JP2004291943A - Vehicular control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make a similar control to that before a failure even when the failure occurs in a communication system for control operation. <P>SOLUTION: The vehicular control device comprises: a wiper ECU 1 for generating a control signal to execute wiper control in accordance with a wire control program incorporated therein; another ECU 2 for executing another control than the wire control; an input/output ECU 3 to which the control signal is input from the wiper ECU 1 for generating output based on the control signal; and a multiple communication line 4 for connecting the ECUs 1-3 with one another. The vehicular control device predicts a failure of the communication system between the wiper ECU 1 an the input/output ECU 3, transfers the control program incorporated in the wiper ECU 1 to the other ECU 2 via the multiple communication line 4 and installs it in the other ECU 2, and outputs control signal to the input/output ECU 3 so that the other ECU 2 executes the wire control instead of the wiper ECU 1. Thus, the wire control is executed. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a vehicle control device having a fail-safe function capable of preventing a failure in a communication system for performing various controls even when a failure occurs, for example, for performing wiper driving. It is suitable to be applied to the wiper drive control device.
[0002]
[Prior art]
When a failure occurs in the communication system for controlling the vehicle, measures such as fixing the control to a safe side or restricting the control are taken. This countermeasure is determined for each system, and when a communication system fails, a fixed control determined in accordance therewith is performed.
[0003]
For example, when the communication system fails, the circuit configuration is such that a Hi-level output is inevitably output, so that each system is set to be fixed on the safe side so that control corresponding to the Hi-level output can be performed. Also, if there is a control mode that can still be used even if the communication system breaks down, for example, if manual control can be used even when automatic control is disabled, only manual control can be used. It is set to limit control.
[0004]
[Patent Document 1]
JP-A-2002-2121075
[Problems to be solved by the invention]
However, only by taking measures such as fixing the control on the safe side or restricting the control as described above, only a limited control function can be realized when the communication system fails.
[0006]
In addition, if the control system is configured as a dual system, a continuation method of operating one of the systems when one of the systems fails can be considered, but a redundant system is required, and this is not cost effective. Absent.
[0007]
SUMMARY OF THE INVENTION In view of the above, it is an object of the present invention to enable a control system equivalent to that before a failure to be performed even when a failure occurs in a communication system for performing control.
[0008]
[Means for Solving the Problems]
In order to achieve the above object, according to the first aspect of the present invention, a first control device (1) mounted on a vehicle and generating a control signal for executing a first control based on a built-in control program is provided. A second control device (2) mounted on the vehicle for executing a second control different from the first control, and a control signal from the first control device is input, and outputs an output based on the control signal. A multiplex communication line (4) for connecting the input / output control device (3) to be generated with each of the first control device, the second control device, and the input / output control device, and enabling communication between these control devices. The first control device and the second control device are general-purpose control devices already mounted on the vehicle for controlling in-vehicle devices, and a communication system failure occurs between the first control device and the input / output control device. If predicted, via multiple communication lines (1) The control program stored in the control device is transferred to the second control device and installed in the second control device. After the installation, the second control device executes the first control in place of the first control device. A control signal is output to the input / output control device, and the input / output control device executes the first control based on the control signal.
[0009]
In the vehicle control device having such a configuration, between the first control device and the input / output control device, a program is installed from the first control device to the second control device when a communication system failure is predicted. I have. Therefore, it is possible to reliably install the program before the first control device completely breaks down. Further, even after a communication system failure of the first control device occurs, it is possible to obtain a fail-safe function of causing the second control device to execute the same first control as that performed by the first control device. it can. In addition, since the general-purpose control device already mounted on the vehicle is used for on-vehicle device control, a separate control device is required to install only the program when a failure of the communication system of the first control device is predicted. It is also possible to eliminate the need for installation.
[0010]
In this case, the first control device, the second control device, and the input / output control device are each configured as a separate chip.
