Abstract:
It is an object of the present invention to accurately extract all failures occurring in a unit as hard signals and use the hard signals to completely cut off the faulty unit&#39;s communications for the purpose of maintaining the communications among the other units.  
     Disclosed is a communication control system comprising a plurality of control units which are connected via a communication bus to provide bidirectional communication. A control unit detects a failure when it occurs. Upon failure detection, the control unit generates a failure detection signal, which operates a communication signal cutoff means to cut off the communication signal transmission from the control unit. In accordance with the communication signal reception state in a control unit other than the control unit in which the failure is detected, the former control unit identifies a failure occurrence in the latter faulty control unit.

Description:
BACKGROUND OF THE INVENTION  
         [0001]    1. Field of the Invention  
           [0002]    The present invention relates to a communication control system comprising a plurality of control units and to a failure supervising method. It particularly relates to a communication control system which has a function to detect a failure and perform a fail-safe when the failure occurred in at least one of said control units, and relates to a failure supervising method for realizing the fail-safe function.  
           [0003]    2. Prior Art  
           [0004]    When a failure occurred in at least one of the control units within a conventional communication control system comprising a plurality of control units, the faulty control unit performs a systematic fail-safe by turning on a warning lamp of itself in order to inform a user of the failure or by cutting off the control signal transmission to an actuator or by shutting off the power supply to an actuator control unit. As regards a communication signal failure, a specific important control signal is combined with a hardware signal to form a redundancy system, and the resulting signal combination is compared against a communication signal to assure reliability.  
           [0005]    A method for supervising on an inter-CPU level in control unit is disclosed by Japanese Patent Laid-open No. 11-190251, etc. A method for realizing a fail-safe mechanism of backup IC is disclosed by Japanese Patent Laid-open No. 8-147001, etc. A method for supervising a microcomputer (CPU) failure by a peripheral IC is disclosed by Japanese Patent Laid-open No. 2001-312325.  
           [0006]    As a communication control system comes into more widespread use in all industrial fields, it is more frequently used as a distributed control system. In an automobile, for instance, which is equipped with conventional communication control system comprising a plurality of control units, a warning lamp is mounted on a meter panel in order to inform a driver of a failure when the failure occurred in at least one of control units. And the turning on the warning lamp is performed by the control unit in which the failure exists.  
           [0007]    However, when the idea of distributed control is adopted, a meter unit is incorporated into a communication system so that the faulty unit transmits a failure signal to the meter unit. The meter unit detects the failure signal and turns on a warning lamp. Further, in an ACC (Adaptive Cruise Control) system, an ACC control unit does not directly drive a throttle actuator or brake actuator for vehicle travel control, but transmits a torque command value and brake liquid pressure command value to an engine control unit and brake control unit respectively via a communication bus. Thereby, the respective control units drive a throttle and brake in accordance with received data.  
           [0008]    A problem here is that data communications exchanged between component units of the communication control system are transmitted/received via a microcomputer within a respective control unit. To put it concretely, if a failure occurs in the microcomputer or peripheral, a failure in one control unit cannot accurately be transmitted to another control unit at all times. As a result, the system may continue with its operation while a control failure is allowed to exist.  
         SUMMARY OF THE INVENTION  
         [0009]    The present invention is therefore made to solve the foregoing problem and it is an object of the invention to provide a communication control system for properly detecting a failure in any situation, permitting another control unit to detect a faulty unit, and accurately performing a fail-safe process, and to provide a method for supervising a failure in a communication control system.  
           [0010]    To achieve the above object, a communication control system of the present invention comprises a plurality of control units, which are connected via a communication bus to provide bidirectional communication. Each of the control units includes a failure detection means for detecting a failure when it occurs and generating a failure detection signal, and a communication signal cutoff means, which operates according to a failure detection signal generated by the failure detection means and cuts off the communication signal transmission from the control units.  
           [0011]    According to the communication control system of the present invention, a failure of respective control unit is detected by the failure detection means of its control unit, and the control unit generates a failure detection signal upon failure detection. The failure detection signal activates the communication signal cutoff means, which then cuts off the communication signal transmission from the control unit.  
