JP2003015743A - Automatic operation system for vehicle - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide the automatic operation system of a vehicle capable of ensuring safety while preventing the cost increase or scale enlargement of on- vehicle equipment. SOLUTION: Different dummy data are transmitted to a comparator 43 as each arithmetic result in a main CPU 41 and a sub-CPU 42, and when a matching signal is outputted from the comparator 43, it is judged that abnormality is generated. When it is judged that abnormality is generated from the matching signal outputted from the comparator 43 according to the transmission of the dummy data, the main CPU 41 transmits a self-system stop signal to an output signal selecting device 60 so that the arithmetic result of the processing system can be prevented form being used as a signal for controlling an actuator for traveling control.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an automatic vehicle driving system.

[0002]

2. Description of the Related Art A vehicle automatic driving system uses a communication infrastructure and a vehicle-mounted device to perform road-to-vehicle communication between roads and vehicles, and vehicle-to-vehicle communication between vehicles. Based on this, the vehicle control actuator is controlled to perform automatic driving. At this time,
In-vehicle information processing devices that process sensor signals are multiplexed for the purpose of ensuring safety. Completely multiplexing information processing devices means preparing all parts, so that even if a problem occurs in any part, it can be run in a standby state and can be made fail-safe. However, on the other hand, the number of parts becomes enormous, and the function is satisfactory, but there is a problem in that it is not preferable in terms of cost and physique. Also, if it is attempted to avoid it, some parts will not be multiplexed and the safety will be impaired.

[0003]

The present invention has been made under such a background, and an object thereof is to provide a vehicle in which safety can be ensured while avoiding an increase in cost and an increase in size of an in-vehicle device. To provide an automatic driving system.

[0004]

According to the invention described in claim 1, on the vehicle side, the signals from the sensors are taken into the multiplexed processing system, and the arithmetic processing is performed by a plurality of processing devices in each processing system. Is performed and each operation result in multiple processing devices is compared by a single comparison device in each processing system. If they do not match, the operation results match. The traveling control actuator is controlled to automatically drive the vehicle along the road.

At this time, when different dummy data are sent to the comparison device as the respective calculation results in the plurality of processing devices and the coincidence signal is output from the comparison device, it is determined to be abnormal. Therefore, although the comparison device monitoring the processing device is not multiplexed, a failure of the comparison device can be detected. As a result, it is possible to ensure safety by providing a diagnostic function even in a non-multiplexed part.

In this way, the safety can be ensured while avoiding the cost increase and the size increase of the vehicle-mounted device. Further, as described in claim 2, a signal relating to a calculation result by the processing device in each processing system is sent to the output signal selection device, and the output signal selection device is sent from the processing system to which the coincidence signal is sent from the comparison device. The signal related to the calculation result of is output as a signal for controlling the actuator for traveling control, and the processing device in each processing system, when an abnormal condition in which the coincidence signal is output from the comparison device in association with the transmission of the dummy data, A self-system stop signal may be sent to the output signal selection device so that the calculation result in the processing system is not used as a signal for controlling the travel control actuator.

Further, as described in claim 3, the output signal selection device executes the processing at the time of abnormality accompanying the input of the mismatch signal for the first time when the mismatch signal is received from the comparison device twice consecutively. In this case, it is possible to prevent a malfunction due to the transmission of the dummy data.

[0008]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows the overall configuration of an automatic vehicle driving system according to the present embodiment.
A large number of magnetic lane markers 11 are embedded in the traveling road 10 at a center portion in the width direction at predetermined intervals. A magnetic signal is emitted from the magnetic lane marker 11. On the other hand, a magnetic nail sensor 21 is mounted on the side of the vehicle 20 traveling on the traveling road 10, and the magnetic nail sensor 21 can detect a magnetic signal generated by the magnetic lane marker 11.

A loop antenna 1 is provided on the road 10.
A large number of 2 are embedded at predetermined intervals, and each loop antenna 12 is connected to a control device 14 through a roadside-vehicle communication roadside device 13. On the other hand, on the vehicle 20 side, the road-to-vehicle communication device 22 is mounted, and the road-to-vehicle communication device 22 is installed.
Thus, it is possible to communicate with the control device 14 via the loop antenna 12 and the roadside-vehicle communication roadside device 13.

