JP2006306166A - Redundant system and its fault diagnosis method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a redundant system and its fault diagnosis method capable of making troubleshooting certainly while the robustness in troubleshooting the redundant system is secured. <P>SOLUTION: The redundant system is to measure one object with a plurality of sensors and monitor the values of the sensors using a plurality of controllers, wherein the relative relational value of the sensors is acquired after the controllers are started, and each sensor value is subjected to an internal diagnosis to know whether it is normal or not on the basis of the relative relational value, followed by a relative diagnosis to know whether it is normal or not on the basis of the result from the internal diagnosis of itself and the results from internal diagnosis of the other controllers, and when the result from the internal diagnosis of itself differs from the results from internal diagnosis of the other controllers according to the result from the relative diagnosis, the relative relational value is acquired again. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a redundant system, and more particularly, to a failure diagnosis of a redundant system that measures the same measurement object using a plurality of sensors.

Conventionally, a technique described in Patent Document 1 is known as a technique for performing failure diagnosis using a plurality of sensors. In this publication, the vehicle speed is calculated from the output signals of the rotation sensors arranged at three or more parts of the automatic transmission, and the sensor in which an abnormality has occurred is specified by the majority decision of these calculated values. In addition, priorities are assigned to the sensors, and which sensor values are used for control according to the priorities. However, although the above prior art makes a majority decision with a plurality of sensors, there is a problem that control cannot be continued when one controller fails. Also, when taking a majority decision, if only one abnormal value is indicated, the fail-safe operation is started immediately, so that the robustness of the system may not be ensured. Therefore, in the technique described in Patent Document 2, a plurality of sensors and a plurality of controllers are provided, a majority decision is made on the values output from the plurality of controllers, and the larger value is output as the correct value. Even when an abnormality is indicated, the robustness of the system is ensured by outputting a correct value.
Japanese Patent Laid-Open No. 4-151068. Japanese Patent Laid-Open No. 10-340103 (see FIG. 8).

  However, in the technique shown in the above-mentioned Patent Document 2, since the control is continued while permitting a state in which a signal with one wrong value is output, there is a problem shown below. For example, deviations (A−B), (B−C), and (C−A) (first, second, and third combinations) of three sensors A, B, and C are obtained, and each deviation is a predetermined value. If it is determined by majority decision whether or not it is less than the predetermined value, the control is continued while leaving a case where a certain set of deviations (first combination) is equal to or greater than a predetermined value. At this time, when a failure actually occurs and the deviation of the other combination (second combination) becomes a predetermined value or more, the two combinations of the first combination and the second combination are the predetermined values. Thus, it is specified that the sensors (for example, sensor B) related to both of these two sets are abnormal. Here, when the sensor that has actually failed is the sensor C related to both the second combination and the third combination, there is a possibility that the correct sensor B is determined to be abnormal.

  The present invention has been made paying attention to the above problems, and the object of the present invention is to provide a redundant system capable of reliably determining a failure while ensuring robustness in the redundant system, and a failure diagnosis method therefor. It is to provide.

  In order to achieve the above object, in the redundant system according to the present invention, the same measurement object is measured by a plurality of sensors, and the values of the sensors are monitored by a plurality of controllers. An initialization processing unit that acquires the relative relation value of each sensor at the time of starting each controller, an internal diagnosis processing unit that diagnoses whether the value of each sensor is normal based on the relative relation value, and its internal diagnosis A relative diagnosis processing unit for diagnosing normality based on a result and an internal diagnosis result of another controller, and when the internal diagnosis result of the relative diagnosis result is different from the internal diagnosis result of another controller, the initialization And a re-initialization instruction unit that performs re-initialization by the processing unit.

  In the redundant system of the present invention, a relative diagnosis process based on the internal diagnosis process is performed, and when each internal diagnosis result is different, the relative relation value is reinitialized. Therefore, robustness can be secured without falling into a fail-safe operation. In addition, a state that is physically impossible due to reinitialization is not left, and erroneous diagnosis can be avoided.

  Hereinafter, a vehicle steering apparatus to which a redundant system of the present invention is applied will be described based on an embodiment shown in the drawings.

  FIG. 1 is an overall system diagram illustrating a vehicle steering apparatus according to a first embodiment. The vehicle steering apparatus according to the first embodiment is an example in which a redundant system is applied to a steer-by-wire (SBW) system including a backup mechanism.

  First, the configuration will be described. As a steering input means for a driver to input a steering amount, a steering wheel 1 and a steering shaft 2 rotatably supported on the vehicle body side and connected to the steering wheel 1 are provided. On the steering shaft 2, a steering angle sensor 8 that detects a steering angle as a steering amount of the driver and a steering torque sensor 9 that detects a steering torque as a steering amount of the driver are provided.