[0011]
Specifically, as described in claim 3, the first control device transmits a reply signal from the input control device even though the first control device transmits a predetermined signal to the input / output control device. If the signal cannot be received, or if a reply signal is received, but the expected content of the reply signal is missing, the communication system is predicted to be faulty and the control program is transferred. Further, the control program may be transferred when a system failure occurs more than a predetermined frequency.
[0012]
In addition, the code | symbol in the parenthesis of each said means shows the correspondence with the concrete means described in embodiment mentioned later.
[0013]
BEST MODE FOR CARRYING OUT THE INVENTION
(1st Embodiment)
FIG. 1 shows a block configuration of a vehicle control device having a fail-safe function according to a first embodiment of the present invention. The configuration of the vehicle control device will be described with reference to FIG.
[0014]
As shown in FIG. 1, the vehicle control device includes a wiper ECU 1 as a first control device, another ECU 2 as a second control device that performs control different from the wiper ECU 1, an input / output ECU 3 as an input / output control device, A multiplex communication line (vehicle LAN) 4 connecting these ECUs 1 to 3 and a wiper motor 5 are provided.
[0015]
The wiper ECU 1 is a control device that executes arithmetic processing relating to control of a system mounted on a vehicle. In the present embodiment, the wiper ECU 1 generates a control signal for performing a wiper drive according to a driver's request by executing a control program installed in advance based on a wiper drive request signal from the driver. Specifically, the wiper drive request signal means a signal sent when the driver turns on a switch or the like of a wiper drive lever disposed on the back side of the steering in the vehicle interior.
[0016]
The other ECU 2 is a control device that executes arithmetic processing relating to a control different from wiper control as control of a system mounted on the vehicle. The other ECU 2 here is configured as a general-purpose control device such as an air conditioner control ECU, an ABS control ECU, or an engine control ECU, and is provided as a chip having a configuration different from that of the wiper ECU 1. This means that the chip has at least a free space capable of storing a wiper driving program. Before the occurrence of the communication system failure of the wiper ECU 1, the other ECU 2 executes only another vehicle control different from the wiper control. When the communication system failure of the wiper ECU 1 occurs, the other ECU 2 installs the wiper driving program stored in the wiper ECU 1 via the multiplex communication line 4 to drive the wiper ECU 1 instead of the wiper ECU 1. Is generated.
[0017]
The input / output ECU 3 corresponds to an input / output processing device that receives a control signal from the wiper ECU 1 or another ECU 2 when executing the wiper control and generates a predetermined output, and constitutes a wiper output circuit. . For example, when a control signal from the wiper ECU 1 is sent via the multiplex communication line 4, the input / output ECU 3 generates an output (output voltage) according to the control signal. This input / output ECU 3 is also configured as a separate chip from the wiper ECU 1.
[0018]
The wiper motor 5 is driven by the input / output ECU 3 and performs wiper drive according to the output generated by the input / output ECU 3, for example, low speed drive or Hi speed drive.
[0019]
The wiper driving and the fail-safe processing executed by the vehicle control device configured as described above will be described based on the flowcharts shown in FIGS.
[0020]
FIG. 2 is a flowchart of a process executed by the input / output ECU 3, and FIG. 3 is a flowchart of a process executed by the wiper ECU 1. FIG. 4 is a flowchart of a process executed by another ECU 2, and FIG. 5 is a flowchart of a process executed by an OS (Operating System) of the other ECU 2.
[0021]
As shown in FIG. 2, the input / output ECU 3 determines in step 110 whether the master ECU that is executing the current wiper control is another ECU 2. This processing is determined, for example, by determining whether or not a flag in the input / output ECU 3 is set. This flag is determined by a control master indicating that the master ECU for wiper control has become another ECU 2 in step 440 of FIG. The signal is set when a switching signal is sent from another ECU 2 to the input / output ECU 3.
[0022]
If a negative determination is made in step 110, the process proceeds to step 120, where a control signal indicating the content of the wiper drive instruction is acquired from the wiper ECU 1 in order to execute the wiper drive by the wiper ECU 1. On the other hand, if an affirmative determination is made, the routine proceeds to step 130, where a control signal indicating the content of the wiper drive instruction is acquired from another ECU 2 in order to execute the wiper drive by the other ECU 2.
