JP2009227276A - Vehicle controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a vehicle controller for securing high reliability, real time property and scalability at low cost, with a simple constitution of an ECU, by backing up an error in the whole system without unnecessarily increasing redundancy of each controller. <P>SOLUTION: In this vehicle controller, a sensor controller 2 capturing a sensor signal indicating a state quantity of a vehicle and a control variable of a driver, a command controller for generating a control target value based on the sensor signal, and an actuator controller 3 for operating an actuator 5 for receiving the control target value to control a vehicle are connected via a network. The actuator controller 3 has a control target value generating means for generating the control target value based on a sensor value on the network received by the actuator controller 3, when an error occurs in the control target value generated by the command controller, and controls the actuator 5 by the control target value. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a vehicle control device (vehicle control system) that controls the running state of a vehicle, and more particularly to a vehicle control device that performs driving, steering, and braking of a prime mover of a vehicle such as an automobile by electronic control.

  2. Description of the Related Art Conventionally, as a vehicle control device, there is an operation control device that centrally controls a control unit related to a braking force, a driving force, and a steering angle by an electronic control device that serves as one master (for example, Patent Document 1).

  In recent years, with the aim of improving driving comfort and safety of automobiles, the driver's accelerator, steering, and brake operations are generated by electronic control instead of mechanical coupling. Development of a vehicle control device to be reflected in the mechanism is active. Such a vehicle control device is required to have high reliability so that functions relating to driving, steering, and braking of the vehicle do not fail.

  Conventionally, the control realized by the mechanical mechanism has been replaced by the electric mechanism. A good example is Fly-by-Wire for aircraft control and X-by-Wire for vehicle control. Conventionally, in these applications, a mechanical backup mechanism has been prepared in preparation for a failure. However, as the mechanical mechanism disappears, it is necessary to increase the reliability of the electrical mechanism.

  Among the X-by-Wire (XBW system) that electrically controls the car, Steer-by-Wire that electrically controls the steering and Brake-by-Wire that electrically controls the brake cause malfunctions. Therefore, it is required to operate reliably, and high reliability is required. In particular, Steer-by-Wire is required to have particularly high reliability because there is no (fail-safe) steering position that ensures safety in the event of a failure.

  On the other hand, as a merit of X-by-Wire, the concept of active safety that enhances vehicle safety by so-called vehicle stability control, which improves vehicle stability by comprehensively controlling steering and brakes by electronic control, spreads. (For example, Patent Document 3).

  Moreover, as a conventional example of a highly reliable vehicle control device, reliability is improved by duplicating a master controller having a function such as ABS (Anti Lock Bracket System), TCS (Transmission Control System), etc. (for example, Non-Patent Document 1), the front wheel brake control module is configured to continue normal operation even if an error occurs (fail operative), and the rear wheel brake control module is There is a case where high reliability is achieved by configuring the function to stop (fail silent) (for example, Patent Document 2).

  For example, as a kind of vehicle control device, an operation amount of a driver with respect to a steering means such as a brake pedal is converted into an electric signal, which is transmitted to a control computer provided in the brake mechanism by a communication means such as CAN (Control Area Network). However, there is a vehicle control device that performs electronic control.

JP 2003-263235 A JP 2002-347602 A Japanese Patent Laid-Open No. 10-291489

3rd and 6th pages of the first "X-by-Wire" seminar material sponsored by D & M Nikkei Mechanical and others, lower left of slide 12.

  Such a vehicle control device is generally known as an X-by-Wire system. Compared with a conventional method of transmission by a mechanical mechanism or a hydraulic mechanism, the vehicle control device can realize advanced traveling integrated control using a computer, It is said that the weight can be reduced and the degree of design freedom can be improved.

  In the conventional vehicle control device, a sensor for monitoring the operation amount of the driver and the state of the vehicle is input to one master electronic control device (master ECU), and an internal combustion engine control device or brake that is an actuator for vehicle control. Since the control device and the steering control device are integratedly controlled, if the master ECU breaks down, no maneuvering can be performed. Therefore, to ensure safety, the reliability of the master ECU must be extremely high. There is a problem.

  Therefore, a technique for ensuring reliability by multiplexing master ECUs is known, but there is a problem that it is expensive to multiplex master ECUs that require advanced processing.

  In the conventional control architecture, the entire vehicle is composed of subsystems such as an internal combustion engine, steering, and brake. This is because the operation means and the actuator have a one-to-one correspondence such as the accelerator and the internal combustion engine, the steering wheel and the steering, the brake pedal and the brake.

  Many XBW systems in practical use are designed as an extension of the conventional control architecture as described above. That is, a subsystem is configured for each function such as Drive-by-Wire, Steer-by-Wire, and Break-by-Wire, and vehicle motion control is realized by cooperation between these subsystems.

  Examination of the problems of these conventional technologies (conventional control architectures) revealed that there is a problem that the cost is extremely high in order to ensure the reliability, real-time performance, and expandability required for the vehicle control device. It was. The problems of the prior art are shown below.

  The vehicle integrated vehicle control device requires high reliability. That is, even if a failure occurs in the controller, sensor, or actuator, it is necessary for the vehicle to ensure safe traveling.

  In the prior art, since function development is performed for each subsystem, fail operability (operability at the time of failure) is required for each subsystem. That is, in the prior art, there is an ECU that controls an actuator (steer, brake, etc.) based on a sensor (handle, pedal, etc.) for each subsystem.

  Since the ECU centrally controls the sensors and actuators, the ECU for each subsystem needs to have fail operability in order to have fail operability in the entire system. In order to give the ECU fail-operability, it is necessary to perform multiplexing or the like, which leads to an increase in product cost.

  In order to realize a highly reliable system at a low cost, it is difficult to realize with a conventional configuration in which each subsystem has an ECU and the ECU is made fail-operable.

  On the other hand, the present inventors separated the control function of the ECU into vehicle integrated control, actuator control, and sensor control, and provided the necessary and sufficient reliability for each function. In addition, if an autonomous backup function that can be controlled based on sensor information can be provided even when the vehicle integrated control function is abnormal, it is considered effective for realizing a highly reliable and low-cost system.

  The vehicle control apparatus is basically based on hard real-time processing that satisfies strict time constraints. In other words, it is necessary to reflect changes in crew maneuvering and road surface conditions within the time limit. In the prior art, since function development is performed for each subsystem, it is relatively easy to ensure real-time performance within the subsystem.

  However, for example, in the case of control in which a plurality of actuators are integrated, such as skidding posture control, it is difficult to ensure real-time performance. That is, since information obtained from one sensor propagates through vehicle control functions of a plurality of subsystems such as a brake, a steer, and an internal combustion engine, it is difficult to guarantee operation within a deadline necessary for control.

  Furthermore, due to the data propagation delay, it becomes difficult to ensure the simultaneity of the data referenced by each subsystem. Therefore, in order to realize a high degree of coordination of vehicle motion control with the prior art, the man-hours for adapting and adjusting the system and subsystems increase, leading to an increase in development cost.

  In order to realize the real-time integrated control at a low cost, it is difficult to realize the conventional configuration in which the vehicle control logic and the device driver are distributed to each ECU and the ECUs cooperate with each other.

  On the other hand, the present inventors will separate the control function into a vehicle integrated ECU and a device (actuator, sensor) controller, and if each can operate autonomously and share data, real-time integration is possible. It is considered effective for realizing control.

  In the development of new models, a common method is to develop multiple models using a common platform in order to reduce development costs. Therefore, it is necessary to make it easy to add functions and change parts for each vehicle type. However, in the prior art, the function is realized by the ECU at the subsystem level, so standardization at the sensor / actuator level is difficult.

  That is, as the control logic of the ECU, there are both logical and abstract control applications and device driver portions that actually control the sensors and actuators.

  Although there is a trend toward standardization of device drivers, it is just standardization of the interface, and is closely related to control applications in terms of real-time performance and ECU resource resources.

  For this reason, if a sensor / actuator is added or changed, a design review of a control task or the like at the subsystem level occurs, leading to an increase in development cost.

  In order to realize a highly expandable system, it is necessary to provide a virtual shared memory in the distributed vehicle control device after providing a controller so that the sensors and actuators can operate autonomously. In contrast, in the present invention, each sensor / actuator broadcasts to a shared memory using a high-dimensional interface such as state information and control target value, and autonomously transmits data necessary for each sensor / actuator. It is considered effective to acquire and control.

  The challenge for the practical application of a highly reliable vehicle control device is to achieve high reliability without significantly increasing the cost. However, in the prior art, a part of the master controller or the control module is used. However, it is made fail-operable by a complicated hardware configuration such as redundancy, and is not yet an optimal system configuration in terms of cost.

  In addition, even in the above prior art, even when the driver operates beyond the limit of the vehicle, the brake operation etc. can be corrected electronically to avoid accidents by preventing the vehicle from slipping or spinning. it can.

  However, since the electronic control unit (ECU) centrally controls the brakes on each wheel based on information from the brake pedal and various sensors, if the electronic control unit (ECU) breaks down, the brakes will not operate. The control unit (ECU) is required to have high reliability, and further consideration must be given to the reliability of the control device.

  The present invention has been made in view of the above-described problems, and its object is to provide a simple ECU by backing up errors in the entire system without increasing the redundancy of individual controllers more than necessary. It is an object of the present invention to provide a vehicle control device that secures high reliability, real-time performance, and expandability at low cost.

  In the vehicle control apparatus according to the present invention, a sensor slave computer (sensor controller) outputs a sensor value on the same network, a master computer (command controller) receives the sensor value, and sets a control target value based on the sensor value. A vehicle control device that controls the actuator by receiving the control target value while the actuator slave computer (actuator controller) receives the control target value while calculating and outputting it on the network, wherein the actuator slave computer correctly sets the control target value. When reception is not possible, the actuator slave computer receives the sensor value output from the sensor slave computer on the same network, calculates a control target value based on the sensor value, and controls the actuator. To.

