FR2944612A3 - Electronic control architecture e.g. braking system, for motor vehicle, has voting device counting number of messages and deactivating actuator when number is higher than or equal to threshold that is equal to number of monitoring units - Google Patents

Abstract

The architecture has a monitoring unit monitoring operation of an actuator forming unit e.g. brake pedal clamp actuation unit. A host computer (32) drives an actuator (30) e.g. electric motor, in the actuator forming unit. The monitoring unit transmits a deactivation message to the actuator forming unit. The actuator forming unit has a voting device (42) to count the number of deactivation messages and to deactivate the actuator when the number is higher than or equal to a predetermined threshold that is lower than or equal to total number of the monitoring units.

Description

ELECTRONIC CONTROL ARCHITECTURE OF A MOTOR VEHICLE 5 FIELD OF THE INVENTION

The invention relates to the all-electronic control of parts of a motor vehicle, and in particular the all-electronic control of the steering or braking thereof. STATE OF THE ART

In motor vehicle control architectures called X-by-wire, such as for example the by-wire (steer-by-wire) direction, by-wire braking (brake-by-wire), acceleration by -wire (throttle-b-wire), mechanical control systems, hydraulic or pneumatic are replaced by electronic devices. Thus in the by-wire steering and braking architectures, intelligent brake and electrical steering actuators are distributed in the vehicle and are coupled by means of a synchronous communication network enabling them to exchange data and produce data. joint action.

However, while conventional architectures inherently have a high degree of security, the electronics present in X-by-wire architectures are subject to multiple failures that can affect the safety of the vehicle and its occupants. requiring the taking of specific safety measures.

One of the security interests of an X-by-wire architecture however lies in the possibility offered by the synchronous communication network to exchange data on the operation of the electronic devices connected to it. Thus, for example, each actuator can give indications on its operating state or diagnostic units can be provided to analyze the data transmitted by the actuators (or the unjustified absence of data transmission) and thus diagnose their state. Operating.

So, if an actuator were to show a failed state, a unit of the network being in charge of the deactivation of the actuator can deactivate it, or force it into a degraded mode of operation that does not affect the security of the actuator. vehicle, in order to prevent said actuator from generating inappropriate actions. However, it is necessary to take into account that a network unit having the function of deactivating a faulty actuator may itself be faulty and thus make inappropriate disabling decisions, or else not make a disabling decision while this is necessary. Such a failure of a deactivation unit then spreads over the network and the entire architecture may then fail.

SUMMARY OF THE INVENTION The object of the present invention is to propose a motor vehicle electronic control architecture that is robust with respect to the failures of its actuators as well as failures of the units whose function is to deactivate faulty actuators. To this end, the subject of the invention is an electronic motor vehicle control architecture, comprising, connected to a synchronous data communication network, at least one actuator unit and at least one unit for monitoring the operation of said unit. least one actuator unit, said at least one actuator unit comprising an actuator, an actuator control computer and a communication controller for data exchange between the computer and the communication network .

According to the invention, this architecture is characterized in that: a plurality of units for monitoring the operation of the at least one actuator unit are provided, said monitoring units being able to transmit a message to the actuator unit deactivating it; and the at least one actuator unit comprises a voting device adapted to count the number of received deactivation messages and to deactivate the actuator when said number is greater than or equal to a predetermined threshold less than or equal to the number of total of surveillance units.

In other words, the operating state of an actuator unit is supervised by a plurality of monitoring units, such as, for example, dedicated units or other actuator units carrying the tools necessary for diagnosis, and the deactivation of the actuator unit is decided by vote of the monitoring units. In fact, the decision of a faulty monitoring unit does not carry the final decision of deactivation because of the opposition of the other monitoring units which function satisfactorily. It should also be noted that several surveillance units can be simultaneously failing without the entire architecture being threatened. According to particular embodiments of the invention, the architecture comprises one or more of the following characteristics:

the monitoring units are configured to transmit their deactivation signals in a predefined time interval of a communication cycle on the network, and the voting device is configured to count the deactivation messages transmitted only during said interval; the polling device comprises a timer and a counter connected to the communication controller, the timer being able, upon receipt of a first deactivation message, to initialize the counter, to allow the counter to count the deactivation messages, and blocking the initialization of the counter during a predetermined counting time; the time interval during which the emission of the deactivation messages is carried out has a duration shorter than the counting time; 20 ^ the communication controller is configured not to issue an interrupt signal to the attention of the computer when receiving a message from the network, the computer being configured to regularly interrogate the communication controller to take knowledge of messages received by the latter; The interval of time during which the emission of the deactivation messages is carried out is less than half the communication cycle; the communication controller is configured to issue an interrupt signal to the computer upon receipt of a message from the network, the computer being configured to interrogate the communication controller upon receipt of the message. an interruption signal; the counting time is less than any other time interval in which messages other than deactivation messages are likely to be transmitted on the network in a number equal to or greater than the counting threshold; and transmitting a message on the network other than a deactivation message is spaced temporally from the transmission of a first deactivation message from the monitoring units of at least the counting time. BRIEF DESCRIPTION OF THE FIGURES The present invention will be better understood on reading the following description, given solely by way of example, and with reference to the accompanying drawings, in which:

FIG. 1 is a schematic view of an architecture according to the invention; and FIG. 2 is a schematic view of an actuator unit according to the invention forming part of the architecture of FIG. 1.