           [0012]    Each control unit in the communication control system of the present invention comprises a main CPU, a supervisory IC for supervising the operation of the main CPU, and a power supply IC having a capability for detecting a constant-voltage failure. The failure detection means comprises the supervising IC and the power supply IC. When the communication control system is based on a CAN (Control Area Network) communication system, each control unit includes a CPU used for a CAN controller and a CAN driver used for a communication interface.  
           [0013]    When a failure occurs in the communication control system of the present invention, a control unit, in which a failure is detected, cuts off the communication signal transmission. Therefore, another control unit, in which no failure is detected, can identify the failure occurrence in the above-mentioned faulty control unit in accordance with its own reception state. As a result, another control unit that has identified the failure occurrence can operate a warning means connected to itself to notify an operator of the failure occurrence or stop the operation of the actuator targeted for control for fail-safe processing purposes.  
           [0014]    The communication signal cutoff means incorporated in the communication control system of the present invention cuts off the communication signal transmission from a control unit, in which a failure is detected, by disconnecting the communication line (cutting off the communication signal transmission), by disconnecting the transmission line for the communication section in the control unit in which the failure is detected, by shutting off the power supply to the communication interface for the control unit in which the failure is detected, or by placing the communication interface for the communication section of the control unit, in which the failure is detected, in a sleep mode.  
           [0015]    To achieve the above object, the method for supervising a failure in the communication control system of the present invention serves as a failure supervising method for the communication control system comprising a plurality of control units that are connected via a communication bus to provide bidirectional communication. This failure supervising method detects a failure in a control unit, cuts off the communication signal transmission from the control unit upon failure detection, and cuts off the communication signal transmission from the control unit, in which the failure is detected, for the purpose of causing another control unit to identify a failure occurrence in the control unit, in which the failure is detected, in accordance with its own communication signal reception state.  
           [0016]    The failure supervising method for the communication control system of the present invention cuts off the communication signal transmission from a control unit in which a failure is detected. This communication signal transmission cutoff is recognized from the communication signal reception state of another control unit. Consequently, the failure occurrence in a control unit is recognized by another control unit.  
           [0017]    In the occurrence of a failure, the failure supervising method for the communication control system of the present invention informs the operator of the failure by operating the warning means in a control unit which identified the failure occurrence and stops, for fail-safe processing purposes, the actuator controlled by a control unit which the failure occurrence identified.  
           [0018]    Upon failure detection, the failure supervising method for the communication control system of the present invention cuts off the communication signal transmission from a control unit in which a failure is detected, by disconnecting the communication line, by disconnecting the transmission line for the communication section of the control unit in which the failure is detected, by shutting off the power supply to the communication interface for the communication section of the control unit in which the failure is detected, or by placing in a sleep mode the communication interface for the communication section of the control unit in which the failure is detected. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0019]    [0019]FIG. 1 is a schematic block diagram of one embodiment of a communication control system according to the present invention.  
         [0020]    [0020]FIG. 2 is a data table illustrating one embodiment of a communication control system according to the present invention.  
         [0021]    [0021]FIG. 3 is a flowchart illustrating a fail-safe process of one embodiment of a communication control system according to the present invention.  
         [0022]    [0022]FIG. 4 is a flowchart illustrating a fail-safe process of one embodiment of a communication control system according to the present invention.  
         [0023]    [0023]FIG. 5 is a schematic block diagram of a first embodiment of a communication control system according to the present invention.  
         [0024]    [0024]FIG. 6 is a schematic block diagram of a second embodiment of a communication control system according to the present invention.  
         [0025]    [0025]FIG. 7 is a schematic block diagram of a third embodiment of a communication control system according to the present invention.  
         [0026]    [0026]FIG. 8 is a schematic block diagram of a fourth embodiment of a communication control system according to the present invention.  
         [0027]    [0027]FIG. 9 is a schematic block diagram of a fifth embodiment of a communication control system according to the present invention. 