  A vehicle control device according to the present invention includes an operation amount generation node that calculates an operation amount command value based on a driver request signal and a vehicle state signal, and an actuator based on an operation amount command value from the operation amount generation node. A vehicle control device configured to control, drive, steer and brake a vehicle, wherein each node has a failure detection function, and the failure detection function detects a failure in the node. Is configured so as not to have any effect other than notifying that the node is in a failure state outside the node, and when a failure occurs in any of the nodes, the node from the node in the failure state Based on the failure detection notification, the normal operation of the entire system is continued by switching control in a normal node other than the relevant node. .

  The sensor that detects the driver's request is connected to a communication network, and when detecting a failure in the sensor, the sensor has an action other than notifying that the sensor is in a failure state. It is configured not to reach.

  Specifically, the sensor includes a plurality of sensor elements, an A / D converter that converts the outputs of the plurality of sensor elements into digital values, a matching check function of a plurality of A / D conversion values, a filter function, and a communication interface. Consists of

  When the operation amount generation node receives a failure detection notification from a node in a failure state, the operation amount generation node stably maintains the traveling state of the vehicle by switching control according to the failure location.

  The actuator drive node has a function of generating an operation amount command value based on a signal of a sensor that detects the driver's request when the operation amount command value from the operation amount generation node cannot be received. When the operation amount command value from the operation amount generation node cannot be received, the driving state of the vehicle is stably maintained by switching from the normal control to the control realizing the function.

  The sensor that detects the driver's request, the operation amount generation node, and the actuator drive node are connected to the same communication network. The communication network is composed of a main bus and a backup bus. The main bus is connected with all sensors for detecting a driver's request, an operation amount generation node and an actuator drive node, and the backup bus has A part of the sensor for detecting the driver's request and a part of the actuator driving node are connected, and the actuator driving node stably keeps the traveling state of the vehicle when the main bus fails.

  More specifically, in the vehicle control device according to the present invention, the sensor that detects the driver's request includes a steering angle sensor that measures a rotation angle of a steering wheel, and a brake pedal position sensor that measures a depression amount of a brake pedal. , And an accelerator pedal position sensor that measures the amount of depression of the accelerator pedal, and the operation amount generation node interprets the driver's intention from the signal of the sensor that detects the driver's request, and detects the vehicle state. In addition, a vehicle motion integrated control controller that comprehensively controls the vehicle motion and a drive system integrated control controller that comprehensively controls the drive system of the vehicle. The actuator drive node is a steering actuator that generates a steering force. Steering actuator drive controller to control, block to generate brake force A suspension actuator drive controller for controlling the suspension actuator for adjusting the brake actuator drive controller for controlling a rk actuator, and the damping force, these nodes are connected to the same communications network. Further, a radar or a camera that detects the state of the outside world of the vehicle may be configured to be connected to the communication network.

  Further, the accelerator pedal position sensor is connected to the communication network, and also directly connected to an engine control controller that receives a torque command value from the drive system integrated control controller and controls the internal combustion engine based on the torque command value. .

  In such a vehicle control device, when the brake pedal and the brake force generation mechanism are not mechanically coupled, at least the brake pedal position sensor is configured to continue normal operation even in the event of a single failure.

  When the steering and the steering force generation mechanism are not mechanically coupled, at least the steering angle sensor and the steering actuator drive controller are configured to continue normal operation even in the event of a single failure, and the steering actuator Make it redundant.

  The force generated by each steering actuator is smaller than that of a steering actuator used in a system in which the steering and the steering force generation mechanism are mechanically coupled.

  Further, when the steering actuator drive controller detects a failure in the node, the drive node is configured to have no effect other than notifying that the node is in a failure state outside the node. And the drive nodes are independently driven by the redundant steering actuators.

  In a vehicle control device that does not have a brake and steering backup mechanism, the brake pedal position sensor and the steering angle sensor include a plurality of sensor elements, an A / D converter that converts the outputs of the plurality of sensor elements into digital values, and a plurality of sensors. Fail-silent sensor composed of A / D conversion value match check function, filter function, and communication interface is made redundant, or at least three sensor elements and the output of the plurality of sensor elements are digital values A fail-operating sensor comprising an A / D converter for converting to A, a majority function of a plurality of A / D conversion values, a filter function, and a communication interface.

  The vehicle control apparatus according to the present invention includes an operation amount generation node, a correction amount generation node, and an actuator drive node. In the actuator drive node, when the correction amount generation node is normal, the operation amount from the operation amount generation node is The actuator is controlled as a control target value by adding a correction amount from the correction amount generation node. When the correction amount generation node is abnormal, the actuator is controlled using the operation amount from the operation amount generation node as a control target value.

  As a result, even if the correction amount generation node fails, the actuator can be controlled based on the operation amount although correction is not performed.

  The vehicle control apparatus according to the present invention includes a plurality of actuator driving means for controlling the actuator based on a driver's request or a vehicle state, and a communication means for connecting the plurality of actuator driving means. , A vehicle control device that controls at least one of steering and braking, and the actuator drive means includes a control method selection means for selecting an actuator control method based on its own operation state and operation states of other actuator drive means. I have.

  The vehicle control apparatus according to the present invention includes a plurality of actuator driving means for controlling the actuator based on a driver's request or a vehicle state, and a communication means for connecting the plurality of actuator driving means. A vehicle control device that controls at least one of steering and braking, and the actuator driving means detects a failure of itself and notifies other actuator driving means of the occurrence of the failure via the communication means; Control method selection means for selecting a control method of the actuator based on its own failure state and failure state of other actuator driving means is provided.

  The vehicle control apparatus according to the present invention includes a plurality of actuator driving means for controlling the actuator based on a driver's request or a vehicle state, and a communication means for connecting the plurality of actuator driving means. , A vehicle control apparatus that controls at least one of steering and braking, and the actuator driving means selects a control method of the actuator based on a reception state of a message from another actuator driving means via the communication means Means.

  The vehicle control apparatus according to the present invention includes a plurality of actuator driving means for controlling the actuator based on a driver's request or a vehicle state, and a communication means for connecting the plurality of actuator driving means. , A vehicle control device that controls at least one of steering and braking, and the actuator driving means transmits a message for notifying the operation state to the other actuator driving means via the communication means, and the other actuator driving means Control method selection means for selecting an actuator control method based on whether the message is received from the means.

  Further, the vehicle control device according to the present invention is based on at least one operation amount generation means for calculating an operation amount command value based on a driver's request or a vehicle state, and on an operation amount command value from the operation amount generation means. A vehicle control device having a plurality of actuator driving means for controlling an actuator, a communication means for connecting the operation amount generating means and the actuator driving means, and controlling at least one of driving, steering, and braking of the vehicle. The drive means includes control method selection means for selecting an actuator control method based on its own operation state, operation state of other actuator drive means, and operation state of the operation amount generation means.

  Further, the vehicle control device according to the present invention is based on at least one operation amount generation means for calculating an operation amount command value based on a driver's request or a vehicle state, and on an operation amount command value from the operation amount generation means. A vehicle control device having a plurality of actuator driving means for controlling an actuator, an operation amount generating means and a communication means for connecting the actuator driving means, and controlling at least one of driving, steering and braking of the vehicle; The operation amount generation means includes a failure detection means that detects a failure of itself and notifies the occurrence of the failure to the actuator drive means or the operation amount generation means via the communication means. The actuator drive means detects the failure of itself. Failure detection means for notifying the occurrence of failure to other actuator drive means or operation amount generation means via communication means, and the own failure state, Comprises of a fault condition of the actuator driving means, a control method selection means for selecting a method of controlling the actuator based on the state of occurrence of a failure of the operation amount generating means.

  Further, the vehicle control device according to the present invention is based on at least one operation amount generation means for calculating an operation amount command value based on a driver's request or a vehicle state, and on an operation amount command value from the operation amount generation means. A vehicle control device having a plurality of actuator driving means for controlling an actuator, an operation amount generating means and a communication means for connecting the actuator driving means, and controlling at least one of driving, steering and braking of the vehicle; The actuator driving unit includes a control method selecting unit that selects an actuator control method based on a state of reception of a message from another actuator driving unit or an operation amount generating unit.

  Further, the vehicle control device according to the present invention is based on at least one operation amount generation means for calculating an operation amount command value based on a driver's request or a vehicle state, and on an operation amount command value from the operation amount generation means. A vehicle control device having a plurality of actuator driving means for controlling an actuator, an operation amount generating means and a communication means for connecting the actuator driving means, and controlling at least one of driving, steering and braking of the vehicle; The manipulated variable generation means transmits the manipulated variable command value to each of the actuator drive means via the communication means. When the actuator drive means receives the manipulated variable command value, a response message is sent to the manipulated variable generation means or another actuator drive. The actuator driving means transmits an operation amount command value from the operation amount generating means or another actuating means. And a control method selection means for selecting a method of controlling the actuator based response messages from Yueta driving means whether it has received.

  The vehicle control device according to the present invention includes a sensor unit that detects a driver's request or a vehicle state, at least one operation amount generation unit that calculates an operation amount command value based on information from the sensor unit, A plurality of actuator driving means for controlling the actuator based on an operation amount command value from the amount generating means or information from the sensor, and a communication means for connecting the sensor means, the operation amount generating means, and the actuator driving means, A vehicle control device that controls at least one of driving, steering, and braking of a vehicle. The actuator driving means includes its own operating state, operating states of other actuator driving means, and operating state of failure of the operation amount generating means. , Control method using operation amount command value from operation amount generation means, control method using information from sensor, actuator And a control method selection means for selecting one control method to a predetermined state.

