JP7730301B2 - Electronic Control System - Google Patents

Description

The present invention relates to an electronic control system that controls the memory storage method for vehicle/diagnostic data.

As automobiles become more powerful, the number of electronic control units (ECUs: Electrical Control Units) required to perform each function is also on the rise. A large number of ECUs complicates the network configuration between ECUs, potentially resulting in problems such as signal delays. To address these issues, in recent years, the introduction of a Zone Architecture configuration has been considered, in which ECUs are grouped by functional system and controlled collectively by a centralized electronic control unit (central ECU). Furthermore, with the trend toward autonomous driving, vehicle and diagnostic data is on the rise. Furthermore, due to demands for miniaturization and low cost, ECUs other than the central ECU (hereinafter referred to as other ECUs) are required to limit the increase in internal memory, creating a growing demand for the central ECU to manage and store various data processed by other ECUs.

When the above-mentioned Zone architecture configuration is adopted, vehicle/diagnostic data collected from other ECUs to the central ECU does not pass through the other ECUs, i.e., it is not stored within the other ECUs. Therefore, if a communication error occurs between the central ECU and at least one other ECU on the same functional system, there is a risk that the update timing of the data managed and stored by the central ECU will differ between the other ECUs. In other words, the vehicle/diagnostic data of the other ECU where the communication error occurred will not be updated, but the vehicle/diagnostic data of the other ECUs will be updated. As a result, the vehicle/diagnostic data of the other ECUs at the time the communication error occurred is overwritten, making it impossible to obtain information about the entire vehicle at the time the communication error occurred. This makes it difficult to analyze the cause of the problem using data stored in the central ECU. Patent Document 1, for example, is one method for securing data when an abnormality occurs.

Patent Document 1 describes the problem of "reliably storing the vehicle state at the time of abnormality occurrence, even if the vehicle state detection process is executed several times from the time of abnormality occurrence until the execution of the storage process." It then describes a solution to this problem as follows: "In the vehicle abnormality state storage device 10, the first vehicle state storage processing unit 23 stores the vehicle state detected by the vehicle state detection processing unit 21 at each detection cycle in the first storage unit 13 together with the index number assigned by the index number assignment processing unit 22 in association with each vehicle state. When the abnormality determination processing unit 24 determines that an abnormality has occurred in the vehicle state, the index number extraction processing unit 25 extracts the index number corresponding to that vehicle state. The second vehicle state storage processing unit 26 stores the vehicle state corresponding to the index number extracted by the index number extraction processing unit 25 in the second storage unit 14 at each predetermined storage cycle set longer than the detection cycle."

JP 2013-142617 A

However, the invention described in Patent Document 1 requires constant indexing of vehicle/diagnostic data, resulting in a high computational processing load. Furthermore, when multiple ECUs are connected to a central ECU, only the vehicle data of the ECU in which an abnormality has occurred is stored in the second storage unit, resulting in an update mismatch with vehicle data of ECUs other than the ECU in which the abnormality has occurred. This means that when performing a cause analysis using the vehicle data stored in the central ECU, the vehicle data from each ECU is not complete, making the analysis difficult.

To solve the above problem, the electronic control system of the present invention has a first electronic control unit and multiple second electronic control units. The first electronic control unit receives signals output from the multiple second electronic control units, processes the signals received from the multiple second electronic control units to generate processed data, and overwrites and saves the generated processed data in a memory unit. When a communication error occurs with at least one second electronic control unit, the processed data generated from the signals received from all second electronic control units and stored in the memory unit at the time the communication error was detected is saved as error-time data without being overwritten.

According to the present invention, vehicle data from each ECU at the time of/just before a communication error can be stored in the storage of the central ECU, so that the overall state of the vehicle when a communication error occurs can be grasped and the cause can be analyzed.
Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. Furthermore, problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

1 is a block diagram showing a configuration of an electronic control system according to a first embodiment of the present invention; FIG. 2 is a flowchart showing a process performed by the electronic control system according to the first embodiment of the present invention. FIG. 10 is a block diagram showing the configuration of an electronic control system according to a second embodiment of the present invention. FIG. 6 is a flowchart showing a process performed by an electronic control system according to a second embodiment of the present invention. FIG. 10 is a block diagram showing the configuration of an electronic control system according to a third embodiment of the present invention. FIG. 2 is a diagram showing an example of a connection configuration between electronic control units according to the first embodiment of the present invention. FIG. 4 is a diagram showing another example of a connection configuration between electronic control units according to the first embodiment of the present invention.

