JP2018158591A - Control device for vehicle - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control device for a vehicle capable of reliably operating a sub communication module. SOLUTION: In a vehicle control device having a main control unit 12 and a sub control unit 22 connected to an in-vehicle network such as a CAN, the sub communication module 24 transmits transmission data composed of predetermined data to the main communication module 14. The main communication module 14 transmits the reply data configured based on the transmission data to the sub communication module 24, and when the sub communication module 24 receives the reply data, the sub control unit 22 is based on the reply data. , Check whether the sub communication module 24 is normal or not. After confirming that the sub communication module 24 is normal, when it is determined that the main communication module 14 has failed via a different route such as SPI, the control data to the in-vehicle device on the in-vehicle network is transmitted. Transmission is performed by the sub-communication module 24. [Selection diagram] Fig. 1

Description

  The present invention relates to a control device (vehicle control device) used for a vehicle such as an automobile, for example, and relates to a redundant control device including a main control unit and a sub control unit.

  For example, Patent Document 1 discloses a control device for a drive device, and the control device includes a main system microcomputer and a sub system microcomputer, and an AD (Analog-to-Digital) conversion module and a CAN (Controller Area Network) module are redundant. It has become. Specifically, in the control device of Patent Document 1, output calculation software for calculating input data is stored only in the main microcomputer. When the main system CAN module is abnormal and the sub system CAN module is normal, the main system microcomputer uses the sub system CAN input data stored in DPRAM (Dual Port RAM), and the sub system CAN module Communication can be performed.

  The sub-system microcomputer (CPU of the sub-system drive unit (ATCU) control device) of Patent Document 1 always stores the status (normal or abnormal) of the sub-system CAN module and the sub-system CAN input data (input value) in the DPRAM. Can write.

JP 2006-055832 A

  In Patent Document 1, when the main CAN module is normal, communication with the main CAN module is executed, while communication with the sub CAN module is not executed. Therefore, when the state of the main CAN module changes from normal to abnormal and the sub CAN module is normal, communication in the sub CAN module is actually executed. However, the present inventors have recognized that when the sub-system CAN module is activated, communication in the sub-system CAN module may not actually be executed. In other words, when the sub-system microcomputer erroneously determines that the sub-system CAN module is normal, the sub-system CAN module actually transmits the transmission data even if a transmission command for transmission data is transmitted to the sub-system CAN module. Can not be sent to.

  Further, in Patent Document 1, when the main microcomputer is abnormal, communication with the sub CAN module is not executed. This is because communication in the sub CAN module is controlled by the main microcomputer.

  One object of the present invention is to provide a vehicle control device that can reliably operate a sub-communication module such as a sub-system CAN module. Another object of the present invention is to provide a vehicle control device capable of operating a sub-communication module even in a situation where a main control unit such as a main system microcomputer breaks down. Other objects of the present invention will become apparent to those skilled in the art by referring to the aspects and best embodiments exemplified below and the accompanying drawings.

  In the following, in order to easily understand the outline of the present invention, embodiments according to the present invention will be exemplified.

In the first aspect, a vehicle control device having a main control unit and a sub-control unit connected to an in-vehicle network,
A first main communication module capable of executing communication on the in-vehicle network;
A first sub communication module capable of executing communication on the in-vehicle network;
A second main communication module capable of executing communication on a route different from the in-vehicle network;
A second sub-communication module capable of executing communication on the different path;
With
The first sub communication module transmits transmission data including predetermined data to the first main communication module,
The first main communication module transmits reply data configured based on the transmission data to the first sub communication module;
When the first sub-communication module receives the reply data, the sub-control unit confirms whether the first sub-communication module is normal based on the reply data,
When the main control unit determines that the first main communication module has failed, the second main communication module transmits failure data to the second sub communication module;
When the second sub-communication module receives the failure data, the sub-control unit determines that the first main communication module has failed,
When it is determined that the first main communication module is out of order via the different path after it is confirmed that the first sub communication module is normal through the in-vehicle network, Transmission of control data to the in-vehicle device on the in-vehicle network is executed by the first sub communication module instead of the first main communication module.

  In the first aspect, before transmission of control data to the in-vehicle device on the in-vehicle network (for example, CAN) is executed by the first sub-communication module, the first sub-communication module transmits through the in-vehicle network. Data is actually transmitted to the first main communication module, and reply data as an execution result is actually received from the first main communication module. In the first aspect, since it is confirmed that the first sub communication module can actually transmit the transmission data, the first sub communication module reliably transmits the control data to the in-vehicle device on the in-vehicle network. can do. Thus, according to the first aspect, it is possible to provide a vehicle control device that can reliably operate the sub-communication module.

In a second aspect dependent on the first aspect,
When the data from the second main communication module is disconnected, the sub-control unit may determine whether the data from the first main communication module is disconnected,
When the data from the second main communication module is disconnected and the data from the first main communication module is not disconnected, the transmission of the control data to the in-vehicle device on the in-vehicle network is the first May continue to be executed by the main communication module.