  The vehicle control device according to the present invention includes a sensor unit that detects a driver's request or a vehicle state, at least one operation amount generation unit that calculates an operation amount command value based on information from the sensor unit, A plurality of actuator driving means for controlling the actuator based on an operation amount command value from the amount generating means or information from the sensor, and a communication means for connecting the sensor means, the operation amount generating means, and the actuator driving means, A vehicle control device that controls at least one of driving, steering, and braking of a vehicle, and an operation amount generation unit detects a failure of itself and generates a failure in the actuator drive unit or the operation amount generation unit via a communication unit. A failure detecting means for notifying, the actuator driving means detects its own fault, and the other actuator driving means via the communication means Or a failure detection means for notifying the operation amount generation means of the occurrence of a failure, an operation amount generation means based on the own failure state, a failure state of another actuator driving means, and a failure occurrence state of the operation amount generation means. Control method selection means for selecting one of a control method using the operation amount command value from the control method, a control method using information from the sensor, and a control method for bringing the actuator into a predetermined state.

  The vehicle control device according to the present invention includes a sensor unit that detects a driver's request or a vehicle state, at least one operation amount generation unit that calculates an operation amount command value based on information from the sensor unit, A plurality of actuator drive means for controlling the actuator based on an operation amount command value from the amount generation means or information from the sensor, and a communication means for connecting the sensor means, the operation amount generation means and the actuator drive means, A vehicle control device that controls at least one of driving, steering, and braking of a vehicle, and the actuator driving means is based on a reception state of a message from another actuator driving means or an operation amount generating means, from the operation amount generating means. The control method using the operation amount command value, the control method using information from the sensor, and the actuator to a predetermined state And a control method selection means for selecting one of the control methods.

  The vehicle control device according to the present invention includes a sensor unit that detects a driver's request or a vehicle state, at least one operation amount generation unit that calculates an operation amount command value based on information from the sensor unit, A plurality of actuator drive means for controlling the actuator based on an operation amount command value from the amount generation means or information from the sensor, and a communication means for connecting the sensor means, the operation amount generation means and the actuator drive means, A vehicle control device that controls at least one of driving, steering, and braking of a vehicle, wherein an operation amount generation unit transmits an operation amount command value to each of the actuator driving units via a communication unit, and the actuator driving unit When the operation amount command value is received, a response message is transmitted to the operation amount generation means or the other actuator driving means via the communication means. The actuator drive means uses the operation amount command value from the operation amount generation means based on whether the operation amount command value from the operation amount generation means or a response message from another actuator drive means has been received. Control method selection means for selecting one of a control method, a control method using information from the sensor, and a control method for bringing the actuator into a predetermined state is provided.

  The vehicle control device according to the present invention is a vehicle control device that drives, steers, and brakes a vehicle, detects a driver's request and outputs a signal, and calculates an operation amount command value based on the request signal. The operation amount generation node that outputs a signal and the actuator drive node that controls the actuator based on the operation amount command value from the operation amount generation node are distributed, and each node stores each signal output. It has a data reception table for determining the contents of the data reception table, and has a failure detection function for other nodes.

  In the vehicle control device according to the present invention, the data reception table includes information indicating the time of the message, and when the time delay is larger than a predetermined value, the transmission source or the communication path is normal. Judge that it is not working or has returned to normal.

  The vehicle control apparatus according to the present invention includes a failure voting unit in the data reception table, and has a function of specifying a failed node or a node that has returned to a normal state according to a predetermined algorithm. As a result, it is possible to determine the occurrence and return of a node failure, and it is possible to continue vehicle control safely.

  Moreover, the vehicle control apparatus according to the present invention outputs the failure diagnosis information of other nodes as a failure vote, thereby sharing the failure determination status of each node. Thereby, since the failure determination of each node corresponds, vehicle control can be continued safely.

  The vehicle control device according to the present invention can safely continue vehicle control by another actuator driving means even if the operation amount generating means or any actuator driving means cannot be controlled. As a result, high reliability, real-time performance, and expandability can be ensured at a low cost with a simple ECU configuration without increasing the redundancy of individual controllers more than necessary.

The block diagram which shows the basic composition of 1st Embodiment of the vehicle control apparatus by this invention. (A), (b) is a data flow figure which shows the specific example of the communication data flow in the vehicle control apparatus by 1st Embodiment, respectively. 1 is a schematic diagram of a vehicle to which a vehicle control device according to a first embodiment is applied. The control block diagram of vehicle motion integrated control ECU of the vehicle control apparatus by 1st Embodiment. Explanatory drawing which shows a vehicle movement state amount. The flowchart which shows the vehicle state estimation process flow by the vehicle state estimation part of vehicle motion integrated control ECU. The flowchart which shows the target state calculation process flow by the target state calculating part of vehicle motion integrated control ECU. Explanatory drawing which shows a vehicle body operation vector and an operation moment. The flowchart which shows the operation amount calculation process flow by the operation amount calculation part of vehicle motion integrated control ECU. Explanatory drawing which shows the tire vector of vehicle body operation. (A), (b) is a schematic diagram which shows an operation amount distribution process. The control block diagram of DBW type | system | group integrated control ECU of the vehicle control apparatus by 1st Embodiment. The block diagram which shows the autonomous distributed control platform (2nd Embodiment) for the next generation vehicle integrated vehicle control apparatus to which the vehicle control apparatus by this invention is applied. (A), (b) is a block diagram which shows the outline | summary of the data field of an autonomous distributed control platform. It is a block diagram which shows the outline | summary of the autonomous operation | movement of a distributed control platform. The schematic diagram of a vehicle movement state amount. The block diagram which shows the outline | summary of autonomous monitoring. The figure which shows the operation | movement flow of an actuator node. (A), (b) is a block diagram which shows the structural example of a XBW vehicle control apparatus. The block diagram which shows the basic composition of 2nd Embodiment of the vehicle control apparatus by this invention. The block diagram which shows the function of the operation amount production | generation node. The block diagram which shows the function of an actuator drive node. The schematic diagram of the vehicle to which the third embodiment of the vehicle control device according to the present invention is applied. Explanatory drawing which shows the failure detection method of the node in TDMA communication. The functional block diagram of a fail silent sensor node. The hardware block diagram of a fail silent sensor node. The schematic diagram of the vehicle to which the 4th embodiment of the vehicle control device by the present invention was applied. The schematic diagram of the vehicle to which the fifth embodiment of the vehicle control device according to the present invention is applied. The schematic diagram of the vehicle to which the sixth embodiment of the vehicle control device according to the present invention is applied. The schematic diagram of the vehicle to which the seventh embodiment of the vehicle control device according to the present invention is applied. The block diagram which shows the structure of an actuator drive node. The block diagram which shows embodiment which made the operation amount generation node and the correction amount generation node redundant. The block diagram which shows embodiment of the actuator drive node which has a majority decision function and a comparison function. The block diagram which shows embodiment of the actuator drive node which carries out a change operation at the time of a failure. The time chart which shows the change-over operation at the time of failure. The block diagram which shows embodiment which each node connected to the same communication path. The figure which shows the flow of the information transmitted through the same communication channel. The block diagram which shows the specific example which applied this embodiment to the Steer-by-Wire system. The block diagram which shows the specific example which applied this embodiment to Break-by-Wire. The block diagram which shows the specific example which applied this embodiment to the system which integrated Steer-by-Wire and Brake-by-Wire. The block diagram which shows the basic composition of 8th Embodiment of the vehicle control apparatus by this invention. The block diagram which shows the modification of 8th Embodiment of the vehicle control apparatus by this invention. The block diagram which shows another modification of 8th Embodiment of the vehicle control apparatus by this invention. The block diagram which shows the function of the operation amount production | generation node. The block diagram which shows the function of an actuator drive node. The time chart which shows operation | movement of an actuator drive node. The flowchart which shows a control program selection process. (A), (b) is explanatory drawing which shows the example of a control program selection table, respectively. The time chart which shows operation | movement of the operation amount production | generation node and actuator drive node in the start time of brake control. The time chart which shows operation | movement of the operation amount production | generation node and actuator drive node during brake control. The flowchart which shows the process which selects the wheel which performs braking control. (A), (b) is explanatory drawing which shows the example of a braking wheel selection table, respectively. The time chart which shows the operation | movement amount production | generation node and operation | movement of an actuator drive node when the actuator drive node or actuator of a left rear wheel fails at the start time of brake control. The time chart which shows operation | movement of the operation amount production | generation node and actuator drive node when the actuator drive node or actuator of a left rear wheel fails during brake control. The time chart which shows operation | movement of the operation amount production | generation node and actuator drive node when the actuator drive node or actuator of the left rear wheel which failed temporarily during brake control recovers. The time chart which shows operation | movement of an actuator drive node when the operation amount generation node fails during brake control. The time chart which shows operation | movement of the operation amount production | generation node and an actuator drive node when the operation amount production | generation node which failed temporarily during brake control recovers. The time chart which shows operation | movement of the actuator drive node when the operation amount generation node and the actuator drive node of the left rear wheel or the actuator fail during the brake control. The block diagram which shows the other modification of 8th Embodiment of the vehicle control apparatus by this invention. The block diagram which shows 9th Embodiment of the vehicle control apparatus by this invention. Head showing a specific example of the data reception table. The flowchart which shows the failure diagnosis process of another node. The block diagram which shows other embodiment of the vehicle control apparatus by this invention.

(First embodiment)
First, a basic configuration of a vehicle control device according to the present invention will be described with reference to FIG.
The vehicle control device has a master computer (command controller) 1, a sensor slave computer (sensor controller) 2, and an actuator slave computer (actuator controller) 3, which are wired, wireless, bus type, mesh A network N1 of a type, star type, ring type or the like is connected so as to be able to communicate data in both directions.

  The master computer 1 is a command controller that calculates a control target value, and has a master control function (master control means) 1A.