     
    
     DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0028]    Preferred embodiments of the present invention will now be described with reference to the accompanying drawings.  
         [0029]    [0029]FIG. 1 illustrates a typical configuration of a communication control system according to one embodiment of the present invention. The communication control system includes a plurality of control units  10 A,  10 B- 10 N. The control units  10 A,  10 B- 10 N are interconnected via a communication bus  100  so as to provide bidirectional communication. These control units  10 A,  10 B- 10 N exchange data with each other and exercise control over actuators  41 , warning lamps  42 , motors  43 , and other components connected to their outputs.  
         [0030]    For the convenience of explanation, the present embodiment assumes that control unit  10 A (unit A) is faulty. Since all control units  10 A,  10 B- 10 N have substantially the same structure, control unit  10 A will now be described herein.  
         [0031]    Control unit  10 A includes a main CPU  11 , a supervising IC  12  for supervising the results of computations performed by the main CPU  11 , a power supply IC  13 , input interface sections  14  for switch signal detection, an output interface section  15  for outputting a signal to an actuator  41 , and a communication driver  16  for exchanging communication signals with the communication bus  100 .  
         [0032]    The main CPU  11  includes input ports  17  for receiving a signal input from the input interface sections  14 , an output port  18  for outputting a signal to the output interface section  15 , a communication port  19  for exchanging communication signals with the communication driver  16 , a parallel port  20  for making a parallel connection to the supervising IC  12 , a P_RUN signal output terminal  21 , and a RESET signal input terminal  22 .  
         [0033]    A 3-input AND circuit  30  is provided between the output port  18  and output interface section  15  of the main CPU  11 . The 3-iniput AND circuit  30  selectively cuts off the actuator drive signal transmission from the output port  18  to the output interface section  15 .  
         [0034]    A communication signal cutoff means  31  is provided between the communication port  19  and communication driver  16  of the main CPU  11 . The communication signal cutoff means  31  closes when the output of a 2-input AND circuit  32  is High and opens when the same output is Low.  
         [0035]    The power supply IC  13  includes a constant-voltage output terminal  26 , a constant-voltage failure output terminal  27 , a P_RUN signal input terminal  28  for receiving a RUN signal input from the P_RUN signal output terminal  21  of the main CPU  11 , and a RESET signal output terminal  29  for outputting a reset signal to the RESET signal input terminal  22  of the main CPU  11 . The power supply IC  13  supervises the RUN signal that is output from the main CPU  11 . Upon failure recognition, the power supply IC  13  resets the main CPU  11  by outputting a reset signal to the main CPU  11  from the RESET signal output terminal  29 .  
         [0036]    The output (constant-voltage failure output signal) from the constant-voltage failure output terminal  27  of the power supply IC  13  is entered into the 3-input AND circuit 30 and 2-input AND circuit  32 . When the constant-voltage value output from the power supply IC  13  is abnormal, a normal judgment may not be formulated due to unstable operations of the main CPU  11  and supervising IC  12 . Therefore, the signal level changes from High to Low for failure detection signaling purposes.  
         [0037]    Consequently, if the constant-voltage value output from the power supply IC  13  is abnormal, a fail-safe process is performed so that the 3-input AND circuit  30  cuts off the signal to be entered from the main CPU  11  to the output interface section  15  for driving the actuator  41 , and that the signal cutoff means  31  cuts off the signal to be entered from the communication port  19  to the communication driver  16 .  
         [0038]    The supervising IC  12  includes a parallel port  23  for making a parallel connection to the main CPU  11 , a P_RUN signal input terminal  24  for receiving a RUN signal input from the P_RUN signal output terminal  21  of the main CPU  11 , and a system shut signal output terminal  25  for outputting a system shut signal as a failure detection signal.  
         [0039]    The supervising IC  12  enters a system shut signal from the system shut signal output terminal  25  into the 3-input AND circuit 30 and 2-input AND circuit  32 , enters a RUN signal from the main CPU  11  to the P_RUN signal input terminal  24 , and compares register computation results via the parallel port  23 . If the comparison reveals any failure, the supervising IC  12  changes the level of the system shut signal (failure detection signal) from High to Low.  