DETAILED DESCRIPTION OF THE INVENTION

In FIG. 1, an X-by-wire architecture of a motor vehicle, for example the braking system, is illustrated schematically under the reference 10.

The architecture 10 comprises actuator units 12-18, for example the units in charge of actuating the calipers of the brake pads of the vehicle, as well as monitoring units 20-26 for the operation of the actuator units 12. 18 and deactivating them. Each of the units 12-26 is connected to a synchronous data communication network 28, for example a network of the FlexRay type. The synchronous term refers here to the notion that the synchronization of all the elements of the network 28 is controlled by a single source, for example the unit 20, the communication on the network 10 being organized in particular in communication cycles as is known per se in the state of the art.

The architecture 10 is organized so that each actuator unit 12-18 is associated with a plurality of units able to deactivate it in the event of a malfunction. This can be for example the units 20-26 dedicated to this monitoring and deactivation function or for example the other actuator units that are configured to implement such a function. Each actuator unit 12-18 is furthermore capable of transmitting data relating to its operation on the network 28 and / or the units responsible for monitoring it and, if necessary, deactivating it, are able to diagnose its operating state by 45 function of the data transmitted by the actuator unit, or the absence of an expected transmission of data, and possibly other available information. The diagnosis of the operation of an actuator unit is known per se from the state of the art and will not be described in more detail later for reasons of conciseness.

According to the invention, it is only necessary for the architecture 10 to be configured so that several independent units are able to monitor the operating state of an actuator unit and to transmit on the network to the attention of the unit forming actuator a deactivation message when a malfunction thereof has been detected.

Figure 2 is a schematic view of an actuator unit according to the invention.

Said unit comprises: an actuator 30, such as for example the electric motor or motors of an electromechanical caliper associated with a wheel of the vehicle; a host computer 32, such as a microprocessor system for example, driving the actuator 30 through an electrical connection 34; a communication controller 36 providing, via an electrical connection 38, the interface function between the host computer 32 and the data communication network 28. The communication controller 36 allows in particular a control of the actuator 30 which is suitability with the states of the architecture 10 and broadcast on the network 28 the operating states of the actuator 30 and the host computer 32; an interrupt line 40 which enables the communication controller 36 to warn the host computer that a message intended for it has just arrived on the data communication network 28.

The organs just described are conventional and will not be described in more detail.

According to the invention, the actuator unit further comprises a polling device 42 comprising: a controllable counter 44 which counts the number of interrupt messages which occur on the interrupt line 40; a timer 46 controlling the counter 44 by means of a binary signal sent to the counter 44 on an electrical link 48. When the logic signal at the output of the timer 46 is in its low state and a message of interruption is produced on the interrupt line 40, the timer 46 then switches the logic signal in the high state for a predetermined time T, hereinafter referred counting time. The rising edge of the slot thus generated by the timer initializes the counter 44 and the high level of the slot allows it to count the number of interrupt messages produced on the interrupt line by the communication controller 36. The absence rising edge during the counting period T of the slot thus makes it possible not to reset the counter during this period. The switching of the logic signal at the end of the counting period T has the effect of stopping the counting implemented by the counter 44; and a comparator 50 which compares the value of the counter 44, supplied via an electrical connection 52, to a predetermined threshold M-1, and which emits a deactivation signal of the actuator 30 via an electrical connection 54 when the value of the counter is greater than or equal to said threshold M-1.

Thus, when a failure of the actuator unit, such as a failure of its actuator 30 or host computer 32, is detected by the units in charge of monitoring it, the latter transmit on the network to the actuator unit deactivation messages.

The communication controller 36 receives said deactivation messages and transmits for each of them an interrupt message on the interrupt line 40. During the generation of the first interrupt message, the timer 46 then generates a slot initializing the counter 44 and allowing it to count. When the number of interrupts counted by counter 44 is greater than or equal to M-1, thus signifying that M interrupt messages have been produced on line 40 (the first message used to initialize and start the count) the comparator 50 then deactivates the actuator, or forces it into an operating mode that does not affect the safety of the vehicle. The deactivation of the actuator is therefore obtained by a vote of the units in charge of monitoring the actuator unit, and not by the intervention of a single one of it. Preferably, the vote is majority, that is to say that the number M is greater than or equal to half the number of units in charge of monitoring and deactivation of the actuator unit.