  A sensor 4 for observing (measuring) the state of the controlled object is connected to the sensor slave computer 2. The sensor slave computer 2 has a sensor processing function (sensor processing means) 2 </ b> A that processes a sensor signal from the sensor 4.

  The actuator slave computer 3 is connected with an actuator 5 for acting on a controlled object. The actuator slave computer 3 is a slave computer for controlling the actuator 5 and calculates an actuator control function (actuator control means) 3A for controlling the actuator 5 based on a control target value from the master computer 1 and a control target value. And a simple master function (control target value generating means) 3B.

  In the network N1, there is a data flow D1 for the control target value and a data flow D2 for the sensor measurement value.

  The sensor measurement value data flow D2 is a sensor value data flow output by the sensor slave computer 2, and the sensor value output by the sensor slave computer 2 is used as the master function 1A of the master computer 1 and the simple master function of the actuator slave computer 3. Both 3Bs are receiving.

  The control target value data flow D1 is a control target value data flow output from the master computer 1, and the actuator control function 3A of the actuator slave computer 3 receives the control target value output from the master computer 1.

  During normal operation, the actuator slave computer 3 controls the actuator 5 based on the control target value from the master computer 1 received by the actuator control function 3A through the data flow D1.

  However, when an abnormality occurs in the data flow D1, the actuator slave computer 3 controls the actuator 5 based on the control target value calculated by the simple master function 3B. That is, the simple master function 3B calculates the control target value based on the sensor measurement value obtained by the data flow D2, and the actuator control function 3A is the simple master function obtained by the data flow D3B in the actuator slave computer 3. The actuator 5 is controlled based on the control target value based on the calculation result of 3B.

  By adopting the above configuration, even if the master function 1A of the master computer 1 falls into a state where it cannot be used, the actuator control is performed based on the calculation result of the simple master function 3B. It becomes possible to reflect a change in the state of the vehicle, and a highly reliable vehicle control device can be realized.

  In FIG. 1, the master computer 1 is shown as a single computer, but the master control function may be divided and implemented in a plurality of computers.

  A specific example of the communication data flow in the vehicle control apparatus shown in FIG. 1 will be described with reference to FIGS.

  As a master computer, there is a vehicle motion integrated control means 10 that integrally controls the motion of the entire vehicle.

  As a sensor slave computer, a steering angle instruction means (steering angle sensor system) 31 operated by a driver, a deceleration instruction means (brake pedal depression amount sensor system) 32, and an acceleration instruction means (accelerator pedal depression amount sensor system) 33.

  The actuator slave computer includes a steering amount control unit 11 that controls the steering angle of the vehicle, a braking force control unit 12 that controls the braking force of the vehicle, and a driving force control unit 13 that controls the driving force of the vehicle.

  The steering angle instruction means 31, the deceleration instruction means 32, the acceleration instruction means 33, the steering amount control means 11, the braking force control means 12, the driving force control means 13, and the vehicle motion integrated control means 10 are: They are connected to each other by a communication bus N11.

FIG. 2A shows a data flow when the vehicle motion integrated control means 10 is operating normally.
In this data flow, symbol D31 is an operation amount of the steering angle instruction means 31 by the driver, and is converted into an electric signal by the steering angle instruction means 31 and output to the communication bus N11.

  Reference sign D32 is an operation amount of the deceleration instruction means 32 by the driver, which is converted into an electric signal by the deceleration instruction means 32 and output to the communication bus N11.

  Reference numeral D33 is an operation amount of the acceleration instruction means 33 by the driver, which is converted into an electric signal by the acceleration instruction means 33 and output to the communication bus N11.

  The vehicle motion integrated control means 10 receives the steering angle instruction means operation amount D31, the deceleration instruction means operation amount D32, and the acceleration instruction means operation amount D33 from the communication bus N11, and controls the vehicle motion in an integrated manner. Perform the operation.

  Thereafter, the vehicle motion integrated control means 10 outputs the steering amount target value D11, the braking force target value D12, and the driving force target value D13 to the communication bus N11 as target values given to the control means for controlling the vehicle. To do.

  The steering force control means 11 receives the steering amount target value D11 from the communication bus N11, and controls a steering device such as a steering so as to realize the steering amount target value.

  The braking force control means 12 receives the braking force target value D12 from the communication bus N11, and controls a braking device such as an electric brake so as to realize the braking force target value.

  The driving force control means 13 receives the driving force target value D13 from the communication bus N11, and controls a driving force source such as an internal combustion engine, a transmission, and an electric motor, and a power transmission system so as to realize the driving force target value.

FIG. 2B shows a data flow when an error occurs in the vehicle motion integrated control means 10.
When the vehicle motion integrated control means 10 fails, the steering amount target value D11, the braking force target value D12, and the driving force target value D13 are not output to the communication bus N11. However, it is necessary to control the vehicle as intended by the driver.

  Therefore, when the steering force control means 11 determines that an error has occurred in the vehicle motion integrated control means 10, the steering force instruction means operation amount D31 is received from the communication bus N11, and based on the steering angle instruction means operation amount D31. Control a steering device such as a steering.

  When the braking force control means 12 determines that an error has occurred in the vehicle motion integrated control means 10, the braking force control means 12 receives the deceleration instruction means operation amount D32 from the communication bus N11, and the electric brake based on the deceleration instruction means operation amount D32 Control the braking device.

  When the driving force control means 13 determines that an error has occurred in the vehicle motion integrated control means 10, the driving force control means 13 receives the acceleration instruction means operation amount D33 from the communication bus N11, and based on the acceleration instruction means operation amount D33, the internal combustion engine / shift Controls driving force sources such as motors and electric motors.

  The occurrence of an error in the vehicle motion integrated control means 10 is determined on the data receiving side using an event such as the data output to the communication bus N11 not being performed for a certain period of time. The vehicle motion integrated control means 10 itself may output a message to that effect when an error occurs.

  Next, one embodiment of a vehicle (automobile) to which the vehicle control device according to the present invention is applied will be described with reference to FIG.

  The control system network N1A corresponds to a communication line in the present invention, and is used for communication of data related to vehicle motion control. The control system backup network N1B also corresponds to the communication line in the present invention, and is used as a backup means when a failure occurs in the control system network N1A due to force majeure such as disconnection due to a collision accident.

  The steering sensor 41 corresponds to the steering angle instruction means 31. The steering sensor 41 measures the operation amount (steering angle) of the steering wheel 51 operated by the driver, performs signal processing such as a filter, and outputs the steering wheel operation amount as an electrical signal to the control system network N1A and the control system backup network N1B. Output.

  The steering wheel 51 is connected to the front wheel steering mechanism 71 by a mechanical mechanism, and even when a fault occurs in the control system network N1A, the steering sensor 41, and the SBW / VGR driver ECU (Electronic Control Unit) 81 due to force majeure. The steering angle of the front wheels 72R and 72L of the vehicle 50 can be controlled.

  The brake pedal position sensor 42 corresponds to the deceleration instruction means 22. The brake pedal position sensor 42 measures the operation amount of the brake pedal 52 operated by the driver, performs signal processing such as a filter, and outputs the brake pedal operation amount as an electric signal to the control system network N1A and the control system backup network N1B. .

  The brake pedal 52 is also connected to the front wheel brake 73 in the hydraulic system, and the braking force of the vehicle 50 can be increased even when a fault occurs in the control system network N1A, the brake pedal position sensor 52, the BBW driver ECU 83A, 83B, etc. due to force majeure. Can be controlled.

  The accelerator pedal position sensor 43 corresponds to the acceleration instruction means 33. The accelerator pedal position sensor 43 measures the amount of operation of the accelerator pedal 53 operated by the driver, performs signal processing such as a filter, and outputs the amount of operation of the accelerator pedal as an electrical signal to the control system network N1A.

  The accelerator pedal position sensor 43 is also connected to the internal combustion engine control ECU 21 via another communication line, and controls the internal combustion engine of the vehicle 50 even when a fault occurs in the control system network N1A or the DBW system integrated control ECU 20 due to force majeure. be able to.

The millimeter wave radar / camera 44 is used to recognize the external state of the vehicle 50, such as detecting the traveling state of other vehicles ahead and behind, or recognizing the white line of the traveling lane. The millimeter wave radar / camera 44 recognizes an external state, calculates, for example, a relative angle, a relative distance, a relative speed, and the like with a vehicle traveling ahead by signal processing, and outputs it as an electrical signal to the control system network N1A. .

  The steering sensor 41, the brake pedal position sensor 42, the accelerator pedal position sensor 43, and the millimeter wave radar / camera 44 correspond to a sensor slave computer.

  The vehicle motion integrated control ECU 30 is a master computer and corresponds to the vehicle motion integrated control means 10 described above. The vehicle motion integrated control ECU 30 inputs the operation amount by the driver, the running state of the vehicle, and the sensor measurement value provided in the vehicle integrated control ECU 30 that are output on the control system network N1A, and comprehensively manages the motion of the vehicle 50. Then, control target values such as driving force control means, braking force control means, steering amount control means, suspension control means, and safety device control means are output to the control system network N1A.

  The vehicle motion integrated control ECU 30 also has a gateway function between the overall network N3 and the control network N1A.

  There are SBW / VGR driver ECU 81, BBW driver ECUs 83A to 83D, EAS driver ECUs 84A to 84D, and airbag ECU 85 as actuator slave computers.

  The SBW / VGR (Steer-By-Wire / Variable Gear Ratio) driver ECU 81 corresponds to a steering angle control means, and controls the steering angle of the front wheels 72R and 72L by the front wheel steering mechanism 71 by controlling the electric motor M1. The known steering device variable gear ratio (VGR) mechanism 54 is controlled by controlling the electric motor M5.

  The SBW driver ECU 82 also corresponds to the steering angle control means, and controls the steering angles of the rear wheels 75R and 75L by the rear wheel steering mechanism 74 by controlling the electric motor M2.