         [0040]    When a failure is recognized by the supervising IC  12  in the above manner, a fail-safe process is performed so that the 3-input AND circuit  30  cuts off the signal to be entered from the main CPU  11  to the output interface section  15  for driving the actuator  41 , and that the signal cutoff means  31  cuts off the signal to be entered from the communication port  19  to the communication driver  16 .  
         [0041]    When the communication signal is cut off according to a constant-voltage failure signal and system shut signal generated by the power supply IC  13  and supervising IC  12 , another control unit ( 10 B,  10 C, etc.) detects such a communication signal cutoff and performs a fail-safe process. This fail-safe process will now be described with reference to FIGS. 2 and 3.  
         [0042]    [0042]FIG. 2 shows an example of communication data exchanged by the communication control devices shown in FIG. 1. Individual communication data are assigned unique ID numbers so that the data length, transmission intervals, and transmitting and receiving units are stipulated for each communication data.  
         [0043]    For this example, it will be assumed that 4-bit data having the data ID number  123  is transmitted from control unit  10 A (unit A) to control unit  10 B (unit B) and control unit  10 C (unit C). When viewed from control units  10 B and  10 C, the data having the data ID number  123  is updated at 100 ms intervals and supervised by control units  10 B and  10 C.  
         [0044]    The 3-input AND circuit  30  ANDs the output from the output interface section  15  with the constant-voltage failure output from the power supply IC  13  even if the output port  18  is being controlled and the High level prevails. Therefore, when, for instance, the constant-voltage output varies from a specified value due to a failure in the power IC  13  and the constant-voltage failure output signal goes Low, the control signal entered from the main CPU  11  of control unit  10 A to the output interface section  15  of the same control unit is cut off and the operation of the actuator  41  comes to a stop.  
         [0045]    The communication signal cutoff means  31  also works in the same manner. When the constant-voltage failure output signal of the power supply IC  13  goes Low, the communication driver  16  for exchanging communication signals does not transmit any communication signal because it is cut off due to ANDing by the 2-input AND circuit  32 . As a result, control units  10 B and  10 C to  10 N cannot recognize the data having the data ID number  123 .  
         [0046]    Control unit  10 B repeatedly executes a unit B failsafe processing routine shown in FIG. 3 at predetermined time intervals. The unit B fail-safe processing routine checks whether the data having the ID number  123  is updated at predetermined communication intervals (step S 11 ).  
         [0047]    A generally employed means for checking whether the data is updated is to increment a data counter on each reception cycle and supervise the data or perform computations on specified data (e.g., add data) on each communication cycle and check at predetermined intervals whether a specified computation result (e.g., addition result) is obtained.  
         [0048]    If the data update check reveals that the data is properly updated (the question in step S 11  is answered “Yes”), a process is performed so as to keep a warning lamp  42  illuminated pt extinguish the warning lamp  42  (step S 12 ). If, on the other hand, the data is not properly updated (the question in step S 11  is answered “No”), the warning lamp  42  is illuminated (step S 13 ) so as to notify the operator (vehicle driver) of a failure.  
         [0049]    In like manner, control unit  10 C repeatedly executes a unit C fail-safe processing routine shown in FIG. 4 at predetermined time intervals in order to check whether the data having the ID number  123  is updated at predetermined communication intervals (step S 21 ).  
         [0050]    If the data update check reveals that the data is properly updated (the question in step S 21  is answered “Yes”), a motor  43  is allowed to be driven (step S 22 ). If, on the other hand, the data is not properly updated (the question in step S 21  is answered “No”), the motor  43  is inhibited from being driven and brought to a forced stop (step S 23 ) to perform a fail-safe process.  
