JP2018052315A - Control device for automobile and control device for internal combustion engine - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a novel control device for an automobile which can alternatively perform control function processing by mutual fallback functions even if two or more control computers perform the different control function processing, and a control device for an internal combustion engine.SOLUTION: A control device for an automobile comprises a storage region for storing a program for making two or more control computers (11, 12) which perform different control function processing perform fallback functions of the control function processing of the other control computers (11, 12), or a fixed value, and when an abnormal state of one control computer (11) is detected by a monitor computer (14), the control function processing which is performed by the abnormal control computer (11) is alternatively performed by the other normal control computer (12).SELECTED DRAWING: Figure 1

Description

  The present invention relates to an automobile control device that controls the driving state of an automobile and an internal combustion engine control device that controls the operating state of an internal combustion engine, and more particularly to an automotive control device and an internal combustion engine having a fallback function corresponding to an abnormal state. The present invention relates to an industrial control device.

Important systems for safety in automobiles (eg electronic anti-lock braking systems, electronic stability systems, electric / hydraulic braking systems, electric power steering systems, etc.) perform the control functions of the respective systems. It is controlled by a control computer using a processor core. The control computer is provided with a fallback mode (degenerate mode) so that the control function is not lost when a system failure or abnormality occurs. In the following, failures and abnormalities are collectively referred to as “abnormal conditions”. For example, in an electronic antilock brake system, if an abnormal condition occurs in the system, the control computer is shut down and the fallback mode is executed. ing. That is, the hydraulic valve that is not controlled when the control computer is shut off is configured to perform a normal braking operation. In other words, when an abnormal state occurs in the system, emergency operation or limited operation is guaranteed.

  Therefore, in the case of a system having a mechanical fallback function such as hydraulic pressure, it is sufficient to shut down the control computer or to disconnect the control computer from the peripheral elements when a computer failure or a memory failure is recognized.

  This is achieved, for example, by including two identical control computers (multiprocessor core system) that execute synchronously and execute the same program in parallel. When the calculation results by the two control computers have a deviation, the processing of the control computer is stopped assuming that an abnormal state has occurred. The fault tolerant function provided with such a double system is described in Japanese translations of PCT publication No. 2005-512218 (patent document 1) etc.

JP 2005-512218 A

  By the way, in the case of a non-hydraulic brake system such as an electric / mechanical brake system, the fallback function using the hydraulic pressure described above cannot be used, and therefore the fallback function cannot be executed by disconnecting the control computer. Is. Therefore, in Patent Document 1, when a failure occurs in the control computer, a fault tolerant function is realized by cutting off the communication controller so that the control value of the failed control computer is not sent on the data bus. .

  However, in Patent Document 1, two (or two or more) control computers are redundant systems in which the same program is executed synchronously in parallel, and each control computer has different control function processing, for example, control functions. In the case of a configuration in which the processes are divided and executed and the control process is distributed, the method as in Patent Document 1 cannot be adopted, and a sufficient fallback function cannot be ensured.

  An object of the present invention is to provide a novel automobile control apparatus and internal combustion engine control apparatus that can execute a fallback function instead of each other even when two or more control computers perform different control function processes. It is to provide.

  A feature of the present invention is that each of two or more control computers that perform different control function processes is provided with a fallback function of the control function process of another control computer, and an abnormal state of one control computer is detected by the monitoring computer. When detected, the control function processing by the control computer in the abnormal state is executed by another normal control computer.

  According to the present invention, even when two or more control computers perform different control function processing, the control function processing by the control computer in the abnormal state can be executed by another control computer, so that the abnormality The function of the system controlled by the state control computer can be secured.

1 is a system block diagram of an automotive control device according to a first embodiment of the present invention. It is explanatory drawing explaining operation | movement of the control apparatus for internal combustion engines which becomes the 2nd Embodiment of this invention.

  Embodiments of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to the following embodiments, and various modifications and application examples are included in the technical concept of the present invention. It is included in the range.

  FIG. 1 shows a system block of a control apparatus for an automobile according to a first embodiment of the present invention, and controls, for example, an electric brake system and an electric power steering system. In particular, the electric brake system and the electric power steering system are system elements necessary for an automatic driving system of an automobile.

  In FIG. 1, the automobile control device 10 includes a first control computer 11 and a second control computer 12, and these control computers 11 and 12 are connected to a communication controller 13. These control computers 11 and 12 are control computer systems which operate synchronously with time synchronization or clock synchronization. Here, the control computers 11 and 12 are of a multiprocessor core format, and two processor cores (corresponding to the control computers 11 and 12) are mounted in one processor package. According to this, the mounting area can be reduced and the communication between the processor cores can be speeded up.

  The automobile control device 10 includes a monitoring computer 14, and the monitoring computer 14 includes a monitoring function for monitoring the operation state of the control computers 11 and 12 through a communication line. For example, the mutual diagnosis program is stored in the control computers 11 and 12, and the calculation result of the mutual diagnosis program is monitored by the monitoring computer 14, and if it does not coincide with the normal calculation result stored in the monitoring computer, it is determined as abnormal. can do.

  Furthermore, a monitoring function for monitoring the operation state of the control computers 11 and 12 may be provided by other methods. The monitoring computer 14 has a function of generating a reset signal and resetting the control computers 11 and 12 in an abnormal state when an abnormal state occurs in the control computers 11 and 12.

  The communication controller 13 is connected to the data bus line 15 and has a function of transmitting various data from the communication controller 13 or receiving various data from the data bus line 15. Therefore, the actuator control values calculated by the control computers 11 and 12 can be sent to the data bus line 15. Similarly, the sensor signal from the operation amount detection sensor can be sent from the data bus line 15 to the control computers 11 and 12 via the communication controller. The data bus line 15 is configured by an in-vehicle communication network such as CAN, Flexray, TTCAN, TTP, or the like.

  In addition, a first communication unit 16 and a second communication unit 17 are connected to the data bus line 15, a first actuator 18 is connected to the first communication unit 16, and a second communication unit 17. The 2nd actuator 19 is connected to.

  Therefore, the control value from the first control computer 11 is sent to the first actuator 18 via the data bus line 15 and the first communication unit 16, and similarly, the control value from the second control computer 12 is The data is sent to the second actuator 19 via the data bus line 15 and the second communication unit 17, and a necessary control function is executed.

  For example, if the first control computer 11 is used in an electric brake system, the control function of the first control computer 11 is a braking function, and the first actuator 18 controls the piston of the brake caliper. It is an electric motor. If the second control computer 12 is used in an electric power steering system, the control function of the second control computer 12 is a steering function, and the second actuator 19 is a steering function of the electric power steering system. It is an electric motor for assist.

  Here, the fallback function that is a feature of the present embodiment will be described. The storage area of the first control computer 11 is unique to the second control computer 12 together with a program or a fixed value for executing a function specific to the first control computer 11 itself (= function specific to the electric brake system). A program for executing a fallback function (= fallback function unique to the electric power steering system) or a fixed value is stored.

  Similarly, the storage area of the second control computer 12 has a program or a fixed value for executing a function specific to the second control computer 12 itself (= function specific to the electric power steering system), as well as the first control computer 12. 11 stores a program or a fixed value for executing a fallback function peculiar to 11 (= fallback function peculiar to the electric brake system).

  Thus, the control computers 11 and 12 are each provided with a fallback function having redundancy. That is, the control computer 11 can execute a fallback function specific to the other second control computer 12 and the control computer 12 can execute a fallback function specific to the first control computer 11. is there.

  Here, the control value or the fixed value obtained by executing the program for the fallback function is used in each control function process as so-called backup data. Of course, this backup data is not sent to the data bus line 15 when the control computers 11 and 12 are operating normally.

  In the configuration as described above, in the process in which the control computers 11 and 12 operate to control the actuators 18 and 19 to execute the respective control functions, the monitoring computer 14 operates normally. Monitoring results are sent to the control computers 11 and 12 via the communication controller 13.

  When the monitoring computer 14 determines that an abnormal state has occurred in the control computers 11, 12, the monitoring computer 14 detects abnormal control computer information, that is, the first control computer 11 is abnormal or the second control computer 2. Error information indicating that the two control computers 11 and 12 are abnormal is sent to the control computers 11 and 12 via the communication line and the communication controller 13.

  For example, when the monitoring computer 14 detects an abnormal state of the first control computer 11, the monitoring computer 14 detects the abnormal state of the first control computer 11 with respect to the normal second control computer 12 and the first control computer 11 in the abnormal state. Send error information.

  Then, the first control computer 11 in the abnormal state interrupts sending the control value calculated by itself to the communication controller 13. On the other hand, when receiving the error information, the normal second control computer 12 starts a program that executes the fallback function of the first control computer 11 in the abnormal state, and calculates a control value that is backup data. Alternatively, a fixed value is read and transmitted to the communication controller 13.

  The communication controller 13 sends the backup data obtained by the normal second control computer 12 to the data bus line 15, and sends the backup data to the first actuator 18 controlled by the first control computer 11 in an abnormal state. The fallback function is executed by sending backup data.

  Conversely, when an abnormal state occurs in the second control computer 12, the monitoring computer 14 sends a second control computer to the normal first control computer 11 and the second control computer 12 in the abnormal state. 12 error information is transmitted.

  Then, the second control computer 12 in the abnormal state interrupts sending the control value calculated by itself to the communication controller 13. On the other hand, when the normal first control computer 11 receives the error information, the normal first control computer 11 starts a program that executes the fallback function of the abnormal second control computer 12 and calculates a control value that is backup data. Alternatively, a fixed value is read and transmitted to the communication controller 13.

  The communication controller 13 sends the backup data obtained by the normal first control computer 11 to the data bus line 15, and sends the backup data to the second actuator 19 controlled by the second control computer 12 in an abnormal state. The fallback function is executed by sending backup data.

  When both control computers 11 and 12 are in an abnormal state, the monitoring computer 14 sends error information to the respective control computers 11 and 12 via the communication line and the communication controller 13 and also sends a reset signal to the control computer 11 and 12. 12, the control computers 11 and 12 are reset. In this case, control values including errors of the control computers 11 and 12 are blocked from being sent to the data bus line 15 by the communication controller 13.

  As described above, according to this embodiment, even when two or more control computers perform different control function processes, the fallback function of the control computer in an abnormal state can be executed by another control computer. The function of the system controlled by the control computer in the abnormal state can be secured.

  FIG. 2 shows an operating state of an internal combustion engine control apparatus according to another embodiment of the present invention. The basic system block configuration is almost the same as that shown in FIG. 1, except that the control function of the control computer is a function for controlling and adjusting the operating state of the internal combustion engine.

  That is, the internal combustion engine control device 20 includes at least a first control computer 21 and a second control computer 22, and the first control computer 21 controls a fuel injection valve 25 and a fuel control function and an ignition device. An ignition control function for controlling the motor 26 is provided. The second control computer 22 does not have a fuel control function and an ignition control function, and has a valve timing control function and an electric control system that control a variable valve timing device (VTC) 27 that controls the opening / closing phase of the intake valve and the exhaust valve. A throttle control function for controlling the throttle valve 28 is provided. Although it is possible to provide the control functions of other auxiliary machines in the respective control computers 21 and 22, they do not have the same control function.

  These control computers 21 and 22 are control computer systems that operate in time synchronization, clock synchronization, or crank angle synchronization. Here, as in the first embodiment, the control computers 21 and 22 are in a multiprocessor core format, and two processor cores (control computers 21 and 22) are mounted in one processor package.

  The internal combustion engine control device 20 includes a monitoring computer 24. The monitoring computer 24 includes a monitoring function for monitoring the operation state of the control computers 21 and 22 through a communication line. The monitoring computer 24 has a function of generating a reset signal and resetting the control computers 21 and 22 in the abnormal state when an abnormal state occurs in the control computers 21 and 22. Furthermore, the communication controller 23 sends the control values calculated by the control computers 21 and 22 to the fuel injection valve 25, the ignition device 26, the VTC device 27, and the electric throttle valve 28 corresponding to the respective control functions.

  Next, a fallback function that is a feature of the present embodiment will be described. The storage area of the first control computer 21 has fixed values (fixed fuel injection amount and fixed injection timing, fixed energization angle and fixed ignition timing) for executing the fuel control function and ignition control function of the first control computer 21 itself. ) And fixed values (fixed opening / closing phase and fixed throttle opening) for executing the valve timing control function and the throttle control function fallback function of the second control computer 22 are stored.

  Similarly, the storage area of the second control computer 22 includes a fixed value (fixed opening / closing phase and fixed throttle opening) for executing the valve timing control function and the throttle control function of the second control computer 22 itself, and the first The fixed values (the fixed fuel injection amount and the fixed injection timing, and the fixed energization angle and the fixed ignition timing) for executing the fuel control function and the fallback function of the ignition control function of the control computer 21 are stored.

  Here, the fixed value for the fallback function is used in each control function process as so-called backup data. Of course, this backup data is not sent to the fuel injection valve 25, the ignition device 26, the VTC device 27, and the electric throttle valve 28 when the control computers 21 and 22 are operating normally.

  In the configuration as described above, in the process in which the control computers 21 and 22 operate to control the fuel injection valve 25, the ignition device 26, the VTC device 27, and the electric throttle valve 28 to execute the respective control functions, The monitoring computer 24 monitors whether the control computers 21 and 22 are operating normally, and the monitoring result is sent to each control computer 21 and 22 via the communication controller 13.

  Here, when the first control computer 21 is operating normally, the first control computer 21 supplies a fuel injection command (calculated injection amount, injection timing) to the fuel injection valve 25, and An ignition command (calculated energization angle and ignition timing) is supplied to the ignition device 26. Similarly, when the second control computer 22 is operating normally, the second control computer 22 supplies a VTC control command (calculated opening / closing phase) to the VTC device 27, and a throttle control command ( The calculated throttle opening) is supplied to the electric control throttle 28.

  On the other hand, when the monitoring computer 24 detects, for example, the abnormal state of the first control computer 21, the first control computer 24 is compared with the normal second control computer 22 and the first control computer 21 that has entered the abnormal state. 21 error information is transmitted.

  Then, the first control computer 21 in the abnormal state interrupts sending the fuel injection command and the ignition command calculated by itself to the communication controller 23. On the other hand, when the normal second control computer 22 receives the error information, it is stored in the storage area of the second control computer 22 in order to execute the fallback function of the first control computer 21 in the abnormal state. The fixed fuel injection amount and fixed injection timing, and the fixed energization angle and fixed ignition timing, which are backup data, are read and transmitted to the communication controller 23.

  The communication controller 23 sends the fixed fuel injection amount and the fixed injection timing, and the fixed energization angle and the fixed ignition timing obtained by the normal second control computer 22 to the fuel injection valve 25 and the ignition device 26, resulting in an abnormal state. The fallback function of the fuel injection valve 25 and the ignition device 26 controlled by the first control computer 21 is executed.

  Conversely, when an abnormal state occurs in the second control computer 22, the monitoring computer 24 sends a second control computer to the normal first control computer 21 and the second control computer 22 in the abnormal state. 22 error information is transmitted.

  Then, the second control computer 22 in an abnormal state interrupts sending the VTC control command and the throttle control command calculated by itself to the communication controller 23. On the other hand, when the normal first control computer 21 receives the error information, it is stored in the storage area of the first control computer 21 in order to execute the fallback function of the abnormal second control computer 22. The fixed opening / closing phase and the fixed throttle opening which are backup data are read out and transmitted to the communication controller 23.

  The communication controller 23 sends the fixed opening / closing phase and the fixed throttle opening obtained by the normal first control computer 21 to the VTC device 27 and the electric control throttle 28, and the second control computer 22 in an abnormal state The fallback function of the controlled VTC device 27 and the electric throttle 28 is executed.

  As described above, according to the present embodiment, the control computer that executes the fuel control function and the ignition control function of the internal combustion engine and the control computer that executes the control function of the internal combustion engine different from these control functions are used. However, the control function processing of the internal combustion engine controlled by the control computer in the abnormal state can be controlled by executing the fallback function of the control computer in the abnormal state by another control computer to control the operation state of the internal combustion engine. Functions can be secured.

  As described above, according to the present invention, a program for executing a fallback function of a control function process of another control computer or a fixed value is stored in each of two or more control computers that perform different control function processes. When an abnormal state of one control computer is detected by the monitoring computer, a fallback function of control function processing by the control computer in the abnormal state is executed by another normal control computer.

  According to this, even when two or more control computers perform different control function processing, the fallback function of the control computer in the abnormal state can be executed by another control computer. It becomes possible to secure the functions of the system controlled by the system.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

  DESCRIPTION OF SYMBOLS 10 ... Control apparatus for motor vehicles, 11 ... 1st control computer, 12 ... 2nd control computer, 13 ... Communication controller, 14 ... Monitoring computer, 15 ... Data bus line, 16 ... 1st communication unit, 17 ... 1st 2 communication units, 18 ... first actuator, 19 ... second actuator, 20 ... control device for internal combustion engine, 21 ... first control computer, 22 ... second control computer, 23 ... communication controller, 24 ... Monitoring computer, 25 ... fuel injection valve, 26 ... ignition device, 27 ... VTC device, 28 ... electric throttle.

Claims (5)

  A fallback function of the control function processing of another control computer is given to each of two or more control computers that perform different control function processes for controlling the driving state of the automobile, and an abnormality of one of the control computers is performed by the monitoring computer. When the state is detected, a control function process by the control computer in an abnormal state is executed instead of another normal control computer. The vehicle control device according to claim 1,
Each of the two or more control computers is composed of a multiprocessor core, and the normal processor core of the multiprocessor core executes control function processing by the processor core in an abnormal state of the multiprocessor core, An automotive control device, wherein an actuator controlled by the processor core in an abnormal state is controlled by backup data obtained by executing a fallback function of a normal processor core. A first control computer having at least a fuel control function and an ignition control function of the internal combustion engine, and a second control state control function for controlling an operation state of the internal combustion engine different from the fuel control function and the ignition control function. At least two of the control computers
The first control computer is provided with a fallback function of the operating state control function, the second control computer is provided with a fallback function of the fuel control function and the ignition control function, When an abnormal state is detected in one of the control computers, a control function process by the control computer in the abnormal state is executed instead of another normal control computer. The control device for an internal combustion engine according to claim 3,
Each of the first control computer and the second control computer is composed of a multiprocessor core, and the normal processor core of the multiprocessor core replaces the control function processing by the processor core in an abnormal state of the multiprocessor core. And controlling the actuator controlled by the processor core in an abnormal state with backup data obtained by executing the fallback function of the normal processor core. The control apparatus for an internal combustion engine according to claim 4,
The control apparatus for an internal combustion engine, wherein the backup data is a fixed value for controlling the actuator controlled by the fuel control function, the ignition control function, or the operation state control function by a predetermined amount.

Images