  BBW (Brake-By-Wire) driver ECUs 83A, 83B, 83C, 83D each correspond to a braking force control means.

  The BBW driver ECU 83A controls the hydraulic pressure of the pump P by controlling the electric motor M3A, and controls the braking force generated on the right front wheel 72R by the front wheel brake mechanism 73.

  The BBW driver ECU 83B controls the hydraulic pressure of the pump P by controlling the electric motor M3B, and controls the braking force generated on the left front wheel.

  The BBW driver ECU 83C controls the hydraulic pressure of the pump P by controlling the electric motor M3C, and controls the braking force generated on the right rear wheel 75R by the rear wheel brake mechanism 76 by the front wheel brake mechanism 73.

  The BBW driver ECU 13D controls the hydraulic pressure of the pump P by controlling the electric motor M3D, and controls the braking force generated on the left rear wheel 75L by the rear wheel brake mechanism 76.

  EAS (Electric Active Suspension) driver ECUs 84A, 84B, 84C, and 84D correspond to suspension control means, respectively, and control suspension mechanisms 77 and 78 provided in the vehicle 50.

  The EAS driver ECU 84A controls the suspension length, the spring constant, the damping constant, and the like of the front wheel suspension mechanism 77 provided in the right front wheel 72R by controlling the electric motor M4A.

  The EAS driver ECU 84B controls the suspension length, the spring constant, the damping constant, and the like of the front wheel suspension mechanism 77 provided in the left front wheel 72L by controlling the electric motor M4B.

  The EAS driver ECU 84C controls the suspension length, the spring constant, the damping constant, and the like of the rear wheel suspension mechanism 78 provided in the right rear wheel 75R by controlling the electric motor M4C.

  The EAS driver ECU 84D controls the suspension length, the spring constant, the damping constant, and the like of the rear wheel suspension mechanism 78 provided in the left rear wheel 75L by controlling the electric motor M4D.

  In this way, the vehicle motion integrated control ECU 30 controls the EAS driver ECUs 84A to 84D to increase the spring constant of the front wheel suspension 77 at the time of deceleration to prevent the vehicle 50 from tilting forward, It is possible to prevent the rollover by increasing the spring constant of the suspension, or to shorten the front wheel suspension length and increase the rear wheel suspension length when climbing the slope, thereby reducing the inclination of the vehicle body.

  The airbag ECU 85 corresponds to safety device control means and controls an occupant protection device such as an airbag.

  The DBW (Drive-By-Wire) system integrated control ECU 20 corresponds to driving force control means. The DBW system integrated control ECU 20 controls devices related to drive control of the vehicle 50 such as the internal combustion engine control ECU 21, the transmission control ECU 22, the electric motor control ECU 23, and the battery control ECU 24 connected by the DBW system subnetwork N2. .

  By adopting such a configuration, it is only necessary to instruct the final driving force from the vehicle motion integrated control ECU 30 to the DBW system integrated control ECU 20, and the target value is instructed regardless of the configuration of the device related to the actual drive control. This makes it possible to simply configure the control device.

  The internal combustion engine control ECU 21 is an ECU for controlling an internal combustion engine (not shown). The internal combustion engine control ECU 21 receives target values such as the internal combustion engine shaft torque and the internal combustion engine speed from the DBW system integrated ECU 20 and realizes the target values. Control the engine.

  The transmission control ECU 22 is an ECU for controlling a transmission (not shown), receives a target value such as a gear position from the DBW system integrated ECU 20, and controls the transmission so as to realize the target value.

  The electric motor control ECU 23 is an ECU for controlling an electric motor for generating a driving force (not shown). The electric motor control ECU 23 receives a target value such as an output torque or a rotational speed from the DBW system integrated ECU 20 and realizes the target value. Control the engine. It also operates as a negative driving force generation source by electric motor regeneration.

  The battery control ECU 24 is an ECU for controlling a battery (not shown), and controls the state of charge of the battery.

  The information system gateway 35 is a gateway for connecting a general network N3 to an information system network (such as MOST known to the same trader) that connects a wireless communication means such as a mobile phone (not shown), GPS, car navigation, or the like.

  By connecting the information system network and the control system network N1A via the gateway function, it becomes possible to logically separate the control system network N1A from the information system network. An easily satisfied configuration can be configured relatively simply.

  The body system gateway 36 is a gateway for connecting a body system network such as a door lock and a power window (not shown) and the overall network N3. By connecting the body system network and the control system network N1A via the gateway function, it becomes possible to logically separate the control system network N1A from the body system network. An easily satisfied configuration can be configured relatively simply.

  Next, processing performed by the vehicle motion integrated control ECU 30 will be described with reference to FIG. FIG. 4 shows a data flow when the vehicle motion integrated control ECU 30 is operating normally.

  The vehicle motion integrated control ECU 30 includes a vehicle state estimation unit 101, a target state calculation unit 102, a vehicle body operation vector operation moment calculation unit 103, an operation amount calculation unit 104, and a vehicle parameter storage unit 105, and a steering sensor 41. Each sensor signal of the brake pedal position sensor 42, the accelerator pedal position sensor 43, the millimeter wave radar / camera 44, and the sensor S such as a wheel speed sensor, a vehicle body acceleration sensor, and an angular acceleration sensor not shown in FIG. And

The vehicle state estimation unit 101 estimates the current state of the vehicle using the sensor signal.
The target state calculation unit 102 calculates the target state of the vehicle that should be realized by the control using the traveling state of the vehicle and the sensor signal, that is, the target motion state that the vehicle should take.

  The vehicle body operation vector operation moment calculator 103 is a translation direction generated in the vehicle by control based on the difference between the current state of the vehicle estimated by the vehicle state estimator 101 and the target state calculated by the target state calculator 102. And a moment vector in the rotational direction are calculated.

  Based on the force vector and the moment vector calculated by the vehicle body operation vector operation moment calculation unit 103, the operation amount calculation unit 104 is based on the BBW driver ECUs 83A to 83D, the DBW system integrated control ECU 20, the SBW / VRG driver ECU 81, the SBW driver ECU 82, A target operation amount to be realized by a control actuator such as the EAS driver ECUs 84A to 84D and the airbag ECU 85 is calculated.

  The vehicle parameter storage unit 105 includes vehicle body dynamic constants (for example, mass, rotational inertia, center of gravity position, etc.) and control actuator specifications (for example, time constant of each actuator, maximum braking force of the brake, maximum steering angle of the steering). The vehicle parameters are stored in the vehicle state estimation unit 101, the target state calculation unit 102, the vehicle body operation vector operation moment calculation unit 103, and the operation amount calculation unit 104. The

  In FIG. 4, the output from the operation amount calculation unit 104 to each driver ECU is described by a single line, but this indicates not only one value but a set of control amounts. It is. For example, an independent braking force for each wheel may be instructed to the BBW driver ECUs 83A to 83D.

  The vehicle motion integration control ECU 30 includes a vehicle state estimation unit 101, a target state calculation unit 102, a vehicle body operation vector operation moment calculation unit 103, and an operation amount calculation unit 104, thereby integrating vehicle motion. Can be managed and controlled.

  Further, by separating the vehicle state estimation unit 101, for example, even when the control actuator configuration of the vehicle is changed, such as when the vehicle having the same platform is changed from the internal combustion engine to the hybrid type only. In addition, it is possible to reuse the part for calculating the mechanical characteristics of the vehicle, and the development efficiency of the control device is improved.

  Further, by separating the target state calculation unit 102, the target state calculation unit 102 is reflected even when the individuality of the driver is reflected or the limiter of the target value is changed depending on the vehicle traveling around or the road state. It is only necessary to change these, and there is an effect that the development efficiency of the control device is improved.

  Further, since the vehicle body operation vector operation moment calculation unit 103 and the operation amount calculation unit 104 are configured independently, the operation amount to the vehicle body can be calculated independently of the configuration of the control device provided in the vehicle. .

  For example, even if the configuration is changed from a hybrid vehicle to an in-wheel electric motor type vehicle, the vehicle body operation vector operation moment calculation unit 103 only has to calculate the force / moment vector to be generated, and the operation amount calculation unit 104 can be changed. That's fine. Therefore, there is an effect that the development efficiency of the vehicle control device is improved.

  Next, the current state of the vehicle calculated by the vehicle state estimation unit 101 and the target state of the vehicle calculated by the target state calculation unit 102 will be described with reference to FIG.

  The current state and the target state of the vehicle represent a state quantity 1X in a rigid body motion when the body portion of the vehicle 50 is assumed to be a rigid body. The state quantity 1X is, for example, displacement (x, y, z), rotation angle (θx, θy, θz) in the three-dimensional (XYZ) local coordinate system 1G fixed to the center of gravity of the body of the vehicle 50, It refers to velocity (dx / dt, dy / dt, dz / dt) and angular velocity (dθx / dt, dθy / dt, dθz / dt).

  Since each component of the state quantity 1X is coupled to each other in the rigid body mechanics, it is possible to perform more precise control by determining the state quantity 1X, and to perform control with high passenger comfort and stability. There is an effect.

A vehicle state estimation process flow by the vehicle state estimation unit 101 will be described with reference to FIG.
First, in step S1011, the motion state in the local coordinate system 1G fixed to the vehicle is estimated.

Next, in step S1012, the motion state in a fixed coordinate system fixed to a specific point, such as Nihonbashi, is estimated.
Next, in step S1013, the situation around the vehicle is estimated.

  Next, in step S1014, the measured values of the sensor S, the BBW driver ECUs 83A to 83D, the DBW system integrated control ECU 20, the SBW / VRG driver ECU 81, the SBW driver ECU 82, the EAS driver ECUs 84A to 84D, the airbag ECU 85, etc. Estimate and update the vehicle failure state based on the self-failure diagnosis result.