  The steering wheel 1 incorporates an air bag mechanism as a collision safety device. One end of the airbag mechanism is fixed to the vehicle body side and wound around the outer periphery of the steering shaft 2 with a margin, and the other end is fixed to the steering wheel 1 (or the steering shaft 2) and controlled by the airbag mechanism. A spiral cable 16 capable of outputting signals and the like is provided.

  Further, the steering wheel 20 side of the steering angle sensor 8 and the steering torque sensor 9 has a reaction force motor 3 that applies a steering reaction force to the driver (the steering wheel 1). The reaction force motor 3 includes a resolver 10 that detects a motor rotation angle of the reaction force motor 3. On the steered wheel 20 side with respect to the reaction force motor 3, an electromagnetic clutch 6 capable of physically engaging and releasing between the steering shaft 2 and the backup mechanism 7 is provided.

  The backup mechanism 7 includes a steering-side cable pulley 7a having one end connected to the electromagnetic clutch 6, a steered-wheel-side cable pulley 7b having one end connected to the pinion shaft 15, and both cable pulleys 7a and 7b in opposite directions. The two cables 7c and 7d are connected in a state of being wound around. When the electromagnetic clutch 6 is released, the rotation of the steering shaft 2 is not transmitted to the pinion shaft 15. On the other hand, when the steering wheel 1 is rotated in one direction while the electromagnetic clutch 6 is engaged, one of the two cables 7c and 7d transmits a steering torque input from the driver, The other cable is configured to exhibit a function equivalent to that of the column shaft by transmitting a reaction torque input from the steering wheel 20.

  As a turning means for turning the steered wheels 20, the pinion shaft 16 is rotatably supported on the vehicle body side and connected at one end to the steered wheel side cable pulley 7b. The pinion shaft 16 includes an incremental type that detects a rotation angle of the first and second turning motors 5a and 5b and a first turning motor 5a and a second turning motor 5b that output turning torque to the pinion shaft 16. Of the first rotation angle sensor 11a and the second rotation angle sensor 11b, the first and second turning motors 5a and 5b, and the steered wheels 20, which detect the rotational torque of the pinion shaft 16. A torque sensor 12 and an incremental third rotation angle sensor 13 for detecting the rotation angle of the pinion shaft 16 are provided. A rack and pinion mechanism (not shown) is provided at the steered wheel side end of the pinion shaft 16, and the steered wheel 20 is steered by moving the steering rack 4 in the axial direction.

  The first controller ECU1 detects the rotation angle of the first steered motor 5a based on the value detected by the first rotation angle sensor 11a. The second controller ECU2 detects the rotation angle of the second steered motor 5b based on the value detected by the second rotation angle sensor 11b. The third controller ECU 3 detects the pinion rotation angle based on the value detected by the third rotation angle sensor 13. When the system power is turned on and the supplied power voltage exceeds a predetermined value, each controller ECU1 to ECU3 detects the sensor value with the rotation angle of each rotation angle sensor at that time as the zero position. Start.

  In the steer-by-wire control system of the first embodiment, the rotation of the pinion shaft 16 that is one rotating element is detected by three sensors (11a, 11b, 13), and the values of the respective sensors are detected by three controllers ECU1, ECU2, Redundant system is built by loading into ECU3. Each of the controllers ECU1 to ECU3 is provided with a counter, detects a value of a sensor connected to each controller, and shares each sensor value by communication between the controllers. The reason why three controllers are arranged in this manner is that even if there are only three sensors, if one controller fails, it will still fall into the fail mode.

  In the steer-by-wire control system, the steering angle detected by the steering angle sensor 8, the steering torque detected by the steering torque sensor 9, the reaction force motor rotation angle detected by the resolver 10, the first and second rotation angles. The turning motor rotation angle detected by the sensors 11a and 11b, the turning torque detected by the turning torque sensor 12, the pinion shaft rotation angle detected by the third rotation angle sensor 13, and other sensors (vehicle speed sensor, On the basis of the sensor signal of the yaw rate sensor, the lateral acceleration sensor, etc.), the steering control according to the steering angle of the driver and the traveling state of the vehicle is executed.

  Specifically, a control signal is output to the reaction force motor 3 so as to apply a steering reaction force torque corresponding to the traveling situation, and the turning motor 5 is adapted to the traveling situation and the steering state of the driver. A control signal is output so as to give the turning amount. Note that the electromagnetic clutch 6 is disengaged during normal steer-by-wire control execution, and is configured to engage the electromagnetic clutch 6 during ignition OFF or fail-safe control.

  FIG. 2 is a schematic diagram illustrating a relationship between the first rotation angle sensor 11a, the second rotation angle sensor 11b, and the third rotation angle sensor 13 according to the first embodiment. The pinion shaft 16 is provided with a worm wheel 16a. The worm wheel 16a includes a worm gear 51 of the first turning motor 5a, a worm gear 52 of the second turning motor 5b, and a worm gear of the third turning motor 5c. 131 is engaged. The configuration is not limited to the configuration of the worm wheel and the worm gear, and a bevel gear or the like may be used.

