JP2010181212A - System and method of diagnosing fault - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a fault diagnostic system rapidly and accurately identifying true events causing faults even if a plurality of ECUs output abnormality signals. <P>SOLUTION: The fault diagnostic system 1 includes: a fault tree building device 3; a fault diagnostic device 5; a fault propagation database 7; a fault tree database 9. The fault tree building device 3 builds fault tree groups used for fault diagnoses from data of the fault propagation database 7, data of fault trees built for respective ECUs, and the like, and registers the group in the fault tree database 9. The fault diagnostic device 5 performs fault diagnoses based on the fault tree database 9 when the ECUs output abnormality signals and outputs the diagnostic result. Fault diagnoses are performed by information on fault events of which signals are output from the ECUs and information on fault events of which no signals are output from the ECUs. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a failure diagnosis system and a failure diagnosis method for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs (Electronic Control Units).

  In recent years, in an in-vehicle system equipped with a plurality of ECUs, it has become difficult to identify a failure location as the system becomes more complex and larger. Normally, each ECU outputs an abnormal signal indicating that it cannot operate normally when it cannot operate normally. In a complex and large-scale in-vehicle system, if one event that causes a failure occurs, the failure propagates and a plurality of ECUs cannot operate normally. At this time, since each ECU outputs an abnormal signal, it becomes difficult to specify the event causing the failure.

  In the mechanism described in Patent Document 1, a maintenance person sequentially infers a part that causes a failure by inputting a failure symptom. Probability information is added to failure factors, and sequential reasoning is performed using a rule base that represents a functional chain.

Japanese Patent No. 2907873

  However, in the mechanism described in Patent Document 1, it is necessary for the mechanic to receive education and training for handling the inference system, and the inference result depends on the mechanic. In addition, diagnosis takes time due to sequential reasoning. In addition, the diagnosis result tends to be ambiguous. Therefore, a failure diagnosis system that performs failure diagnosis quickly and accurately is desired.

  As described above, each ECU has a function of outputting an abnormality signal. Therefore, it may be considered to identify an event that causes a failure based on an abnormal signal output from each ECU. As a technique for identifying an event that causes a failure, for example, a failure tree analysis (FTA) can be considered. On the other hand, since the in-vehicle system has become complicated and large-scale, each ECU is independently developed and designed. Therefore, a failure tree can be constructed only for each ECU. The failure tree constructed for each ECU cannot grasp the propagation of the failure, etc., and when the abnormal signal is output from multiple ECUs, the event that causes the true failure (the failure propagation source event) is accurate. Cannot be specified.

  The present invention has been made in view of the above-described problems, and its purpose is to quickly and accurately identify an event that causes a true failure even when abnormal signals are output from a plurality of ECUs. It is to provide a failure diagnosis system and the like that can be used.

  In order to achieve the above-described object, a first invention is a failure diagnosis system for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs, and inputs a failure tree having a failure event detected by the ECU as a top event. And, based on a fault propagation model that models a path through which a fault propagates between the ECUs, a fault propagation path calculation means for calculating a fault propagation path between the fault trees, and an overlap of basic events between the fault trees. A fault tree grouping means for searching and grouping the fault trees having overlapping basic events as a fault tree group; and a fault that holds the fault tree group and the fault propagation path When a signal indicating the occurrence of the failure event is output from the tree database and the ECU, the failure diagnosis means that searches the failure tree database and performs failure diagnosis, and A fault diagnosis system, wherein the fault diagnosis apparatus, in that they are composed of comprising a diagnosis result output means for outputting a diagnosis result of impaired diagnosing means. According to the first invention, even if an abnormal signal is output from a plurality of ECUs, an event that causes a true failure can be accurately identified.

  According to a first aspect of the present invention, the failure diagnosis means searches the failure tree database using information on a failure event for which the signal is output from the ECU and information on a failure event for which the signal is not output from the ECU. It is desirable to perform failure diagnosis. As a result, failure diagnosis processing can be performed quickly.

  Further, for example, the failure diagnosis means in the first invention specifies a combination of basic events satisfying the generated failure event as a failure cause under the constraint that the basic events of the failure cause are minimum.