The following describes an embodiment of the electronic control system and test method with reference to the drawings. However, the embodiment shown below is merely an example, and is not intended to exclude various modifications or the application of technologies not explicitly stated in the embodiment. In other words, this embodiment can be implemented with various modifications within the scope of its intent. Furthermore, each figure is not intended to include only the components shown in the figure, but may also include other functions, etc.

[Example 1]
FIG. 1 is a block diagram showing the overall configuration of an electronic control system 1 according to a first embodiment. The electronic control system 1 is mounted on a vehicle and includes a first electronic control unit (central ECU 100) and multiple second electronic control units (ECUs 210 and 220). The central ECU 100 includes a transceiver unit 110, an error detection unit 120, a signal processing unit 130, a first memory unit (cache 140), a data transfer instruction unit 150, and a second memory unit (storage 160). The ECUs 210 and 220 are various devices mounted on the vehicle (e.g., cameras, radar sensing devices such as LiDAR), and acquire information related to the vehicle's control status and safety status to generate vehicle/diagnosis data. Note that while this embodiment describes a case in which there are two ECUs, the number of ECUs is not limited as long as there is more than one.

The transmitter/receiver unit 110 transmits and receives data between the ECU 210 and the ECU 220. The error detection unit 120 detects errors that occur during data transmission and reception between the transmitter/receiver unit 110 and the ECU 210 and the ECU 220. In this embodiment, the error is a communication error in which communication between the transmitter/receiver unit 110 and the ECU 210 and the ECU 220 is interrupted. The signal processing unit 130 processes signals received by the transmitter/receiver unit 110 and processed by the ECU 210 and the ECU 220 to generate processed data.

The cache 140 and storage 160 store the processed data generated by the signal processing unit 130. In this embodiment, the storage capacity of the cache 140 is smaller than the storage capacity of the storage 160. This is also true in other embodiments. In this embodiment, the storage 160 is built into the central ECU 100, but it may be mounted in another area within the vehicle in which the central ECU 100 is mounted. The data transfer instruction unit 150 transmits a transfer instruction signal to the signal processing unit 130, instructing it to transfer the processed data stored in the cache 140 to the storage 160. In this embodiment, the data transfer instruction unit 150 transmits a data transfer signal to the signal processing unit 130 upon receiving an error detection signal from the error detection unit 120, as will be described in more detail below.

By connecting multiple ECUs 210, 220 to the central ECU 100 so that they can communicate with each other, as in this embodiment, it becomes possible to store and manage vehicle/diagnostic data within the central ECU 100, rather than storing all of the data in the non-volatile memory of the multiple ECUs 210, 220. The ECUs 210, 220 may also have volatile memory, in which all data is stored before being sent to the central ECU 100.

FIG. 2 is a flow diagram showing the processing performed by the electronic control system according to this embodiment. While the transceiver unit 110 is communicating with the ECUs 210 and 220, the error detection unit 120 monitors whether an error has occurred in the communication between the transceiver unit 110 and the ECUs 210 and 220 (step S201). If the error detection unit 120 does not detect an error (step S201: No), the vehicle/diagnosis data processed by the ECUs 210 and 220 is transferred to the signal processing unit 130, where it is processed to generate processed data (step S202). The generated processed data is first sent to the cache 140, which may be a volatile memory, and overwritten (step S203). Furthermore, at any time, the data stored in the cache 140 is transferred to and stored in the storage 160, which may be a nonvolatile memory, without being overwritten (step S204). The above flow is repeated until an error occurs. Because the data stored in the cache 140 is overwritten, the previously stored data is erased. Therefore, by saving the processing data at predetermined time intervals in storage 160, which has a larger storage capacity than cache 140, it becomes possible to save the processing data at predetermined time intervals.

If the error detection unit 120 detects a communication error ("Yes" in step S201), the error detection unit 120 issues an error detection signal indicating that an error has been detected and sends it to the data transfer instruction unit 150 (step S205). In the following, we will assume that a communication error has occurred between the ECU 210 and the transceiver unit 110. Upon receiving the error detection signal, the data transfer instruction unit 150 issues a transfer instruction signal to instruct the data stored in the cache 140 to be transferred to the storage 160, and sends this signal to the signal processing unit 130.