[0023]
Thereafter, in step 140, an output corresponding to the control signal acquired in step 120 or step 130 is generated as a wiper motor drive output. As a result, the wiper motor 5 performs wiper drive according to a request from the driver.
[0024]
As shown in FIG. 3, the wiper ECU 1 predicts in step 210 whether the wiper ECU 1 itself can fail. In this processing, for example, even though the wiper ECU 1 transmits a predetermined signal to the input / output ECU 3 via the multiplex communication line 4, it cannot receive a reply signal from the input / output ECU 3, Is received, the wiper ECU 1 is predicted to be able to break down if there is any omission from the expected content of the reply signal or if such a state occurs more than a predetermined frequency. If a negative determination is made in this step, it is determined that the communication system failure of the wiper ECU 1 has not occurred, and the routine proceeds to step 220 to execute (continue) the wiper control. If an affirmative determination is made, the routine proceeds to step 230, where the wiper control program stored in the wiper ECU 1 itself is transferred to another ECU 2, and the process is terminated.
[0025]
As shown in FIG. 4, the other ECU 2 determines in step 310 whether or not the wiper control program has been transferred from the wiper ECU 1. This process is performed by referring to the flag, when the wiper control program is transferred from the wiper ECU 1 in step 230 in FIG. Then, if a negative determination is made in step 310, the wiper drive is executed by the wiper ECU 1 instead of the other ECU 2, and the process is terminated as it is. On the other hand, if the determination is affirmative, the received wiper control program is written into the empty area of the other ECU 2 itself, and then an additional task generation signal indicating that an additional task has occurred in addition to the program executed by the other ECU 2 itself Send to OS.
[0026]
As shown in FIG. 5, the OS of the other ECU 2 determines in step 410 whether or not there is an additional task. This processing is performed by referring to the flag when the OS receives the additional task generation signal in step 330 in FIG. 4 because a flag indicating that fact is set in the OS. Then, if a negative determination is made in step 410, the process ends as there is no additional task, and if an affirmative determination is made, task scheduling is reconstructed. For example, if the control programs (1) and (2) that must be executed by another ECU 2 already exist, the wiper control program is added to the control program (3) after the control programs (1) and (2). ) And only the control programs (1) and (2) need to be executed, and the order is reset as control programs (1) to (3).
[0027]
Next, the process proceeds to step 430, where the execution environment is reconstructed. That is, the resource allocation of the microcomputer in the OS is changed so that the resource function is given to the wiper control program set as the control program (3).
[0028]
Then, the process proceeds to step 440, where a control master switching signal indicating that the master ECU for wiper control has been changed to another ECU 2 is transmitted to the input / output ECU 3, and the process is terminated. When the control master switching signal is transmitted, the input / output ECU 3 receives the signal and performs processing such as setting a flag in the input / output ECU 3.
[0029]
As described above, in the present embodiment, it is predicted that a communication system failure of the wiper ECU 1 may occur, and it is assumed that the wiper control by the wiper ECU 1 is becoming impossible. In this case, the wiper control program stored in the wiper ECU 1 is reliably transferred to another ECU 2 before a failure occurs. Then, the other ECU 2 installs the transferred wiper control program, and after the installation, executes the wiper control in place of the wiper ECU 1.
[0030]
In the present embodiment, the wiper ECU 1 and the input / output ECU 3 are configured separately so that the wiper control can be performed by another ECU 2 instead of the wiper ECU 1. The reason for this is that the communication between the case where the wiper driving ECU similar to the conventional one shown in FIGS. 6A and 6B is used and the case where the wiper ECU 1 and the input / output ECU 3 are configured differently as in this embodiment. A description will be given with reference to embodiments.