  In addition, for example, the failure tree database in the first invention further holds the probability that each basic event will occur, and the failure diagnosis means has a basic event that satisfies the generated failure event under the constraint that the overall probability is maximum. Identify the combination as the cause of failure.

  A second invention is a failure diagnosis system for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs, wherein a failure tree having a failure event detected by the ECU as a top event is input, and a failure occurs between the ECUs. A fault tree construction device comprising fault propagation path calculation means for calculating a fault propagation path between the fault trees based on a fault propagation model that models a propagation path, and holds the fault tree and the fault propagation path A fault tree database, and when a signal indicating the occurrence of the fault event is output from the ECU, the fault tree database is searched in consideration of duplication of basic events between the fault trees and a fault diagnosis is performed. And a failure diagnosis apparatus comprising: a diagnosis result output means for outputting a diagnosis result of the failure diagnosis means. According to the second invention, even if an abnormal signal is output from a plurality of ECUs, an event that causes a true failure can be accurately specified.

  A third invention is a failure diagnosis method for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs, wherein a failure tree having a failure event detected by the ECU as a top event is input, and a failure occurs between the ECUs. Based on a fault propagation model that models a propagation path, calculating a fault propagation path between the fault trees, registering the fault propagation path in a fault tree database, and duplication of basic events between the fault trees Searching, grouping the fault trees having overlapping basic events as a fault tree group, registering the fault tree group in the fault tree database, and outputting a signal indicating the occurrence of the fault event from the ECU Then, searching for the fault tree database, performing fault diagnosis, and outputting a diagnosis result of the fault diagnosis is included. It is a disabled diagnostic methods.

  A fourth invention is a failure diagnosis method for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs, wherein a failure tree having a failure event detected by the ECU as a top event is input, and a failure occurs between the ECUs. Calculating a fault propagation path between the fault trees based on a fault propagation model that models a propagation path, and registering the fault tree and the fault propagation path in a fault tree database; When a signal indicating the occurrence of a fault is output, the fault tree database is searched in consideration of duplication of basic events between the fault trees, a fault diagnosis is performed, and a diagnosis result of the fault diagnosis is output. A fault diagnosis method characterized by including:

  According to the present invention, it is possible to provide a failure diagnosis system and the like that can quickly and accurately identify an event that causes a true failure even when abnormal signals are output from a plurality of ECUs.

The figure which shows schematic structure of the failure diagnosis system 1 Hardware configuration diagram of a computer realizing the fault tree construction device 3 Hardware configuration diagram of failure diagnosis device 5 Flow chart showing details of operation of fault tree construction device 3 Flow chart showing details of operation of failure diagnosis device 5 The figure which shows an example of the failure tree of vehicle speed calculation ECU The figure which shows an example of the failure tree of EPS ECU Diagram showing an example of a structural model Diagram showing an example of a fault propagation model Diagram showing an example of failure propagation path Schematic diagram of fault tree and fault propagation path Schematic diagram of fault trees with overlapping basic events Schematic diagram of fault trees without overlapping basic events The figure which shows the 1st failure diagnosis result The figure which shows the 2nd failure diagnosis result The figure which shows the 3rd failure diagnosis result The figure which shows the 4th failure diagnosis result The figure which shows the 5th failure diagnosis result

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the embodiment of the present invention, it is assumed that a fault tree is constructed for each ECU in the in-vehicle system to be diagnosed. In addition, it is assumed that a structural model (see FIG. 8) that models the structure of the in-vehicle system to be diagnosed or a failure propagation model (see FIG. 9) that models a path through which a fault propagates between ECUs is built. It becomes.

  FIG. 1 is a diagram showing a schematic configuration of a failure diagnosis system 1. The failure diagnosis system 1 is a system for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs. As shown in FIG. 1, the failure diagnosis system 1 includes a failure tree construction device 3, a failure diagnosis device 5, a failure propagation database 7, a failure tree database 9, and the like.