Further, a collision prevention radar 23, an inter-vehicle communication device 24, and an inter-vehicle distance sensor 25 are mounted on the vehicle 20 side. The collision prevention radar 23 outputs a vehicle stop signal when the distance to the collision target is closer than a predetermined value. Further, the inter-vehicle communication device 24 can perform inter-vehicle communication. Further, the inter-vehicle distance sensor 25 measures the inter-vehicle distance.

Further, the vehicle 20 is equipped with a controller (vehicle control ECU) 26, a driver 27, an accelerator actuator 28, a brake actuator 29, and a steering actuator 30. The controller 26 takes in signals from various sensors and executes predetermined arithmetic processing, and based on the arithmetic result, the driver 27
Via the accelerator actuator 28, the brake actuator 29, and the steering actuator 30
To activate the desired automatic operation. In addition, the controller 26 drives the driver 2 when an emergency stop is required.
An emergency brake actuator (not shown) is operated via 7.

As described above, the present system detects the magnetic lane marker 11 embedded in the traveling road 10 by the magnetic nail sensor 21 mounted on the vehicle, and the controller 2
6 is a system that guides the vehicle 20 to travel in the central portion of the road while controlling the actuators 28, 29, and 30 of the accelerator, brake, and steering by means of 6.

Details of the controller 26 in FIG.
As shown in FIG. In FIG. 2, the controller 26 includes a main CPU 41 and a sub CPU 42, and the CPUs are multiplexed (duplexed). Each sensor is connected to the main CPU 41, and the main CPU 41 executes various calculations based on sensor input data.

Further, from the main CPU 41 to the sub CPU 4
2, the input data (sensor data) fetched by the main CPU 41 is sent as calculation data. Based on this data, the sub CPU 42 executes the same processing as the calculation in the main CPU 41.

A comparison device 43 is connected to the main CPU 41 and the sub CPU 42, and processing data (calculation result) in the main CPU 41 and processing data (calculation result) in the sub CPU 42 are sent to the comparison device 43. The comparing device 43 compares both data (both operation results) and outputs a coincidence signal when they coincide with each other and outputs a non-coincidence signal when they do not coincide.

The computer 40 having such a configuration
But another one is prepared. That is, computer 1
System 40 and computer 2 system 50 having the same configuration
Is equipped with.

An output signal selection device 60 is connected to the computer 1 system 40 and the computer 2 system 50. The exchange of signals between the output signal selection device 60 and the computer will be described using the computer 1 system 40.
The match / mismatch signals from the above are sent to the output signal selection device 60. In addition, the output signal selection device 6 from the main CPU 41
The calculation result data is sent to 0 and the sub CPU 4
The calculation result data is also sent from 2 to the output signal selection device 60. Then, in the output signal selection device 60, the CPU 4
The data of either 1 or 42 is sent to the external driver 27 (see FIG. 1). In this example, when the main CPU 41 and the sub CPU 42 are compared, the priority of the main CPU 41 is set to be high, and the output data from the main CPU 41 is initially sent to the driver 27.

For example, in the comparison device 43, the main CP
As a result of comparing the operation output results of the U41 and the sub CPU 42, if the outputs of both CPUs 41 and 42 match,
The computer 1 system 40 regards it as normal and sends a coincidence signal to the output signal selection device 60. In the output signal selection device 60, the data from the main CPU 41 in the computer 1 system 40 is selected and the next stage (driver 27 in FIG. 1). Send to. On the other hand, as a result of comparison by the comparison device 43, if they do not match, the computer 1 system 40 determines that there is a failure and sends a mismatch signal to the output signal selection device 60, and the data sent by the output signal selection device 60 is sent from the computer 2 system 50. Switch to data.

Also, a main system stop signal is sent from the main CPU 41 to the output signal selection device 60, and the sub CP
The own system stop signal is also sent from the U42 to the output signal selection device 60. Then, in the output signal selection device 60, the CPU to which the own system stop signal is sent as the data to be sent to the driver 27 (the CPU in which the abnormality has occurred) is switched to the normal CPU.

Although the computer 1 system 40 has been described, the computer 2 system 50 has a similar configuration and operation. Here, referring to FIG. 3, the main CPU / sub-CP
Mention the need for U.