[0031]
As shown in FIG. 6A, the wiper driving ECU 50 conventionally used for wiper control has a configuration in which the wiper ECU 1 and the input / output ECU 3 shown in the present embodiment are integrated. I have. In the case of such a configuration, transfer of a control signal from another ECU 51 through the wiper driving ECU 50 in which a communication system failure has occurred, as indicated by a communication path indicated by an arrow in FIG. It must be made. For this reason, even if the wiper control ECU 50 transfers the wiper control program to another ECU 51 when the occurrence of a communication system failure is predicted, the other ECU 51 cannot drive the wiper motor 52.
[0032]
However, if the wiper ECU 1 and the input / output ECU 3 are configured differently as in the present embodiment, the wiper ECU 1 in which a communication system failure has occurred, such as the communication path indicated by the arrow in FIG. It is possible to exchange control signals from other ECUs 2 without passing through the communication path. Therefore, when the occurrence of a communication system failure of the wiper ECU 1 is predicted, the wiper control can be executed by another ECU 2 by transferring the wiper control program to the other ECU 2.
[0033]
By using the vehicle control device having such a configuration, even after a communication system failure of the wiper ECU 1 occurs, the other ECU 2 executes the same wiper control as that performed by the wiper ECU 1 in a fail-safe manner. Function can be obtained.
[0034]
In addition, since the general-purpose control device already mounted on the vehicle is used as the other ECU 2 as the vehicle control, if a failure of the communication system of the wiper ECU 2 is predicted, only the wiper control program is separately installed. It is also possible to eliminate the need to install an ECU.
[0035]
(Other embodiments)
In the first embodiment, the wiper ECU 1 for driving the wiper has been described as an example. However, the transfer of the program is not limited to the wiper control program in the wiper ECU 1 but may be another control program such as a headlamp control program. By doing so, the same fail-safe function as in the first embodiment can be obtained.
[Brief description of the drawings]
FIG. 1 is a diagram showing a block configuration of a vehicle control device according to a first embodiment of the present invention.
FIG. 2 is a flowchart of a process executed by an input / output ECU 3 shown in FIG.
FIG. 3 is a flowchart of a process executed by a wiper ECU 1 shown in FIG.
FIG. 4 is a flowchart of a process executed by another ECU 2 shown in FIG.
FIG. 5 is a flowchart of a process executed by an OS of another ECU 2 shown in FIG.
FIG. 6A is a schematic diagram illustrating a communication mode when a wiper driving ECU is configured in the same manner as in the related art, and FIG. 6B is a schematic diagram illustrating a communication mode of the vehicle control device in the present embodiment FIG.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Wiper ECU, 2 ... Other ECU, 3 ... Input / output ECU, 4 ... Multiple communication line,
5. Wiper motor.

Claims (4)

A first control device (1) mounted on a vehicle and generating a control signal for executing first control based on a built-in control program;
A second control device (2) mounted on the vehicle for executing a second control different from the first control;
An input / output control device (3) that receives a control signal from the first control device and generates an output based on the control signal;
A multiplex communication line (4) for connecting between the first control device, the second control device, and the input / output control device, and enabling communication between the control devices;
The first control device and the second control device are general-purpose control devices already mounted on the vehicle for controlling in-vehicle devices,
When a communication system failure is predicted between the first control device and the input / output control device, a control program incorporated in the first control device is transferred to the second control device via the multiplex communication line. Installing in the second control device, and after the installation, the second control device outputs a control signal for executing the first control in place of the first control device to the input / output control device. A control device for a vehicle, wherein the input / output control device executes the first control based on the control signal. The vehicle control device according to claim 1, wherein the first control device, the second control device, and the input / output control device are each configured as a separate chip. The first control device is configured to be unable to receive a reply signal from the input control device even though the first control device transmits a predetermined signal to the input / output control device, or Even if a signal is received, the communication program is predicted to be faulty and the control program is transferred when there is a missing from the expected content of the reply signal. The control device for a vehicle according to claim 1 or 2, wherein The control device for a vehicle according to claim 3, wherein the first control device is configured to transfer the control program when the system failure occurs more than a predetermined frequency.

Images