  The fault tree construction device 3 is, for example, a computer, and does not need to be mounted on the in-vehicle system to be diagnosed. The failure tree construction device 3 constructs a failure tree group used for failure diagnosis from the data of the failure propagation database 7, the failure tree data (not shown) constructed for each ECU, etc., and registers the failure tree group in the failure tree database 9. .

  The failure diagnosis device 5 is mounted on an in-vehicle system to be diagnosed, for example, as an ECU that performs a failure diagnosis function. When an abnormality signal is output from the ECU, the failure diagnosis device 5 performs failure diagnosis based on the failure tree database 9 and outputs a diagnosis result. Note that the failure diagnosis device 5 may be configured as a computer without being mounted in the in-vehicle system to be diagnosed for the purpose of performing failure diagnosis before repair and maintenance. Hereinafter, the failure diagnosis apparatus 5 will be described as an ECU mounted on the in-vehicle system to be diagnosed.

  FIG. 2 is a hardware configuration diagram of a computer that implements the fault tree construction apparatus 3. Note that the hardware configuration in FIG. 2 is an example, and various configurations can be adopted depending on the application and purpose.

  The fault tree construction apparatus 3 includes a control unit 31, a storage unit 32, a media input / output unit 33, a communication control unit 34, an input unit 35, a display unit 36, a peripheral device I / F unit 37, etc. connected via a bus 38. Is done.

  The control unit 31 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like.

The CPU calls a program stored in the storage unit 32, ROM, recording medium or the like to a work memory area on the RAM, executes it, drives and controls each device connected via the bus 38, and the fault tree construction device 3 The process to be described later is realized.
The ROM is a non-volatile memory and permanently holds a computer boot program, a program such as BIOS, data, and the like.
The RAM is a volatile memory, and temporarily stores a program, data, and the like loaded from the storage unit 32, ROM, recording medium, and the like, and includes a work area used by the control unit 31 for performing various processes.

The storage unit 32 is an HDD (hard disk drive), and stores a program executed by the control unit 31, data necessary for program execution, an OS (operating system), and the like. As for the program, a control program corresponding to an OS (operating system) and an application program for causing a computer to execute processing described later are stored.
Each of these program codes is read by the control unit 31 as necessary, transferred to the RAM, read by the CPU, and executed as various means.

The media input / output unit 33 (drive device) inputs / outputs data, for example, a CD drive (-ROM, -R, -RW, etc.), DVD drive (-ROM, -R, -RW, etc.), MO drive, etc. And other media input / output devices.
The communication control unit 34 has a communication control device, a communication port, and the like, is a communication interface that mediates communication between the computer and the network 39, and controls communication with other computers via the network 39.

The input unit 35 inputs data and includes, for example, a keyboard, a pointing device such as a mouse, and an input device such as a numeric keypad.
An operation instruction, an operation instruction, data input, and the like can be performed on the computer via the input unit 35.
The display unit 36 includes a display device such as a CRT monitor and a liquid crystal panel, and a logic circuit (such as a video adapter) for realizing a video function of the computer in cooperation with the display device.

The peripheral device I / F (interface) unit 37 is a port for connecting a peripheral device to the computer, and the computer transmits and receives data to and from the peripheral device via the peripheral device I / F unit 37. The peripheral device I / F unit 37 is configured by USB, IEEE 1394, RS-232C, or the like, and usually includes a plurality of peripheral devices I / F. The connection form with the peripheral device may be wired or wireless.
The bus 38 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

  FIG. 3 is a hardware configuration diagram of the failure diagnosis apparatus 5. Note that the hardware configuration shown in FIG. 3 is merely an example, and various configurations can be adopted depending on the application and purpose.

  As shown in FIG. 3, the failure diagnosis apparatus 5 includes a control unit 51, a storage unit 52, a communication interface 53, and the like.

  The controller 51 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like.

The CPU calls and executes a program stored in the storage unit 52, the ROM, the recording medium, etc. to the work memory area on the RAM, and drives and controls the entire failure diagnosis apparatus 5.
The ROM is a non-volatile memory and permanently holds programs, data, and the like necessary for processing.
The RAM is a volatile memory, and temporarily stores a program, data, and the like loaded from the storage unit 52, the ROM, and the like, and includes a work area used by the control unit 51 for performing various processes.