In automatic (unmanned) driving, since a final danger avoidance measure (emergency brake, etc.) cannot be taken by a person, each device is required to have very high reliability. Therefore, it is necessary to surely prevent a calculation error due to noise or the like, a program runaway, and a calculation error due to a component failure or a program runaway. It has been impossible to detect an abnormality in the case where one bit in the memory is inverted due to noise, failure, etc. with a watch dog that is generally used in the past. In other words, the calculated value becomes abnormal, but the program does not run out of control. Therefore, as shown in Fig. 3, both main and sub CPs
It is necessary to perform the same calculation in U41 and U42 and compare the results in hardware. With this configuration, even if one bit in the memory is inverted due to the above-mentioned noise or failure, the operation result on the main side and the sub side will be different, so it is possible to detect an abnormality and fail-safe. Can be secured.

Next, the necessity of the redundant system will be described with reference to FIG. In this system, the "dual system by the main / sub CPU" for realizing the fail-safe is shown in FIG.
Two systems are prepared as shown in. Since this system is intended for use in public transportation such as buses that are operated automatically (unmanned), it is necessary to improve the operating rate as much as possible while achieving fail-safe. For that purpose, the fail-safe “dual system by main / sub CPU” section is shown in FIG.
As shown in the figure, two systems are prepared to improve the operating rate.
In this case, operation is possible as usual as long as either one system is operating.

As described above, the CPU is duplicated so that the failure can be detected, and the CPU is fail-safe. In addition, two redundant systems are used in which another system is used when a failure occurs.

In the above description, the vehicle automatic driving system according to the present embodiment incorporates the signals from the sensors into the multiplexed processing system on the vehicle side, and a plurality of processing devices (main CPU 41, sub CPU 42) in each processing system. ) Performs a calculation process by a plurality of processing devices (main CPU 4
1. Comparing the respective calculation results in the sub CPU 42) by the single comparing device 43 in each processing system, and in the case of disagreement, the traveling control is performed based on the calculation result in the processing system in which the calculation results match. The vehicle actuators 28, 29, 30 are controlled to automatically drive the vehicle 20 along the road 10. As described above, in this system, safe driving is the first because of automatic driving and unmanned driving, and it is important to stop on the safe side when there is a failure, and a running function for temporary saving by a redundant system. Will be. For that purpose, a safe traveling control system is constructed by a collision prevention radar for preventing a rear-end collision, an inter-vehicle distance sensor, inter-vehicle communication, and road-vehicle communication via a loop antenna. That is,
In the vehicle control ECU, dual CPU and
A multi-redundant system (two redundant systems in this example) is configured.

Here, although the CPUs are multiplexed, there is only one comparison device 43, and when it fails, it causes a defective operation. Of course, it suffices to use two comparison devices 43 for multiplexing, but if all of them are multiplexed, the computer becomes larger and more expensive and becomes unusable.

Therefore, in the present embodiment, the circuit is constructed by multiplexing important parts such as CPU, sensor input, etc., and by only detecting a failure in one part. In particular, the failure detection of the comparison device 43 is performed as follows.

When each CPU 41, 42 is normal, the CPU
If the data from 41 and 42 are compared, they match, but the data that does not match are sent out at a predetermined timing. At that time,
The CPU 41 (or 42) checks whether or not the mismatch signal is returned correctly from the comparison device 43. At this time, if a mismatch signal is returned from the comparison device 43, C
The PU determines that the comparison device 43 is normal, but if the coincidence signal returns, the CPU determines that the comparison device 43 has failed and outputs the own system stop signal to the output signal selection device 60, and the output signal selection device 60. Determines that the computer 1 system has failed and switches to the 2 system side.

A detailed description will be given below. FIG. 5 shows the contents of processing performed by the main CPU 41, the sub CPU 42, and the comparison device 43. Further, FIG. 6 is a time chart showing various signals. In FIG. 6, the N value changes from the top, the output timing of the comparison data from the main CPU 41,
Output timing of data confirmation signal from main CPU 41, output timing of comparison data from sub CPU 42, output timing of data determination signal from sub CPU 42, comparison processing timing in comparison device 43, match / mismatch from comparison device 43 The output timing of the signal, the content of the comparison result, and the failure determination content of the output signal selection device 60 are shown.

FIG. 7 is a flow chart for comparison with FIG. 5, in which the main CPU 41 and the sub CPU in the case where no measure is taken against the failure detection of the comparison device 43.
42 shows the contents of processing performed by 42 and the comparison device 43.