Then, upon receiving the transfer instruction signal, the signal processing unit 130 transfers and stores in the storage 160, as error-time data, all processing data corresponding to the vehicle/diagnosis data generated by the ECUs 210, 220 that was stored in the cache 140 from the time the data transfer instruction unit 150 received the error detection signal up to a predetermined time prior (step S207).

Specifically, for example, if the data transfer instruction unit 150 receives an error detection signal at time T, the signal processing unit 130 transfers from the cache 140 to the storage 160 the processed data generated by processing the signals received from each of the ECUs 210 and 220 between time T and time T-Δt, which is Δt before time T.

Then, it is determined whether the communication error has been resolved (step S208). If the communication error has been resolved ("Yes" in step S208), the process returns to step S201. If the communication error has not been resolved ("No" in step S208), the process proceeds to step S209, where safety control such as stopping the vehicle or degrading (such as lowering the autonomous driving level) is performed.

In this embodiment, the error is described as a communication error, but it is not limited to this and may also be a signal abnormality or ECU malfunction. There are also many methods for detecting errors, such as CRC checks or determination using a packet loss counter.

In this embodiment, with the above configuration, when a communication error occurs in the electronic control system, any data stored in the cache memory up to the time of the error can be saved to storage. This makes it possible to grasp the overall vehicle status when analyzing the cause of the error, making it easier to analyze the cause. This is because, as in-vehicle systems become increasingly computerized and complex, it is difficult to analyze the cause of the error using only the vehicle/diagnostic data of the ECU in which the communication error occurred. For example, if the ECU in which the communication error occurred is responsible for managing each area/zone (front, rear, left, right), it is necessary to understand the status of each area/zone and then understand the basis and situation of vehicle control. The same applies when the ECU is responsible for each function (automatic driving control, driver assistance control, powertrain, vehicle body control, etc.).

When considering the above in light of this embodiment, the following problem can be solved. That is, for an ECU 210 whose communication with the transceiver unit 110 is interrupted, the vehicle/diagnostic data generated by the ECU 210 cannot be updated after time T. However, for an ECU 220 whose communication with the transceiver unit 110 is not interrupted, the vehicle/diagnostic data generated by the ECU 210 continues to be transmitted to the central ECU 100 even after time T. Data continues to be overwritten and saved in the cache 140, which is volatile memory. In other words, data previously saved is erased. Therefore, if a communication error continues for a certain period of time, even if the communication error between the ECU 210 and the transceiver unit 110 is resolved, the vehicle/diagnostic data generated by the ECU 220 at time T will not be saved, making it impossible to analyze what event occurred at time T that caused the error.

However, according to this embodiment, the vehicle/diagnosis data generated by ECUs 210 and 220 at time T is reliably stored in storage 160. Therefore, when the communication error in ECU 210 is resolved, it becomes possible to grasp the overall state of the vehicle at time T, which can be useful in analyzing the cause of the communication error that occurred in ECU 210 and any associated problems.

In this embodiment, communication between ECUs 210, 220 and transceiver unit 110 is performed via separate paths (e.g., Ethernet, CAN, or SerDes), but the connection method is not limited to this. Specifically, as shown in Figure 6, ECUs 210, 220 may be connected to transceiver unit 110 via a shared communication bus 700. Alternatively, as shown in Figure 7, connection may be made via a switching device 800. In either case, the communication path configuration can be simplified, and data management can be made easier by, for example, connecting ECUs belonging to the same functional system together to transceiver unit 110 via a common bus or switching device.

[Example 2]
Next, an electronic control system according to a second embodiment will be described with reference to Figs. 3 and 4. Fig. 3 is a block diagram showing an example of the configuration of an electronic control system 1 according to this embodiment. The configuration of the central ECU 100 in this embodiment is the same as that in the first embodiment, and therefore a description thereof will be omitted. This embodiment differs from the first embodiment in that data is stored in the cache not only on the central ECU 100 side but also on the ECUs 210 and 220 side.

In this embodiment, the ECU 210 has a transmitter/receiver unit 111, an error detection unit 121, an information processing unit 131, a third memory unit (cache 141), and an information acquisition unit 300. The ECU 220 has a similar configuration.