A target state calculation processing flow by the target state calculation unit 102 will be described with reference to FIG.
First, in step S1021, the vehicle state intended by the driver is estimated based on the operation amounts of the steering sensor 41, the brake pedal position sensor 42, and the accelerator pedal position sensor 43 and the current vehicle state.

  Next, in step S1022, a vehicle state limiter is calculated based on the situation around the vehicle, the performance of the vehicle control means, the state of equipment failure, legal regulations, and the like. For example, when one part of the brake device fails, the maximum speed is limited within a range where braking can be safely performed with the ability of the brake device to operate normally.

  In step S1023, the target state quantity of the vehicle 50 is determined so as to meet the driver's intention within a range not exceeding the vehicle state limiter.

FIG. 8 shows operating force / moment vectors calculated by the vehicle body operating vector operating moment calculator 103.
As shown in FIG. 8, the operating force vector F (Fx, Fy, Fz) and the operating moment vector τ (τx, τy, τz) are calculated on a local coordinate system fixed to the vehicle body. Therefore, there is an effect that it can be easily converted into the operation amount in the control device fixed to the vehicle.

The operation amount calculation processing flow by the operation amount calculation unit 104 will be described with reference to FIG.
The operation amount calculation unit 104 receives the vehicle body operation force vector F and the moment vector τ calculated by the vehicle body operation vector operation moment calculation unit 103 as input, and calculates what control amount is set as the target value by the actual control means. .

First, in step S <b> 1041, the vehicle body operation force vector F and the moment vector τ are distributed to tire forces that are generated for each tire attached to the vehicle 50. Thereafter, the control vector target value in the actual control means is calculated from the tire vector.
By using braking force, driving force, and turning force (tire lateral force generated by steering) as a target value in vehicle control, it becomes possible to control the motion of the entire vehicle in an integrated manner.

FIG. 10 shows the tire vector calculated in step S1041.
FFR is a tire vector generated on the right front wheel by control. FFL is a tire vector generated on the left front wheel by control. FRR is a tire vector generated on the right rear wheel by control. FRL is a tire vector generated on the left rear wheel by control. Each tire vector is defined as a component in the local coordinate system 1G fixed to the vehicle body 50.

  By defining the tire vector as a component of the local coordinate shape, there is an effect that the conversion to the operation amount of the tire drive shaft and the steering device fixed to the vehicle body 50 is facilitated.

  In step S1042, an operation amount distribution process is performed. The operation amount distribution process is performed corresponding to the configuration of the actuator that actually controls the vehicle.

11A and 11B show details of the operation amount distribution process.
FIG. 11A shows an operation amount distribution process (step S1042a) when the vehicle 50 has an internal combustion engine drive or hybrid internal combustion engine drive power train. This operation amount distribution process is based on a tire vector as an input, a steering amount as a target value in the SBW / VRG driver ECU 81 and the SBW driver ECU 82, a brake braking torque as a target value in the BBW driver ECUs 83A to 83D, and a DBW system The powertrain braking / driving torque that is the target value in the integrated control ECU 20 is output.

  FIG. 11B shows an operation amount distribution process (step S1042b) when the vehicle 50 has a known in-wheel electric motor type power train. The operation amount distribution process includes a steering amount that is a target value in the SBW / VRG driver ECU 81 and the SBW driver ECU 82, a regenerative operation by an in-wheel electric motor (not shown), and a brake braking torque that is a target value in the brake pad control ECU. The electric motor driving torque, which is a target value in the in-wheel electric motor control ECU (not shown), is output.

  By performing the operation amount distribution processing corresponding to the configuration of the actuator that actually controls the vehicle, it becomes possible to cope with the change in the actuator configuration by exchanging the operation amount distribution processing execution means. This has the effect of improving the development efficiency.

The configuration of the DBW system integrated control ECU 20 will be described with reference to FIG.
The right front wheel drive torque receiving unit 201 receives a drive torque to be generated by the right front wheel 72R. The left front wheel drive torque receiving unit 202 receives a drive torque to be generated by the left front wheel 72L. The right rear wheel drive torque receiving unit 203 receives drive torque to be generated by the right rear wheel 75R. The left rear wheel drive torque receiving unit 204 receives a drive torque to be generated by the left rear wheel 75L.

  The powertrain operation amount calculation unit 205 calculates a value that is a target value in the ECU that controls the actual actuator, and instructs the operation amounts of the internal combustion engine control ECU 21, the transmission control ECU 22, the electric motor control ECU 23, and the battery control ECU 24. To do.

  In a known torque-based vehicle control device, control is performed using the torque that should be generated on the drive shaft of the drive means as a target value. Therefore, there is a problem that the in-wheel electric motor type DBW system integrated control ECU 20 that can control the driving force for each wheel is not compatible.

  Therefore, for example, even in a drive system having drive means that generates drive force in a concentrated manner, such as an internal combustion engine or a hybrid system, the drive force for each wheel is received as a control target value, and the internal control unit 20 of the DBW system integrated control ECU 20 To redistribute to the drive actuator. As a result, the command value reception method (interface) of the DBW system integrated control ECU for the hybrid system and the DBW system integrated control ECU for the in-wheel electric motor type system can be shared.

(Second Embodiment)
An autonomous distributed control platform for a next-generation vehicle integrated vehicle control device to which a vehicle control device according to the present invention is applied will be described with reference to FIG.

The purpose of the autonomous distributed control platform is to realize high reliability, real-time processing, and expandability in vehicle control at low cost.
“Autonomous distributed” is one of the highly reliable distributed system models in the control field. This is a system in which computing entities called nodes corresponding to cells in living organisms are loosely coupled via a place where shared data called data fields are placed.

  For more details on “autonomous decentralization”, Junji Mori, Niji Miyamoto, Junichi Ihara: Proposal of the concept of autonomous decentralization: IEEJ Transactions C Vol.104 No.12 pp.303-310 (1984), See K.Mori: Autonomous Decentralized Systems: Concept, Data field Architecture and Future Trends: IEEE International Symposium on Autonomous Decentralized Systems (ISADS) pp. 28-34 (1993-Mar).

  In an autonomous distributed control system, each node is a program that can operate independently and autonomously, so that a configuration in which some failures do not reach the entire system can be realized, and a distributed system with high reliability and scalability Can be realized. However, it is difficult to apply a concept based on a biological model to an actual system, and a general application method has not yet been established. Therefore, it is necessary to consider the architecture for each application system.

  The autonomous distributed control platform includes 1) a data field DF10 for sharing data, 2) autonomous operation, 3) autonomous management, and 4) nodes capable of autonomous backup (sensor node A20, actuator node A30, controller) Node A10). Each node has a self-monitor (self-monitoring function) A13, A23, A33.

  The controller node A10 activates the processing routine A11 according to the time condition A12 (for example, 10 [ms] cycle). The controller node A10 acquires the sensor data DA20 from the data field DF10, calculates the control target value of the actuator node A30, and broadcasts it to the data field DF10 as controller data DA10.

  The data field DF10 is a shared memory space virtually provided on the control network. In a normal state, the data field DF10 includes sensor data DA20 output from the sensor node A20 and controller data (control target value) DA10 output from the controller node A10. Exists.

  Autonomous operation is a function that performs processing spontaneously according to time conditions and the state of the own node without receiving a processing request from another node.

  The autonomous management function is a function for executing the monitoring of the operation and state of the own node which is hidden from other nodes.

  Autonomous backup is a function that incorporates simple control to calculate the necessary data by simple control and realize the minimum necessary processing when there is an abnormality in the data required for processing of the local node. is there.

  In the following, data field DF10 is used to improve scalability suitable for vehicle control devices, time-driven operation suitable for real-time distributed control by autonomous operation, and state for ensuring reliability by autonomous management function and autonomous backup function It shows that monitoring and system fault tolerance can be realized.

Data fields of the autonomous distributed control platform will be described with reference to FIGS. 14 (a) and 14 (b).
The aim of the data field is to improve the expandability of the vehicle control device. By introducing a data field, the interface between nodes is standardized, and the purpose is to facilitate replacement and addition of parts.

  In the autonomous distributed control platform, data exchange between nodes is performed via a data field DF20 which is a virtual shared memory defined on the network. In other words, the data itself is recognized as an object without being conscious of what device is connected to the network.

  Therefore, the data defined on the data field DF20 is highly abstract data that can be standardized at the sensor / actuator level. For example, in sensor measurement, not a primitive data such as a voltage value, but a physical value subjected to a filtering process and floating point conversion by multiple measurement is defined on a data field. Also in the actuator control, standardized data such as a target braking force of the brake is defined on the data field.

  In the example of FIG. 14A, the depression amount of the brake pedal SA200 is measured by the brake pedal position sensor node A200, converted into a physical quantity, and then broadcast on the data field DF20 as a brake pedal state amount (brake depression amount) DA200. Is done.

  The controller node A100 refers to the brake pedal state quantity DA200, calculates the target braking force of each wheel (only the right front wheel target braking force DA100 and the left front wheel target braking force DA101 are shown), and broadcasts them on the data field DF20.

  The front wheel brake actuator node A300 refers to the right front wheel target braking force DA100 and the left front wheel target braking force DA101, and controls the left front wheel brake actuator AA300 and the left rear wheel brake actuator AA301 so as to realize the target braking force. .

  In the example of FIG. 14B, the brake controller is changed after adding an inter-vehicle distance control function to the control architecture of FIG.

  A radar SA 210 for measuring the inter-vehicle distance from the preceding vehicle and a radar node A 210 for controlling the radar are added, and the measured inter-vehicle distance DA 210 is broadcast to the data field DF20.

  The controller node A100 refers to the brake pedal state quantity DA200 and the inter-vehicle distance DA210, calculates the target braking force of the wheel (only the right front wheel target braking force DA100 and the left front wheel target braking force DA101 are shown), and broadcasts it on the data field DF20. To do.