         [0051]    When a failure occurs in a communication control system, the communication signal cutoff means  31  discontinues, as described above, the data transmission from a control-signal-transmitting control unit (e.g., control unit  10 A), in which the failure is encountered, and a receiving-end control unit (e.g., control unit  10 B or  10 C) detects that a data update is discontinued. This ensures that a fail-safe process can be properly performed. It is important in communication cutoff that the cutoff logic of a discontinuing end be confined to the recessive side so as to maintain the communications among the other units.  
         [0052]    Some embodiments of the communication signal cutoff means  31 , which meet the aforementioned requirements, will now be described with reference to FIGS.  5  to  9 . For the purposes of this description, a control unit in which a failure is encountered will be referred to as a faulty unit  50 , whereas a control unit other than the faulty unit is referred to the other unit  90 .  
         [0053]    [0053]FIG. 5 illustrates a first embodiment of the present invention. It represents an embodiment that disconnects the line between a CAN controller CPU  51  and a CAN driver  52  for providing communication interface in a CAN (Control Area Network) communication system, which is based on a specific communications protocol that is now increasingly used particularly in the automotive and other industries. The CAN controller CPU  51  and CAN driver  52  are interconnected with serial communication lines CAN-Rx and CAN-Tx.  
         [0054]    Upon detection of a constant-voltage failure, system shut signal, or other failure signal in a faulty unit  50 , a failure check means  53  outputs a High-level failure detection signal (FAIL signal). A transistor switching circuit  54  then performs a switching operation so that serial communication line CAN-Tx, which is connected between the output of the CAN controller  51  and the CAN driver  52 , is fixed at a Low level. Therefore, the CAN driver  52  remains in a no-signal output state. The other unit  90 , which is connected to the communication bus (CAN bus)  100 , detects this state and performs a fail-safe process. The other unit  90  also includes a CAN controller CPU  91  and a CAN driver  92 . The CAN driver  52  of the faulty unit  50  is connected to the CAN driver  92  of the other unit  90  with CAN-H and CAN-L terminals.  
         [0055]    When the CAN driver  52  of the faulty unit  50  stays in a no-signal output state, the other unit  90  illuminates a warning lamp  96  that is connected to its own output interface section  95 . In the present embodiment, a communication cutoff circuit can be formed within a unit without using a high-side driver or other expensive device. Therefore, a significant cost increase does not result.  
         [0056]    [0056]FIG. 6 illustrates a second embodiment, which includes a high-side driver  55 , which is provided in a power supply circuit for the CAN driver  52  of the faulty unit  50 . This high-side driver  55  shuts off the power (constant voltage Vcc) for the CAN driver  52 . When a constant-voltage failure, system shut signal, or other failure signal in the faulty unit  50  is detected by the failure check means  53  in the present embodiment, the failure check means  53  also outputs a High-level failure detection signal.  
         [0057]    The transistor switching circuit  54  then performs a switching operation so that the high-side driver  55 , which supplies power to the CAN driver  52 , changes its state so as to stop the power supply to the CAN driver  52 . As a result, the CAN driver  52  stays in a no-signal output state. The other unit  90 , which is connected to the communication bus  100 , detects this state and then performs a fail-safe process in the same manner as with the first embodiment shown in FIG. 5.  
         [0058]    In the second embodiment, the cost is relatively high because the high-side driver  55  turns off the CAN driver  52  instead of disconnecting the line between the CAN controller CPU  51  and CAN driver  52 . However, it is not necessary to insert a resistor or the like into a serial communication line between the CAN controller CPU  51  and CAN driver  52 . Therefore, no design changes need be made to compensate for a decreased communication speed or the like. The present embodiment supports high-grade specifications for high-speed communications.  
         [0059]    [0059]FIG. 7 illustrates a third embodiment, which disconnects the communication bus (CAN bus)  100  outside the faulty unit  50 . In the present embodiment, the communication bus  100  is provided with a relay switch  61 . The relay switch  61  opens/closes in accordance with the on/off operation of the transistor switching circuit  54 .  