The transmitter/receiver unit 111 communicates with the transmitter/receiver unit 110 on the central ECU 100 side. If the error detection unit 121 detects a communication error between the transmitter/receiver units 110 and 111, it issues an error detection signal and transmits it to the information processing unit 131. The information acquisition unit 300 is a sensing element such as a camera or radar, and acquires information related to vehicle control and safety. The information processing unit 131 processes the information acquired by the information acquisition unit 300 and generates a processed signal.

In this embodiment, when the error detection unit 121 detects a communication error, it transmits an error detection signal to the information processing unit 131. In response to receiving the error detection signal, the information processing unit 131 stores and preserves in the cache 141 information about the processing signal generated within a predetermined time before and after the time when the error detection unit 121 detected the communication error, until the communication error is resolved.

The above process will be explained using the flowchart in Figure 4. While the transceiver unit 111 is communicating with the transceiver unit 110 of the central ECU 100, the error detection unit 121 monitors whether an error has occurred in the communication between the transceivers 110 and 111 (step S401). If the error detection unit 121 does not detect an error ("No" in step S401), the information processing unit 131 processes the information acquired by the information acquisition unit 300 and generates a processing signal (step S402). The information processing unit 131 then transmits the processed signal to the transceiver unit 111 (step S403). The above flow is then repeated until an error occurs.

If the error detection unit 121 detects a communication error ("Yes" in step S401), the error detection unit 121 issues an error detection signal indicating that a communication error has been detected and transmits it to the information processing unit 131 (step S404). Upon receiving the error detection signal, the information processing unit 131 stores information about the processing signals generated within a predetermined time before and after the time the error detection unit 121 detected the error in the cache 141 until the communication error is resolved (step S405).

The error detection unit 121 then monitors whether the communication error has been resolved (step S406). If the communication error has been resolved ("Yes" in step S406), the information processing unit 131 transmits the data stored in the cache 141 to the transceiver unit 111. If the communication error has not been resolved ("No" in step S406), the process proceeds to step S408, where safety control such as stopping the vehicle or degrading (such as lowering the autonomous driving level) is performed.

In this embodiment, by performing the above-described processing, in addition to the effects of embodiment 1, data generated by an ECU in which a communication error occurred after the communication error occurred and that could not be transmitted to the central ECU 100 can be transmitted after communication is restored. Therefore, by analyzing the continuity of data generated around the time of the communication error, detailed cause analysis is possible, which makes maintenance easier and provides feedback to the design. Note that there may be a time lag in the cache data transmitted from ECU 210 to the central ECU when communication is restored, but this can be adjusted by the signal processing unit 130 performing synchronization processing using, for example, a timestamp.

Even if the communication error is not resolved or the ECU that caused the error fails, this embodiment makes it possible to understand the vehicle's condition at the time the communication error occurred by extracting the ECU and obtaining the data log from the cache.

[Example 3]
5 is a block diagram showing the configuration of an electronic control system 1 according to a third embodiment of the present invention. This embodiment differs from the first embodiment in that it includes an external communication unit 500 capable of communicating with an external device 600 (such as a management center or a user) outside the vehicle 400 equipped with the central ECU 100. In this embodiment, the external communication unit 500 is configured to be able to communicate with the signal processing unit 130, and can transfer vehicle/diagnosis data at any timing to, for example, a center or a user with a mobile terminal, or can transmit data obtained by integrating and processing the data.

In addition to the effects of Examples 1 and 2, the above configuration enables real-time notifications to the center and driver while the vehicle is in operation, making it possible to provide highly reliable services such as safety control, warnings, logging, and trend analysis.

According to the embodiment of the present invention described above, the following advantageous effects are achieved.
(1) The electronic control system of the present invention has a first electronic control device and a plurality of second electronic control devices, wherein the first electronic control device receives signals output from the plurality of second electronic control devices, processes the signals received from the plurality of second electronic control devices to generate processed data, overwrites and saves the generated processed data in a memory unit, and when a communication error occurs with at least one second electronic control device, saves the processed data generated from the signals received from all second electronic control devices that was saved in the memory unit at the time the communication error was detected as data at the time of the error occurrence without overwriting it.

With the above configuration, vehicle data from each ECU in the event of a communication error can be saved in the central ECU's storage, allowing the overall vehicle status to be understood and the cause to be analyzed.

(2) The data at the time of error occurrence includes processed data generated from signals received from all second electronic control units from the time the communication error was detected up to a predetermined time prior. This makes it possible to analyze data continuity, etc., from immediately before the communication error occurred, making it easier to analyze the cause of the error.