  That is, the rotation of the pinion shaft 16 that is physically one element is detected by three sensors, that is, the first rotation angle sensor 11a, the second rotation angle sensor 11b, and the third rotation angle sensor 13, and the redundant system. Is secured. In addition, as shown in FIG. 3, a redundant system may be ensured as a structure which rotates the 3rd rotation angle sensor 13 integrally with the 2nd steering motor 5b, and it does not specifically limit it.

(Sensor fault diagnosis process)
4 and 5 are flowcharts showing a failure diagnosis process of the rotation angle sensor according to the first embodiment. In this control flow, when the system is started, each controller ECU1 to ECU3 starts detection of each sensor value, and then the initialization process as described later is executed in each controller ECU1 to ECU3. Fault diagnosis processing is executed. For the sake of simplicity, the first rotation angle sensor 11a is referred to as sensor A, the second rotation angle sensor 11b is referred to as sensor B, and the third rotation angle sensor 13 is referred to as sensor C.

  The flow of failure diagnosis processing executed in each of the controllers ECU1 to ECU3 includes an initialization processing unit, an internal diagnosis processing unit, a relative diagnosis processing unit, a reinitialization instruction unit, and a fail processing unit.

[Initialization processing section]
In step 101a, the value of sensor A is read at a timing unique to ECU1, the values of sensors B and C are received from ECU2 and ECU3 at this timing, and the average deviations α1 *, β1 *, and γ1 * of the sensor values are calculated. The average deviation is expressed by the following formula. Since the deviation changes at the reading timing, the average deviation is taken n times in succession, but it may not be an average value.
α1 * = (Σ ⁿ _{i = 1} | A−B |) / n
β1 * = (Σ ⁿ _{i = 1} | B−C |) / n
γ1 * = (Σ ⁿ _{i = 1} | C−A |) / n

In step 101b, the value of sensor B is read at ECU2's own timing, the values of sensors A and C are received from ECU1 and ECU3 at this timing, and the average deviations α2 *, β2 *, and γ2 * of the sensor values are calculated. The average deviation is expressed by the following formula.
α2 * = (Σ ⁿ _{i = 1} | A−B |) / n
β2 * = (Σ ⁿ _{i = 1} | B−C |) / n
γ2 * = (Σ ⁿ _{i = 1} | C−A |) / n

In step 101c, the value of sensor C is read at ECU3's own timing, the values of sensors A and B are received from ECU1 and 2 at this timing, and the average deviations α3 *, β3 *, and γ3 * of the sensor values are calculated. The average deviation is expressed by the following formula.
α3 * = (Σ ⁿ _{i = 1} | A−B |) / n
β3 * = (Σ ⁿ _{i = 1} | B−C |) / n
γ3 * = (Σ ⁿ _{i = 1} | C−A |) / n

[Internal diagnosis processing]
In step 102a, the value of sensor A is read at ECU1's own timing, sensors B and C are received from ECU2 and 3, and the deviation is calculated. The deviation is expressed by the following formula.
α1 = | A−B |
β1 = | BC |
γ1 = | C−A |

In step 102b, the value of sensor B is read at ECU2's own timing, sensors A and C are received from ECU1 and ECU3, and the deviation is calculated. The deviation is expressed by the following formula.
α2 = | A−B |
β2 = | B−C |
γ2 = | C−A |

In step 102c, the value of sensor C is read at ECU3's own timing, sensors B and A are received from ECU2 and 1, and the deviation is calculated. The deviation is expressed by the following formula.
α3 = | A−B |
β3 = | B−C |
γ3 = | C−A |

  In step 103a, it is determined whether or not the difference between the deviation α1 and the average deviation α1 * is smaller than the standard tolerance. If it is smaller, it is determined that the sensor A and the sensor B are normal, and the process proceeds to step 104a. Determines that sensor A or sensor B is out of order and proceeds to step 105a.

  In step 103b, it is determined whether or not the difference between the deviation α2 and the average deviation α2 * is smaller than the standard tolerance. When the difference is smaller, it is determined that the sensor A and the sensor B are normal, and the process proceeds to step 104b. Determines that sensor A or sensor B is out of order and proceeds to step 105b.

  In step 103c, it is determined whether or not the difference between the deviation α3 and the average deviation α3 * is smaller than the standard tolerance. If the difference is smaller, it is determined that the sensor A and the sensor B are normal, and the process proceeds to step 104c. Determines that sensor A or sensor B is out of order and proceeds to step 105c.

In step 104a, the failure flag Fα1 is set to 0.
In step 104b, the failure flag Fα2 is set to 0.
In step 104c, the failure flag Fα3 is set to 0.