In a first preferred mode of operation of the architecture 10 according to the invention: the communication controller 36 is configured to generate an interrupt message on the line 40 each time it receives a deactivation message intended for it, and to not generate an interrupt message for messages of another type; the host computer 32 is configured to read messages received from the network 28 by regular interrogation of the communication controller 36, the host computer 32 is no longer alerted to the receipt of a new message from the network by the production of an interrupt message on line 40, the interrupt function being entirely dedicated to the management of deactivation messages; network messaging 28, namely the predetermined scheduling of the messages dictating to the various units at which precise moment of the communication cycle they must send their messages, and / or the communication controller 36 are configured so that the deactivation messages expressed during a communication cycle are grouped in a time interval of less than the counting duration T of the timer 46, and the counting time T is itself chosen less than half the duration of the communication cycle. The deactivation vote of the actuator 30 is thus performed by counting the deactivation messages generated during the same communication cycle and not by the counting of deactivation messages belonging to two consecutive communication cycles.

In a second preferred mode of operation of the architecture 10 according to the invention: the communication controller 36 is configured to generate on the line 40 an interrupt message each time a message is received for its attention, whether a deactivation message or not; the host computer 32 is configured to read messages received from the network at each interrupt message produced on the line 40; the network messaging 28 is configured so that the deactivation messages are grouped together in a time interval of less than the counting duration T of the timer 46; the network messaging 28 and / or the communication controller 36 are configured so that M interrupt messages on the line 40 are not grouped in a time interval of duration less than or equal to the counting time T, or else the counting time T is chosen to be less than the duration of any time interval in which M messages other than deactivation messages are likely to be produced. Thus, interrupt messages produced by the reception of messages other than deactivation messages do not trigger the deactivation of the actuator 30; and the network messaging 28 and / or the communication controller 36 are configured so that the interrupt messages caused by messages other than deactivation messages do not precede the interrupt message caused by the first deactivation message received. less than the counting period T to ensure that the timer 46, and therefore the counter 44, is well initialized.

Claims (9)

REVENDICATIONS1. A motor vehicle electronic control architecture (10) comprising, connected to a synchronous data communication network (28), at least one actuator unit (12-18) and at least one monitoring unit (12-26) of the operation of said at least one actuator unit (12-18), said at least one actuator unit (12-18) comprising an actuating member (30), a control computer (32) for controlling the actuator member actuation (30) and a communication controller (36) for data exchange between the computer and the communication network, characterized in that: a plurality of units (12-26) for monitoring the operation of the at least one forming unit actuator (12-18) are provided, said monitoring units (12-26) being able to transmit to the actuator unit (12-18) a deactivation message thereof; and the at least one actuator unit (12-26) comprises a voting device (42) adapted to count the number of received deactivation messages and to deactivate the actuating member (30) when said number is greater than or equal to a predetermined threshold less than or equal to the total number of monitoring units (12-26). 2. Architecture according to claim 1, characterized in that the monitoring units (12-26) are configured to transmit their deactivation signals in a predefined time interval of a communication cycle on the network (28), and in that the polling device (42) is configured to count the deactivation messages transmitted only during said interval. 3. Architecture according to any one of the preceding claims, characterized in that the voting device (42) comprises a timer (46) and a counter (44) connected to the communication controller (36), the timer (46) being able, upon receipt of a first deactivation message, to initialize the counter (44), to allow the counter (44) to count the deactivation messages and to block the initialization of the counter (44) during a counting period predetermined. 4. Architecture according to claims 2 and 3, characterized in that the time interval during which the emission of deactivation messages is performed has a duration less than the counting time. 5. Architecture according to any one of the preceding claims, characterized in that the communication controller (36) is configured not to issue an interrupt signal to the attention of the computer (32) when receiving a message from the network (28), the computer (32) being configured to periodically poll the communication controller (36) to learn the messages received by it. 6. Architecture according to claims 3 and 5, characterized in that the time interval during which the emission of deactivation messages is carried out is less than half the communication cycle. 7. Architecture according to any one of claims 1 to 4, characterized in that the communication controller (36) is configured to issue an interrupt signal to the attention of the computer (32) when receiving a message from the network (28), the computer (32) being configured to interrogate the communication controller (36) following receipt of an interrupt signal. 8. Architecture according to claims 3 and 7, characterized in that the counting time is less than any other time interval in which messages other than deactivation messages are likely to be transmitted on the network in equal or greater number at the counting threshold. 9. Architecture according to claim 8, characterized in that the transmission of a message on the network other than a deactivation message is spaced temporally from the transmission of a first deactivation message from the monitoring units. at least the counting time.