The storage unit 52 stores a program executed by the control unit 51, data necessary for program execution, an OS (operating system), and the like.
Each of these program codes is read by the control unit 51 as necessary, transferred to the RAM, read by the CPU, and executed as various means.

  The communication interface 53 mediates communication between the failure diagnosis apparatus 5 and an in-vehicle LAN 54 such as a CAN (Controller Area Network).

  Next, details of the operation of the fault tree construction device 3 will be described with reference to FIGS. 4 and 6 to 13.

  FIG. 4 is a flowchart showing details of the operation of the fault tree construction apparatus 3. As shown in FIG. 4, the control unit 31 of the fault tree construction apparatus 3 inputs a fault tree (S101). The failure tree to be input is constructed with a failure event defined for each ECU as a top event. The top event is the root of the fault tree (Root). The ECU has a function of outputting a corresponding diagnostic signal (diagnostic signal) when a failure event occurs. A plurality of failure events may be defined for each ECU. Hereinafter, in order to simplify the description, one failure event is defined for one ECU.

  FIG. 6 is a diagram illustrating an example of a failure tree of the vehicle speed calculation ECU. In the vehicle speed calculation ECU 61, for example, an internal circuit failure 62 is defined as a failure event. The fault tree shown in FIG. 6 is constructed with the internal circuit fault 62 as a top event. In the symbols shown in FIG. 6, 62 represents a top event, 63 represents an OR gate, and 64 to 66 represent basic events. The basic event is a basic event that is not developed any more, or a basic event at the lowest level where the probability of occurrence can be obtained independently, and is a leaf (Leaf). FIG. 6 shows that when any one of the microcomputer fault 64, the memory circuit fault 65, and the communication circuit fault 66 occurs, the top event internal circuit fault 62 occurs and the vehicle speed calculation ECU 61 outputs a diagnosis signal.

  FIG. 7 is a diagram illustrating an example of a failure tree of an EPS (Electric Power Steering) ECU. The EPS ECU 71 is assumed to define an EPS control stop 72 as a failure event, for example. In the symbols shown in FIG. 7, 72 is a top event, 73 is an OR gate, 77 is an AND gate, 75 is an intermediate event, and 74, 76, 78, and 79 are basic events. An intermediate event is an event that occurs due to a combination of basic events or the like, and is neither a top event nor a basic event. FIG. 7 shows that when any one of the steering angle sensor 74, the torque value output stop 75, and the vehicle speed data stop 76 occurs, the EPS control stop 72 of the top event occurs and the EPS ECU 71 outputs a diagnosis signal. . In addition, when both the torque sensor 1 failure 78 and the torque sensor 2 failure 79 occur, an intermediate event torque value output stop 75 occurs.

  Returning to the description of FIG. Next, the control unit 31 constructs a fault propagation model (S102). The control unit 31 can construct a failure propagation model (see FIG. 9) by referring to the structure model (see FIG. 8) showing the structure of the system to be diagnosed from the failure propagation database 7. In addition, a failure propagation model may be input to the failure propagation database 7 in advance.

  FIG. 8 is a diagram illustrating an example of a structural model. The example shown in FIG. 8 shows the structure of an in-vehicle system in which a vehicle speed ECU 61 and an EPS ECU 71 are connected via an in-vehicle LAN 54. The vehicle speed ECU 61 includes a processor, a memory, and a communication IC. The processor of the vehicle speed ECU 61 calculates a vehicle speed by using a signal from the wheel speed sensor as an input, and outputs the vehicle speed to the EPS ECU 71 via the communication IC. The EPS ECU 71 includes a processor, a memory, and a communication IC. The EPS ECU 71 calculates a control value by using a signal from the vehicle speed ECU 61 via the torque sensor 1, the torque sensor 2, the rudder angle sensor, and the communication IC as input, and outputs the control value to the motor.

