, one bit time of the receiving node 302 is made up of a synchronization segment 201, a first time segment 202, and a second time segment 203. The bus level (dominant or recessive) is determined at the timing of a sample point 204 located at the boundary between the first time segment 202 and the second time segment 203.

[0032] The delay 303 is the delay until a signal transmitted from another node (transmitting node) connected to the receiving node 302 is received by the receiving node 302. The delay 303 is a steady delay caused by, for example, an output buffer of the transmitting node, a CAN bus, and an input buffer of the receiving node 302.

[0033] Timing 305 is the timing at which synchronization processing between the bus level 301 and the receiving node 302 is performed, and corresponds to the timing of the falling edge of the bus level (the timing of transition from recessive to dominant). If the bus level 301 and the receiving node 302 are not synchronized at timing 305 (if the synchronization segment 201 of the receiving node 302 is not located at the edge of the bus level), the receiving node 302 adjusts the positions of the segments 201 to 203 (synchronization processing) so that the bus level 301 and the receiving node 302 are synchronized. Note that in FIG. 3, since the bus level 301 and the receiving node 302 are synchronized, synchronization processing is not performed at timing 305 of the falling edge of the bus level 301.

[0034] FIG. 4 illustrates CAN communication when an abnormal delay continues. Assume that an abnormal delay 402 occurs at a rising edge 401. Specifically, the delay 402 is a transmission delay caused by deterioration of the communication line (an increase in the resistance of the communication line). Delays caused by deterioration of the communication line tend to persist once they occur. The delay 402 causes a synchronization error (a state in which the synchronization segment 201 is not positioned at the edge of the bus level 301) in the receiving node 302. Therefore, synchronization processing is performed at a falling edge 403 after the delay occurs. In the synchronization processing, an additional width 404 is added between the first time segment 202 and the second time segment 203 to compensate for the synchronization error, thereby adjusting the position of the synchronization segment 201. The additional width 404 is also referred to as a synchronization jump width (SJW). The value of the additional width 404 can be set by the designer along with information about other segments. By compensating for the synchronization error with the additional width 404, the timing of the subsequent edges of the bus level 301 can be aligned with the synchronization segment 201, and synchronization can be achieved between the bus level 301 and the receiving node 302. Here, adding the additional width 404 moves the sample point 204 from position 405 to position 406, causing a fluctuation 407 in the sample point 204.

[0035] FIG. 5 illustrates CAN communication when an abnormal delay temporarily occurs. Assume that an abnormal delay 501 occurs at timing 401 of the rising edge. Specifically, the delay 501 is a transmission delay caused by temperature fluctuations in the communication line, irregular noise, or the like. Such a delay occurs, for example, due to a rise in the temperature of the communication line caused by a temporary overload on the communication line. Therefore, after a certain period of time has passed and the overload is eliminated, the temperature of the communication line drops, and the delay is eliminated. In FIG. 5 , such a temporary delay is assumed, and the delay ends at timing 502, a certain period of time after the delay occurred.

[0036] When the delay is eliminated at timing 502, a synchronization error occurs between the bus level 301 and the receiving node 302. Therefore, synchronization processing is performed again at timing 503 of the falling edge after timing 502 when the delay is eliminated. In the synchronization processing, the size (width) of the first time segment 202 and the second time segment 203 is adjusted to compensate for the synchronization error and adjust the position of the synchronization segment 201. By compensating for the synchronization error by adjusting the first time segment 202 and the second time segment 203, the timing of the edge of each bit on the subsequent bus level 301 can be aligned with the synchronization segment 201, and synchronization between the bus level 301 and the receiving node 302 can be achieved. Here, by changing the size of the first time segment 202 and the second time segment 203, the sample point 204 moves from position 504 to position 505, resulting in a fluctuation 506 in the sample point 204.

[0037] FIG. 6 shows the amount of fluctuation in the sample point 204 when a regular data sequence is received via a degraded communication line. The regular data sequence here refers to a data sequence in which dominants and recessives alternate in 1-bit increments. In this special data sequence, the frequency components of the bus level do not change, so the delay in the communication line is constant. After the sample point 204 fluctuates at the timing when the delay is first detected, the sample point 204 does not fluctuate. Therefore, while receiving this regular data sequence, the sample point 204 does not fluctuate continuously, making it impossible to detect degradation in the communication line. However, in an actual data sequence, dominants and recessives appear randomly, so degradation in the communication line can still be detected. This point will be explained using FIG. 7.