In step 105a, the failure flag Fα1 is set to 1.
In step 105b, the failure flag Fα2 is set to 1.
In step 105c, the failure flag Fα3 is set to 1.

  In step 106a, it is determined whether or not the difference between the deviation β1 and the average deviation β1 * is smaller than the standard tolerance. If it is smaller, it is determined that the sensor B and sensor C are normal, and the process proceeds to step 107a. Determines that sensor B or sensor C is out of order and proceeds to step 108a.

  In step 106b, it is determined whether or not the difference between the deviation β2 and the average deviation β2 * is smaller than the standard tolerance. If it is smaller, it is determined that the sensor B and the sensor C are normal, and the process proceeds to step 107b. Determines that sensor B or sensor C is faulty and proceeds to step 108b.

  In step 106c, it is determined whether or not the difference between the deviation β3 and the average deviation β3 * is smaller than the standard tolerance. If it is smaller, it is determined that the sensor B and sensor C are normal, and the process proceeds to step 107c. Determines that sensor B or sensor C is faulty and proceeds to step 108c.

In step 107a, the failure flag Fβ1 is set to 0.
In step 107b, the failure flag Fβ2 is set to 0.
In step 107c, the failure flag Fβ3 is set to 0.

In step 108a, the failure flag Fβ1 is set to 1.
In step 108b, the failure flag Fβ2 is set to 1.
In step 108c, the failure flag Fβ3 is set to 1.

  In Step 109a, it is determined whether or not the difference between the deviation γ1 and the average deviation γ1 * is smaller than the standard tolerance. If it is smaller, it is determined that the sensor C and the sensor A are normal, and the process proceeds to Step 110a. Determines that sensor C or sensor A is out of order and proceeds to step 111a.

  In Step 109b, it is determined whether or not the difference between the deviation γ2 and the average deviation γ2 * is smaller than the standard tolerance. If it is smaller, it is determined that the sensor C and the sensor A are normal, and the process proceeds to Step 110b. Determines that sensor C or sensor A is out of order and proceeds to step 111b.

  In Step 109c, it is determined whether or not the difference between the deviation γ3 and the average deviation γ3 * is smaller than the standard tolerance. If the difference is smaller, it is determined that the sensor C and the sensor A are normal, and the process proceeds to Step 110c. Determines that sensor C or sensor A is out of order and proceeds to step 111c.

In step 110a, the sub failure flag Fγ1 is set to 0.
In step 110b, the sub failure flag Fγ2 is set to 0.
In step 110c, the sub failure flag Fγ3 is set to 0.

In step 111a, the sub failure flag Fγ1 is set to 1.
In step 111b, the sub failure flag Fγ2 is set to 1.
In step 111c, the sub failure flag Fγ3 is set to 1.

In step 112a, the combination of the failure flag F1 (Fα1, Fβ1, Fγ1) of ECU1 is set.
In step 112b, the combination of the failure flag F2 (Fα2, Fβ2, Fγ2) of ECU2 is set.
In step 112c, a combination of a failure flag F3 (Fα3, Fβ3, Fγ3) of the ECU 3 is set.

[Relative diagnosis processing]
In step 113a, the results of the failure flags F2 and F3 are received from ECU2 and ECU3.
In step 113b, the results of the failure flags F1 and F3 are received from ECU1 and ECU3.
In step 113c, the results of the failure flags F1 and F2 are received from ECU1 and ECU2.

In step 114a, it is determined whether F1 = F2. If Yes, the process proceeds to step 115a, and the sub error flag Eα1 is set to 0. On the other hand, when the answer is No, the process proceeds to step 116a, where the sub error flag Eα1 is set to 1.
In step 114b, it is determined whether F2 = F1. If Yes, the process proceeds to step 115b, and the sub error flag Eα2 is set to 0. On the other hand, if No, the process proceeds to step 116b, and the sub error flag Eα2 is set to 1.
In step 114c, it is determined whether F3 = F1. If Yes, the process proceeds to step 115c, and the sub error flag Eα3 is set to 0. On the other hand, if No, the process proceeds to step 116c, and the sub error flag Eα3 is set to 1.

In step 117a, it is determined whether F1 = F3. If Yes, the process proceeds to step 118a, and the sub error flag Eβ1 is set to 0. On the other hand, if No, the process proceeds to step 119a, and the sub error flag Eβ1 is set to 1.
In step 117b, it is determined whether F2 = F3. If Yes, the process proceeds to step 118b, and the sub error flag Eβ2 is set to 0. On the other hand, if No, the process proceeds to step 119b, and the sub error flag Eβ2 is set to 1.
In step 117c, it is determined whether F3 = F2. If Yes, the process proceeds to step 118c, and the sub error flag Eβ3 is set to 0. On the other hand, if No, the process proceeds to step 119c, and the sub error flag Eβ3 is set to 1.