  In the second aspect, even when the data from the second main communication module is disconnected, when the data from the first main communication module is not disconnected, the sub-control unit detects an abnormality in the in-vehicle network (for example, the main It is possible to estimate an abnormality in a different route (for example, disconnection of the SPI communication line) instead of a failure of the control unit. In the second aspect, when the data from the first main communication module is not interrupted, in other words, it is confirmed that the first main communication module can actually transmit, for example, reply data. The main communication module can reliably transmit control data to the in-vehicle device on the in-vehicle network. Thus, the operation of the first main communication module can be continued.

In a third aspect subordinate to the second aspect,
When the data from the second main communication module is disconnected and the data from the first main communication module is also disconnected, the sub-control unit estimates that the main control unit has failed, The transmission of the control data to the in-vehicle device on the in-vehicle network may be executed by the first sub communication module.

  In the third aspect, when the data from the second main communication module is disconnected and the data from the first main communication module is also disconnected, the sub-control unit detects an abnormality in a different path (for example, disconnection of the SPI communication line). ), The failure of the main control unit can be estimated. In the third aspect, in other words, since it has been confirmed that the first main communication module could not actually transmit, for example, reply data, the first main communication module is no longer connected to the in-vehicle device on the in-vehicle network. Control data cannot be transmitted reliably. Therefore, instead of the first main communication module, the first sub communication module can reliably transmit control data to the in-vehicle device on the in-vehicle network.

In a fourth aspect subordinate to any one of the first to third aspects,
The predetermined data constituting the transmission data transmitted from the first sub-communication module to the first main communication module is generated by executing a predetermined calculation in the sub-control unit at predetermined intervals. It may be variable data.

  In the fourth aspect, since the predetermined data constituting the transmission data is variable data, the transmission data is changed at a predetermined interval. Accordingly, the reply data configured based on the transmission data is also changed at a predetermined interval. By using such reply data, in the fourth aspect, it can be confirmed more reliably that the first sub-communication module can actually transmit the transmission data. In other words, when the return data is fixed data, or transmission data (variable data) is not reflected in the return data, the sub control unit does not confirm that the first sub communication module is normal or the first sub An abnormality of the communication module can be determined.

In a fifth aspect subordinate to the fourth aspect,
When the reply data is based on the variable data, the sub control unit may confirm that the first sub communication module is normal.

  In the fifth aspect, when the return data is based on variable data (transmission data changed at a predetermined interval), it is more reliably confirmed that the first sub-communication module has actually transmitted the transmission data. Can do.

In a sixth aspect subordinate to the fifth aspect,
When the return data is not based on the variable data, the sub control unit may transmit an abnormality of the first sub communication module to the main control unit via the different path,
When the abnormality of the first sub-communication module is received by the main control unit via the different path, and the main control unit determines that the first main communication module has failed, The second main communication module does not transmit the failure data of the first main communication module to the second sub communication module, and transmission of the control data to the in-vehicle device on the in-vehicle network is , And may not be executed by the first main communication module and the first sub communication module.

  In the sixth aspect, when the return data is not based on variable data (transmission data that is changed at a predetermined interval), the sub-control unit sends an abnormality of the first sub-communication module to the main control unit via a different route. Send. In the sixth aspect, even if the first main communication module fails, the main control unit does not notify the sub-control unit that the first main communication module has failed. Therefore, in the sixth aspect, when the return data is not based on the variable data, the sub-control unit cannot determine that the first main communication module has failed. Do not send control data to the above in-vehicle device.

In a seventh aspect subordinate to any one of the first to sixth aspects,
The sub-control unit may determine whether or not the first sub-communication module has failed,
After the sub control unit determines that the first sub communication module has not failed, the sub control unit determines whether the first sub communication module is normal based on the return data. May be confirmed.

  In the seventh aspect, when the sub-control unit determines that the first sub-communication module has not failed, the return data confirms whether or not the first sub-communication module has actually transmitted the transmission data. be able to. In other words, when the sub-control unit determines that the first sub-communication module has not failed, the present inventors have recognized that the transmission in the first sub-communication module may not actually be performed. .

In an eighth aspect dependent on any one of the first to seventh aspects,
The first sub-communication module may transmit next transmission data composed of next predetermined data based on the reply data to the first main communication module,
When the first main communication module receives the transmission data, the main control unit confirms whether or not the first main communication module is normal based on the transmission data and the reply data. Well,
When it is not confirmed that the first main communication module is normal, the second main communication module may transmit an abnormality of the first main communication module to the second sub communication module.

  In the eighth aspect, there is a possibility that transmission by the first main communication module is not actually executed even if the main control unit determines that the first main communication module has not failed. The inventors have recognized. In other words, in the eighth aspect, the first main communication module actually transmits the reply data to the first sub-communication module via the in-vehicle network, and the reply data as the execution result is not reflected in the transmission data. Sometimes it is estimated that transmission in the first main communication module is not actually being performed, or it is not confirmed that the first main communication module is normal. In such a situation, in the eighth aspect, the main control unit can transmit an abnormality of the first main communication module to the sub-control unit.