[0038] FIG. 7 shows the amount of fluctuation in sample point 204 when a regular data stream is received via a degraded communication line. When a random data stream is received via a degraded communication line, the frequency components of the bus level change, causing variations in the delay of the communication line. Specifically, the amount of delay varies depending on the number of consecutive occurrences of the same value (dominant or recessive). As a result, the amount of additional width added between the first time segment 202 and the second time segment 203 also varies, causing continuous fluctuations in sample point 204. Capturing this continuous fluctuation in sample point 204 makes it possible to detect degradation of the communication line.

[0039] Fig. 8 is a diagram showing how delays occur in low-speed communication, and Fig. 9 is a diagram showing how delays occur in high-speed communication. The difference between the effect of delays in low-speed communication on sample point 204 and the effect of delays in high-speed communication on sample point 204 will be explained with reference to Figs. 8 and 9. As shown in Fig. 8, if the communication speed of low-speed communication is 1 Mbps, one bit time is 1 μs. As shown in Fig. 9, if the communication speed of high-speed communication is 5 Mbps, one bit time is 0.2 μs.

[0040] 8 and 9, delay 801 indicates a steady delay, and delay 802 indicates a delay caused by deterioration of the communication line. As an example, the delay time of steady delay 801 is set to 100 ns, and the delay time of delay 802 caused by deterioration of the communication line is set to 50 ns.

[0041] Even with the same delay time, the degree of influence per bit time differs between low-speed and high-speed communication, with high-speed communication having a greater influence on sample point 204 than low-speed communication. In low-speed communication, even a delay of 50 ns does not cause a large fluctuation in sample point 204, but in high-speed communication, even with the same 50 ns delay, sample point 204 will fluctuate significantly. This is because one bit time in high-speed communication is shorter than one bit time in low-speed communication.

[0042] In this way, in low-speed communication, the amount of fluctuation in sample point 204 is small, making it difficult to detect delay, whereas in high-speed communication, the amount of fluctuation 205 in sample point 204 per bit time is large, making it possible to detect delay from the fluctuation in sample point 204.

[0043] Fig. 10 is a diagram showing an example of the configuration of a vehicle control system related to communication line deterioration detection. In Fig. 6, a vehicle control system 600 includes a communication line 601 for performing CAN communication, and vehicle control devices 602 and 603. The vehicle control devices 602 and 603 are connected via the communication line 601 and can transmit and receive CAN signals to and from each other.

[0044] The communication line 601 is a communication line that communicates in accordance with the CAN protocol and transfers data to each node. The data here refers to, for example, output information from sensors, information transmitted from other vehicle control devices, and other information inside and outside the vehicle.

[0045] The vehicle control device 602 is a control device capable of CAN communication, and is composed of a control unit such as a microcomputer and a storage unit such as a register. There are multiple vehicle control devices 602, and they are connected to other nodes via communication lines 601. Although the figure shows two vehicle control devices, there may be more than two. The connection method is a multi-master method, which allows equal bus access to each node.

[0046] The vehicle control device 602 transmits and receives signals via the communication line 601. Upon receiving a signal, the vehicle control device 602 performs sampling processing for each bit and determines the bus level of the received signal.

[0047] Fig. 11 is a diagram showing another example of the configuration of a vehicle control system related to communication line degradation detection. In Fig. 11, a vehicle control system 700 includes a communication line 701 for CAN communication, vehicle control devices 702 to 705, and host vehicle control devices 706 and 707. The vehicle control devices 702 to 705 and the host vehicle control devices 706 and 707 are connected via the communication line 701, and are capable of transmitting and receiving CAN signals to and from each other.

[0048] The communication line 701 is similar to the communication line 601 shown in FIG. 10, and the vehicle control devices 702 to 705 are similar to the vehicle control devices 602 and 603 shown in FIG. 10, so a description thereof will be omitted.