         [0060]    When a constant-voltage failure, system shut signal, or other failure signal in the faulty unit  50  is detected by the failure check means  53  in the present embodiment, the failure check means  53  also outputs a High-level failure detection signal. The transistor switching circuit  54  then performs a switching operation so as to open the relay switch  61 , which is provided externally to the units and mounted on the communication bus  100  connected between the CAN driver  52  and the other unit  90 . As a result, the relay switch  61  disconnects the communication bus  100 .  
         [0061]    When the communication bus  100  is disconnected as described above, no more data transmission from the faulty unit  50  exists on the communication bus  100  so that a no-signal output state prevails. The other unit  90 , which is connected to the communication bus  100 , detects this state and then performs a fail-safe process in the same manner as with the embodiment shown in FIG. 5. In the third embodiment, existing control units may be used without being redesigned because the relay switch  61  is added externally to the units.  
         [0062]    [0062]FIG. 8 illustrates a fourth embodiment. In the present embodiment, bias line b for a switching transistor  57 , which is connected to the output of a CAN-Tx register  56  for a CAN controller CPU  51 ′, is independently positioned outside the CPU package so that the voltage of bias line b is controlled by the switching circuit  54 .  
         [0063]    When a constant-voltage failure, system shut signal, or other failure signal in the faulty unit  50  is detected by the failure check means  53  in the present embodiment, the failure check means  53  also outputs a High-level failure detection signal. The transistor switching circuit  54  then performs a switching operation so as to shut off the bias supply to the output of the CAN-Tx register  56  incorporated in the CAN controller CPU  51 ′. As a result, the CAN driver  52  stays in a no-signal output state. The other unit  90 , which is connected to the communication bus  100 , detects this state and then performs a fail-safe process in the same manner as with the embodiment shown in FIG. 5. In the fourth embodiment, bias line b, which is connected to the output of the CAN-Tx register  56 , is merely positioned outside the CAN controller CPU  51 ′. Since no other devices or parts are required, the cost does not increase.  
         [0064]    [0064]FIG. 9 illustrates a fifth embodiment, in which a CAN driver  52 ′ incorporates a sleep/standby function. As is well known, the sleep/standby function reduces the system&#39;s power consumption during the interval between the instant at which the system is stopped and the instant at which the system is later restarted, by retaining the data stored in a RAM and various other data for use in a system restart.  
         [0065]    When the sleep/standby terminal goes Low, the CAN driver  52 ′ enters a sleep/standby mode. In the sleep/standby mode, the CAN driver  52 ′ stops outputting data to the CAN bus (communication bus  100 ) and performs only a read operation (to read data on the CAN bus) for the CAN controller CPU  51 . The sleep/standby terminal of the CAN driver  52 ′ goes High or Low in accordance with the transistor switching circuit  54 .  
         [0066]    When the failure check means  53  detects a constant-voltage failure, system shut signal, or other failure signal in the faulty unit  50  and then outputs a High-level failure detection signal, the transistor switching circuit  54  performs a switching operation so that the sleep/standby terminal of the CAN driver  52 ′ goes Low. This places the CAN driver  52 ′ in the sleep/standby mode and inhibits the CAN-Rx signal output from the CAN controller CPU  51  from being positioned on the communication bus  100 . Consequently, no more data transmission from the faulty unit  50  exists on the communication bus  100  so that a no-signal output state prevails. The other unit  90 , which is connected to the communication bus  100 , detects this state and then performs a fail-safe process in the same manner as with the embodiment shown in FIG. 5.  
         [0067]    In the present embodiment, the existing CAN driver  52  having the sleep/standby function can be continuously used so that no other devices or parts are required. Therefore, the cost does not increase.  
         [0068]    While the present invention has been described in detail in terms of preferred embodiments (five embodiments), it should be understood that the invention is not limited to those preferred embodiments, and that various design changes can be made without departure from the scope and spirit of the invention as set forth in the appended claims.  
       INDUSTRIAL APPLICABILITY  
       [0069]    Effect of the Invention  
         [0070]    The present invention can properly detect a failure in a distributed control system for communications no matter what failure is encountered, enable a unit to detect the existence of any faulty unit, and accurately perform a fail-safe process.