In a ninth aspect dependent on any one of the first to eighth aspects,
When transmission of the control data to the in-vehicle device on the in-vehicle network is executed by the first sub communication module instead of the first main communication module, the control data is an operation of the in-vehicle device. It may be degenerate data that degenerates.

  In the ninth aspect, when the failure of the first main communication module is transmitted to the sub control unit, the sub control unit can transmit the degenerate data to the in-vehicle device. In other words, in the ninth aspect, when the first sub communication module is not made redundant, the function of the in-vehicle device controlled by the vehicle control device can be reduced or a part of the in-vehicle device can be stopped.

  Those skilled in the art will readily understand that the illustrated embodiments according to the present invention can be further modified without departing from the spirit of the present invention.

The structural example of the control apparatus for vehicles according to this invention is shown. FIG. 2A is a flowchart showing an operation example of the sub control device that generates CAN transmission data (predetermined data) for confirming whether or not the first sub communication module is normal. 2 (B) is a flowchart showing an operation example of the main control device that generates CAN reply data based on CAN transmission data (predetermined data). FIG. 3A is a flowchart showing an example of the operation of the main control device that generates CAN failure data for causing the sub-control device to transmit degenerate data, and FIG. The flowchart figure which shows the operation example of a control apparatus is shown.

  The best mode described below is used to easily understand the present invention. Accordingly, those skilled in the art should note that the present invention is not unduly limited by the embodiments described below.

  FIG. 1 shows a configuration example of a vehicle control device according to the present invention. Although not shown in FIG. 1, a vehicle such as an automobile typically includes many ECUs (Electronic Control Units), and these ECUs are connected to an in-vehicle network such as a CAN. Moreover, those ECUs can control various actuators (not shown) to realize vehicle travel. The vehicle control device shown in FIG. 1 is one of those ECUs or a general ECU that supervises these ECUs. The vehicle control device is, for example, a 2-wire differential voltage type CAN communication. The main control unit 12 and the sub-control unit 22 are connected to a CAN (in a broad sense, an in-vehicle network). Each of the main control unit 12 and the sub control unit 22 typically includes a calculation unit such as a CPU.

  In FIG. 1, a main control unit 12 executes communication on a CAN by a first main communication module 14 (vehicle network module) such as a CAN communication module, for example. As a normal operation, an ECU (broadly defined) Can transmit control data to a vehicle-mounted device. On the other hand, the sub-control unit 22 does not transmit control data to the ECU on the in-vehicle network as a normal operation. Only when the main-side CAN communication module fails, the sub-control unit 22 uses the first sub-communication module 24 (specifically, the sub-side CAN communication module) as an in-vehicle network as an exception or emergency operation. Control data can be transmitted to the above ECU. The main-side and sub-side CAN communication modules thus made redundant are provided in the vehicle control device.

  Specifically, the vehicle control device of FIG. 1 includes a main control device 10 and a sub control device 20, and each of the main control device 10 and the sub control device 20 includes, for example, a CAN such as an SPI (Serial Peripheral Interface). Has an SPI communication module capable of executing communication (main-sub communication) on different paths. The second main communication module 16 (specifically, the main-side SPI communication module) detects a failure, abnormality, etc. of the first main communication module 14 (main-side CAN communication module). (Specifically, it can be transmitted to the sub-side SPI communication module). Similarly, the second sub-communication module 26 (specifically, the sub-side SPI communication module) detects failures, abnormalities, etc. of the first sub-communication module 24 (sub-side CAN communication module). This can be transmitted to the communication module 16 (specifically, the SPI communication module on the main side).

  FIG. 2A illustrates the CAN control data (predetermined data) for generating whether or not the first sub communication module 24 (sub-side CAN communication module) is normal. The flowchart figure which shows an operation example is shown. FIG. 2B is a flowchart showing an operation example of the main controller 10 that generates CAN reply data based on CAN transmission data (predetermined data).

  As a normal operation, the first sub communication module 24 (sub-side CAN communication module) does not transmit control data to the ECU (in-vehicle device in a broad sense) on the in-vehicle network, but only to the main control device 10. Thus, CAN transmission data (predetermined data) for confirming whether or not the sub-side CAN communication module is normal can be transmitted (see step ST04 in FIG. 2A).

  Note that when the sub-control device 20 starts normal operation, initial values are set in the main-side reply data (sub-side received data), and the sub-control device 20 omits, for example, step ST01 and step ST02. Then, step ST03 is executed. In other words, when the sub control device 20 starts normal operation, the sub control device 20 can immediately generate CAN transmission data (predetermined data) in step ST03.

  In step ST03 of FIG. 2A, the sub-control device 20 adds, for example, a numerical value of received data and, for example, a fixed numerical value on the sub-side that is arbitrarily set as a predetermined calculation on the sub-side. The addition value that is the sub-side calculation value is set to predetermined data (predetermined numerical value). The sub control device 20 generates transmission data including the predetermined data, and the sub control device 20 transmits the transmission data (predetermined data) to the main control device 10 on the CAN by using the CAN communication module on the sub side. Is transmitted (see step ST04).