In step 120a, an error flag E1 = (Eα1, Eβ1) is set.
In step 120b, an error flag E2 = (Eα2, Eβ2) is set.
In step 120c, an error flag E3 = (Eα3, Eβ3) is set.

[Re-initialization instruction section]
In step 121a, it is determined whether or not the error flag E1 is a combination of (1, 1). If this combination is selected, the process proceeds to step 101a, where ECU1 is reinitialized, and otherwise, the process proceeds to step 122a.
In step 121b, it is determined whether or not the error flag E2 is a combination of (1, 1). If this combination is selected, the process proceeds to step 101b, where ECU2 is reinitialized. Otherwise, the process proceeds to step 122b.
In step 121c, it is determined whether or not the error flag E3 is a combination of (1, 1). If this combination is selected, the process proceeds to step 101c, where ECU3 is reinitialized, and otherwise, the process proceeds to step 122c.

In step 122a, the combination of the failure flags F1 is determined. If (0, 0, 0), it is determined that all the sensors are normal, the process proceeds to step 102a, and the sensor failure diagnosis process is continued. Next, in the case of a combination of (1, 0, 0), (0, 1, 0), (0, 0, 1), the process proceeds to step 101a to reinitialize ECU1.
In step 122b, the combination of the failure flags F2 is determined. If (0, 0, 0), it is determined that all the sensors are normal, the process proceeds to step 102b, and the sensor failure diagnosis process is continued. Next, in the case of a combination of (1, 0, 0), (0, 1, 0), (0, 0, 1), the process proceeds to step 101b, and ECU 2 is reinitialized.
In step 122c, the combination of the failure flags F1 is determined. If (0, 0, 0), it is determined that all the sensors are normal, the process proceeds to step 102c, and the sensor failure diagnosis process is continued. Next, in the case of a combination of (1, 0, 0), (0, 1, 0), (0, 0, 1), the process proceeds to step 101c and ECU 3 is reinitialized.

[Fail processing section]
In the above steps 122a to 122c, when (1, 0, 1), the process proceeds to step 123, the sensor A is determined to be faulty, the ECU 1 is shut down, and the system is shifted to the fail mode. If (1, 1, 0), the process proceeds to step 124 where it is determined that the sensor B is out of order, the ECU 2 is shut down, and the system is shifted to the fail mode. If (0, 1, 1), the process proceeds to step 125 where the sensor C determines that a failure has occurred, shuts down the ECU 3, and shifts the system to the fail mode.

(Operation of sensor failure diagnosis processing)
Next, the operation of the sensor failure diagnosis process based on the flowchart will be described. First, average deviations α *, β *, and γ *, which are relative values of sensors A, B, and C, are acquired by the initialization processing unit when each controller is activated. Next, in the internal diagnosis processing unit, the deviations α, β, γ of the values of the sensors A, B, C are calculated, and it is diagnosed whether the deviation between this value and the average deviation which is a relative value is within the standard tolerance. The normal / abnormal judgment result is set as a failure flag. Next, the relative diagnosis processing unit diagnoses whether each controller is normal based on the failure flag that is the internal diagnosis result of each controller and the failure flag that is the internal diagnosis result of the other controller, and the matching / mismatch diagnosis Set result to error flag.

  Next, in the re-initialization instruction unit, when the own diagnosis result is different from the internal diagnosis result of other controllers based on the error flag which is the relative diagnosis result, that is, when E = (1, 1), the initial value Go to the initialization processor and reinitialize. On the other hand, when E = (0,0), (1,0), (0,1), the internal diagnosis result is further referred to and only one abnormality determination result is included in the internal diagnosis result. When F = (1, 0, 0), (0, 1, 0), (0, 0, 1), the process proceeds to the initialization processing unit and re-initialization is performed. As a result, it is possible to avoid a physically impossible state of only one abnormality, and an erroneous failure determination can be avoided.

  Due to the majority of the relative diagnosis processing unit, there is another internal diagnosis result that coincides with its own internal diagnosis result, that is, F = (1, 0), (0, 1), and the internal diagnosis result is abnormal. When two determination results are included, that is, when F = (1,1,0), (1,0,1), or (0,1,1), both of these two abnormality determination results It is determined that the sensor is faulty, and the fail processing unit shuts down the controller connected to the sensor determined to be faulty and shifts to the fail mode. For example, when F1 = (1, 1, 0), Fα1 and Fβ1 are abnormal. Since the sensor relating to both is the sensor B, it is determined that the sensor B is out of order, and the ECU 2 connected to the sensor B is shut down.

  Next, a case where the initialization process is not properly performed will be described based on the time chart of FIG. FIG. 6 is a time chart showing a case where ECU 2 is diagnosed as a physically impossible state even though each sensor A, B, C has not failed.