In FIG. 5, the main CPU 41 has 5 ms.
Start the loop processing of ec. At this time, the count value N
= 0. The main CPU 41 reads the data in step 100 and sends the synchronization signal in the sub-CP in step 101.
Send to U42. Step 200 in the sub CPU 42
When the input of the sync signal is confirmed in step 201, a preparation completion signal is sent to the main CPU 41 in step 201.

When confirming the input of the preparation completion signal in step 102, the main CPU 41 determines in step 103 whether the count value N is a predetermined value K ("5" in FIG. 6), and the count value N is predetermined. If it is less than the value K, the process proceeds to step 105. In this step 105, the main CPU
41 sends the calculation data to the sub CPU 42, and further,
In step 106, arithmetic processing is performed and the result is compared with the comparison device 4.
Send to 3. On the other hand, the sub CPU 42 inputs arithmetic data in step 202, performs arithmetic processing in step 203, and sends the result to the comparison device 43.

In the comparison device 43, the calculation result from the main CPU 41 and the calculation result from the sub CPU 42 are compared in step 300, and it is determined in step 301 whether they match. If they match, a match signal is sent in step 302, and if they do not match, a mismatch signal is sent to both CPUs 41 and 42 and the output signal selection device 60 in step 303.

Further, in the main CPU 41, in step 107, the count value N is a predetermined value K (in the case of FIG. 6,
If the count value N is less than the predetermined value K, the process proceeds to step 108. This step 1
In 08, the main CPU 41 judges whether they match or not, and if they do not match, sends a self-system stop signal to the output signal selection device 60.
On the other hand, if they match in step 108, step 109
The N value is incremented by 1 and the process returns to step 100.
The increment operation of this N value is t10 in FIG.
The timing is 1,102. In addition, sub CPU
In step S42, a check is made in step 204 for a match / mismatch.

On the other hand, as shown at the timing of t200 in FIG. 6, the count value N is a predetermined value K (in the case of FIG. 6,
"5"), the main CPU 41 shifts from step 103 to step 104 of FIG. And step 104
In, the main CPU 41 generates different dummy data, sends one data to the sub CPU 42, and performs an operation using the other data. Then step 10
Go to 6. The sub CPU 42 performs the same calculation using the dummy data described above. As a result, the main CPU 41
The calculation result in the sub CPU 42 and the calculation result in the sub CPU 42 are different from each other.
Different dummy data are output to the comparison device 43 as the respective calculation results of 1 and 42.

Since the count value N is the predetermined value K in step 107 in the main CPU 41, the process proceeds to step 110. Main CP in this step 110
U41 determines whether or not a non-coincidence signal is input from the comparison device 43, determines that there is an abnormality when the coincidence signal is output from the comparison device 43, and sends a self-system stop signal to the output signal selection device 60.

Further, when the data (dummy data) which is intentionally mismatched on a test basis is output, the mismatch signal is sent to the output signal selection device 60 even when the comparison device 43 is normal. As shown in FIG. 6, in the selection device 60, when the mismatch signal is received twice consecutively, it is determined that the failure occurs and the abnormality process (system switching) is executed.
As a result, even if a non-match signal as a test signal is received from the comparison device 43, it is invalidated and does not participate in the entire basic operation.

Therefore, as the timing for transmitting the data (dummy data) that causes the test disagreement, the data may be transmitted as the test data at every predetermined check cycle as in the present example, or may be transmitted every other time. Alternatively, the normal data and the data that intentionally does not match may be alternately sent from each CPU. The point is that test data should not be output twice in a row.

Thus, as compared with the comparative example shown in FIG.
Like steps 103, 104, 107, 109, 1
By adding each process of 10, when different dummy data is sent to the comparison device 43 as each calculation result in the plurality of processing devices (the main CPU 41 and the sub CPU 42), when the comparison signal is output from the comparison device 43. Can be determined to be abnormal. Therefore, CPU
Although the comparison device 43 monitoring 41 and 42 is not multiplexed, a failure of the comparison device 43 can be detected. As a result, it is possible to ensure safety by providing a diagnostic function even in a non-multiplexed part. In this way, safety can be ensured while avoiding an increase in the cost and size of the in-vehicle device.