  Incidentally, the first main communication module 14 (main-side CAN communication module) transmits control data to the ECU on the in-vehicle network as a normal operation, and only the sub-control device 20 has a sub-side CAN. CAN reply data based on transmission data (predetermined data) from the communication module can be generated (see step ST13 in FIG. 2B).

  Note that when the main control device 10 starts a normal operation, the main control device 10 omits, for example, step ST11 and step ST12 and executes step ST13. In other words, when the main control device 10 receives transmission data (predetermined data) from the sub-control device 20, the sub-side transmission data (predetermined data) is set in the main-side reception data, and the main control device 10 can generate reply data (main-side transmission data) based on the received data (predetermined data) in step ST13.

  In step ST13 of FIG. 2B, the main control device 10 performs, for example, a numerical value of received data (a predetermined numerical value of predetermined data) as a predetermined calculation on the main side, and a fixed value on the main side, for example, fixed Add the numeric value. The addition value, which is the calculation value on the main side, is set to the numerical value of the transmission data on the main side. The main control device 10 generates reply data including the transmission data, and the main control device 10 transmits the reply data to the sub control device 20 on the CAN using the CAN communication module on the main side (step ST14). reference).

  In step ST01 of FIG. 2A, the sub-control device 20 can determine whether or not a certain time has elapsed after transmitting the transmission data (predetermined data) in step ST04. Here, the fixed time is based on a normal time required from transmission of transmission data (predetermined data) at the sub-control device 20 to reception of reception data (reply data) at the sub-control device 20, for example, a fixed time. Is set by adding the maximum allowable time to the normal time.

  After a certain period of time has elapsed, the sub-control device 20 can read the sub-side received data received by the sub-side CAN communication module (specifically, the reception buffer). Since the main control device 10 uses the main-side CAN communication module to transmit the main-side reply data to the sub-control device 20 on the CAN, the sub-side received data is usually the main-side reply data. Match the data. In step ST02 of FIG. 2A, the sub-control device 20 confirms whether or not the sub-side received data is valid. Specifically, the sub-control device 20 determines whether or not the numerical value of the sub-side received data (= the main-side reply data) matches the calculated value on the main side in step 13 in FIG. In order to confirm, the same calculation as the predetermined calculation on the main side is executed (see step ST02 in FIG. 2A).

  More specifically, in step ST02 of FIG. 2A, the sub-control device 20 is a sub-side calculated value (execution result of step ST03) stored in the sub-control unit 22 (specifically, RAM). (Predetermined numerical value of predetermined data) is read out, and the calculated value (predetermined numerical value of the predetermined data) is added to the arbitrarily set main numerical value, for example. Alternatively, the sub-control device 20 reads the numerical value of the sub-side transmission data stored in the sub-side CAN communication module (specifically, the transmission buffer), and arbitrarily specifies the numerical value (predetermined numerical value of the predetermined data). For example, a fixed numerical value on the main side to be set is added.

  In step ST02, the sub-control device 20 can confirm whether or not the numerical value of the sub-side received data (= main-side reply data) matches the added value. For example, the same numerical value is used between the sub control device 20 and the main control device 10 as the fixed numerical value on the main side, and the numerical value is preset in each of the sub control device 20 and the main control device 10. . When the sub-CAN communication module can actually transmit the transmission data (predetermined data) in step ST04, the numerical value of the sub-side reception data (= main-side reply data) matches the added value. The apparatus 20 confirms that the sub-side CAN communication module is normal.

  On the other hand, when the sub-CAN communication module cannot actually transmit the transmission data (predetermined data) in step ST04, the numerical value of the sub-side reception data (= main-side reply data) does not match the added value. The sub-control device 20 does not confirm that the sub-side CAN communication module is normal. In other words, when the numerical value of the reception data on the sub side (= the reply data on the main side) does not match the added value, the sub control device 20 does not actually execute transmission in the CAN communication module on the sub side. And the abnormality of the sub-CAN communication module can be determined (see step ST05 in FIG. 2A).

  The relationship between the sub-side transmission data (predetermined data) and the main-side reply data will be specifically described below. When the received data on the sub side represents, for example, “0” (= initial value) and the fixed value on the sub side is, for example, “2”, the predetermined data in step ST03 is, for example, “2” (= “0” + “2”). Therefore, for example, when the sub-side transmission data representing “2” is actually transmitted from the sub-side CAN communication module to the main-side CAN communication module, the main-side reception data in step ST12 represents, for example, “2”. . When the reception data on the main side represents “2” and the fixed value on the main side is, for example, “3”, the return data on the main side is, for example, “5” (= “2” + “3”) in step ST13. Represents. Therefore, for example, when the reply data (transmission data) on the main side representing “3” is actually transmitted from the CAN communication module on the main side to the CAN communication module on the sub side, the reception data (main side data on the main side) in step ST02 is transmitted. For example, “transmission data” represents “5”. At the same time, in step ST02, an addition value ("5") between the numerical value ("2") of the transmission data transmitted in step ST04 and the fixed value ("3") on the main side is calculated, and this addition value and The sub-side received data (main-side transmission data) is compared with the numerical value. When the sub-side CAN communication module can actually transmit the transmission data in step ST04, the sub-control device 20 determines that the sub-side received data (= main-side reply data) matches the added value. Confirm that the CAN communication module on the side is normal. In the next step ST03, the next predetermined data represents, for example, “7” (= “5” + “2”). In this way, when the sub-side CAN communication module is normal, the predetermined data constituting the transmission data is variable data (transmission data changed at a predetermined interval).