  The right front wheel brake actuator node A310 controls the right front wheel brake actuator AA310 with reference to the right front wheel target braking force DA100.

  The left front wheel brake actuator node A320 controls the left front wheel brake actuator AA320 with reference to the left front wheel target braking force DA101.

  As described above, as shown in FIGS. 14A and 14B, the inter-vehicle distance measurement node is obtained by simply adding the “inter-vehicle distance” data on the data field DF20 without affecting other sensors and actuators. It is possible to add a radar node A210.

  Further, the brake actuator node is also changed from the front wheel control type to the individual wheel independent type, but does not affect the other nodes and the data field DF20. That is, by using the data field DF20, nodes can be loosely coupled, and a distributed system with good expandability can be easily realized.

Among the features of the distributed control platform, autonomous operation will be described with reference to FIG. 15 (and FIG. 13).
The aim of the autonomous operation is to realize an operation based on time driving that allows easy temporal prediction of processing in order to cope with distributed real-time processing.

  The autonomous operation in the autonomous distributed control platform is that a node starts processing spontaneously according to a time condition or a node state. That is, the process can be activated not only by receiving a message but also by a time condition (time or cycle) and a state change (interrupt) of the own node as an operation condition of the node.

  In a real-time system, it is essential to capture the state of the system to be controlled and reflect it in the control within a certain time. Therefore, at the time of control design, it is necessary to be able to design the processing execution time in End-to-End. On the other hand, a function for continuing the processing of the own node without being affected by an abnormality of another node is also required. In order to realize such a highly reliable distributed real-time system, it is necessary to make the operation of the node autonomous.

  The sensor node A20 starts the processing routine A21 according to the time condition A22 (for example, 10 [ms] period).

  The sensor node A20 reads the measurement value of the sensor SA20, performs preprocessing such as filter processing and floating point conversion, and converts it into a physical quantity, and then broadcasts the sensor data DA20 to the data field DF10.

  The actuator node A30 also starts the processing routine A31 according to the individual time condition A32 (20 [ms] cycle).

  The actuator node A30 acquires the sensor data DA20 from the data field DF10, calculates the control target value of the node A30, and then controls the actuator AA30 so as to realize the target value.

  Note that the time conditions A22 and A32, which are activation conditions, may be a change in the state of the own node, such as an internal combustion engine rotation interrupt. Thus, autonomous operation of a node becomes possible by acquiring necessary data by itself and performing computation while spontaneously starting the process.

  By the autonomous operation, the operation of the node becomes a time drive type or a drive type by a change in the state of the own node. In other words, event driving by other nodes is not necessary, and the design of the worst execution time becomes extremely easy. In addition, since the processing can be continued without being affected by the abnormality of other nodes, a highly reliable system can be realized.

  Among the features of the autonomous distributed control platform, autonomous management is described. The aim of autonomous management is to ensure the high reliability required for vehicle control. Specifically, it is possible to realize the operation monitoring of the own node and the processing at the time of failure (fail operative / fail silent) for each node constituting the distributed system. Also, in order to achieve both high reliability and low cost, fail-operating (operability at the time of failure) and fail-silent (non-runaway at the time of failure) are properly used according to the target node.

  In the conventional configuration, sensor measurement, vehicle control amount calculation, and actuator control are performed by an ECU for each subsystem. For this reason, in order to increase the reliability of the system, the fail operability of many ECUs is required, leading to higher costs. Further, when the mutual monitoring function between the ECUs is used, there is a problem that the coupling between the ECUs becomes dense, leading to deterioration of expandability and development efficiency.

FIG. 16 shows an outline of autonomous monitoring.
In this configuration, the node A 400 is provided with a self-monitoring function A 430 to monitor the operation A 410 in a normal state. When an abnormality occurs, a function stop process A411 (fail silent) is performed.

  For nodes that are difficult to back up, such as brake pedals and steering wheels, fail-operability is provided and functions are continued. In addition, the node is prevented from running out of control by stopping the function of the node even when the autonomous monitoring function itself fails.

  This autonomous monitoring makes it possible to construct a highly reliable system with a set of low-cost fail silent nodes while keeping the coupling between nodes sparse. Furthermore, fail operability at the system level can be realized by a combination with the autonomous backup described below.

  Among the features of the autonomous distributed control platform, autonomous backup is described. The aim of autonomous backup is to ensure the high reliability required for vehicle control. Specifically, it is a simple control function for compensating for a failure of a node constituting the distributed vehicle control device.

  Autonomous backup is a function that realizes the minimum necessary control by sharing data between slave nodes when a node that performs the master function fails in a logical configuration of a control node that normally takes a master-slave configuration. .

FIG. 17 shows an operation flow of the actuator node.
Normally, the controller node A10 calculates a control target value using the measured value of the sensor node A20, and the actuator node A30 controls the actuator AA30 based on the control target value (step S311 affirmation → step S312 → Step S313).

  On the other hand, the actuator node A30 incorporates a simplified version (simple control function) A34 (see FIG. 13) of the control function of the master node (controller node A10), and refers to the sensor measurement value simultaneously with the control target value. The simple control target value is calculated based on the sensor measurement value. If an abnormality occurs in the master node, the function is stopped by the above-described self-monitoring function. Therefore, for example, due to an event that the data on the data field DF10 is not updated, the actuator node A30 determines the master node in step S311. Determine failure. When actuator node A30 determines that the master node has failed (No in step S311 → step S314 → step S313 is executed, and the built-in simple control function A34 backs up the processing necessary for realizing the function of the own node by itself. To do.

  With this autonomous backup function and the above-described autonomous monitoring function, a highly reliable fail-operable system can be realized by a collection of low-cost fail silent nodes.

  Next, an operation example of the autonomous distributed control architecture will be described taking the brake control function as an example. In particular, this proposal shows that a fail-operable system can be constructed by combining fail-safe nodes.

  FIGS. 18A and 18B show a configuration example of the XBW vehicle control device. In FIGS. 18A and 18B, attention is focused on a vehicle integrated ECU, a brake pedal position sensor, a brake actuator (BBW (Brake-By-Wire) driver ECU), and a data field. The data field is provided on a vehicle control network implemented by, for example, FlexRay.

  First, the operation of the brake control function in the normal autonomous distributed control platform will be described with reference to FIG.

  The brake control function in the autonomous distributed control platform includes a brake pedal node B20, a vehicle motion overall control node (vehicle motion overall control ECU) B10, and a brake actuator node B30.

  The brake pedal node B20 is autonomously activated periodically and measures the state of the brake pedal position sensor SB20 using the A / D converter B203.

  The brake pedal node B20 performs filtering, correction processing, and the like on the measured value by the filter correction processing member B202, and further standardizes data by the data standardization unit B204. Thereafter, the data “brake pedal state” is disclosed to the autonomous distributed data field DF30 using the communication driver B201.

  The vehicle motion overall control node B10 is periodically activated. After starting, the vehicle motion overall control node B10 uses the communication driver B101 to refer to the brake pedal state and other data (yaw rate, steering angle, etc.) on the autonomous distributed data field DF30, and at the vehicle motion observer B102. The driver's operation intention is estimated by the driver intention grasping unit B103 based on the motion state of the vehicle. Based on the estimation result, the actuator target value generation member B104 calculates actuator control target values such as braking force, drive shaft torque, and steering angle. Thereafter, the control target value is disclosed to the autonomous distributed data field DF30 using the communication driver B101.

  Here, the operation of the brake actuator node B30 will be described by taking the left rear wheel as an example. Like the other nodes, the brake actuator node B30 is also periodically activated. After activation, the brake actuator node B30 refers to the control target value on the autonomous distributed data field NF30, that is, the target braking force, using the communication driver B301. Then, the brake actuator AB30 is controlled based on the target braking force. The brake state is observed using the A / D converter B303, the brake caliper control unit B302 calculates the brake control amount based on the difference between the braking force generated by the brake and the target state, and the predriver B304 is Used to control the brake actuator AB30.

  Note that the data field reference cycle and the actuator control cycle do not necessarily have to be the same cycle, and the actuator control cycle can be taken at a higher speed. By doing so, appropriate control can be performed in accordance with the control time constant of the actuator to be controlled.

Next, the operation of the brake control function when the vehicle motion overall control node B10 fails will be described with reference to FIG.
The brake pedal node B20 autonomously starts up and performs processing, as in normal times. It is not affected by the failure of the vehicle motion control node B10. When the vehicle motion control node B10 detects its own failure by the autonomous management function, the vehicle motion control node B10 performs a fail-silent process. That is, when viewed from the outside, all processes are stopped. Therefore, the actuator control target value on the autonomous distributed data field DF30 is not updated.

  Here, the operation of the brake actuator node B30 will be described by taking the left rear wheel as an example. The brake actuator node B30 is periodically activated. After activation, the brake actuator node B30 refers to the control target value on the autonomous distributed data field DF30, that is, the target braking force. However, since the target braking force data is no longer updated, a failure of the vehicle motion control node B10 is detected. As a result, the autonomous distributed control function B305 of the brake pedal node B20 is activated. The autonomous distributed control function B305 calculates a simple target value with reference to the brake pedal state on the autonomous distributed data field DF30.

  The brake caliper control unit B302 controls the brake actuator AB30 based on the simple target value calculated by the autonomous distributed control function B305 instead of the control target value calculated by the vehicle motion overall control node B10.

  However, this simple target value is calculated by using only the brake pedal state, and does not control the behavior of the vehicle as calculated by the vehicle motion overall control node B10.

  The operation of the brake control function using the autonomous distributed control platform has been described above. The data field, autonomous operation, autonomous management, and autonomous backup, which are the characteristics of the autonomous distributed platform, showed that even if the controller node that calculates the target value fails, it can operate as a vehicle control device.