  FIG. 9 is a diagram illustrating an example of a failure propagation model. The failure propagation model shows the state of failure propagation in a state transition diagram. When the communication IC of the vehicle speed ECU 61 enters a “communication stop” state, the communication IC of the EPS ECU 71 enters a “communication stop” state. Further, when the communication IC of the vehicle speed ECU 61 enters a “communication error” state, the communication IC of the EPS ECU 71 enters a “communication error” state. Further, when the in-vehicle LAN 54 is in the “disconnected” state, the communication IC of the EPS ECU 71 is in the “communication stopped” state. Further, when the in-vehicle LAN 54 enters the “noise” state, the communication IC of the EPS ECU 71 enters the “communication error” state.

  Furthermore, when the communication IC of the EPS ECU 71 is in a “communication stop” state, the vehicle speed data is in a “data stop” state. Further, when the communication IC of the EPS ECU 71 enters a “communication error” state, the vehicle speed data enters a “data abnormality” state.

  Returning to the description of FIG. Next, the control unit 31 calculates a fault propagation path between fault trees from the fault propagation model constructed in S102 (S103). A fault propagation path is a path through which a fault propagates between fault trees via other components.

  FIG. 10 is a diagram illustrating an example of a failure propagation path. In the example shown in FIG. 10, when a communication circuit failure 66 occurs in the vehicle speed calculation ECU 61, a vehicle speed data stop 76 occurs in the EPS ECU 71. In this case, the failure propagation path is a path from the communication circuit fault 66 to the vehicle speed data stop 76.

  FIG. 11 is a schematic diagram of a fault tree and a fault propagation path. In the fault tree A, the top event is the fault event 1, and the basic events are the events a, b, c, and d. In the fault tree B, the top event is the fault event 2 and the basic events are the events e, f, g, and h. Events i and k are events included in the failure propagation path calculated in S103. The failure propagation path shown in FIG. 11 is a path having event c as the propagation source and event h as the propagation destination via event i and event k.

  Returning to the description of FIG. Next, the control unit 31 searches for an overlap of basic events between fault trees, and groups fault trees having the overlap of basic events as a fault tree group (S104).

  FIG. 12 is a schematic diagram of fault trees having overlapping basic events. In the fault tree C, the top event is the fault event 3, and the basic events are the events a, b, c, and d. In the failure tree D, the top event is the failure event 4 and the basic events are the events d, e, and f. The overlapping basic event is event d. In this case, the control unit 31 groups the failure tree C and the failure tree D as a failure tree group.

  FIG. 13 is a schematic diagram of fault trees with no overlapping of basic events. In the failure tree E, the top event is the failure event 5 and the basic events are the events h, i, j, and k. In the fault tree F, the top event is the fault event 6 and the basic events are the events m, n, and o. There are no overlapping basic events. In this case, the control unit 31 treats the fault tree E and the fault tree F as different fault tree groups.

  Returning to the description of FIG. Next, the control unit 31 registers the fault tree group and the fault propagation path in the fault tree database 9 (S105). The failure tree database 9 is held in the storage unit 52 of the failure diagnosis apparatus 5 to dictate.

  Next, details of the operation of the failure diagnosis apparatus 5 will be described with reference to FIGS. 5 and 14 to 18. As a premise, it is assumed that a fault tree database 9 in which a fault tree group and a fault propagation path are registered is held in the storage unit 52 of the fault diagnosis device 5.

  FIG. 5 is a flowchart showing details of the operation of the failure diagnosis apparatus 5. As shown in FIG. 5, the control unit 51 of the failure diagnosis apparatus 5 receives a diagnosis signal from the ECU, inputs a failure event that has occurred (S201), searches the failure tree database 9 (S202), and has occurred. A combination of basic events satisfying the failure event is specified as a failure cause (S203), and the specified failure cause is output as a diagnosis result (S204).

  In S202 and S203, the control unit 51 of the failure diagnosis apparatus 5 uses the failure event information from which the diagnosis signal is output from the ECU and the failure event information from which the diagnosis signal is not output from the ECU, to the failure tree database. 9 is searched and failure diagnosis is performed.