[0049] The higher-level vehicle control devices 706, 707 are vehicle control devices that manage the vehicle control devices 702-705 (lower-level vehicle control devices) that belong to the same group (first group 710 or second group 720), and have the same basic configuration as the vehicle control devices 702-705. The groups 710, 720 are, for example, groups that are each supplied with power from an independent power supply system. The higher-level vehicle control devices 706, 707 manage each of the vehicle control devices 702-705 by, for example, grasping diagnostic information about the vehicle control devices 702-705, determining and implementing processing based on the diagnostic results, and integrating the processing results of the vehicle control devices 702-705 (combining the output data of each vehicle control device), etc.

[0050] The higher-level vehicle control devices 706 and 707 may be higher-level vehicle control devices that manage other vehicle control devices in a vehicle control system that does not have groups. Furthermore, the vehicle control devices managed by the higher-level vehicle control devices 706 and 707 may belong to different groups. Furthermore, multiple higher-level vehicle control devices 706 and 707 may exist within the same group.

[0051] FIG. 12 is a flowchart showing the operation of the vehicle control system 700 shown in FIG. 11 from the detection of deterioration to the operation after the detection.

[0052] In step S101, each vehicle control device detects a communication delay. The method for detecting a communication delay will be described in detail later with reference to FIG.

[0053] Step S102 is a step in which the vehicle control device that detected a delay in step S101 notifies the upper vehicle control device of the delay information. The delay information here refers to information determined to be a communication delay based on the comparison result of sample points 204 performed in step S101. The upper vehicle control device here refers to a higher-level vehicle control device that belongs to the same group as the vehicle control device that detected the delay information. The higher-level vehicle control device may be a higher-level vehicle control device that manages the vehicle control device that detected the delay in a vehicle control system that is in a different group or does not have groups. Even if a delay is detected on a communication line used to notify the upper vehicle control device, if communication is possible (unless communication is impossible due to a line break or the like), notification is made using the communication line as usual. If communication is difficult, notification is made, for example, via a different communication line or to another upper-level vehicle control device. If the vehicle control device that detected a delay in step S101 is a higher-level vehicle control device, step S102 is omitted and the process proceeds to step S103.

[0054] In step S103, the upper vehicle control device detects the deterioration state of the communication line based on the delay information notified from the vehicle control device in step S102. The method for detecting the deterioration state of the communication line will be described in detail later with reference to FIG.

[0055] In step S104, the upper vehicle control device that detected the degradation state of the communication line in step S103 notifies another upper vehicle control device of the degradation information. The other upper vehicle control devices referred to here are upper vehicle control devices that belong to a different group from the upper vehicle control device that detected the degradation state of the communication line. In a system in which a different group or no groups exist, this includes upper vehicle control devices that do not have the vehicle control device that performed the delayed detection under their control. Even if degradation is detected in the communication line used to notify another upper vehicle control device, if communication is possible (unless communication is impossible due to a line break or the like), notification is made using the communication line as usual. If communication is difficult, notification is made, for example, using a different communication line, or to another upper vehicle control device with which communication is possible, etc.

[0056] In step S105, the other higher-level vehicle control device performs control processing based on the degradation information notified from the higher-level vehicle control device in step S104. The control processing here includes, for example, degeneration operation, notification to the user, notification to the server, etc.

[0057] The degenerate operation is, for example, an operation in a state in which functions and performance are limited, which is performed in a group different from the group to which the communication line in which degradation is detected belongs. The degenerate operation enables operation that avoids the use of the communication line in a degraded state, thereby avoiding the risk of communication line disconnection and delays and improving safety. Note that if it is difficult to maintain the current state with the degenerate operation due to the use or degree of degradation of the communication line in which degradation is detected, a process of stopping operation or a process of transitioning to a state in which operation can be stopped may be performed.

[0058] The use of the communication line here refers to, for example, the importance of information in system operation, risk, etc. When a communication line that is the core of the system becomes degraded, if it is difficult to continue degraded operation by avoiding the use of that communication line, the system may be shut down or may transition to a state where it can be shut down.

[0059] The notification to the user may be, for example, a display on a display screen, a voice notification, etc. The notification information may be, for example, a maintenance reminder or other guidance to quickly resolve the deterioration state. The notification process to the user may be performed by a higher-level vehicle control device that detects the deterioration state.

[0060] The notification to the server may be, for example, a notification to a system administrator. By having the administrator understand the deterioration state, it is possible to urge the user to perform maintenance, and the deterioration state can be resolved early. Note that the server notification process may be performed by the upper-level vehicle control device that detected the deterioration state.