(3) The memory unit has a first memory unit that overwrites and saves processed data, and a second memory unit that saves processed data without overwriting it, and the first electronic control device transfers error data from the first memory unit to the second memory unit in response to detecting the occurrence of a communication error. This makes it possible to use a volatile cache memory with a smaller storage capacity as the first memory unit than the second memory unit, which is non-volatile storage memory, and makes it possible to miniaturize the device.

(4) The electronic control system further includes an external communication unit capable of communicating with the outside of the vehicle in which it is installed, and the external communication unit transmits information, including the processed data stored in the memory unit, to the outside of the vehicle. This enables real-time notifications to the center and driver while the vehicle is in operation, making it possible to provide highly reliable services such as safety control, warnings, logging, and trend analysis.

(5) Each of the multiple second electronic control devices acquires information about the vehicle in which the electronic control system is installed, processes the information to generate a processing signal, and, if a communication error occurs, stores information about the processing signal generated within a predetermined time before and after the communication error in a third memory unit. This makes it possible to acquire data even after the communication error occurs by referencing the data log in the memory unit as needed.

(6) Each of the multiple second electronic control units stores information in a third memory unit until the communication error is resolved, and when the communication error is resolved, transmits the information stored in the third memory unit to the first electronic control unit. This makes it possible to transmit data immediately after the communication error occurs that could not be transmitted to the central ECU during the communication error after the communication error has occurred after communication is restored, enabling more detailed analysis of the cause, facilitating maintenance and providing feedback to the design.

(7) Multiple second electronic control devices are connected to the first electronic control device via a common communication path or selectively connected via a switching circuit. This makes it possible to simplify the communication path between the second electronic control device and the first electronic control device.

The technical scope of the present invention is not limited to the scope described in the above embodiments, and includes various modifications without departing from the main features of the present invention. Therefore, the above-described examples are merely illustrative and should not be interpreted in a limiting sense. Furthermore, it is possible to add, delete, or replace part of the configuration of each example with other configurations, and all of this is within the scope of the present invention.

1 Electronic control system, 100 Central ECU (first electronic control device), 140 Cache (first memory unit), 141 Cache (third memory unit), 160 Storage (second memory unit), 210, 220 ECU (second electronic control device), 400 Vehicle, 500 External communication unit, 600 External, 700 Communication bus, 800 Switching device

Claims (6)

An electronic control system having a first electronic control unit and a plurality of second electronic control units,
The first electronic control device
receiving signals output from the plurality of second electronic control units;
Processing signals received from the plurality of second electronic control units to generate processed data;
The generated processing data is overwritten and saved in the storage unit.
When a communication error occurs with at least one of the second electronic control units, the processing data generated from the signals received from all of the second electronic control units and stored in the memory unit at the time the communication error is detected is saved as data at the time of the error occurrence without being overwritten ;
Each of the plurality of second electronic control units is
Acquire information about a vehicle in which the electronic control system is installed;
processing the information to generate a processed signal;
When the communication error occurs, information about the processed signal generated within a predetermined time before and after the time when the communication error occurred is stored in a third storage unit.
An electronic control system characterized by: 2. The electronic control system of claim 1,
The error occurrence data includes the processing data generated from all signals received from the second electronic control unit during a period from the time when the occurrence of the communication error was detected to a time preceding a predetermined time.
An electronic control system characterized by: 2. The electronic control system of claim 1,
the storage unit includes a first storage unit that overwrites and stores the processing data, and a second storage unit that stores the processing data without overwriting it;
the first electronic control unit, in response to detecting the occurrence of the communication error, transfers the error occurrence data from the first storage unit to the second storage unit;
An electronic control system characterized by: 2. The electronic control system of claim 1,
an external communication unit capable of communicating with the outside of the vehicle in which the electronic control system is installed;
The external communication unit transmits information including the processing data stored in the storage unit to an outside of the vehicle.
An electronic control system characterized by: 2. The electronic control system of claim 1 ,
Each of the plurality of second electronic control units stores the information in the third storage unit until the communication error is resolved, and when the communication error is resolved, transmits the information stored in the third storage unit to the first electronic control unit.
An electronic control system characterized by: 2. The electronic control system of claim 1,
The plurality of second electronic control units are connected to the first electronic control unit via a common communication path or selectively connected via a switching circuit.
An electronic control system characterized by: