JP6365608B2 - Vehicle control device - Google Patents

Description

  The present invention relates to a control device for controlling a vehicle.

  Various automatic driving techniques have been developed in recent years. For example, one of a large number of CPUs (Central Processing Units) mounted on a vehicle may be used as a main control unit that comprehensively controls other CPUs. Based on information from various sensors and cameras mounted on the vehicle, the main control unit controls vehicle speed, vehicle acceleration, vehicle traveling direction, braking force applied to the vehicle, and traction transmitted from the vehicle to the road surface. A target value may be determined. These target values determined by the main control unit are transmitted to other CPUs through a wire harness (see Patent Document 1).

  Each of the other CPUs is used as a component control unit that controls a corresponding electrical component (for example, engine, transmission, brake, steering). The component control unit that has received the target value from the main control unit controls the corresponding electrical component so that the target value of speed, acceleration, traveling direction, braking force, and traction is achieved.

  Vulnerabilities in in-vehicle communication systems are often pointed out. As a result of unauthorized access, there is a risk that the main control unit sets an inappropriate target value. If the main control unit has a learning function, there is a risk that the main control unit sets an inappropriate target value as a result of inappropriate learning. Although irrelevant to an inappropriate operation of the main control unit, Patent Document 2 proposes forcibly interrupting an inappropriate operation of the vehicle under the abnormality of the accelerator device.

JP 2014-34373 A JP 2013-220679 A

  Under the application of the technique of Patent Document 2, if the operation of the main control unit is stopped, or if signal transmission from the main control unit is interrupted, all operations of the vehicle are stopped. Become. In this case, even retreat traveling for avoiding the vehicle from danger becomes impossible.

  An object of the present invention is to provide a technique that enables a vehicle to be evacuated even when an abnormality occurs in a main control unit.

  A vehicle control device according to an aspect of the present invention includes a plurality of component control units that control a plurality of electrical components that control driving of the vehicle, and a main control unit that generates a command signal that gives a command to the plurality of component control units. And when an abnormality occurs in the main control unit, it is operated by a blocking unit that blocks transmission of the command signal from the main control unit to the plurality of component control units, and a driver that drives the vehicle, An operation unit that generates an operation signal representing an operation of the driver. When the blocking unit blocks the transmission of the command signal, at least one of the plurality of component control units controls a corresponding one of the plurality of electrical components according to the operation signal.

  According to the above configuration, when the main control unit generates a command signal that gives a command to the plurality of component control units, the plurality of component control units change the plurality of electrical components that control driving of the vehicle according to the command signal. Can be controlled. When an abnormality occurs in the main control unit, the blocking unit blocks transmission of the command signal from the main control unit to the plurality of component control units, so that the vehicle is released from the control of the main control unit under the occurrence of the abnormality. . At this time, at least one of the plurality of component control units controls a corresponding one of the plurality of electrical components in accordance with an operation signal indicating the operation of the driver. Under the evacuation can be performed.

  With regard to the above configuration, the plurality of electrical components may include a brake, an engine, a transmission, and a steering.

  According to the above configuration, the plurality of electrical components include the brake, the engine, the transmission, and the steering. If no abnormality has occurred in the main control unit, the brake, the engine, the transmission, and the steering are Controlled under control. On the other hand, if an abnormality occurs in the main control unit, the brake, engine, transmission, and steering are controlled in accordance with operation signals representing the driver's operation, so that the vehicle is “traveling”, “reversing”, “turning”. The basic operation of the vehicle such as “stop” can be continued. Therefore, the vehicle can retreat under the operation of the driver.

  With regard to the above configuration, when the driver operates the blocking unit, the blocking unit may block the transmission of the command signal.

  According to the above configuration, when the driver operates the blocking unit, the blocking unit blocks transmission of the command signal. Therefore, when the driver feels an abnormality in the control of the main control unit, the driver Can be released from the control of the main control unit. Alternatively, if the control of the main control unit does not conform to the driver's intention, the driver can release the vehicle from the control of the main control unit. Therefore, the driver can drive the vehicle safely or comfortably.

  With regard to the above configuration, at least one of the plurality of component control units may include a determination unit that determines the abnormality of the main control unit from the command signal. The determination unit that has determined that the abnormality has occurred in the main control unit may generate a request signal that requests blocking of the transmission of the command signal. The blocking unit may block the transmission of the command signal in response to the request signal.

  According to the above configuration, since at least one of the plurality of component control units includes the determination unit that determines abnormality of the main control unit from the command signal, communication between the main control unit and the plurality of component control units. Below, an abnormality of the main control unit is quickly determined. The determination unit that has determined that an abnormality has occurred in the main control unit generates a request signal that requests blocking of transmission of the command signal, and the blocking unit blocks transmission of the command signal in response to the request signal. Therefore, the vehicle is automatically released from the control of the main control unit under the occurrence of an abnormality.

  With regard to the above configuration, the control device may further include a determination unit that determines an abnormality of the main control unit from the command signal. The determination unit that determines that the abnormality has occurred in the main control unit may generate a request signal that requests the blocking unit to block the transmission of the command signal. The blocking unit may block the transmission of the command signal in response to the request signal.

  According to said structure, since a control apparatus is further provided with the determination part which determines the abnormality of a main control part from a command signal, determination of the presence or absence of abnormality of a main control part may depend on a determination part. Since the determination process of the presence or absence of abnormality of the main control unit does not give an excessive calculation load to the plurality of component control units, the plurality of component control units can smoothly control the plurality of electrical components.

  Regarding the above configuration, the command signal may give a target value for control to each of the plurality of electrical components to each of the plurality of component control units. The determination unit may compare the target value with a threshold value and determine whether or not the abnormality has occurred in the main control unit.

  According to the above configuration, since the command signal gives a target value for control to each of the plurality of electrical components to each of the plurality of component control units, each of the plurality of component control units directs the corresponding electrical component to the target value. Can be operated. Since the determination unit compares the target value with the threshold value and determines whether or not an abnormality has occurred in the main control unit, control toward an extreme target value that exceeds or falls below the threshold value is avoided.

  With regard to the above configuration, the control device may further include a detection unit that detects a traveling state of the vehicle and generates a detection signal representing the traveling state. The determination unit may determine the threshold according to the detection signal.

  According to said structure, since a detection part detects the driving state of a vehicle and produces | generates the detection signal showing a driving state, the determination part can grasp | ascertain the driving state of a vehicle. Since the determination unit determines the threshold according to the detection signal, if the main control unit gives an inappropriate target value for the running state, the determination unit determines that an abnormality has occurred in the main control unit. Can be determined.

  With respect to the above configuration, the detection unit may detect the presence of an obstacle. If the target value represents an accelerated approach to the obstacle, the determination unit may determine that the abnormality has occurred in the main control unit.

  According to the above configuration, if the target value represents an accelerated approach to the obstacle detected by the detection unit, the determination unit determines that an abnormality has occurred in the main control unit. Vehicle collisions with objects are avoided.

  With regard to the above configuration, the control device may further include an acquisition unit that acquires road information around a position where the vehicle travels. The determination unit may determine whether the abnormality has occurred in the main control unit based on the road information.

  According to said structure, since a determination part determines whether abnormality has arisen in the main control part based on the road information acquired by the acquisition part, the main control part does not adapt to road information. If an action is to be given to the vehicle, the vehicle is released from the control of the main control unit under the occurrence of an abnormality. Thereafter, the vehicle can continue the basic operations of the vehicle such as “advance”, “reverse”, “turn”, and “stop” according to the operation signal.

  Regarding the above configuration, if the target value is inconsistent with the operation represented by the operation signal, the determination unit may determine that the abnormality has occurred in the main control unit. .

  According to the above configuration, if the target value is inconsistent with the operation represented by the operation signal, the determination unit determines that an abnormality has occurred in the main control unit. Priority is given to the control of the main control unit. Therefore, the vehicle is operated according to the driver's intention.

  The above-described technology enables the vehicle to evacuate even when an abnormality occurs in the main control unit.

It is a block diagram showing the notional functional structure of the control apparatus of 1st Embodiment. It is a block diagram showing the notional functional structure of the control apparatus of 2nd Embodiment. It is a block diagram showing the notional functional structure of the components control part of 3rd Embodiment. It is a block diagram showing the notional functional structure of the control apparatus of 4th Embodiment. It is a schematic flowchart of the abnormality determination process of 5th Embodiment. It is a block diagram showing the notional functional structure of the control apparatus of 6th Embodiment. It is a schematic flowchart of the abnormality determination process of 7th Embodiment. It is a schematic flowchart of the abnormality determination process of 8th Embodiment. It is a schematic flowchart of the abnormality determination process of 9th Embodiment. It is a block diagram showing the notional functional structure of the components control part of 10th Embodiment. It is a schematic flowchart showing the process of the abnormality determination part of the components control part shown by FIG. It is a schematic flowchart showing the process of the instruction | indication part of the components control part shown by FIG. It is a schematic flowchart showing the process of the count part of the components control part shown by FIG. It is a block diagram showing the hardware constitutions of the control apparatus of 11th Embodiment. It is a block diagram which shows the schematic hardware constitutions of the digital processing circuit of the control apparatus shown by FIG. It is a block diagram which shows the schematic hardware constitutions of the digital processing circuit of the control apparatus shown by FIG. It is a block diagram which shows the schematic hardware constitutions of the digital processing circuit of the control apparatus shown by FIG. It is a schematic block diagram of the action | operation circuit of 12th Embodiment. It is a schematic block diagram of the action | operation circuit of 13th Embodiment.

<First Embodiment>
The inventors have developed a control device including a main control unit and a plurality of component control units. The main control unit controls the plurality of component control units in an integrated manner. Each of the plurality of component control units controls corresponding electrical components (for example, a brake, an engine, a transmission, and a steering). The main control unit sets an operation target (for example, a target value of braking force, an engine speed, a target value of traction, a steering direction and a steering angle) for the electrical components in accordance with the traveling environment of the vehicle. A command signal representing the operation target is output from the main control unit to a plurality of component control units. Each of the plurality of component control units controls the corresponding electrical component such that the corresponding electrical component achieves a given operation target. Therefore, the control device can greatly contribute to the automatic driving of the vehicle.

  The operation target set by the main control unit must be adapted to the operation of the driver, the running state of the vehicle, and the surrounding environment of the vehicle. If the operation target set by the main control unit is incompatible with these conditions, the vehicle will not behave according to the driver's intention, behave in an unstable manner, or excessively move on other objects around the vehicle. Inappropriate movement such as approach.

  If the main controller is properly designed, the operational goal is often determined to meet the above-mentioned conditions. However, if the main control unit is exposed to unauthorized access, an inappropriate operation target may be set.

  The main control unit may have a learning function. If the determination algorithm of the main control unit develops beyond the designer's intention, the main control unit executes a determination process unintended by the designer and sets an inappropriate operation target to each of the plurality of component control units. May also be given to

  In view of the above-mentioned potential risks, the present inventors have released the technology for releasing the vehicle from the control by the main control unit. If the control subject is changed from the main control unit where the abnormality has occurred to the driver, and the vehicle can continue the basic operation of the vehicle such as “advance”, “reverse”, “turn”, “stop” For example, the vehicle can perform evacuation travel to avoid danger under the control of the driver. In the first embodiment, an exemplary control device that enables the vehicle to evacuate even when the main control unit is abnormal will be described.

  FIG. 1 is a block diagram illustrating a conceptual functional configuration of the control device 100 according to the first embodiment. The control apparatus 100 is demonstrated with reference to FIG.

  The control device 100 includes a main control unit 110, four component control units 121, 122, 123, and 124, a hub 130, a blocking unit 140, and an operation unit 150. The main control unit 110 is electrically connected to the blocking unit 140 through a wire harness. Each of the blocking unit 140 and the operation unit 150 is electrically connected to the hub 130 by a wire harness. The component control units 121, 122, 123, and 124 and the hub 130 are connected in a ring shape by a plurality of wire harnesses. Since the component control units 121, 122, 123, 124, the hub 130, and the plurality of wire harnesses form an annular signal transmission path (hereinafter referred to as “signal transmission loop”), a part of the signal transmission loop is formed. Even if it breaks, the component control units 121, 122, 123, 124 can receive signals from the main control unit 110 and / or the operation unit 150. If the component control units 121, 122, 123, and 124 output signals to the main control unit 110, the blocking unit 140, and / or the operation unit 150, the main control unit 110, the blocking unit 140, and / or the operation unit 150 may Even if a part of the signal transmission loop is broken, signals from the component control units 121, 122, 123, and 124 can be received. Instead of the signal transmission loop, another signal transmission path may be applied to the electrical connection between the component control units 121, 122, 123, and 124 and the hub 130. Therefore, the principle of the present embodiment is not limited to the signal transmission loop formed by the component controllers 121, 122, 123, 124 and the hub 130.

  FIG. 1 shows four electrical components EC1, EC2, EC3, and EC4 that control driving of a vehicle (not shown). The electrical component EC1 may be one of a brake, an engine, a transmission, and a steering. The electrical component EC2 may be another one of a brake, an engine, a transmission, and a steering. The electrical component EC3 may be another one of a brake, an engine, a transmission, and a steering. The electrical component EC4 may be the remaining one of a brake, an engine, a transmission, and a steering.

  The main control unit 110 generates a command signal for giving a command to the component control units 121, 122, 123, and 124. The command signal may represent a target for the operation of the electrical components EC1, EC2, EC3, and EC4. The component control units 121, 122, 123, 124 are given target values for the operation of the electrical components EC 1, EC 2, EC 3, EC 4 by transmission of command signals from the main control unit 110. For example, the command signal may represent a braking force that acts on the vehicle. The command signal may represent the speed of the vehicle. The command signal may represent the acceleration of the vehicle. The command signal may represent traction transmitted from the vehicle to the road surface. The command signal may represent the traveling direction of the vehicle. The command signal may represent the steering angle of the vehicle. The principle of the present embodiment is not limited to a specific target represented by the command signal.

  If the main control unit 110 is normal, the command signal is transmitted to the hub 130 through the blocking unit 140. Thereafter, the command signal is transmitted to the component controllers 121, 122, 123, and 124 through the hub 130. Each of the component control units 121, 122, 123, and 124 controls corresponding ones of the electrical components EC1, EC2, EC3, and EC4 according to the command signal.

  If the electrical component EC1 is a brake, the component control unit 121 may adjust the hydraulic pressure acting on the disc brake in accordance with the command signal. If the electrical component EC2 is an engine, the component control unit 122 may adjust the ignition timing and the rotational speed of the engine according to the command signal. If the electrical component EC3 is a transmission, the component control unit 123 may change the gear according to the command signal (for example, from the 3rd speed to the 4th speed). If the electrical component EC4 is a steering, the component control unit 124 may rotate the steering shaft by a predetermined angle clockwise or counterclockwise according to the command signal. The principle of this embodiment is not limited to the specific control executed by the component control units 121, 122, 123, and 124.

  The operation unit 150 includes various parts operated by the driver, and various sensors and electronic parts attached to these parts. For example, the operation unit 150 may include a brake pedal, an accelerator pedal, a gear lever, and a steering wheel. These accompanying sensors and electronic components generate operation signals that represent the driver's operations on these components. The operation signal may indicate that the driver has depressed the brake pedal. The operation signal may indicate that the driver has depressed the accelerator pedal or the amount of depression of the accelerator pedal. The operation signal may represent a gear (for example, third gear) designated by the gear lever. The operation signal may represent the steering angle of the steering wheel or the steering angle given to the steering wheel by the driver. The principle of this embodiment is not limited to the specific content represented by the operation signal.

  The operation signal is transmitted from the operation unit 150 to the hub 130. Thereafter, the component controllers 121, 122, 123, and 124 receive the operation signal through the hub. The operation signal may coexist with a command signal generated by the main control unit 110 in a signal transmission loop formed by the hub 130, the component control units 121, 122, 123, and 124 and a plurality of wire harnesses. In this case, the component control units 121, 122, 123, and 124 can receive the operation signal and the command signal. If the main control unit 110 is normal, the component control units 121, 122, 123, and 124 may preferentially process the operation signal or preferentially process the command signal.

  When an abnormality occurs in the main control unit 110, the blocking unit 140 blocks transmission of a command signal from the main control unit 110 to the hub 130. The driver may determine whether an abnormality has occurred in the main control unit 110. In this case, the blocking unit 140 is operated by the driver and blocks transmission of a command signal from the main control unit 110 to the hub 130. At least one of the component controllers 121, 122, 123, 124 may determine whether an abnormality has occurred in the main controller 110. In this case, at least one of the component controllers 121, 122, 123, and 124 generates a request signal that requests blocking of transmission of a command signal from the main controller 110 to the hub 130. The request signal is transmitted from at least one of the component control units 121, 122, 123, and 124 to the blocking unit 140 through the hub 130. The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 to the hub 130 in response to the request signal. A CPU for determining the occurrence of an abnormality in the main control unit 110 is a signal transmission path between the main control unit 110 and the blocking unit 140, a signal transmission path between the blocking unit 140 and the hub 130, or the hub 130 and the component control unit. 121, 122, 123, 124 may be arranged in a signal transmission loop. In this case, the request signal described above is generated by the CPU that determines the occurrence of an abnormality in the main control unit 110. A CPU that determines the occurrence of an abnormality in the main control unit 110 may be incorporated in a circuit designed as the blocking unit 140. In this case, when the CPU incorporated in the shut-off circuit designed as the shut-off unit 140 determines that an abnormality has occurred in the main control unit 110, the shut-off circuit shuts off the transmission of the command signal from the main control unit 110 to the hub 130. To do. The principle of the present embodiment is not limited to a specific determination subject that determines the occurrence of an abnormality in the main control unit 110.

  When the blocking unit 140 blocks the transmission of the command signal as described above, the component control units 121, 122, 123, and 124 can exclusively receive the operation signal from the operation unit 150. If the electrical component EC1 is a brake and the operation signal indicates that the driver has stepped on the brake pedal, the component control unit 121 sets the hydraulic pressure acting on the disc brake in accordance with the operation signal. It may be increased. If the electrical component EC2 is an engine and the operation signal indicates that the driver has depressed the accelerator pedal or the amount of depression of the accelerator pedal, the component control unit 122 increases the engine speed. The ignition timing may be adjusted to match the increase in the engine speed. If the electrical component EC3 is a transmission and the operation signal indicates that the gear indicated by the gear lever has been changed from “3rd speed” to “4th speed”, the component control unit 123 outputs the operation signal. The gear may be changed accordingly. If the electrical component EC4 is steering, and the operation signal represents the steering direction of the steering wheel or the steering angle given to the steering wheel, the component control unit 124 determines whether or not the steering wheel The motor may be driven to rotate the steering shaft by a predetermined angle clockwise or counterclockwise. Therefore, even after the interruption of the transmission of the command signal from the main control unit 110 to the component control units 121, 122, 123, 124 (that is, after the occurrence of an abnormality in the main control unit 110), the vehicle is operated by the operation unit 150. Under the control, the basic operations of the vehicle such as “advance”, “reverse”, “turn” and “stop” can be continued.