[0061] The control process by the other higher-level vehicle control device continues until the degradation of the communication line is resolved. Even if the delay state is resolved during or after the control process, once the degradation state is determined, the predetermined operation continues without changing the control operation. Note that when the delay state is resolved, a process different from the control process may be performed, such as performing the process before the delay was detected (before the control process) or performing the degradation detection process again.

[0062] 13 is a flowchart showing an example of a method for detecting deterioration of a communication line. Steps S201 to S207 in FIG. 13 are detailed versions of steps S101 to S103 in FIG.

[0063] Step S101 is a step in which each vehicle control device is started up and starts CAN communication.

[0064] Step S202 is a step in which each vehicle control device performs CAN communication.

[0065] Step S203 is a step in which the vehicle control device that received the CAN communication signal in step S202 determines whether or not synchronization processing has been performed. Synchronization processing is performed at the timing of the falling edge of the bus level when synchronization between the bus level and the receiving node is not achieved. In other words, performing synchronization processing means that a delay has occurred in the received signal. If synchronization processing is to be performed (if a delay has occurred), the process proceeds to step S204; if synchronization processing is not performed, the process returns to step S202 and CAN communication continues.

[0066] Step S204 is a step for acquiring the amount of variation in the sample points resulting from the synchronization process performed in step S202.

[0067] Step S205 is a step for determining whether the variation amount of the sample points acquired in step S204 is equal to or greater than a threshold. The variation amount of the sample points corresponds to the magnitude of the delay. If the variation amount of the sample points is equal to or greater than the threshold, that is, if the magnitude of the delay is equal to or greater than the threshold, the process proceeds to step S206. If the variation amount of the sample points is smaller than the threshold, the process returns to step S202 and CAN communication continues.

[0068] The threshold is set, for example, to a predetermined percentage of the maximum value of the additional width (SJW). The predetermined percentage here is set based on the importance of the information being transmitted and received (such as the risk defined in functional safety). For example, if the risk of data handled by communication line A is equivalent to ASIL D, the threshold percentage is set to be small, and if the risk of data handled by communication line B is equivalent to ASIL QM, the threshold percentage is set to be large.

[0069] The threshold may also be set as a percentage of one bit time. For example, if the sample point is set at a position that is 75% of one bit time, the threshold is set to 15% of one bit time.

[0070] Step S206 determines whether the time during which the variation in the sample point is greater than or equal to the threshold is equal to or greater than a predetermined time. This determines whether the delay is continuous, i.e., whether the delay is due to degradation of the communication line. When the communication line is in a degraded state, continuous delays occur, and the sample point also fluctuates continuously. On the other hand, in the case of temporary delays, the sample point fluctuations are also temporary. Therefore, whether the sample point fluctuations are continuous (whether the communication line is in a degraded state) is determined by whether the time during which the variation in the sample point is greater than or equal to the threshold is equal to or greater than a predetermined time. This allows temporary delays to be excluded from degradation detection. If the time during which the variation in the sample point is greater than or equal to the threshold is equal to or greater than the predetermined time, the process proceeds to step S207. If the time is less than the predetermined time, the process returns to step S202 and CAN communication continues. The predetermined time may be set to any value, or, for example, it may be set based on a CAN non-reception determination time set in the vehicle control device that performs degradation detection.

[0071] In step S206, the number of times the threshold value is determined to be equal to or greater than the threshold value within a predetermined time may be used to determine whether the delay is continuous. That is, the determination of whether the amount of variation in the sample points is equal to or greater than the threshold value (step S205) is repeatedly performed, and the number of times the threshold value is determined to be exceeded is counted. If the counted number exceeds the number of times that the delay is considered to be continuous, the communication line is determined to be deteriorated. The counting method may be either the number of times the threshold value is continuously exceeded or the total number of times the threshold value is exceeded.

[0072] In step S207, it is determined that the communication line is deteriorated based on the determinations in steps S205 and S206. After determining the deterioration state, the deterioration information is notified to other vehicle control devices and a higher-level vehicle control device. Step S207 corresponds to step S103 in FIG. 12.

[0073] 14 is a flowchart showing another example of a method for detecting deterioration of a communication line. The differences from FIG. 13 will be explained below.