  By the way, for example, when the next transmission data on the sub side representing “7” is not actually transmitted from the sub CAN communication module to the main CAN communication module, the next reception data on the main side in the next step ST12 is , Continues to be the previous received data and represents, for example, “2”. Accordingly, in the next step ST13, the next reply data on the main side continues to represent, for example, “5” (= “2” + “3”). In the next step ST02, the next reception data on the sub side in step ST02 (the next transmission data on the main side) continues to represent “5”, for example. At the same time, in the next step ST02, the next added value (“10”) of the numerical value (“7”) of the transmission data not transmitted in step ST04 and the fixed value on the main side (“3”) is calculated. The next addition value is compared with the numerical value of the next reception data on the sub side (next transmission data on the main side). When the sub CAN communication module cannot actually transmit the transmission data in step ST04, the numerical value of the reception data on the sub side (= the return data on the main side) does not match the added value. The sub-side CAN communication module is not confirmed to be normal. That is, the sub-control device 20 can estimate that transmission by the sub-CAN communication module is not actually executed, and can determine the abnormality of the sub-CAN communication module (see step ST05).

  In step ST11 of FIG. 2B, the main control device 10 can determine whether or not a certain time has elapsed after transmitting the transmission data (reply data) in step ST14. Here, the fixed time is based on a normal time required from transmission of transmission data (reply data) at the main control device 10 to reception of reception data (transmission data) at the main control device 10, for example, the fixed time is Set by adding the maximum allowable time to the normal time.

  After a predetermined time has elapsed, the main control apparatus 10 can read the main-side received data received by the main-side CAN communication module (specifically, the reception buffer). The sub-control device 20 uses the sub-side CAN communication module to transmit the sub-side transmission data to the main control device 10 on the CAN. Therefore, the main-side reception data is normally transmitted from the sub-side transmission data. Match the data. In step ST12 of FIG. 2B, the main controller 10 confirms whether or not the main-side received data is valid. Specifically, the main control device 10 determines whether or not the numerical value of the main-side received data (= sub-side transmission data) matches the sub-side calculation value in step 03 of FIG. In order to confirm, the same calculation as the predetermined calculation on the sub side is executed (see step ST12 in FIG. 2B).

  More specifically, in step ST12 of FIG. 2B, the main control device 10 is the main-side calculated value (the execution result of step ST13) stored in the main control unit 12 (specifically, RAM). The numerical value of the reply data) is read out, and the calculated value (the numerical value of the reply data) is added to, for example, a fixed numerical value on the sub side that is arbitrarily set. Alternatively, the main control apparatus 10 reads the numerical value of the main-side transmission data stored in the main-side CAN communication module (specifically, the transmission buffer) and arbitrarily sets the numerical value (the numerical value of the reply data). For example, a fixed numerical value on the sub side is added.

  In step ST12, the main controller 10 can confirm whether or not the numerical value of the main-side received data (= sub-side transmission data) matches the added value. For example, the same numerical value is used between the main control device 10 and the sub control device 20 as a fixed numerical value on the sub side, and the numerical value is preset in each of the main control device 10 and the sub control device 20. . When the main-side CAN communication module can actually transmit the transmission data (reply data) in step ST14, the value of the main-side reception data (= sub-side transmission data) matches the added value. 20 confirms that the CAN communication module on the sub-side is normal.

  On the other hand, when the main-side CAN communication module cannot actually transmit the transmission data (reply data) in step ST14, the numerical value of the main-side reception data (= sub-side transmission data) does not match the added value. The main controller 10 does not confirm that the main CAN communication module is normal. In other words, when the numerical value of the reception data on the main side (= sub transmission data) does not match the added value, the main control device 10 does not actually execute transmission in the main CAN communication module. And the abnormality of the CAN communication module on the main side can be determined (see step ST15 in FIG. 2B).