In particular, the CPUs 41 and 42 in each processing system
Is transmitted to the output signal selection device 60, and the output signal selection device 60 controls the travel control actuator with the signal regarding the calculation result from the processing system to which the coincidence signal is transmitted from the comparison device 43. Is output as a signal of the CPU 4 in each processing system.
Reference numerals 1 and 42 indicate a comparison device 43 when the dummy data is transmitted.
When the coincidence signal is output from the device, an own system stop signal is sent to the output signal selection device 60 so that the calculation result in the processing system is not used as a signal for controlling the travel control actuator. Further, the output signal selection device 60 executes the processing at the time of abnormality accompanying the input of the mismatch signal only when the mismatch signal is received from the comparison device 43 twice in succession, and prevents the malfunction due to the transmission of the dummy data. can do. By doing so, a practically preferable system can be obtained.

[Brief description of drawings]

FIG. 1 is an overall configuration diagram of an automatic vehicle driving system according to an embodiment.

FIG. 2 is a diagram showing details of a controller.

FIG. 3 is a diagram for explaining CPU multiplexing.

FIG. 4 is a diagram for explaining a redundant system.

FIG. 5 is a flowchart showing the contents of processing performed by a main CPU, a sub CPU, and a comparison device.

FIG. 6 is a time chart showing various signals.

FIG. 7 is a flowchart for comparison.

[Explanation of symbols]

26 ... Controller, 28 ... Accelerator actuator, 29 ... Brake actuator, 30 ... Steering actuator, 40 ... Computer 1 system, 41
... Main CPU, 42 ... Sub CPU, 43 ... Comparison device,
50 ... Computer 2 system, 60 ... Output signal selection device.

─────────────────────────────────────────────────── ─── Continuation of front page (51) Int.Cl. ⁷ Identification code FI theme code (reference) B60R 21/00 626 B60R 21/00 626A 627 627 628 628B F02D 29/02 301 F02D 29/02 301D 45/00 370 45/00 370D 374 374C G08G 1/00 G08G 1/00 X (72) Inventor Manabu Ono 1-1, Showamachi, Kariya, Aichi DENSO CORPORATION (72) Inventor Akira Tachibana Toyota, Aichi Prefecture Toyota Town No. 1 Toyota Motor Co., Ltd. (72) Inventor Yoshihiro Oguwa Toyota City, Aichi Prefecture Toyota Town No. 1 Toyota Motor Co., Ltd. (72) Inventor Hideo Nakamura 7-24-1, Narashinodai, Funabashi, Chiba Japan Univ. Faculty of Science and Engineering Department of Electronic Engineering F-term (reference) 3D044 AA25 AA29 AA33 AC56 AC59 3G084 DA27 D A31 DA33 EA07 EA11 EB02 FA04 3G093 BA10 BA23 CA12 CB14 DB16 DB18 DB23 FA11 5H180 AA27 BB04 CC19 LL01 LL09 5H301 AA01 EE06 KK19 LL08 MM05

Claims (3)

[Claims] 1. On the vehicle-mounted side, a signal from a sensor is taken into a multiplexed processing system, a plurality of processing devices perform arithmetic processing in each processing system, and each processing result of each of the plurality of processing devices is processed. Compared with a single comparison device in the system, if they do not match, the calculation results match The control system actuator is controlled based on the calculation results in the processing system to automatically drive the vehicle along the road In the automatic vehicle driving system, the different dummy data is sent to the comparison device as each calculation result in the plurality of processing devices, and if the comparison device outputs the coincidence signal, it is abnormal. An automatic driving system for a vehicle, characterized in that a determination is made. 2. A signal related to a calculation result by the processing device in each processing system is sent to the output signal selection device, and the output signal selection device is a signal related to the calculation result from the processing system to which the coincidence signal is sent from the comparison device. Is output as a signal for controlling the traveling control actuator, and the processing device in each processing system selects the output signal at the time of abnormality in which a comparison signal is output from the comparison device due to the transmission of the dummy data. The automatic driving system for a vehicle according to claim 1, wherein a self-system stop signal is sent to the device so that the calculation result in the processing system is not used as a signal for controlling the traveling control actuator. . 3. The output signal selection device is configured to execute a process at the time of abnormality associated with the input of the mismatch signal only when the mismatch signal is received from the comparison device twice in succession. Item 2. The automatic vehicle driving system according to Item 2.