[0074] In FIG. 14 , the comparison timing of the sample points is different from that in FIG. 13 . In FIG. 13 , the comparison is performed after synchronization processing (after step S203), whereas in FIG. 14 , the comparison is performed when the ECU is started (after step S201). By performing the comparison only when the ECU is started, as in FIG. 14 , the processing load can be reduced compared to a method in which the comparison is performed every time synchronization processing is performed. On the other hand, the accuracy of deterioration detection decreases due to the reduced frequency of comparison (the period from when a deterioration state occurs until the deterioration state is detected becomes longer). In other words, there is a trade-off between processing load and detection accuracy, and the comparison timing of the sample points can be selected based on the processing load of the entire system and the required detection accuracy.

[0075] The timing of the comparison of sample points may be set based on the passage of time. For example, the comparison may be set to be performed once a day, once a week, etc. The comparison of sample points may also be performed based on a specific trigger. For example, the comparison may be performed based on a vehicle diagnosis command from a user, a vehicle diagnosis command from a dealer, etc.

[0076] FIG. 15 is a flowchart showing the operation of the vehicle control system 600 shown in FIG. 10 from the detection of deterioration to the operation after the detection.

[0077] In step S301, each vehicle control device detects a communication delay. The details of the method for detecting a communication delay are as described with reference to FIG.

[0078] In step S302, the vehicle control device that detected the delay in step S301 detects the deterioration state of the communication line based on the delay information. The details of the method for detecting the deterioration state of the communication line are as described with reference to FIG. 13.

[0079] Step S303 is a step in which the vehicle control device that detected the degradation state of the communication line in step S302 notifies the degradation information to the other vehicle control devices. The other vehicle control devices here are vehicle control devices that belong to a different group from the vehicle control device that detected the degradation state. Note that even if degradation is detected in the communication line used for notifying the other vehicle control devices, if communication is possible (unless communication is impossible due to a line break or the like), notification is made using the communication line as usual. If communication is difficult, for example, notification is made using a different communication line, notification is made to another vehicle control device that is able to communicate, etc.

[0080] In step S304, the other vehicle control devices perform control processing based on the degradation information notified from the vehicle control device in step S303. The control processing here includes, for example, a degeneration operation, a notification to the user, a notification to the server, etc.

[0081] The degenerate operation is, for example, an operation in a state in which functions and performance are limited, which is performed in a group different from the group to which the communication line in which degradation is detected belongs. The degenerate operation enables operation that avoids the use of the communication line in a degraded state, thereby avoiding the risk of communication line disconnection and delays and improving safety. Note that if it is difficult to maintain the current state with the degenerate operation due to the use or degree of degradation of the communication line in which degradation is detected, a process of stopping operation or a process of transitioning to a state in which operation can be stopped may be performed.

[0082] The use of the communication line here refers to, for example, the importance of information in system operation, risk, etc. When a communication line that is the core of the system becomes degraded, if it is difficult to continue degraded operation by avoiding the use of that communication line, the system may be shut down or may transition to a state where it can be shut down.

[0083] The notification to the user may be, for example, a display on a display screen, a voice notification, etc. The notification information may be, for example, a maintenance reminder or other guidance to quickly resolve the deterioration state. The user notification process may be performed by the vehicle control device that detected the deterioration state.

[0084] The notification to the server may be, for example, a notification to a system administrator. By having the administrator understand the deterioration state, it becomes possible to urge the user to perform maintenance, and the deterioration state can be resolved early. Note that the server notification process may be performed by the vehicle control device that detected the deterioration state.

[0085] The control process by the other vehicle control device continues until the degradation of the communication line is resolved. Even if the delay state is resolved during or after the control process, once the degradation state is determined, the predetermined operation continues without changing the control operation. Note that when the delay state is resolved, a process different from the control process may be performed, such as performing the process before the delay was detected (before the control process) or performing the degradation detection process again.

[0086] (Summary) In this embodiment, the vehicle control system 600 includes a plurality of vehicle control devices 602, 603 connected via a communication line 601, and the plurality of vehicle control devices 602, 603 each sample the bus level 301 of the communication line 601 at sample points 204 that occur in one bit time period when communicating with another vehicle control device. In this vehicle control system 600, one or more predetermined vehicle control devices included in the plurality of vehicle control devices 602, 603 determine whether a fluctuation amount 205 from one bit time period of the sample point 204 is equal to or greater than a predetermined threshold, and determine whether the communication line 601 has deteriorated based on the frequency at which it is determined that the fluctuation amount 205 is equal to or greater than the threshold.

[0087] In addition, in this embodiment, in vehicle control devices 602, 603 that are connected to other vehicle control devices via a communication line 601 and that sample the bus level 301 of the communication line 601 at sample points that occur in a 1-bit time period when communicating with the other vehicle control devices, the vehicle control devices 602, 603 determine whether the fluctuation amount 205 from a 1-bit time period of a sample point 204 is greater than or equal to a predetermined threshold, and determine whether the communication line has deteriorated based on the frequency at which the fluctuation amount is determined to be greater than or equal to the threshold.

[0088] Furthermore, in this embodiment, the vehicle control system 700 includes a plurality of vehicle control devices 702 to 707 connected via a communication line 701, and when the plurality of vehicle control devices 702 to 707 communicate with other vehicle control devices, the vehicle control device samples the bus level 301 of the communication line 701 at a sample point 204 that occurs in a 1-bit time period. In this method for detecting deterioration of the communication line 701, the vehicle control system 700 determines whether the amount of variation from a 1-bit time period of the sample point is equal to or greater than a predetermined threshold, and determines whether the communication line is deteriorated based on the frequency at which the amount of variation is determined to be equal to or greater than the threshold.

[0089] In addition, in this embodiment, the specified vehicle control device includes a first lower-level vehicle control device 702, 703 included in the multiple vehicle control devices 702 to 707, and a first upper-level vehicle control device 706 included in the multiple vehicle control devices 702 to 707 and managing the first lower-level vehicle control devices 702, 703, and the first lower-level vehicle control devices 702, 703 determine whether the fluctuation amount 205 is greater than or equal to the threshold value and notify the first upper-level vehicle control device 706 of the result of the determination, and the first upper-level vehicle control device 706 determines whether the communication line 701 has deteriorated based on the result of the determination notified by the first lower-level vehicle control devices 702, 703.

[0090] According to this embodiment configured as described above, it is possible to detect the deterioration state of the communication lines 601 and 701 with high accuracy by determining whether the communication lines 601 and 701 are deteriorated or not based on the frequency at which it is determined that the fluctuation amount 205 from one bit time period of the sample point 204 is equal to or greater than a predetermined threshold.

[0091] Furthermore, in this embodiment, the predetermined vehicle control device includes second lower vehicle control devices 704, 705 included in the plurality of vehicle control devices 702 to 707, and a second higher level vehicle control device 707 included in the plurality of vehicle control devices 702 to 707 and managing the second lower level vehicle control devices 704, 705, and when the first higher level vehicle control device 706 determines that the communication line 701 has deteriorated, it notifies the second higher level vehicle control device 707. This makes it possible for the second lower level vehicle control devices 704, 705 to complement the operation of the first lower level vehicle control devices 702, 703.

[0092] In this embodiment, the fluctuation amount 205 is limited to a predetermined maximum value or less, and the threshold value is set to a predetermined percentage of the maximum value, thereby improving the accuracy of detecting the deterioration state of the communication lines 601 and 701.

[0093] In this embodiment, the predetermined vehicle control device determines whether the communication line is deteriorated based on the number of consecutive times that the fluctuation amount 205 is determined to be equal to or greater than the threshold value, or the number of times that the fluctuation amount 205 is determined to be equal to or greater than the threshold value within a predetermined time period, thereby improving the accuracy of detecting the deterioration state of the communication lines 601 and 701.

[0094] In this embodiment, the threshold value is set based on the risk defined by functional safety corresponding to the control executed by the predetermined vehicle control device, thereby enabling early detection of the deterioration state of the wire that handles important information (such as information with a high ASIL level).

[0095] In this embodiment, the timing at which the fluctuation amount 205 is acquired is the timing at which the predetermined vehicle control device performs synchronization processing with the bus level 301. This makes it possible to detect communication delays early.

[0096] Furthermore, in this embodiment, the timing at which the fluctuation amount 205 is acquired is the timing at which the predetermined vehicle control device is activated. This makes it possible to reduce the processing load on the vehicle control systems 600 and 700. Although the examples of the present invention have been described in detail above, the present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those having all of the described configurations.

[0097] 100...vehicle control system, 101...first group, 102...second group, 103-107...sensor unit, 108-111...vehicle control device, 112...first communication unit, 113...second communication unit, 201...synchronization segment, 202...first time segment, 203...second time segment, 204...sample point, 205...variation amount, 301...bus level, 302...receiving node, 303...delay, 304...1 bit time, 305, 401...timing, 402...delay, 403...Timing, 404...Additional width, 405, 406...Position, 407...Fluctuation, 501...Delay, 502, 503...Timing, 504, 505...Position, 506...Fluctuation, 600...Vehicle control system, 601...Communication line, 602, 603...Vehicle control devices, 700...Vehicle control system, 701...Communication line, 702 to 705...Vehicle control devices (lower vehicle control devices), 706, 707...Higher vehicle control devices, 710...First group, 720...Second group, 801, 802...Delay

Claims

1. A vehicle control system comprising a plurality of vehicle control devices connected via a communication line, wherein each of the plurality of vehicle control devices samples the bus level of the communication line at a sample point generated in a 1-bit time period when communicating with other vehicle control devices. In the vehicle control system, one or more predetermined vehicle control devices included in the plurality of vehicle control devices determine whether a variation amount from the 1-bit time period of the sample point is equal to or greater than a predetermined threshold value, and determine whether the communication line is deteriorated based on the frequency of determining that the variation amount is equal to or greater than the threshold value. A vehicle control system characterized by the above.

2. In the vehicle control system according to claim 1, the predetermined vehicle control device includes a first lower vehicle control device included in the plurality of vehicle control devices and a first upper vehicle control device included in the plurality of vehicle control devices and managing the first lower vehicle control device. The first lower vehicle control device determines whether the variation amount is equal to or greater than the threshold value and notifies the result of the determination to the first upper vehicle control device. The first upper vehicle control device determines whether the communication line is deteriorated based on the result of the determination notified from the first lower vehicle control device. A vehicle control system characterized by the above.

3. In the vehicle control system according to claim 2, the predetermined vehicle control device includes a second lower vehicle control device included in the plurality of vehicle control devices and a second upper vehicle control device included in the plurality of vehicle control devices and managing the second lower vehicle control device. The first upper vehicle control device notifies the second upper vehicle control device when it determines that the communication line is deteriorated. A vehicle control system characterized by the above.

4. In the vehicle control system according to claim 1, the variation amount is limited to be equal to or less than a predetermined maximum value, and the threshold value is set to a predetermined ratio of the maximum value. A vehicle control system characterized by the above.

5. In the vehicle control system according to claim 1, the predetermined vehicle control device determines whether the communication line is deteriorated based on the number of consecutive determinations that the variation amount is equal to or greater than the threshold value, or the number of determinations that the variation amount is equal to or greater than the threshold value within a predetermined time. A vehicle control system characterized by the above.

6. A vehicle control system as described in claim 1, characterized in that the threshold value is set based on a risk defined in functional safety corresponding to the control executed by the specified vehicle control device.

7. A vehicle control system according to claim 1, wherein the timing for acquiring the amount of fluctuation is the timing when the specified vehicle control device performs synchronization processing with the bus level.

8. A vehicle control system according to claim 1, characterized in that the timing for acquiring the amount of fluctuation is the timing for starting up the specified vehicle control device.

9. A vehicle control device that is connected to another vehicle control device via a communication line and samples the bus level of the communication line at a sample point that occurs in a one-bit time period when communicating with the other vehicle control device, wherein the vehicle control device determines whether or not the amount of fluctuation from one bit time period of the sample point is equal to or greater than a predetermined threshold, and determines whether or not the communication line has deteriorated based on the frequency at which the amount of fluctuation is determined to be equal to or greater than the threshold.

10. A method for detecting deterioration of a communication line in a vehicle control system comprising a plurality of vehicle control devices connected via a communication line, each of which samples the bus level of the communication line at a sample point that occurs in a one-bit time period when communicating with another vehicle control device, the method comprising: determining whether or not a fluctuation amount from one bit time period of the sample point is equal to or greater than a predetermined threshold value; and determining whether or not the communication line has deteriorated based on the frequency at which the fluctuation amount is determined to be equal to or greater than the threshold value.