  In the sensor failure diagnosis process of the present embodiment, an abnormality is detected depending on whether the deviation of each sensor is within a predetermined range. Each sensor A, B, C basically monitors one rotating element mechanically as shown in FIG. 2 or 3, and each value should show the same value. However, the values of the sensors are not necessarily the same due to tolerances in the mechanical coupling portions that the sensors have in advance, variations in the initialization timing of the ECU1 to ECU3, and the like. In particular, the startup timing of each ECU1 to ECU3 is when the power supply voltage is supplied at the time of system startup and the voltage exceeds a predetermined value, and in the order of several milliseconds, the system of each ECU1 to ECU3 is not necessarily synchronized. It does not start. In addition, the initialization processing unit may not synchronize between the ECUs 1 to 3 until which timing in the control cycle starts reading each sensor value for initialization from another ECU.

  Therefore, the average values α *, β *, and γ * of the deviations between these sensors are calculated at each ECU1 to ECU3's own timing, and the average deviation and the ECU1 to ECU3 diagnosis timing are read simultaneously. A failure diagnosis of each sensor is performed by comparing the deviations α, β, and γ of the sensor values. At this time, failure diagnosis of each sensor is individually performed in each of the controllers ECU1 to ECU3.

  Here, a case will be described where a sensor value is misdiagnosed by having a change in angular velocity, and the misdiagnosis is eliminated by the fault diagnosis processing of the present application. FIG. 6 is a diagram showing the relationship between the initialization timing of each of the ECUs 1 to 3 and the diagnosis timing when the sensor value has a change in angular velocity. First, in each of the ECUs 1 to 3, the internal diagnosis process in each ECU and the relative diagnosis process between the ECUs based on the internal diagnosis result of each ECU will be described separately.

(About internal diagnostic processing in each ECU)
[Internal diagnosis processing of ECU1]
As shown in FIG. 6, at the timing before the failure diagnosis timing of ECU1, initialization processing of ECU1 is executed, and average values α1 *, β1 *, and γ1 * of deviations are calculated. Here, when the average value of the deviation is calculated, the timing for reading the sensor value from another controller does not necessarily match. Therefore, the circle in the figure is the value of sensor A, and the triangle in the figure is the value of sensor B received from ECU2. In the figure, x is the value of sensor C received from ECU3.

  Next, after setting the average deviation value by the initialization process, the sensor values are simultaneously read from the other ECUs 2 and 3 at the failure diagnosis timing of ECU1. At this time, since each deviation α1, β1, γ1 is within the average deviation ± standard tolerance set at the time of initialization, it is determined to be normal, and each sub failure flag Fα1, Fβ1, Fγ1 is set to 0, and failure flag F1 Is set to (0,0,0).

[Internal diagnostic processing of ECU2]
Similar to the processing of ECU1, the initialization processing of ECU2 is executed at a timing before the failure diagnosis timing of ECU2, and average values α2 *, β2 *, and γ2 * of deviations are calculated. In ECU2, when the sensor value is read from other ECUs 1 and 3 for initialization, the angular velocity of the sensor value changes, so the average deviation values α2 *, β2 *, and γ2 * are particularly small values of γ2 *. Is output as

  Next, after setting the average value of deviations by the initialization process, the sensor values are simultaneously read from the other ECUs 1 and 3 at the failure diagnosis timing of ECU2. At this time, each of the deviations α2 and β2 is within the average deviation ± standard tolerance set at the time of initialization, but γ2 is a value deviating from the average deviation ± standard tolerance set at the time of initialization. Therefore, the sub failure flag Fγ2 is set to 1, and the failure flag F is set to (0, 0, 1).

[Internal diagnostic processing of ECU3]
Similar to the processing of ECU1, the initialization processing of ECU3 is executed at the timing before the failure diagnosis timing of ECU3, and average values α3 *, β3 *, and γ3 * of deviations are calculated. ECU3 reads the sensor value from other ECU1 and 2 for initialization. Next, after setting the average deviation value by the initialization process, the sensor values are simultaneously read from the other ECUs 1 and 2 at the failure diagnosis timing of the ECU 3. At this time, since each deviation α3, β3, γ3 is within the average deviation ± standard tolerance set at the time of initialization, it is determined to be normal, each sub failure flag Fα3, Fβ3, Fγ3 is set to 0, and failure flag F3 Is set to (0,0,0).

(Relative diagnosis processing between each ECU based on the failure diagnosis result of each ECU)
[ECU1 relative diagnosis processing]
The ECU 1 receives the results of the failure flags F2 and F3 from the other ECUs 2 and 3, and compares it with the failure flag F1 diagnosed by itself. Comparing F1 and F2, in this case F1 = (0,0,0) and F2 = (0,0,1), so the sub error flag Eα1 is set to 1. Next, when F1 and F3 are compared, in this case F3 = (0, 0, 0), so the sub error flag Eβ1 is set to 0. Based on the above result, the final error flag E1 is set to (1, 0).