  The relationship between the transmission data (reply data) on the main side and the next transmission data on the sub side will be specifically described below. For example, when the transmission data on the main side representing “5” is actually transmitted from the CAN communication module on the main side to the CAN communication module on the sub side, the reception data on the sub side in step ST02 represents, for example, “5”. When the reception data on the sub side represents “5” and the fixed value on the sub side is “2”, for example, the next transmission data on the sub side is “7” (= “5” + “2” in step ST03). ]). Therefore, for example, when the next predetermined data (next transmission data) on the sub-side representing “7” is actually transmitted from the sub-CAN communication module to the main-side CAN communication module, reception on the main side in step ST12. The data (main-side received data) represents “7”, for example. At the same time, in step ST12, an addition value (“7”) between the numerical value (“5”) of the transmission data transmitted in step ST14 and the fixed value (“2”) on the sub side is calculated, The value of the reception data on the main side (next transmission data on the sub side) is compared. When the main-side CAN communication module can actually transmit the transmission data in step ST14, the value of the main-side reception data (= sub transmission-side next transmission data) matches the added value. Confirm that the CAN communication module on the main side is normal. In the next step ST13, the next reply data represents, for example, “10” (= “7” + “3”). Thus, when the main-side CAN communication module is normal, the return data is variable data.

  When the main-side CAN communication module cannot actually transmit the transmission data in step ST14, the value of the main-side reception data (= sub transmission-side next transmission data) does not match the added value. Does not confirm that the CAN communication module on the main side is normal. That is, the main control device 10 can estimate that transmission by the main CAN communication module is not actually executed, and can determine an abnormality of the main CAN communication module (see step ST15).

  Note that the main control device 10 may always omit step ST12 (and step ST15) in FIG. 2B. Therefore, for example, whether only the sub-control device 20 has a normal CAN communication module on the sub-side. You may confirm whether or not. Further, the sub-control device 20 may always omit step ST05 in FIG. 2A. Therefore, for example, the sub-control device 20 does not have to notify the main control device 10 of an abnormality in the sub-CAN communication module. In other words, only the sub control device 20 may recognize the abnormality of the CAN communication module on the sub side. Furthermore, the execution of the predetermined calculation in step ST03 and / or step ST13 may be omitted. Therefore, for example, the predetermined data and / or the reply data may be fixed data. The buffer may be initialized, and it may be confirmed in step ST12 and / or step ST02 whether the received data is valid (predetermined data and / or reply data). In addition, for example, when the main control device 10 determines that the failure of the main-side CAN communication module, step ST04 and step ST14 may be executed only once. In this case, the sub-side CAN module Before transmitting the control data to the ECU on the in-vehicle network, the sub-control device 20 may confirm the normality of the sub-side CAN module and determine the failure of the main-side CAN communication module.

  FIG. 3A is a flowchart showing an example of the operation of the main control apparatus 10 that generates CAN failure data for causing the sub-control apparatus 20 to transmit degenerate data, and FIG. 3B generates degenerate data. The flowchart figure which shows the operation example of the sub-control apparatus 20 to perform is shown. When the main controller 10 in FIG. 1 controls or supervises the ECU on the CAN, the role of the main controller 10 is large. As an example, when the main control device 10 realizes automatic traveling of the vehicle while controlling a plurality of ECUs, for example, the sub-control device 20 starts from normal automatic traveling according to the failure of the CAN communication module on the main side. For example, it is possible to shift to an exception such as a evacuation automatic traveling (including an automatic traveling stop) or an emergency automatic traveling. In other words, when the main CAN communication module is out of order, the sub-control device 20 can transmit, for example, degenerate data that degenerates the operations of a plurality of ECUs.

  In step ST21 in FIG. 3A, the main control unit 12 of the main control device 10 determines whether or not the main communication module corresponding to the first main communication module 14, for example, is out of order. The main control unit 12 includes, for example, a CAN controller, the CAN communication module is, for example, a CAN transceiver, and the CAN controller can detect or diagnose a failure of the CAN transceiver. When the main-side CAN communication module has not failed, the main control unit 12 calculates, for example, a control output value necessary for normal automatic traveling in real time, and controls, for example, an ECU that controls the actuator based on the control output value. Transmission data including the output value is transmitted from the CAN communication module on the main side (see steps ST22 and ST23). Thereby, for example, normal automatic traveling of the vehicle is realized.

  When the main-side CAN communication module is out of order, the main control unit 12 can determine whether or not the sub-side CAN communication module is out of order (see step ST24). In step ST30 of FIG. 3B, the sub control unit 22 of the sub control device 20 determines whether, for example, the CAN communication module on the sub side corresponding to the first sub communication module 24 has failed, and CAN The failure of the communication module can be transmitted to the main control unit 12 by, for example, SPI communication (see step ST36).

  When the main CAN communication module fails, the main control unit 12 can determine whether or not the sub CAN communication module is abnormal (see step ST24). In steps ST02 and ST05 in FIG. 2A, the sub-control unit 22 can confirm whether or not the sub-side CAN communication module is normal, and can control the abnormality of the CAN communication module by, for example, SPI communication. Can be communicated to part 12.

  In step ST24 of FIG. 3A, the main control unit 12 determines whether a failure or abnormality of the sub-side CAN communication module has been received, but the sub-side CAN communication is not performed. It may be determined whether only the module abnormality is received. Alternatively, the main control unit 12 may determine whether only the failure of the sub-CAN communication module is received.