Second Embodiment
The driver may determine whether an abnormality has occurred in the main control unit. For example, if the main control unit performs control that makes the driver uneasy, the driver can determine that an abnormality has occurred in the main control unit. If the driver can operate the shut-off unit and finish the control by the main control unit, the driver can then operate the operation unit and drive the vehicle comfortably. In the second embodiment, an exemplary control device that allows the control by the main control unit to be released under the will of the driver will be described.

  FIG. 2 is a block diagram illustrating a conceptual functional configuration of the control device 100A of the second embodiment. The control device 100A will be described with reference to FIG. The description of the above-described embodiment is applied to elements having the same reference numerals as those of the above-described embodiment.

  As in the first embodiment, the control device 100A includes a main control unit 110, four component control units 121, 122, 123, and 124, a hub 130, and an operation unit 150. The description of the first embodiment is incorporated in these elements.

  The control device 100A further includes a blocking unit 140A. The shut-off unit 140A includes an operation switch 141 and a shut-off switch 142. The cutoff switch 142 includes a first terminal 143 and a second terminal 144. The main control unit 110 is electrically connected to the first terminal 143. The hub 130 is electrically connected to the second terminal 144.

  The operation switch 141 is operated by the driver. The operation switch 141 may be a button or a lever switch arranged around the steering wheel. Alternatively, the operation switch 141 may be disposed on an instrument panel near the driver or may be disposed on an overhead console. The operation switch 141 may be disposed at various positions where the driver can access without greatly changing the posture. The principle of this embodiment is not limited to a specific part used as the operation switch 141 or a specific place where the operation switch 141 is arranged.

  If the operation switch 141 is not operated by the driver, the cutoff switch 142 maintains an electrical connection between the first terminal 143 and the second terminal 144. During this time, the command signal generated by the main control unit 110 is transmitted to the component control units 121, 122, 123, and 124 through the first terminal 143, the second terminal 144, and the hub 130.

  If the driver determines that an abnormality has occurred in the main control unit 110, the driver can operate the operation switch 141. When the operation switch 141 is operated by the driver, the cutoff switch 142 releases the electrical connection between the first terminal 143 and the second terminal 144. As a result, the transmission of the command signal from the main control unit 110 to the component control units 121, 122, 123, 124 is blocked. If the driver feels uneasy about the behavior of the vehicle under the control of the main control unit 110, the driver may operate the operation switch 141. Thereafter, the driver may operate the operation unit 150 to drive the vehicle.

  The interruption of the transmission of the command signal from the main control unit 110 to the component control units 121, 122, 123, 124 may require a plurality of operations on the operation switch 141. In this case, even if the driver does not intend to touch the operation switch 141, the control of the main control unit 110 is continued. That is, the transmission of the command signal due to the driver's erroneous operation is less likely to occur.

  The interruption of the transmission of the command signal from the main control unit 110 to the component control units 121, 122, 123, 124 may require an operation to the operation switch 141 exceeding a predetermined period. Also in this case, even if the driver does not intend to touch the operation switch 141 for a short period of time, the control of the main control unit 110 is continued. That is, the transmission of the command signal due to the driver's erroneous operation is less likely to occur.

  In order to prevent the interruption of the transmission of the command signal due to the driver's erroneous operation, the operation switch 141 may be disposed in a space covered by a rotary or sliding door. Alternatively, the operation switch 141 may be covered with a cover. In these cases, the driver cannot operate the operation switch 141 without operating the door or destroying the cover. Therefore, the transmission of the command signal due to the driver's erroneous operation is less likely to occur.

  The linkage between the operation switch 141 and the cutoff switch 142 may depend on the technology used for known electronic components. When the operation switch 141 is operated, the operation switch 141 may generate an electromagnetic force, and the connection element that connects them may be pulled away from the first terminal 143 and the second terminal 144.

<Third Embodiment>
According to the control principle described in connection with the second embodiment, the driver determines whether an abnormality has occurred in the main control unit. Alternatively or additionally, the component control unit may determine whether an abnormality has occurred in the main control unit. In this case, the occurrence of an abnormality in the main control unit is automatically determined. In the third embodiment, an exemplary control device that enables automatic determination of occurrence of an abnormality in the main control unit will be described.

  FIG. 3 is a block diagram illustrating a conceptual functional configuration of the component control unit 120 according to the third embodiment. The component control unit 120 will be described with reference to FIGS. 1 and 3.

  The description regarding the component control unit 120 is incorporated into at least one of the component control units 121, 122, 123, and 124 described with reference to FIG. Therefore, at least one of the component control units 121, 122, 123, and 124 can have the function of the component control unit 120.

  The component control unit 120 includes an input port 161, an output port 162, an abnormality determination unit 163, a request signal generation unit 164, and a control signal generation unit 165. The input port 161 receives a command signal and / or an operation signal through the signal transmission loop described in the context of the first embodiment. The abnormality determination unit 163 receives a command signal and / or an operation signal through the input port 161.

  When the abnormality determination unit 163 receives the operation signal, the abnormality determination unit 163 refers to the operation signal and determines whether or not the operation signal represents an operation on the control target of the component control unit 120. If the control target of the component control unit 120 is a brake, and the operation signal indicates the driver's brake operation, the abnormality determination unit 163 sends the operation signal to the control signal generation unit 165 and the output port 162. introduce. In other cases, the abnormality determination unit 163 transmits the operation signal to the output port 162 without transmitting the operation signal to the control signal generation unit 165. The operation signal transmitted to the output port 162 is then transmitted to another component control unit through a signal transmission loop.

  When the control signal generation unit 165 receives the operation signal, the control signal generation unit 165 generates a control signal corresponding to the operation signal. If the control target of the component control unit 120 is a brake, and the operation signal represents the driver's brake operation, the control signal generation unit 165 controls the hydraulic pressure applied to the brake disc. Is generated. The control signal is transmitted from the control signal generation unit 165 to the electrical component to be controlled by the component control unit 120. The electrical component performs an operation according to the control signal.

  When the abnormality determining unit 163 receives the command signal, the abnormality determining unit 163 refers to the command signal to determine whether or not an abnormality has occurred in the main control unit 110 (see FIG. 1). If no abnormality has occurred in the main control unit 110, the abnormality determination unit 163 refers to the command signal and determines whether or not the command signal represents an operation on the control target of the component control unit 120. If the control target of the component control unit 120 is a brake, and the command signal represents the target value of the braking force, the abnormality determination unit 163 sends the command signal to the control signal generation unit 165 and the output port 162. introduce. In other cases, the abnormality determination unit 163 transmits the command signal to the output port 162 without transmitting the command signal to the control signal generation unit 165. The command signal transmitted to the output port 162 is then transmitted to another component control unit through a signal transmission loop.

  When the control signal generation unit 165 receives the command signal, the control signal generation unit 165 generates a control signal for achieving the target value given by the command signal. If the control target of the component control unit 120 is a brake, and the command signal represents a target value of the braking force, the control signal generation unit 165 increases the hydraulic pressure applied to the brake disk to control the target. A control signal for achieving power is generated. The control signal is transmitted from the control signal generation unit 165 to the electrical component to be controlled by the component control unit 120. The electrical component performs an operation according to the control signal.

  If the abnormality determination unit 163 refers to the command signal and determines that an abnormality has occurred in the main control unit 110, the abnormality determination unit 163 instructs the request signal generation unit 164 to generate a request signal. The request signal generation unit 164 generates a request signal for requesting interruption of transmission of the command signal based on an instruction from the abnormality determination unit 163. The request signal is output to the signal transmission loop through the output port 162. Thereafter, the blocking unit 140 (see FIG. 1) receives the request signal. The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 according to the request signal. Regarding the present embodiment, the determination unit is exemplified by the abnormality determination unit 163 and the request signal generation unit 164.

<Fourth embodiment>
According to the control principle described in relation to the third embodiment, the component control unit determines whether an abnormality has occurred in the main control unit. In this case, the component control unit executes a process for controlling the electrical component and a process for determining whether or not an abnormality has occurred in the main control unit. As a result, the calculation load applied to the component control unit may become excessive. In the fourth embodiment, an exemplary technique for reducing the calculation load applied to the component control unit will be described.

  FIG. 4 is a block diagram illustrating a conceptual functional configuration of the control device 100B according to the fourth embodiment. The control device 100B will be described with reference to FIG. The description of the above-described embodiment is applied to elements having the same reference numerals as those of the above-described embodiment.

  As in the first embodiment, the control device 100B includes a main control unit 110, component control units 121, 122, 123, and 124, a hub 130, a blocking unit 140, and an operation unit 150. The description of the first embodiment is incorporated in these elements.

  The control device 100B further includes a determination unit 170 that determines whether an abnormality has occurred in the main control unit 110. Determination unit 170 includes an input port 171, an output port 172, an abnormality determination unit 173, and a request signal generation unit 174. The input port 171 receives a command signal and / or an operation signal through a signal transmission loop. The abnormality determination unit 173 receives a command signal and / or an operation signal through the input port 171.

  When the abnormality determination unit 173 receives the operation signal, the abnormality determination unit 173 outputs the operation signal to the output port 172. When the abnormality determination unit 173 receives the command signal, the abnormality determination unit 173 refers to the command signal to determine whether an abnormality has occurred in the main control unit 110. If no abnormality has occurred in main control unit 110, abnormality determination unit 173 outputs a command signal to output port 172. The operation signal and the command signal output to the output port 172 are input again to the signal transmission loop.

  If the abnormality determination unit 173 refers to the command signal and determines that an abnormality has occurred in the main control unit 110, the abnormality determination unit 173 instructs the request signal generation unit 174 to generate a request signal. The request signal generation unit 174 generates a request signal for requesting interruption of transmission of the command signal based on an instruction from the abnormality determination unit 173. The request signal is output to the signal transmission loop through the output port 172. Thereafter, the blocking unit 140 receives a request signal. The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 according to the request signal.

  The determination unit 170 executes a determination process for determining whether an abnormality has occurred in the main control unit 110. Therefore, the component control units 121, 122, 123, and 124 can exclusively handle processing for controlling the electrical components EC1, EC2, EC3, and EC4. Therefore, an excessive calculation load is not applied to the component controllers 121, 122, 123, and 124.

<Fifth Embodiment>
The abnormality determination unit described in relation to the third embodiment and the fourth embodiment may hold in advance a threshold value for the target value represented by the command signal. The abnormality determination unit may determine whether an abnormality has occurred in the main control unit by comparing the target value with a threshold value. In the fifth embodiment, an exemplary abnormality determination technique using a threshold will be described.

  FIG. 5 is a schematic flowchart of the abnormality determination process of the fifth embodiment. With reference to FIGS. 3 to 5, the abnormality determination processing of the abnormality determination units 163 and 173 (see FIGS. 3 and 4) will be described.

(Step S110)
Abnormality determination units 163 and 173 wait for reception of a command signal. When abnormality determination units 163 and 173 receive the command signal, step S120 is executed.

(Step S120)
The abnormality determination units 163 and 173 refer to the command signal and compare the target value represented by the command signal with the upper limit threshold and / or the lower limit threshold. If the target value exceeds the upper threshold value, or if the target value is lower than the lower threshold value, step S130 is executed. In other cases, step S110 is executed.

  The upper limit threshold and / or the lower limit threshold may be set based on the driving ability of the vehicle and legal standards. For example, if the target value represents a travel speed of “250 km / h”, the target value exceeds the travel capability of the vehicle and / or the legal standard, so the abnormality determination units 163 and 173 perform the main control. It can be determined that the unit 110 is in an abnormal state.

(Step S130)
The abnormality determination units 163 and 173 instruct the request signal generation units 164 and 174 to generate a request signal. The request signal generation units 164 and 174 generate request signals under the instruction of the abnormality determination units 163 and 173. The request signal is transmitted from the request signal generation units 164 and 174 to the blocking unit 140. The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 according to the request signal. As a result, the vehicle is controlled according to the operation signal output from the operation unit 150 without being affected by an inappropriate command signal.

<Sixth Embodiment>
The threshold value described in relation to the fifth embodiment may be changed according to the running state of the vehicle, the environment around the vehicle, and other factors. In this case, an abnormality determination process adapted to the running state of the vehicle and the environment around the vehicle is performed on the main control unit. In the sixth embodiment, an exemplary abnormality determination process using a variable threshold will be described.

  FIG. 6 is a block diagram illustrating a conceptual functional configuration of a control device 100C according to the sixth embodiment. The control device 100C will be described with reference to FIGS. The description of the above-described embodiment is applied to elements having the same reference numerals as those of the above-described embodiment.

  As in the first embodiment, the control device 100C includes a main control unit 110, component control units 121, 122, 123, and 124, a hub 130, a blocking unit 140, and an operation unit 150. The description of the first embodiment is incorporated in these elements.

  The control device 100C further includes a determination unit 170C and a data collection unit 180. Similar to the fourth embodiment, the determination unit 170 </ b> C includes an input port 171, an output port 172, and a request signal generation unit 174. The description of the fourth embodiment is incorporated in these elements.

  The determination unit 170C further includes an abnormality determination unit 173C. The abnormality determination unit 173C receives data from the data collection unit 180 and sets a threshold value for abnormality determination processing. The data collection unit 180 includes vehicle acceleration, vehicle deceleration, vehicle speed, turning speed, turning acceleration, turning deceleration, road friction coefficient, road inclination angle, and presence of obstacles around the vehicle. Alternatively, various sensors, radar equipment, camera devices, and GPS systems that contribute to data acquisition such as absence and road information may be included. Signals obtained from these devices and data calculated from signals obtained from these devices are output from the data collection unit 180 to the abnormality determination unit 173C. In the present embodiment, the detection unit is exemplified by the data collection unit 180. The detection signal is exemplified by a signal or data output from the data collection unit 180 to the abnormality determination unit 173C.

  The abnormality determination unit 173C may determine the threshold value (the upper threshold value or the lower threshold value described with reference to FIG. 5) based on a predetermined function F (see the following expression). In the following formula, “X1”, “X2”..., “Xn” are different factors (for example, vehicle acceleration, vehicle deceleration, vehicle speed, turning speed, turning acceleration, turning) Data indicating the deceleration, the friction coefficient of the road surface, the inclination angle of the road surface, the presence or absence of obstacles around the vehicle, and road information).

  Alternatively, the abnormality determination unit 173C determines that the threshold or the allowable range (that is, the main control unit 110 is normal) as a map set in the multidimensional coordinate system using the data for determining the threshold as coordinate axes. Range) may be stored.

  For example, the threshold for the target value related to the turning amount, the turning speed, or the turning acceleration may be set as a function of a road friction coefficient, a road inclination angle, a vehicle speed, or a vehicle acceleration. Alternatively, the threshold value for the target value related to the turning amount, turning speed or turning acceleration is defined in a four-dimensional coordinate system set with the friction coefficient of the road surface, the inclination angle of the road surface, the vehicle speed and the vehicle acceleration as coordinate axes. It may be determined based on the mapped map.

  If the friction coefficient of the road surface is very small, the threshold for the target value related to the turning amount, turning speed, or turning acceleration may be set to a small value. When the vehicle is traveling on a slippery road surface, if the main control unit 110 sets a large target value with respect to the turning amount, the turning speed, or the turning acceleration, the blocking unit 140 performs the main control. The transmission of the command signal from the unit 110 is cut off. As a result, an unstable behavior of the vehicle under the control of the main control unit 110 (that is, vehicle spin) is avoided. Since the vehicle is controlled by the driver's operation of the vehicle instead of the control of the main control unit 110, the vehicle can operate in accordance with the road surface having a low coefficient of friction.

  If the road surface friction coefficient is large, the threshold value for the target value regarding the turning amount, the turning speed, or the turning acceleration may be set to a large value. As a result, the request signal is less likely to be output from the request signal generation unit 174 to the blocking unit 140. This means that the abnormality determination process does not excessively determine an abnormality of the main control unit 110.

<Seventh embodiment>
The control device described in connection with the sixth embodiment makes it possible to avoid a collision between the vehicle and an obstacle under the control of the main control unit. In the seventh embodiment, an exemplary abnormality determination process for blocking transmission of a command signal from a main control unit that allows excessive approach to an obstacle will be described.

  FIG. 7 is a schematic flowchart of the abnormality determination process according to the seventh embodiment. With reference to FIG.6 and FIG.7, the abnormality determination process which cancels | releases control of the main control part which accept | permits the excessive approach to an obstruction is demonstrated.

(Step S210)
Abnormality determination unit 173C acquires travel data from data collection unit 180. In the present embodiment, the data collection unit 180 may include a radar device or a camera device that detects an obstacle present around the vehicle. The travel data may include information such as vehicle acceleration, vehicle deceleration, vehicle speed, vehicle travel direction, and positions of obstacles around the vehicle. When abnormality determination unit 173C acquires travel data, step S220 is executed. In the present embodiment, the detection unit is exemplified by a radar device or a camera device.

(Step S220)
Abnormality determination unit 173C determines whether or not a command signal has been received. If abnormality determination unit 173C has not received a command signal, step S210 is executed. If abnormality determination unit 173C receives a command signal, step S230 is executed. Therefore, the processes in step S210 and step S220 are repeated until abnormality determination unit 173C receives the command signal.

(Step S230)
Abnormality determination unit 173C refers to the travel data acquired in step S210 to determine whether an obstacle exists in a predetermined range around the vehicle. If the obstacle exists in a predetermined range around the vehicle, the abnormality determining unit 173C confirms the direction (or position) of the obstacle with respect to the vehicle. Thereafter, step S240 is executed. In other cases, step S210 is executed.

(Step S240)
Abnormality determination unit 173C refers to the command signal acquired in step S220, and estimates the subsequent traveling direction based on the turning direction specified by the command signal. If the command signal does not indicate a target value related to the steering direction (for example, a target value related to the rotation direction or rotation angle of the steering wheel), the abnormality determination unit 173C refers to the travel data and determines the current travel direction. You may check. The abnormality determination unit 173C verifies whether or not the direction of the obstacle confirmed in step S230 substantially matches the estimated or confirmed traveling direction. If an obstacle exists in the estimated or confirmed traveling direction, step S250 is executed. In other cases, step S210 is executed.

(Step S250)
Abnormality determination unit 173C refers to the command signal acquired in step S220 and determines whether or not the braking force specified by the command signal is sufficiently large, or whether or not the vehicle speed specified by the command signal is sufficiently low. Determine. If the braking force specified by the command signal is sufficiently large and / or if the speed of the vehicle specified by the command signal is sufficiently low, the abnormality determination unit 173C determines that the vehicle stops before contacting the obstacle. can do. In this case, step S210 is executed. On the other hand, when the braking force specified by the command signal is too small, when the speed of the vehicle specified by the command signal is too high (for example, when the command signal indicates acceleration), or when the command signal is an obstacle When another target value that presumes the collision of the vehicle with the vehicle is specified, abnormality determination unit 173C determines that an abnormality has occurred in main control unit 110, and step S260 is executed. .

(Step S260)
The abnormality determination unit 173C instructs the request signal generation unit 174 to generate a request signal. The request signal generation unit 174 generates a request signal under the instruction of the abnormality determination unit 173C. The request signal is transmitted from the request signal generation unit 174 to the blocking unit 140. The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 according to the request signal. As a result, the vehicle is controlled according to the operation signal output from the operation unit 150 without being affected by an inappropriate command signal. That is, the driver can operate the operation unit 150 and avoid an obstacle without being affected by the command signal.

<Eighth Embodiment>
The control device described in connection with the sixth embodiment avoids an inappropriate entry operation of the vehicle (for example, entry into a non-running area such as a waterway, a lake, or the sea) under the control of the main control unit. Make it possible. In the eighth embodiment, an exemplary abnormality determination process for interrupting transmission of a command signal from the main control unit that instructs entry into the inoperable area will be described.

  FIG. 8 is a schematic flowchart of abnormality determination processing according to the eighth embodiment. With reference to FIG.6 and FIG.8, the abnormality determination process which cancels | releases control of the main control part which instruct | indicates the penetration | invasion into a driving impossible area is demonstrated.

(Step S310)
Abnormality determination unit 173C acquires travel data from data collection unit 180. In the present embodiment, the data collection unit 180 may include a navigation system that provides map information about the position of the vehicle and the surroundings of the vehicle. The travel data may further include information such as vehicle acceleration, vehicle deceleration, vehicle speed, and vehicle travel direction. When abnormality determination unit 173C acquires travel data, step S320 is executed. In the present embodiment, the acquisition unit is exemplified by a navigation system.

(Step S320)
Abnormality determination unit 173C determines whether or not a command signal has been received. If abnormality determination unit 173C has not received a command signal, step S310 is executed. If abnormality determination unit 173C receives a command signal, step S330 is executed. Therefore, the processes in step S310 and step S320 are repeated until abnormality determination unit 173C receives the command signal.

(Step S330)
Abnormality determination unit 173C refers to the command signal acquired in step S320, and estimates the subsequent traveling direction based on the turning direction specified by the command signal. If the command signal does not indicate a target value related to the steering direction (for example, a target value related to the rotation direction or rotation angle of the steering wheel), the abnormality determination unit 173C refers to the travel data and determines the current travel direction. You may check. Step S340 is executed after the estimation or confirmation of the traveling direction.

(Step S340)
The abnormality determination unit 173C refers to the vehicle position and map information around the vehicle. When abnormality determination unit 173C travels in the travel direction estimated or confirmed in step S330, does abnormality determination unit 173C enter an area (for example, a waterway, a lake, or the sea) indicated as an untravelable area in the map information? Verify whether or not. If abnormality determination unit 173C determines that there is a high risk of the vehicle entering the untravelable area (for example, a straight line extended from the vehicle in the travel direction extends into the untravelable area), an abnormality Determination unit 173C determines that an abnormality has occurred in main control unit 110, and step S350 is executed. In other cases, step S310 is executed.

(Step S350)
The abnormality determination unit 173C instructs the request signal generation unit 174 to generate a request signal. The request signal generation unit 174 generates a request signal under the instruction of the abnormality determination unit 173C. The request signal is transmitted from the request signal generation unit 174 to the blocking unit 140. The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 according to the request signal. As a result, the vehicle is controlled according to the operation signal output from the operation unit 150 without being affected by an inappropriate command signal. In other words, the driver can operate the operation unit 150 and avoid entry into the non-travelable area without being affected by the command signal.

<Ninth Embodiment>
If the control of the main control unit is inconsistent with the driver's operation, the abnormality determination unit may determine that an abnormality has occurred in the main control unit. If the transmission of the command signal from the main control unit is interrupted in response to the occurrence of a contradiction between the control of the main control unit and the driver's operation, the control of the vehicle is then performed by the driver's operation. It depends exclusively. As a result, the vehicle can travel safely under the control of the driver without being affected by the instruction of the command signal that contradicts the operation of the driver. In 9th Embodiment, the example abnormality determination process for interrupting | blocking transmission of the command signal from a main control part according to generation | occurrence | production of the contradiction between control of a main control part and a driver | operator's operation is demonstrated. Is done.

  FIG. 9 is a schematic flowchart of the abnormality determination process according to the ninth embodiment. With reference to FIGS. 6 and 9, an abnormality determination process for releasing the control of the main control unit according to the occurrence of a contradiction between the control of the main control unit and the operation of the driver will be described.

(Step S405)
Abnormality determination unit 173C waits for reception of a signal. When abnormality determination unit 173C receives the signal, step S410 is executed.

(Step S410)
Abnormality determination unit 173C starts timing. As a result, the time measurement value “T” increases from “0”. Thereafter, step S415 is executed.

(Step S415)
Abnormality determination unit 173C determines whether or not the signal is a command signal. If the signal is a command signal, step S420 is executed. If the signal is an operation signal, step S445 is executed.

(Step S420)
The abnormality determination unit 173C determines whether or not the time measurement value “T” exceeds a predetermined time measurement threshold “TH”. If the timed value “T” exceeds the timed threshold “TH”, step S405 is executed. In other cases, step S425 is executed.

(Step S425)
Abnormality determination unit 173C determines whether or not a signal is further received. If abnormality determination unit 173C further receives a signal, step S430 is executed. In other cases, step S420 is performed.

(Step S430)
The abnormality determination unit 173C determines whether or not the received signal is an operation signal. If the received signal is an operation signal, step S435 is executed. If the received signal is a command signal, step S405 is executed.

(Step S435)
In step S435, the abnormality determination unit 173C receives the command signal and the operation signal within a period determined by the time-measurement threshold “TH”. Abnormality determination unit 173C determines whether or not the target value indicated by the command signal is inconsistent with the operation represented by the operation signal. For example, if the operation signal indicates that the driver is operating the brake while the command signal indicates a target value of a speed higher than the current traveling speed, the abnormality determination unit 173C It is determined that an abnormality has occurred in the main control unit 110. If the operation signal indicates that the driver indicates leftward steering while the command signal indicates a target value that indicates rightward steering, the abnormality determination unit 173C indicates that the abnormality is the main control unit. 110 is determined to have occurred. If abnormality determination unit 173C determines that an abnormality has occurred in main control unit 110, step S440 is executed. In other cases, step S405 is executed.

(Step S440)
The abnormality determination unit 173C instructs the request signal generation unit 174 to generate a request signal. The request signal generation unit 174 generates a request signal under the instruction of the abnormality determination unit 173C. The request signal is transmitted from the request signal generation unit 174 to the blocking unit 140. The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 according to the request signal. As a result, the vehicle is controlled according to the operation signal output from the operation unit 150 without being affected by the command signal that contradicts the operation of the driver.

(Step S445)
The abnormality determination unit 173C determines whether or not the time measurement value “T” exceeds a predetermined time measurement threshold “TH”. If the timed value “T” exceeds the timed threshold “TH”, step S405 is executed. In other cases, step S450 is executed.

(Step S450)
Abnormality determination unit 173C determines whether or not a signal is further received. If abnormality determination unit 173C further receives a signal, step S455 is executed. In other cases, step S445 is executed.

(Step S455)
Abnormality determination unit 173C determines whether or not the received signal is a command signal. If the received signal is a command signal, step S435 is executed. If the received signal is an operation signal, step S405 is executed.

<Tenth Embodiment>
The interruption of the command signal from the main control unit may be executed after the abnormality determination unit determines several times that an abnormality has occurred in the main control unit. Since the result indicating the abnormality of the main control unit is repeatedly output from the abnormality determination unit several times, the interruption of the command signal from the main control unit is executed under a highly accurate abnormality determination. Therefore, the command signal from the main control unit is not excessively sensitive. In the tenth embodiment, an exemplary control device that executes blocking of a command signal from the main control unit under a highly accurate abnormality determination will be described.

  FIG. 10 is a block diagram illustrating a conceptual functional configuration of a component control unit 120D according to the tenth embodiment. The component control unit 120D will be described with reference to FIGS. The description of the above-described embodiment is applied to elements having the same reference numerals as those of the above-described embodiment.

  The description regarding the component control unit 120D is incorporated into one of the component control units 121, 122, 123, and 124 described with reference to FIG. Therefore, one of the component controllers 121, 122, 123, and 124 can have the function of the component controller 120D.

  Similar to the third embodiment, the component control unit 120D includes an input port 161, an output port 162, a request signal generation unit 164, and a control signal generation unit 165. The description of the third embodiment is incorporated in these elements.

  Component control unit 120D further includes an abnormality determination unit 163D, an instruction unit 166, and a count unit 167. FIG. 10 shows the data collection unit 180 described in the context of the sixth embodiment. The description of the sixth embodiment is incorporated in the data collection unit 180.

  The component control unit 120D is exclusively used for controlling a steering mechanism mounted as an electrical component. The abnormality determination unit 163D exclusively processes a command signal and an operation signal including information regarding the steering mechanism. Command signals and operation signals including information irrelevant to the steering mechanism are transmitted from the input port 161 to the output port 162 through the abnormality determination unit 163D without being exposed to the abnormality determination by the abnormality determination unit 163D. Thereafter, these signals are transmitted to other component processing units through the signal transmission loop described with reference to FIG.

  The abnormality determination unit 163D receives the vehicle acceleration, vehicle deceleration, vehicle speed, turning speed, turning acceleration, turning deceleration, turning direction, road friction coefficient, road surface Receive information about tilt angle. Abnormality determination unit 163D may estimate the friction coefficient of the road surface on which the vehicle travels based on information from data collection unit 180. Known computing techniques may be used for the estimation of the friction coefficient. Therefore, the principle of this embodiment is not limited to a specific calculation technique for estimating the friction coefficient.

  The abnormality determination unit 163D sets an allowable range for the target value of the command signal based on the control principle of the sixth embodiment (see the following equation). In the following equation, the symbol “AR1” represents an allowable range related to the turning angle amount (that is, the rotation angle amount of the steering shaft). The symbol “AR2” represents an allowable range related to the steering speed. The symbol “AR3” represents an allowable range related to the turning acceleration. The symbol “AR4” represents an allowable range related to the steering deceleration. The symbol “LS1” represents a lower limit threshold regarding the turning angle amount. The symbol “LS2” represents a lower limit threshold related to the steering speed. The symbol “LS3” represents a lower limit threshold regarding the steering acceleration. The symbol “LS4” represents a lower limit threshold regarding the steering deceleration. The symbol “US1” represents an upper limit threshold related to the turning angle amount. The symbol “US2” represents an upper limit threshold regarding the steering speed. The symbol “US3” represents an upper limit threshold related to the steering acceleration. The symbol “US4” represents an upper limit threshold related to the steering deceleration.

  The lower and upper thresholds are as follows: vehicle acceleration, vehicle deceleration, vehicle speed, turning speed, turning acceleration, turning deceleration, turning direction, road friction It may be defined as a function of the coefficient, the slope of the road surface. In the following equation, the symbol “a1” means the acceleration of the vehicle represented by the travel data. The symbol “a2” means the deceleration of the vehicle represented by the travel data. The symbol “a3” means the speed of the vehicle represented by the travel data. The symbol “a4” means the turning speed represented by the travel data. The symbol “a5” means the turning acceleration represented by the travel data. The symbol “a6” means the steering deceleration represented by the travel data. The symbol “a7” means the direction of turning represented by the travel data. The symbol “a8” means the estimated coefficient of friction. The symbol “a9” means the slope angle of the road surface represented by the travel data.

  The abnormality determination unit 163D has the target values (that is, target values related to the turning angle amount, the turning speed, the turning acceleration, and the turning deceleration) indicated by the command signal within the allowable ranges “AR1”, “AR2”, “ It is determined whether or not each item is included in “AR3” and “AR4”. If the target value indicated by the command signal is included in the allowable ranges “AR1”, “AR2”, “AR3”, “AR4”, the abnormality determination unit 163D determines that the abnormality is the main control unit 110 (see FIG. 1). ) To generate a determination result that does not occur. On the other hand, if at least one of the target values indicated by the command signal is out of the allowable ranges “AR1”, “AR2”, “AR3”, “AR4”, the abnormality determination unit 163D indicates that the abnormality is the main control unit. A determination result representing what has occurred in 110 is generated. These determination results are output from the abnormality determination unit 163D to the instruction unit 166.

  The instruction unit 166 that has received the determination result indicating that no abnormality has occurred in the main control unit 110 instructs the control signal generation unit 165 to generate a control signal. The control signal generation unit 165 generates a control signal for controlling the steering mechanism under the instruction of the instruction unit 166. The control signal is output from the control signal generation unit 165 to a steering mechanism (for example, a motor used as a part of the steering mechanism).

  The instruction unit 166 that has received the determination result indicating that an abnormality has occurred in the main control unit 110 instructs the count unit 167 to increase the count value. The count unit 167 increases the count value under the instruction of the instruction unit 166. If the count value exceeds a predetermined count threshold, the count unit 167 generates a trigger signal. The trigger signal is output from the count unit 167 to the request signal generation unit 164.

  The request signal generation unit 164 generates a request signal according to the trigger signal. As described in connection with the third embodiment, the request signal is then communicated through the output port 162 to the signaling loop. Finally, the request signal is received by the blocker 140 (see FIG. 1). The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 according to the request signal.

  Since the request signal is not generated until the count value exceeds a predetermined count threshold, even if the target value of the command signal generated by the main control unit 110 accidentally exceeds the allowable range, a command from the main control unit 110 is generated. Signal transmission is not interrupted.

  While the determination result indicating that an abnormality has occurred in the main control unit 110 is being output from the abnormality determination unit 163D to the instruction unit 166, the command signal is not reflected in the signal generation processing of the control signal generation unit 165. In this case, the main control unit 110 repeatedly outputs a command signal. If an abnormality has occurred in the main control unit 110, the target value of the command signal repeatedly output exceeds the allowable range. As a result, the count unit 167 repeatedly increases the count value under the instruction unit 166. Therefore, the count value exceeds the count threshold in a short period. As described above, the count unit 167 generates a trigger signal when the count value exceeds the count threshold, and the request signal generation unit 164 generates a request signal according to the trigger signal. A command signal from the main control unit 110 is transmitted.

  FIG. 11 is a schematic flowchart showing the process of the abnormality determination unit 163D. The processing of the abnormality determination unit 163D will be described with reference to FIGS.

(Step S510)
The abnormality determination unit 163D obtains travel data (for example, vehicle acceleration, vehicle deceleration, vehicle speed, turning speed, turning acceleration, turning deceleration, turning direction, road friction) from the data collecting unit 180. Information about the coefficient and the inclination angle of the road surface). Thereafter, step S520 is executed.

(Step S520)
Abnormality determination unit 163D estimates the friction coefficient of the road surface on which the vehicle travels using the travel data acquired in step S510. Thereafter, Step S530 is executed.

(Step S530)
Abnormality determination unit 163D determines whether or not a command signal is received. If the command signal is received, step S540 is executed. In other cases, step S510 is executed.

(Step S540)
Abnormality determination unit 163D determines whether or not the command signal relates to control of the steering mechanism. If the command signal relates to the control of the steering mechanism, step S550 is executed. In other cases, step S590 is executed.

(Step S550)
As described above, abnormality determination unit 163D sets allowable ranges “AR1”, “AR2”, “AR3”, and “AR4”. Thereafter, step S560 is executed.

(Step S560)
Abnormality determination unit 163D refers to the command signal and determines whether or not the target values specified by the command signal are included in allowable ranges “AR1”, “AR2”, “AR3”, and “AR4”, respectively. If the target value specified by the command signal is included in the allowable ranges “AR1”, “AR2”, “AR3”, and “AR4”, step S570 is executed. In other cases, step S580 is performed.

(Step S570)
The abnormality determination unit 163D generates a determination result indicating that no abnormality has occurred in the main control unit 110. The determination result is output from the abnormality determination unit 163D to the instruction unit 166.

(Step S580)
The abnormality determination unit 163D generates a determination result indicating that an abnormality has occurred in the main control unit 110. The determination result is output from the abnormality determination unit 163D to the instruction unit 166.

(Step S590)
Abnormality determination unit 163D outputs a command signal to output port 162. As a result, a command signal unrelated to the control for the steering mechanism is received by another component control unit through the signal transmission loop. After the output of the command signal to the output port 162, step S510 is executed.

  FIG. 12 is a schematic flowchart showing processing of the instruction unit 166. The process of the instruction unit 166 will be described with reference to FIGS. 10 and 12.

(Step S610)
The instruction unit 166 waits for output of the determination result from the abnormality determination unit 163D. When instructing unit 166 receives the determination result from abnormality determining unit 163D, step S620 is executed.

(Step S620)
The instruction unit 166 refers to the determination result and determines whether or not the determination result represents an abnormality of the main control unit 110. If the determination result indicates that the main control unit 110 is normal, step S630 is executed. If the determination result represents an abnormality in the main control unit 110, step S640 is executed.

(Step S630)
The instruction unit 166 instructs the control signal generation unit 165 to generate a control signal. The control signal generation unit 165 generates a control signal under the instruction of the instruction unit 166. Thereafter, the control signal is output from the control signal generator 165 to the steering mechanism.

(Step S640)
The instruction unit 166 instructs the count unit 167 to increase the count value. The count unit 167 increases the count value under the instruction of the instruction unit 166.

  FIG. 13 is a schematic flowchart showing the processing of the counting unit 167. The processing of the counting unit 167 will be described with reference to FIGS.

(Step S710)
The count unit 167 sets the count value “CT” to “0”. Thereafter, step S720 is executed.

(Step S720)
Count unit 167 waits for an instruction from instruction unit 166 (that is, an instruction to increase count value “CT”). When the count unit 167 receives an instruction from the instruction unit 166, step S730 is executed.

(Step S730)
The count unit 167 increases the count value “CT” by “1”. Thereafter, step S740 is executed.

(Step S740)
The count unit 167 compares the count value “CT” with a preset count threshold value “CTH”. If the count value “CT” is larger than the count threshold “CTH”, step S750 is executed. In other cases, step S720 is executed.

(Step S750)
The count unit 167 generates a trigger signal. The trigger signal is output from the count unit 167 to the request signal generation unit 164. The request signal generation unit 164 generates a request signal according to the trigger signal. The request signal is output from the request signal generation unit 164 to the blocking unit 140. The blocking unit 140 blocks the transmission of the command signal from the main control unit 110 according to the request signal. Step S760 is performed after the generation of the trigger signal.

(Step S760)
The count unit 167 returns the count value “CT” to “0”.

<Eleventh embodiment>
The functional configuration described in connection with the above-described embodiments can be constructed by various hardware configurations. In the eleventh embodiment, an exemplary hardware configuration is described.

  FIG. 14 is a block diagram illustrating a hardware configuration of the control device 100E according to the eleventh embodiment. The control device 100E is described with reference to FIGS. The description of the above-described embodiment is applied to elements having the same reference numerals as those of the above-described embodiment.

  Similar to the second embodiment, the control device 100E includes a hub 130, an operation switch 141, and a cutoff switch 142. The description of the second embodiment is incorporated in these elements.

  The control device 100E further includes a main CPU 210, three sub CPUs 221, 222, and 223, an operation detection sensor 251, and a digital processing circuit 252. The main CPU 210 corresponds to the main control unit 110 shown in FIG. 2 and generates a command signal. The cutoff switch 142 is disposed on a signal transmission path connecting the main CPU 210 and the hub 130. When the driver operates the operation switch 141, the cut-off switch 142 cuts off the transmission of the command signal from the main CPU 210 to the hub 130.

  The sub CPU 221 controls the brake according to the command signal transmitted from the main CPU 210. The sub CPU 221 corresponds to one of the component control units 121, 122, 123, and 124 shown in FIG. The sub CPU 222 controls the steering in response to the command signal transmitted from the main CPU 210. The secondary CPU 222 corresponds to another one of the component control units 121, 122, 123, and 124 shown in FIG. The sub CPU 223 controls the power train (that is, the engine and the transmission) according to the command signal transmitted from the main CPU 210. The sub CPU 223 corresponds to the remaining two of the component control units 121, 122, 123, and 124 shown in FIG. The sub CPUs 221, 222, 223 are arranged in the engine room. The hub 130 may be disposed in the engine room or in the vehicle compartment. The hub 130, the sub CPUs 221, 222, and 223 and the plurality of wire harnesses form a signal transmission loop in the engine room.

  The operation detection sensor 251 and the digital processing circuit 252 correspond to the operation unit 150 illustrated in FIG. The operation detection sensor 251 may be a steering angle sensor attached to a steering shaft and / or a motor of an electric power steering system. The rudder angle sensor detects a rotation operation of the steering wheel by the driver, and generates a detection signal representing information related to the rotation angle of the steering wheel. The operation detection sensor 251 may be an accelerator switch or a stroke sensor attached to an accelerator pedal. The accelerator switch generates a detection signal indicating that the driver has depressed the accelerator pedal. A stroke sensor produces | generates the detection signal showing the information regarding the depression amount of an accelerator switch. The operation detection sensor 251 may be one or a plurality of brake switches attached to the brake pedal. The brake switch generates a detection signal indicating that the driver has depressed the brake pedal. These detection signals are output from the operation detection sensor 251 to the digital processing circuit 252.

  The digital processing circuit 252 processes these detection signals and generates an operation signal. The sub CPUs 221, 222, and 223 receive operation signals through the hub 130. When the operation signal generated from the detection signal output from the brake switch is transmitted to the sub CPU 221, the sub CPU 221 controls the brake according to the operation signal. When the operation signal generated from the detection signal output from the steering angle sensor is transmitted to the sub CPU 222, the sub CPU 222 controls the steering in accordance with the operation signal. When the operation signal generated from the detection signal from the accelerator switch or the stroke sensor is transmitted to the sub CPU 223, the sub CPU 223 controls the power train according to the operation signal.

  15A to 15C are block diagrams showing a schematic hardware configuration of the digital processing circuit 252. The digital processing circuit 252 is described with reference to FIGS. 14 to 15C.

  The digital processing circuit 252 includes a first input interface 261, a second input interface 262, and a microcomputer 263. FIG. 15A shows a first brake switch 271 and a second brake switch 272. The first brake switch 271 is attached to the brake pedal. The second brake switch 272 is attached to the brake pedal at a position different from the first brake switch 271. When the driver depresses the brake pedal, the first brake switch 271 and the second brake switch 272 generate a detection signal indicating depression of the brake pedal. Each of the first brake switch 271 and the second brake switch 272 corresponds to the operation detection sensor 251 described with reference to FIG. FIG. 15B shows the first rudder angle sensor 273 and the second rudder angle sensor 274. The first rudder angle sensor 273 detects torque applied to the steering shaft. The second steering angle sensor 274 detects the rotation angle of the motor of the electric power steering system. When the driver rotates the steering wheel, the first rudder angle sensor 273 and the second rudder angle sensor 274 generate detection signals representing torque and rotation angle. Each of the first steering angle sensor 273 and the second steering angle sensor 274 corresponds to the operation detection sensor 251 described with reference to FIG. FIG. 15C shows the accelerator switch 275 and the stroke sensor 276. The accelerator switch 275 is attached to the accelerator pedal. Stroke sensor 276 detects the amount of depression of the accelerator pedal. When the driver depresses the accelerator pedal, the accelerator switch 275 and the stroke sensor 276 generate a detection signal that indicates the depression and the depression amount of the accelerator pedal. Each of the accelerator switch 275 and the stroke sensor 276 corresponds to the operation detection sensor 251 described with reference to FIG.

  The first brake switch 271, the first steering angle sensor 273, and the accelerator switch 275 are electrically connected to the first input interface 261. The second brake switch 272, the second steering angle sensor 274, and the stroke sensor 276 are electrically connected to the second input interface 262. The microcomputer 263 receives the detection signal through the first input interface 261 and the second input interface 262.

  The microcomputer 263 checks whether or not the detection signal received from the first input interface 261 is inconsistent with the detection signal received from the second input interface 262. For example, if the first brake switch 271 outputs a detection signal to the first input interface 261 while the second brake switch 272 does not output a detection signal to the second input interface 262, the microcomputer 263 The detection signal received from the first input interface 261 may be ignored. If the rotation direction represented by the detection signal from the first steering angle sensor 273 does not match the rotation direction represented by the detection signal from the second steering angle sensor 274, the microcomputer 263 ignores these detection signals. May be. If the microcomputer 263 receives the detection signal from the stroke sensor 276 in the absence of the detection signal from the accelerator switch 275, the microcomputer 263 may ignore the detection signal from the stroke sensor 276.

  If the detection signal received from the first input interface 261 is consistent with the detection signal received from the second input interface 262, the microcomputer 263 generates an operation signal from these detection signals. For example, if the microcomputer 263 receives detection signals from the first brake switch 271 and the second brake switch 272, the microcomputer 263 generates an operation signal indicating that the brake has been depressed by the driver. The operation signal is then transmitted to the sub CPU 221 (see FIG. 14) through the hub 130. The sub CPU 221 controls the brake according to the operation signal, and applies a braking force to the vehicle. If the microcomputer 263 receives detection signals from the first rudder angle sensor 273 and the second rudder angle sensor 274, the microcomputer 263 processes these detection signals and represents an operation applied to the steering wheel by the driver. Information (for example, the direction and angle of rotation of the steering wheel) is calculated. The microcomputer 263 generates an operation signal representing the obtained information. The operation signal is then transmitted to the secondary CPU 222 (see FIG. 14) through the hub 130. The sub CPU 222 controls the steering in accordance with the operation signal and changes the traveling direction of the vehicle. If the microcomputer 263 receives detection signals from the accelerator switch 275 and the stroke sensor 276, the microcomputer 263 processes these detection signals and displays information representing an operation applied to the accelerator pedal by the driver (ie, the driver). Is calculated). The microcomputer 263 generates an operation signal representing the obtained information. The operation signal is then transmitted to the secondary CPU 223 (see FIG. 14) through the hub 130. The sub CPU 223 controls the power train according to the operation signal to accelerate the vehicle.

  As described with reference to FIG. 14, when the driver operates the operation switch 141, the transmission of the command signal from the main CPU 210 is blocked by the cutoff switch 142. Even under command signal transmission interruption, the operation signal generated by the digital processing circuit 252 based on the detection signal of the operation detection sensor 251 is transmitted to the sub CPUs 221, 222, and 223 through the hub 130. As a result, the vehicle can continue the basic operations of the vehicle such as “progress”, “turn”, and “stop”.

<Twelfth embodiment>
When the driver repeatedly presses the operation switch, the cutoff switch may be activated. In this case, even if the driver accidentally presses the operation switch, the cutoff switch does not operate. As a result, the transmission of the command signal from the main control unit is not unnecessarily interrupted. In the twelfth embodiment, an exemplary technique for operating the cutoff switch when the driver repeatedly presses the operation switch will be described.

  FIG. 16 is a schematic block diagram of the operation circuit 300 constructed between the operation switch 141 and the cutoff switch 142. The operating circuit 300 is described with reference to FIGS. The description of the above-described embodiment is applied to elements having the same reference numerals as those of the above-described embodiment.

  When the driver repeatedly presses the operation switch 141 within a predetermined period, the operation circuit 300 drives the cutoff switch 142 and cuts off transmission of the command signal from the main control unit 110. Even if the driver accidentally presses the operation switch 141, the operation circuit 300 does not drive the cutoff switch 142. In this case, transmission of a command signal from the main control unit 110 (see FIG. 2) is continuously permitted.