A search for a combination of basic events that satisfies a failure event that has occurred can be viewed as a maximum satisfiability problem. Here, the maximum satisfaction assignment problem is a problem of obtaining an assignment that maximizes the sum of weights of satisfying clauses when a set of weighted clauses is given. The section, n-number of variables y _1, ···, y _n and its negative ¬y _1, ···, from among the ¬y _n, is a logical expression that connect the some logical sum.

  For example, the control unit 51 of the failure diagnosis apparatus 5 is generated by using the solver of the maximum satisfiability problem under the constraint that the basic event of the failure is minimum (hereinafter referred to as “first constraint”). Identify combinations of basic events that satisfy a failure event. The first constraint is based on the idea that many failures do not occur at the same time. Here, for example, when the occurrence of the event a propagates and the event b occurs, it is considered that the basic event causing the failure is only the event a, and the event b is not the basic event causing the failure. That is, the basic event of the cause of failure means only the event of failure propagation when there is failure propagation.

  Further, for example, the failure tree database 9 holds the probability of occurrence of each basic event, and the control unit 51 of the failure diagnosis apparatus 5 is under a constraint that the overall probability is maximum (hereinafter referred to as “second constraint”). By using the solver of the maximum satisfiability problem, the combination of basic events that satisfy the failure event that occurred is specified. Under any of the constraints, failure diagnosis can be performed at high speed by using the solver of the maximum satisfiability problem.

  Below, the process which the control part 51 of the failure diagnosis apparatus 5 performs is demonstrated using a specific example. The symbol “1” shown in FIGS. 14 to 18 means the occurrence of an event. The symbol “0” means no event. The symbol “Δ” means propagation of event occurrence from another fault tree. The symbol “x” means unknown.

  FIG. 14 is a diagram illustrating a first failure diagnosis result. In the example illustrated in FIG. 14, it is assumed that diagnostic signals corresponding to the failure event 7 that is the top event of the failure tree G and the failure event 8 that is the top event of the failure tree H are output. The control unit 51 of the failure diagnosis apparatus 5 uses the first constraint.

  In this example, the failure events for which the diagnosis signal is output are the failure event 7 and the failure event 8. A fault propagation path from event c to event e exists between the fault tree G and the fault tree H. The combinations of basic events that cause the failure are, for example, (c), (a, d), (a, e), (a, f), (b, d), (b, e), (b, f) Etc. are considered. From the first restriction, the control unit 51 of the failure diagnosis apparatus 5 sets the event c as “1” (event occurrence) and the event e as “Δ” (propagation of other event occurrence), The combination is specified as (c) (one).

  When a plurality of fault propagation paths exist between the same fault trees, for example, a path with a short distance between the fault trees is employed. The distance between the fault trees is calculated by the number of hops, for example. When going through five components (parts), the number of hops (logical distance between fault trees) is 4. Moreover, you may make it attach the weight according to the failure probability etc. of a component (component).

  FIG. 15 is a diagram illustrating a second failure diagnosis result. In the example illustrated in FIG. 15, it is assumed that diagnostic signals corresponding to the failure event 7 that is the top event of the failure tree G and the failure event 8 that is the top event of the failure tree H are output. Further, the control unit 51 of the failure diagnosis apparatus 5 uses the second constraint.

  In this example, the failure event for which the diagnosis signal has not been output is the failure event 9. Since the failure event 9 is “0”, the event m of the basic event is also “0”. Since event m is included in the failure propagation path from event c to event k, it is determined that event c is also “0”. By using the information on the failure event for which the diagnosis signal has not been output, the search range is limited, and the search process can be completed at high speed. For example, (a, d), (a, e), (a, f), (b, d), (b, e), (b, f) may be considered as combinations of basic causes of failure. . Here, the probability that the event a occurs is higher than the probability that the event b occurs, and the probability that the event d occurs is higher than the probability that the events e and f occur. From the second restriction, the control unit 51 of the failure diagnosis apparatus 5 sets the events a and d to “1” (event occurrence), sets the events b, e, and f to “0” (event does not occur), The combination of basic events is specified as (a, d). Since the overall probability is a criterion in the second constraint, it is specified that all basic events are either “0” or “1”, unlike the case where the first constraint is used.