  In step ST24 of FIG. 3A, when the main CAN communication module fails and the sub CAN communication module also fails, the main control unit 12 does not execute step ST25. Similarly, when the main-side CAN communication module fails and the sub-side CAN communication module is abnormal, the main control unit 12 does not execute step ST25. The main control unit 12 executes step ST25 when the main control unit 12 confirms that the main CAN communication module has failed but the sub CAN communication module has not failed and is normal. .

  In step ST25 of FIG. 3A, in order to cause the sub-control device 20 to transmit the degeneration data, the main control unit 12 transmits failure data (degeneration operation instruction) indicating a failure of the CAN communication module on the main side, for example, by SPI communication. Can be transmitted to the sub-control unit 22 (see steps ST35, ST33, and ST34 in FIG. 3B).

  When the sub-side CAN communication module has not failed, the sub-control unit 22 can determine whether the SPI communication between the main control device 10 and the sub-control device 20 is valid (FIG. 3). (See steps ST30 and ST31 of (B)). For example, when the clock signal output from the main control unit 12 is not received by the sub control unit 22, the sub control unit 22 indicates that the SPI communication is not valid, that is, the data from the SPI communication module on the main side is disconnected. Can be determined.

  When the main CAN communication module has not failed in step ST21 in FIG. 3A, the main control unit 12 informs the sub control unit 22 that the main CAN communication module has not failed through SPI communication. In other words, the main control unit 12 may always notify the sub-control unit 22 of either non-failure or failure of the main CAN communication module by SPI communication. Therefore, even when the clock signal output from the main control unit 12 is received by the sub-control unit 22, the data signal received by the sub-control unit 22 (sub-side SPI communication module) is the main-side CAN. When the communication module does not indicate any failure or failure, the sub-control unit 22 confirms that the SPI communication is not valid in step ST31, that is, the data from the main SPI communication module is disconnected. Can be determined.

  When the SPI communication between the main controller 10 and the sub controller 20 is not valid, the sub controller 22 can determine whether or not the main CAN communication module is normal (FIG. 3B (See step ST32). For example, in step ST02 of FIG. 2A, when the sub control unit 22 receives transmission data or reply data from the main CAN communication module, the main CAN communication module is normal. It can be determined that the data from the CAN communication module is not disconnected.

  When it is confirmed in step ST12 of FIG. 2B that the main-side CAN communication module is normal, the main control unit 12 detects an abnormality in the main-side CAN communication module through the SPI communication. Do not tell to. Therefore, when the data signal received by the sub-control unit 22 (sub-side SPI communication module) does not indicate an abnormality of the main-side CAN communication module, the sub-control unit 22 indicates that the main-side CAN communication module is normal. That is, it can be determined that data from the CAN communication module on the main side is not disconnected.

  In step ST32 of FIG. 3B, preferably, as described above, the sub control unit 22 uses the CAN communication between the main control device 10 and the sub control device 20, and the sub control unit 22 Normality can be confirmed. However, the sub-control unit 22 uses CAN communication between the main control device 10 and the ECU on the CAN, in other words, confirms that the main CAN communication module is transmitting transmission data addressed to the ECU. Then, it may be determined that the main CAN communication module is normal, that is, data from the main CAN communication module is not disconnected.

  Although the SPI communication between the main control device 10 and the sub control device 20 is not valid, the sub control unit 22 can estimate the disconnection of the SPI communication line when the main CAN communication module is normal. Therefore, the sub-control unit 22 does not execute steps ST33 and ST34 of FIG.

  On the other hand, when the SPI communication between the main control device 10 and the sub control device 20 is not effective and the CAN communication module on the main side is not normal, the sub control unit 22 may estimate the failure of the main control unit 12. it can. Accordingly, the sub-control unit 22 executes steps ST33 and ST34 in FIG. In particular, when the main control unit 12 or the main CPU has failed, in other words, when the main control device 10 has completely failed, the main control unit 12 can give a degenerate operation instruction to the sub-control unit 22. Can not. In such a situation, a failure of the main control unit 12 can be estimated by the sub control unit 22.

  When estimating a failure of the main control unit 12, the sub-control unit 22 calculates, in real time, a degeneration operation control output value necessary for, for example, exceptional or emergency automatic traveling, and includes transmission data ( (Degenerate data) is transmitted from the sub CAN communication module (see steps ST33 and ST34). Thereby, for example, an exception of the vehicle or an emergency automatic traveling is realized.

  When the SPI communication between the main control device 10 and the sub control device 20 is valid, the sub control unit 22 can determine whether or not the main CAN communication module has failed (see step ST35). ). In addition, when the SPI communication between the main control device 10 and the sub control device 20 is valid, the sub control unit 22 can determine whether or not the main CAN communication module is abnormal (step ST35). reference). In step ST35, the sub-control unit 22 determines whether a failure or abnormality has occurred in the main-side CAN communication module, but only a failure in the main-side CAN communication module has been received. It may be determined whether or not. Alternatively, the sub-control unit 22 may determine whether only the abnormality of the main-side CAN communication module is received.

  In step ST35 of FIG. 3B, the sub-control unit 22 can receive failure data or abnormality data (degenerate operation instruction) indicating a failure or abnormality of the CAN communication module on the main side by, for example, SPI communication. When receiving the degeneration operation instruction, the sub-control unit 22 calculates, in real time, a degeneration operation control output value necessary for, for example, an exceptional or emergency automatic traveling, and includes transmission data (degeneration data) including the degeneration operation control output. Is transmitted from the CAN communication module on the sub side (see steps ST33 and ST34). Thereby, for example, an exception of the vehicle or an emergency automatic traveling is realized.

  Note that the main control device 10 may always omit step ST24 in FIG. 3A. Therefore, for example, the sub control device 20 determines that the execution result of step ST02 in FIG. It may be confirmed at predetermined intervals that the communication module is normal. In other words, when step ST24 in FIG. 3A is omitted, every time it is determined in step ST30 in FIG. 3B that the sub-side CAN communication module has not failed, the sub control device 20 In step ST02 of (A), normal (non-abnormal) of the CAN communication module on the sub-side may be confirmed, and thereafter, for example, ST31 of FIG. 3B may be executed.

  The present invention is not limited to the above-described exemplary embodiments, and those skilled in the art will be able to easily modify the above-described exemplary embodiments to the extent included in the claims. .

  DESCRIPTION OF SYMBOLS 10 ... Main control apparatus, 12 ... Main control part, 14 ... 1st main communication module (for example, CAN communication module), 16 ... 2nd main communication module (for example, SPI communication module), 20 ... sub-control device, 22 ... sub-control unit, 24 ... first sub-communication module (for example, CAN communication module), 26 ... second sub-communication module (for example, SPI communication module).

Claims (9)

A vehicle control device having a main control unit and a sub control unit connected to an in-vehicle network,
A first main communication module capable of executing communication on the in-vehicle network;
A first sub communication module capable of executing communication on the in-vehicle network;
A second main communication module capable of executing communication on a route different from the in-vehicle network;
A second sub-communication module capable of executing communication on the different path;
With
The first sub communication module transmits transmission data including predetermined data to the first main communication module,
The first main communication module transmits reply data configured based on the transmission data to the first sub communication module;
When the first sub-communication module receives the reply data, the sub-control unit confirms whether the first sub-communication module is normal based on the reply data,
When the main control unit determines that the first main communication module has failed, the second main communication module transmits failure data to the second sub communication module;
When the second sub-communication module receives the failure data, the sub-control unit determines that the first main communication module has failed,
When it is determined that the first main communication module is out of order via the different path after it is confirmed that the first sub communication module is normal through the in-vehicle network, Transmission of control data to a vehicle-mounted device on a vehicle-mounted network is executed by the first sub-communication module instead of the first main communication module. When the data from the second main communication module is disconnected, the sub-control unit determines whether the data from the first main communication module is disconnected,
When the data from the second main communication module is disconnected and the data from the first main communication module is not disconnected, the transmission of the control data to the in-vehicle device on the in-vehicle network is the first The vehicle control device according to claim 1, wherein the vehicle control device is continuously executed by the main communication module.   When the data from the second main communication module is disconnected and the data from the first main communication module is also disconnected, the sub-control unit estimates that the main control unit has failed, The vehicle control device according to claim 2, wherein transmission of the control data to the in-vehicle device on the in-vehicle network is executed by the first sub-communication module.   The predetermined data constituting the transmission data transmitted from the first sub-communication module to the first main communication module is generated by executing a predetermined calculation in the sub-control unit at predetermined intervals. The vehicle control device according to claim 1, wherein the data is variable data.   5. The vehicle control device according to claim 4, wherein when the return data is based on the variable data, the sub control unit confirms that the first sub communication module is normal. When the reply data is not based on the variable data, the sub control unit transmits an abnormality of the first sub communication module to the main control unit via the different path,
When the abnormality of the first sub-communication module is received by the main control unit via the different path, and the main control unit determines that the first main communication module has failed, The second main communication module does not transmit the failure data of the first main communication module to the second sub communication module, and transmission of the control data to the in-vehicle device on the in-vehicle network is The vehicle control device according to claim 5, wherein the vehicle control device is not executed by the first main communication module and the first sub communication module. The sub-control unit determines whether the first sub-communication module is faulty;
After the sub control unit determines that the first sub communication module has not failed, the sub control unit determines whether the first sub communication module is normal based on the return data. The vehicle control device according to claim 1, wherein the vehicle control device is confirmed. The first sub-communication module transmits next transmission data composed of next predetermined data based on the reply data to the first main communication module,
When the first main communication module receives the transmission data, the main control unit confirms whether or not the first main communication module is normal based on the transmission data and the reply data.
When it is not confirmed that the first main communication module is normal, the second main communication module transmits an abnormality of the first main communication module to the second sub communication module. The vehicle control device according to claim 1.   When transmission of the control data to the in-vehicle device on the in-vehicle network is executed by the first sub communication module instead of the first main communication module, the control data is an operation of the in-vehicle device. The vehicular control apparatus according to claim 1, wherein the vehicular control apparatus is degenerate data that degenerates the data.

Images