  Next, the type of the error flag E1 is determined. Since E1 = (1, 0), this means that there is an ECU that makes the same determination as ECU1. In other words, the judgment of ECU1 may be regarded as correct by the majority decision of the failure flag between the ECUs. Next, the specific contents of the failure flag F1 in the ECU 1 are verified, and since the failure flag F1 is (0, 0, 0), no abnormality is detected, and the failure diagnosis process continues. Done.

[ECU2 relative diagnostic processing]
The ECU 2 receives the results of the failure flags F1 and F3 from the other ECUs 1 and 3 and compares them with the failure flag F2 diagnosed by itself. Comparing F2 and F1, in this case F2 = (0,0,1) and F1 = (0,0,0), so the sub error flag Eα2 is set to 1. Next, when F2 and F3 are compared, in this case F3 = (0, 0, 0), so the sub error flag Eβ2 is set to 1. Based on the above result, the final error flag E2 is set to (1, 1).

  Next, since the type of the error flag E2 is determined and E2 = (1, 1), this means that the determination of the other ECU2 is different from any of the ECU1 and ECU3. If one of the sensors is faulty, the same judgment can be made in the other ECUs 1 and 3, but it is physically impossible to make an abnormal judgment alone. A diagnosis has been made. At this time, since there is a high possibility that the average deviations α2 *, β2 *, and γ2 * in the initialization process are wrongly set, the process proceeds to step 101b and ECU2 is reinitialized. When appropriate average deviations α2 *, β2 *, and γ2 * are set by this reinitialization, the failure flag F2 is set to (0, 0, 0) at the next diagnosis, and diagnosis with other ECUs 1 and 3 is performed. The result is the same.

  That is, when the failure diagnosis is performed only with the ECU 2, there is a state (0, 0, 1), which is a physically impossible diagnosis result, and it is not known whether this state may be allowed. In addition, by allowing this state, there is a risk of erroneous diagnosis when the sensor actually fails. On the other hand, by comparing with the diagnosis results of other ECUs and executing the reinitialization process, the physically impossible diagnosis results are not left unattended. Further, since the above problem can be solved only by performing re-initialization processing, it is not necessary to shift the entire system to the fail mode, and the robustness of the system can be ensured.

[ECU3 relative diagnosis processing]
The ECU 3 receives the results of the failure flags F1 and F2 from the other ECUs 1 and 2 and compares them with the failure flag F3 diagnosed by itself. Comparing F3 and F1, in this case, F3 = (0,0,0) and F1 = (0,0,0), so the sub error flag Eα3 is set to 0. Next, when F3 and F2 are compared, in this case F2 = (0, 0, 1), so the sub error flag Eβ3 is set to 1. Based on the result, the final error flag E3 is set to (0, 1).

  Next, the type of the error flag E3 is determined. Since E3 = (0, 1), this means that there is an ECU that makes the same determination as ECU3. In other words, the judgment of the ECU 3 may be regarded as correct by the majority decision of the failure flag between the ECUs. Next, the contents of the specific failure flag F3 in the ECU 3 are verified, and since the failure flag F3 is (0, 0, 0), no abnormality is detected and normal, so the failure diagnosis process continues. Done.

  In this way, even when the initialization process is not performed properly, the failure diagnosis process is continued without falling into the fail mode by performing the re-initialization process by the ECU 2 that has not been properly performed. be able to.

  As described above, the redundant system according to the first embodiment has the following effects.

  (1). An initialization processing unit for obtaining an average deviation which is a relative relation value of each of the sensors A, B and C after starting each of the controllers ECU1 to ECU3, and a value of each of the sensors A, B and C based on the average deviation Internal diagnosis processing unit for diagnosing normality, relative diagnosis processing unit for diagnosing normality based on its own internal diagnosis result and the internal diagnosis result of another controller, and its internal diagnosis result based on the relative diagnosis result Is different from the internal diagnosis result of other controllers, a re-initialization instruction unit for performing re-initialization is provided. Therefore, a fail-safe operation is not caused in a physically impossible state and the robustness of failure determination can be ensured. In addition, a state that is physically impossible due to reinitialization is not left, and erroneous diagnosis can be avoided.

  (2) The internal diagnosis processing unit determines normality / abnormality related to the difference between sensor A and sensor B, normality / abnormality determination related to the difference between sensor B and sensor C, and normality related to the difference between sensor C and sensor A. A processing unit that executes an abnormality determination, a relative diagnosis processing unit is a processing unit that diagnoses by a majority decision of match / mismatch of the internal diagnosis results of each controller, and a reinitialization instruction unit is a relative diagnosis processing unit In the case where there is another internal diagnostic result that matches the internal diagnostic result of itself due to the majority vote, and there is only one abnormality determination result in the internal diagnostic result of itself, the initialization processing unit re-initializes It was decided to carry out. In other words, it is possible to confirm the match / mismatch with the judgment of other controllers in addition to its own judgment by majority decision, and even if it contains a physically impossible state etc., it is judged that it is normal You can avoid it. Further, after that, a physically impossible state can be resolved by reinitialization, and erroneous diagnosis can be avoided.