  FIG. 16 is a diagram illustrating a third failure diagnosis result. In the example illustrated in FIG. 16, it is assumed that diagnostic signals corresponding to the failure event 10 that is the top event of the failure tree J and the failure event 11 that is the top event of the failure tree K are output. The control unit 51 of the failure diagnosis apparatus 5 uses the first constraint.

  In this example, the failure tree J and the failure tree K are grouped as a failure tree group because there is an overlap of basic events (event d is overlapped). For example, (c, d), (a, b, d), (a, b, e, f) can be considered as combinations of basic causes of failure. From the first constraint, the control unit 51 of the failure diagnosis device 5 specifies the events c and d as “1” (event occurrence), and the combination of the basic events causing the failure as (c, d) (two). .

  FIG. 17 is a diagram illustrating a fourth failure diagnosis result. In the example illustrated in FIG. 17, it is assumed that a diagnosis signal corresponding to the failure event 10 that is the top event of the failure tree J is output. The control unit 51 of the failure diagnosis apparatus 5 uses the first constraint.

  In this example, the failure tree J and the failure tree K are grouped as a failure tree group because there is an overlap of basic events (event d is overlapped). Since the failure event 11 is a failure event for which no diagnosis signal is output, the event d is determined to be “0”, and one of the events e and f is determined to be “0”. For example, (a, b), (a, b, c), and the like are conceivable as combinations of basic causes of failure. From the first restriction, the control unit 51 of the failure diagnosis apparatus 5 specifies that the events a and b are “1” (event occurrence), and the combination of the basic events causing the failure is (a, b) (two). .

  FIG. 18 is a diagram illustrating a fifth failure diagnosis result. In the example illustrated in FIG. 18, it is assumed that diagnostic signals corresponding to the failure event 12 that is the top event of the failure tree L and the failure event 13 that is the top event of the failure tree M are output. Further, the control unit 51 of the failure diagnosis apparatus 5 uses the second constraint.

  In this example, the failure events for which the diagnosis signal is output are the failure event 12 and the failure event 13. Since no fault propagation path exists between the fault tree G and the fault tree H, it is considered that the fault event 12 and the fault event 13 occurred independently. For example, (h, i, m), (h, i, n, o), (j, k, m), (j, k, n, o) can be considered as combinations of basic causes of failure. . Here, the probability that events h and i occur simultaneously is higher than the probability that events j and k occur simultaneously, and the probability that event m occurs is higher than the probability that events n and f occur simultaneously. . From the second constraint, the control unit 51 of the failure diagnosis apparatus 5 sets the events h, i, and m to “1” (event occurrence), and sets the events j, k, n, and o to “0” (no event occurrence). The combination of basic causes of failure is specified as (h, i, m).

  In the above description, the combination of the basic events that cause the failure is specified as one. However, it is also possible to output a plurality of combinations as diagnosis results by considering the constraint condition as the sort condition. For example, in the case of the first constraint, a combination of failure-causing basic events may be output by sorting in ascending order of the number of failure-causing basic events. Also, for example, in the case of the second constraint, the combinations of basic events that cause the failure may be output by sorting in descending order of the overall probabilities.

  Further, in the above description, the fault tree construction device 3 searches for an overlap of basic events between fault trees, groups fault trees with overlapping basic events as fault tree groups, and sets the fault tree group and the fault propagation path. It was decided to register in the fault tree database 9. As another configuration of the failure diagnosis system, a failure tree and a failure propagation path are registered in the failure tree database 9, and the failure tree construction device 5 searches the failure tree database in consideration of the overlapping of basic events between the failure trees. Failure diagnosis may be performed. In the case of this configuration, there is a demerit that the processing time of failure diagnosis increases, but there is also an advantage that the construction of the failure tree database 9 is hardly affected by the delay in the development of some ECUs.

  The failure diagnosis system 1 according to the embodiment of the present invention can quickly and accurately identify an event that causes a true failure even when abnormal signals are output from a plurality of ECUs.