  The operation circuit 300 includes an input filter 310, a counter 320, a latch 330, a drive circuit 340, a timer 350, a NOR gate 360, a first determination unit 370, a second determination unit 380, and an AND gate 390. . The input filter 310 is electrically connected to the operation switch 141. Each time the driver presses the operation switch 141, a pulse signal is output from the operation switch 141 to the input filter 310. The input filter 310 removes noise superimposed on the pulse signal. The pulse signal after the noise removal processing is output from the input filter 310 to the counter 320 and the timer 350.

  The counter 320 counts pulses in the pulse signal. When the counted pulse exceeds a predetermined threshold, the counter 320 requests the latch 330 to operate the drive circuit 340. The latch 330 continues to operate the drive circuit 340 until the counter 320 request is reset. As a result of driving of the drive circuit 340, the cutoff switch 142 releases the electrical connection between the main control unit 110 and the hub 130 (see FIG. 2).

  The timer 350 counts for a predetermined period according to the input of the pulse signal after the noise removal processing. While the timer 350 is timing, a value of “1” is output from the timer 350 to the NOR gate 360. In other periods, a value of “0” is output from the timer 350 to the NOR gate 360. First determination unit 370 determines whether or not the vehicle is in a normal state. If the vehicle is in a normal state, a value of “1” is output from the first determination unit 370 to the NOR gate 360. If the vehicle is in an abnormal state, a value of “0” is output from the first determination unit 370 to the NOR gate 360.

  If the values received from the timer 350 and the first determination unit 370 are both “0”, the NOR gate 360 outputs the value “1” from the NOR gate 360 to the counter 320. In other cases, a value of “0” is output from the NOR gate 360 to the counter 320. When the counter 320 receives the value “1”, the count value is reset. Therefore, the count value continues to be reset while the operation switch 141 is not operated and the first determination unit 370 makes an abnormality determination. Thereafter, when the vehicle is repaired and the first determination unit 370 determines normality, the count value reset process is canceled.

  The second determination unit 380 determines whether or not the driver requests the return of the cutoff switch 142 (that is, restart of transmission of the command signal). If the driver is requesting the return of the cutoff switch 142, a value of “1” is output from the second determination unit 380 to the AND gate 390. In other cases, the value of “0” is output from the second determination unit 380 to the AND gate 390. The AND gate 390 is also electrically connected to the first determination unit 370. Therefore, the AND gate 390 can receive the value “0” or “1” from the first determination unit 370.

  When both the first determination unit 370 and the second determination unit 380 output the value “1”, the AND gate 390 outputs the value “1”. In other cases, the AND gate 390 outputs a value of “0”. When the value of “1” is output from the AND gate 390 to the latch 330, the latch 330 resets the request from the counter 320. Therefore, if the vehicle is in a normal state and the driver desires to restore the control by the main control unit 110, the transmission of the command signal is restored.

<13th Embodiment>
According to the control principle of the twelfth embodiment, when the driver repeatedly presses the operation switch, the cutoff switch cuts off the transmission of the command signal. Alternatively, when the driver presses the operation switch with a strong force, the cut-off switch may cut off the transmission of the command signal. In this case, even if the driver accidentally presses the operation switch with a light force, the cutoff switch does not operate. As a result, the transmission of the command signal from the main control unit is not unnecessarily interrupted. In the thirteenth embodiment, an exemplary technique for operating the cutoff switch when the driver presses the operation switch with a strong force will be described.

  FIG. 17 is a schematic block diagram of an operation circuit 300F according to the thirteenth embodiment. The operation circuit 300F is described with reference to FIGS. The description of the above-described embodiment is applied to elements having the same reference numerals as those of the above-described embodiment.

  When the driver presses the operation switch 141 with a strong force, the operation circuit 300F drives the cutoff switch 142 to cut off transmission of the command signal from the main control unit 110. Even if the driver accidentally presses the operation switch 141 with a light force, the operation circuit 300F does not drive the cutoff switch 142. In this case, transmission of a command signal from the main control unit 110 (see FIG. 2) is continuously permitted.

  Similar to the twelfth embodiment, the actuation circuit 300F includes a latch 330, a drive circuit 340, a first determination unit 370, a second determination unit 380, and an AND gate 390. The description of the twelfth embodiment is incorporated by these elements.

  The operation circuit 300F further includes a pressure sensor 311, an input amplifier 312, and a comparator 313. The pressure sensor 311 is disposed near the operation switch 141 so that the pressing force applied to the operation switch 141 is transmitted to the pressure sensor 311 when the driver presses the operation switch 141. When the pressing force is applied to the pressure sensor 311, the pressure sensor 311 generates a voltage signal having a voltage corresponding to the pressing force. The voltage signal is output from the pressure sensor 311 to the input amplifier 312.

  The input amplifier 312 amplifies the voltage signal. The voltage signal after the amplification processing is input to the comparator 313. The comparator 313 compares the voltage of the amplified voltage signal with a predetermined threshold value. If the voltage of the voltage signal is greater than the threshold value, the comparator 313 requests the latch 330 to operate the drive circuit 340. The latch 330 continues to operate the drive circuit 340 until the request of the comparator 313 is reset. As a result of driving of the drive circuit 340, the cutoff switch 142 releases the electrical connection between the main control unit 110 and the hub 130 (see FIG. 2).

  The principles of the various embodiments described above may be combined to suit the requirements for the vehicle. Some of the various features described in connection with one of the various embodiments described above may be applied to the controller described in connection with another embodiment.

  The principle of the above-described embodiment is preferably used for various vehicle designs.

100, 100A to 100C, 100E ... Control device 110 ... Main control unit 120, 120D ...・ ・ ・ ・ ・ ・ Part control unit 121-124 ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ Part control unit 140 ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・・ ・ Blocking unit 150 ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ Operation unit 163 ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ Abnormality judgment Unit 164 ... Request signal generation unit 170 ... Determination unit 180・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ Data collection part EC1 to EC4 ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ Electrical parts

Claims (10)

A plurality of component control units that control a plurality of electrical components that control driving of the vehicle;
A main control unit for generating a command signal for giving a command to the plurality of component control units;
When an abnormality occurs in the main control unit, a blocking unit that blocks transmission of the command signal from the main control unit to the plurality of component control units,
An operation unit that is operated by a driver driving the vehicle and generates an operation signal representing the operation of the driver;
A hub electrically connected to the plurality of component controllers ,
The command signal and the operation signal are transmitted to the plurality of component control units through the hub,
At least one of the plurality of component control units includes a determination unit that determines the abnormality of the main control unit from the command signal,
The determination unit that has determined that the abnormality has occurred in the main control unit generates a request signal for requesting the interruption of the transmission of the command signal,
The blocking unit is disposed between the hub and the main control unit, and blocks the transmission of the command signal according to the request signal,
If the blocking unit cuts off the transmission of the previous SL command signal, wherein at least one of the plurality of component control unit controls the corresponding ones of the previous SL plurality of electric components in response to the operation signal vehicle Control device. A plurality of component control units that control a plurality of electrical components that control driving of the vehicle;
A main control unit for generating a command signal for giving a command to the plurality of component control units;
A hub electrically connected to the plurality of component controllers;
A determination unit for determining an abnormality of the main control unit from the command signal transmitted through the hub;
When the determination unit determines that the abnormality has occurred in the main control unit, a blocking unit that blocks transmission of the command signal from the main control unit to the plurality of component control units;
An operation unit that is operated by a driver who drives the vehicle and generates an operation signal representing the operation of the driver ;
The determination unit that has determined that the abnormality has occurred in the main control unit generates a request signal for requesting the interruption of the transmission of the command signal,
The blocking unit is disposed between the hub and the main control unit, and blocks the transmission of the command signal according to the request signal,
When the blocking unit blocks the transmission of the command signal, at least one of the plurality of component control units controls a corresponding one of the plurality of electrical components according to the operation signal.
Vehicle control device . The control device according to claim 1, wherein when the driver operates the blocking unit, the blocking unit blocks the transmission of the command signal. The plurality of electrical components include a brake, an engine, a transmission, and a steering
The control device according to any one of claims 1 to 3 . A signal transmission loop that forms a signal transmission path so as to connect the plurality of component control units and the hub in a loop;
The determination unit outputs the request signal to the signal transmission loop.
The control device according to any one of claims 1 to 3 . The command signal gives a target value for control to each of the plurality of electrical components to each of the plurality of component control units,
The determination unit compares the target value with a threshold value and determines whether the abnormality has occurred in the main control unit.
The control device according to any one of claims 1 to 5 . A detection unit that detects a traveling state of the vehicle and generates a detection signal representing the traveling state;
The control device according to claim 6, wherein the determination unit determines the threshold according to the detection signal. The detection unit detects the presence of an obstacle and the direction of the obstacle relative to the vehicle ;
The target value includes a target value related to the turning direction and acceleration of the vehicle,
If the target values related to the steering direction and the acceleration indicate that the vehicle is to be brought closer to the obstacle while accelerating , the determination unit causes the abnormality to occur in the main control unit. The control device according to claim 7. An acquisition unit for acquiring road information around a position where the vehicle travels;
The control device according to claim 6, wherein the determination unit determines whether the abnormality has occurred in the main control unit based on the road information. The determination unit determines that the abnormality has occurred in the main control unit if the target value is inconsistent with the operation represented by the operation signal. The control device according to item 1.

Images