  (3). When there is another internal diagnosis result that coincides with the internal diagnosis result by the majority of the relative diagnosis processing unit, and there are two abnormality determination results in the internal diagnosis result, The sensor related to both of the two abnormality determination results is determined to be a failure, and a failure processing unit is provided to stop the controller connected to the sensor determined to be the failure. Therefore, in addition to the failure of the sensor itself, even if the controller connected to the sensor fails, erroneous control is not performed by shutdown, and malfunction can be reliably prevented.

(Other examples)
The redundant system of the present invention has been described based on the first embodiment applied to the steer-by-wire system. However, the specific configuration is not limited to the first embodiment, and each claim in the claims Design changes and additions are permitted without departing from the spirit of the invention according to the paragraph. For example, the present invention may be applied to a brake-by-wire system that requires a redundant system, such as a by-wire system, or may be applied to a shift-by-wire system that controls a gear position or the like by a driver's shift lever operation. Moreover, not only a vehicle-mounted system but all configurations can be applied as long as the system includes a redundant system.

1 is an overall system diagram illustrating a vehicle steering apparatus according to a first embodiment. It is the schematic showing the relationship between the 1st rotation angle sensor of Example 1, a 2nd rotation angle sensor, and a 3rd rotation angle sensor. It is the schematic showing the relationship of the 1st rotation angle sensor of another Example, the 2nd rotation angle sensor, and the 3rd rotation angle sensor. 3 is a flowchart illustrating a failure diagnosis process of the rotation angle sensor according to the first embodiment. 3 is a flowchart illustrating a failure diagnosis process of the rotation angle sensor according to the first embodiment. 6 is a time chart showing a case where ECU 2 diagnoses a physically impossible state even though each sensor is not malfunctioning in the first embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Steering wheel 2 Steering shaft 3 Reaction force motor 4 Steering rack 5 Steering motor 6 Electromagnetic clutch 7 Backup mechanism 8 Steering angle sensor 9 Steering torque sensor 12 Steering torque sensor 13 Rotary encoder 14 Control unit 15 Pinion shaft 16 Spiral cable 20 Head wheel

Claims (4)

In a redundant system in which the same measurement object is measured by a plurality of sensors and the value of each sensor is monitored by a plurality of controllers,
Each controller is
An initialization processing unit for obtaining a relative relation value of each sensor after activation of each controller;
An internal diagnostic processing unit for diagnosing whether each sensor value is normal based on the relative relationship value;
A relative diagnostic processing unit for diagnosing whether or not normality based on the internal diagnostic result of itself and the internal diagnostic result of another controller;
When the internal diagnosis result of the controller is different from the internal diagnosis result of another controller by the relative diagnosis result, a reinitialization instruction unit that performs reinitialization by the initialization processing unit,
A redundant system characterized by comprising: In the redundant system according to claim 1,
The plurality of sensors are a first sensor, a second sensor, and a third sensor,
The plurality of controllers are a first controller connected to the first sensor, a second controller connected to the second sensor, and a third controller connected to the third sensor. Is a configuration to share each sensor value by communication,
The internal diagnosis processing unit is configured to determine normality / abnormality related to a deviation between the first sensor and the second sensor, normality / abnormality determination related to a deviation between the second sensor and the third sensor, the third sensor and the first sensor. It is a processing unit that performs normality / abnormality judgment related to sensor deviation,
The relative diagnosis processing unit is a processing unit that diagnoses by majority decision of coincidence / mismatch of the internal diagnosis results of the controllers,
The re-initialization instruction unit has one abnormality determination result in its own internal diagnosis result when there is another internal diagnosis result that coincides with its own internal diagnosis result due to the majority of the relative diagnosis processing unit. When there is only a redundant system, the initialization system performs reinitialization. In the redundant system according to claim 2,
If there is another internal diagnosis result that matches the internal diagnosis result of the relative diagnosis processing majority, and there are two abnormality determination results in the internal diagnosis result, the two A redundant system comprising: a fail processing unit that determines that a sensor related to both abnormality determination results is faulty and stops a controller connected to the sensor judged to be faulty. In the fault diagnosis method for a redundant system in which the same measurement object is measured by a plurality of sensors and the values of the respective sensors are monitored by a plurality of controllers.
After starting each controller, the relative relation value of each sensor is acquired, whether each sensor value is normal based on the relative relation value, whether it is normal, and its own internal diagnosis result and the internal diagnosis result of another controller The redundant system is characterized in that a relative diagnosis is performed based on the relative diagnosis result, and when the internal diagnosis result of the controller is different from the internal diagnosis result of another controller, the relative relation value is reacquired. Fault diagnosis method.

Images