  The preferred embodiments of the failure diagnosis system and the like according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these naturally belong to the technical scope of the present invention. Understood.

DESCRIPTION OF SYMBOLS 1 ......... Failure diagnosis system 3 ......... Failure tree construction device 5 ......... Failure diagnosis device 7 ......... Failure propagation database 9 ......... Failure tree database 31 ......... Control unit 32 ......... Storage unit 33 ... ...... Media input / output unit 34 ......... Communication control unit 35 ......... Input unit 36 ......... Display unit 37 ......... Peripheral device I / F unit 38 ......... Bus 39 ......... Network 51 ......... Control Unit 52 ......... Storage unit 53 ......... Communication interface 54 ......... In-vehicle LAN

Claims (7)

A failure diagnosis system for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs,
A fault that calculates a fault propagation path between the fault trees based on a fault propagation model in which a fault tree having a fault event detected by the ECU as a top event is input and a path through which the fault propagates between the ECUs is modeled Propagation path calculation means;
A fault tree grouping means for searching for a duplication of basic events between the fault trees and grouping the fault trees with duplication of basic events as a fault tree group;
A fault tree construction device comprising:
A fault tree database that holds the fault tree group and the fault propagation path;
When a signal indicating the occurrence of the failure event is output from the ECU, a failure diagnosis unit that searches the failure tree database and performs failure diagnosis;
A diagnostic result output means for outputting a diagnostic result of the failure diagnostic means;
A fault diagnosis device comprising:
A failure diagnosis system comprising:   The failure diagnosis means searches the failure tree database using information on a failure event for which the signal has been output from the ECU and information on a failure event for which the signal has not been output from the ECU. The failure diagnosis system according to claim 1, wherein:   2. The failure diagnosis system according to claim 1, wherein the failure diagnosis unit specifies a combination of basic events satisfying the generated failure event as a failure cause under a constraint that the number of basic events causing the failure is minimum. The fault tree database further holds the probability that each basic event will occur,
The fault diagnosis system according to claim 1, wherein the fault diagnosis unit specifies a combination of basic events satisfying the generated fault event as a cause of failure under a constraint that the overall probability is maximum. A failure diagnosis system for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs,
A fault that calculates a fault propagation path between the fault trees based on a fault propagation model in which a fault tree having a fault event detected by the ECU as a top event is input and a path through which the fault propagates between the ECUs is modeled Propagation path calculation means,
A fault tree construction device comprising:
A fault tree database holding the fault tree and the fault propagation path;
When a signal indicating the occurrence of the failure event is output from the ECU, a failure diagnosis unit that searches the failure tree database in consideration of duplication of basic events between the failure trees and performs failure diagnosis,
A diagnostic result output means for outputting a diagnostic result of the failure diagnostic means;
A fault diagnosis device comprising:
A failure diagnosis system comprising: A failure diagnosis method for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs,
Input a fault tree having a fault event detected by the ECU as a top event, and calculate a fault propagation path between the fault trees based on a fault propagation model that models a path through which a fault propagates between the ECUs. Registering the fault propagation path in a fault tree database;
Searching for the duplication of basic events between the fault trees, grouping the fault trees with duplication of basic events as a fault tree group, and registering the fault tree group in the fault tree database;
When a signal indicating the occurrence of the failure event is output from the ECU, searching the failure tree database and performing a failure diagnosis;
Outputting a diagnosis result of failure diagnosis;
A failure diagnosis method comprising: A failure diagnosis method for diagnosing a failure of an in-vehicle system equipped with a plurality of ECUs,
Input a fault tree having a fault event detected by the ECU as a top event, and calculate a fault propagation path between the fault trees based on a fault propagation model that models a path through which a fault propagates between the ECUs. Registering the fault tree and the fault propagation path in a fault tree database;
When a signal indicating the occurrence of the failure event is output from the ECU, searching the failure tree database in consideration of duplication of basic events between the failure trees, and performing a failure diagnosis;
Outputting a diagnosis result of failure diagnosis;
A failure diagnosis method comprising:

Images