  Due to this effect, a fail-operable vehicle control device can be realized by a combination of fail-silent nodes, which is effective for reducing the cost of a highly reliable system.

The basic configuration of the vehicle control apparatus according to the present invention will be described with reference to FIG.
The vehicle control device includes a sensor 500 that detects a driver's request, a sensor 550 that detects a vehicle state, an actuator 400, an operation amount generation node 100, and an actuator drive node 300.

  Among these, the sensor 500 that detects the driver's request, the operation amount generation node 100, and the actuator drive node 300 include failure detection functions 210A, 210B, and 210C, respectively. The failure detection function 210C of the actuator drive node 300 has not only a self-diagnosis function but also a function of detecting a failure of the actuator 400.

  The operation amount generation node 100 calculates an operation amount command value 120 based on the driver's request signal 200 and the vehicle state signal 201.

  In response to this operation amount command value 120, the actuator drive node 300 controls the actuator 400, whereby vehicle driving, steering, braking, and the like are executed.

  When the failure detection function 210A, 210B, 210C detects a failure in the node or the actuator 400, the failure detection function 210A, 210B, 210C outputs a failure detection notification 230 for notifying that the node is in a failure state. All nodes having a failure detection function are configured to stop output to the outside, that is, fail silent, except for outputting this failure detection notification 230 in a failure state.

  FIG. 20 is a functional diagram of the operation amount generation node 100. The operation amount generation node 100 incorporates a plurality of control logics for vehicle control. When a failure detection notification 230 is received from another node, the operation amount generation node 100 is controlled according to the failure location and the degree of failure. The control A, the control B, and the control C) are configured to be switched.

  FIG. 21 is a functional diagram of the actuator drive node 300. The actuator drive node 300 incorporates a plurality of control logics (control X, control Y, control Z) for calculating the operation target value of the actuator 400 based on the operation amount command value 120 generated by the operation amount generation node 100. ing. The controller 320 drives the actuator 400 to reach this target value.

  When receiving the failure detection notification 230 from another node, the actuator drive node 300 is configured to switch the control logic according to the failure location and the degree of failure. When the operation amount command value 120 can be received, the actuator drive node 300 executes the control X or the control Y based on the operation amount command value 120. However, the operation amount command value 120 is set due to a failure of the operation amount generation node 100 or the communication path. When the signal cannot be received, the driver's request signal 200 is taken and the control signal Z is switched to calculate the manipulated variable command value by itself.

(Third embodiment)
A third embodiment of the vehicle control apparatus according to the present invention will be described with reference to FIG. FIG. 22 shows an extracted portion of the vehicle control device, particularly related to brake control and steering control.

  The vehicle control device includes a steering angle sensor 41 that measures the rotation angle of the steering wheel 51 and a brake pedal position sensor 42 that measures the depression amount of the brake pedal 52 as sensors for detecting a driver's request, and generates an operation amount. As a node, it interprets the driver's intention from the signal of the sensor that detects the driver's request, and detects the vehicle state (not shown) together with signals from the acceleration sensor, yaw rate sensor, wheel speed sensor, A vehicle motion integrated control ECU 30 that comprehensively controls vehicle motion is provided.

  The vehicle control apparatus further controls, as an actuator drive node, an electric motor M1 that generates a steering force for the front wheels and an electric motor M5 that acts on a variable gear ratio (VGR) mechanism mounted on the steering column shaft. The driver ECU 81 includes an SBW driver ECU 82 that controls the steering electric motor M2 that generates the steering force for the rear wheels, and BBW driver ECUs 83A to 83D that control the electric brake motors M3A to M3D that generate the braking force for the four wheels.

  Here, as a sensor for measuring the brake pedal operation amount of the driver, it is possible to use a hydraulic pressure sensor that measures the pressure of the hydraulic pressure generated when the brake pedal 52 is depressed.

  All of the above nodes are configured to be fail-silent. The communication network includes a main bus N1A and a backup bus N1B, and all the above nodes are connected to the main bus N1A, whereas the backup bus N1B has a minimum necessary for safe driving of the vehicle. Nodes, that is, all nodes other than the vehicle motion integrated control ECU 30 and the rear wheel SBW driver ECU 82 are connected. Although not shown, it is assumed that power is supplied at least to all nodes connected to the backup bus N1B.

  The front wheel SBW / VGR driver ECU 81 and the four wheel BBW driver ECUs 83 </ b> A to 83 </ b> D incorporate simple control logic units 811 and 831. Here, the simple control means, for example, control with a relatively small processing load such that the electric motor torque command value is simply proportional to the sensor signal value.

  During normal operation, the front wheel SBW / VGR driver ECU 81, the rear wheel SBW driver ECU 82, and the four wheel BBW driver ECUs 83A to 83D receive the steering angle command and the braking force command from the vehicle motion integrated control ECU 30 via the communication network. Thus, the electric motor is controlled based on the command value.

  In this embodiment, the steering wheel 51 is mechanically coupled to the front wheel steering mechanism 71, and the brake pedal 52 is connected to the front wheel brake 73 even in the hydraulic system. By using the mechanism, the driver can directly steer and brake the vehicle.

  In the following, taking the vehicle control device shown in FIG. 22 as an example, even if a failure occurs somewhere in the vehicle control device, the vehicle can run stably without losing the brake and steering functions. Will be described in detail.

  Here, it is assumed that two or more failures do not occur at the same time, and when a failure occurs, the driver is warned to that effect, and the failure site is repaired in a relatively short time. The description will be made on the assumption that failure will be prevented.

(1) When the vehicle motion integrated control ECU 30 fails In this case, the vehicle motion integrated control ECU 30 outputs a failure detection notification to the main bus N1A. If the communication network is set to time division multiple access (TDMA) and each node outputs to the network in a predetermined time slot, the failure detection notification can be made when there is no output. .

  For example, as shown in FIG. 23, this can be realized by dividing the communication cycle into a data transmission cycle and a diagnostic cycle, and all nodes sequentially output some data in the diagnostic cycle. In the example of FIG. 23, since there is no output to the network in the time slot of the node F in the diagnostic cycle, it can be seen that the other node has failed in the node F.

When the front wheel SBW / VGR driver ECU 81 and the rear wheel SBW driver ECU 82 receive the failure detection notification from the vehicle motion integrated control ECU 30, they take in the value of the steering angle sensor 41 from the network and execute simple control.
Further, the four-wheel BBW driver ECUs 83 </ b> A to 83 </ b> D take in the value of the brake pedal position sensor 42 and execute the simple control by the simple control logic unit 813.

(2) When a failure occurs in the main bus N1A in the communication network In this case, the SBW / VGR driver ECU 81 for the front wheels and the BBW driver ECUs 83A to 83D for the four wheels use the backup bus N1B Simple control is performed in the same manner as when the integrated control ECU 30 has failed.

(3) When either the front wheel BBW driver ECU 83A, 83B or the front wheel brake electric motor M3A, M3B fails In this case, stop the power supply to the front wheel brake electric motor on the failed side Thus, the wheel is brought into a state where the brake is not applied, and the vehicle motion integrated control ECU 30 performs control so as to stably stop the vehicle with the remaining three wheels. Alternatively, the driver can directly stop the vehicle using a backup mechanism.

  Here, although the failure of the electric motor is not shown, it includes failures of the electric motor rotation position sensor, the current sensor and the like necessary for the electric motor control. The same applies when any of the rear wheel BBW driver ECUs 83C and 83D or any of the rear wheel brake electric motors M3C and M3D fails.

(4) When either the front wheel SBW / VGR driver ECU 81 or the front wheel steering electric motor M1 (including a sensor necessary for electric motor control) fails. In this case, the front wheel steering electric motor M1 and the VGR mechanism 54 The electric power supply to the electric motor M5 acting on the vehicle is stopped, and the driver directly steers the vehicle using the backup mechanism.

(5) When the steering angle sensor 41 or the brake pedal position sensor 42 fails In this case, power is supplied to the steering electric motors M1, M2 and the electric motor M5 acting on the VGR mechanism or the brake electric motors M3A to M3D. The driver stops and the driver directly steers or brakes the vehicle using the backup mechanism.

  In this embodiment, there is no situation where a backup mechanism is used for both steering and braking due to a single failure.

  As described above, according to the configuration of the present embodiment, an error can be backed up in the entire system. Therefore, in a vehicle control apparatus having a backup mechanism without increasing redundancy of individual nodes more than necessary. A sufficiently reliable vehicle control device can be realized simply by making all the nodes fail-silent.

  The fail-silent node has a simpler hardware configuration than a fail-operative node configured to continue normal operation even if a failure occurs. A highly reliable vehicle control device can be provided.

  Furthermore, by connecting only the minimum necessary nodes related to safe driving of the vehicle to the backup bus N1B, the number of nodes that require redundant communication interfaces can be reduced, thereby reducing costs. it can.

A functional configuration example of the fail-silent steering angle sensor 41 or the brake pedal position sensor 42 will be described with reference to FIG.
The steering angle sensor 41 / brake pedal position sensor 42 includes two sensor elements 60A and 60B, A / D converters 61A and 61B that convert analog outputs of the sensor elements 60A and 60B into digital values, and a failure detection function. 210, a filter function 63, a communication controller 64, a communication driver 65A for outputting a signal to the main bus N1A, and a communication driver 65B for outputting a signal to the backup bus N1B.

  The failure detection function 210 includes a matching check function 62 that determines whether two A / D conversion values by the A / D converters 61A and 61B are the same within a predetermined error range. If not, the communication drivers 65A and 65B are deactivated so as to be fail-silent.

  The failure detection function 210 outputs a trigger signal to the A / D converters 61A and 61B so that the A / D conversion of the two sensor elements 60A and 60B is performed simultaneously.

  According to this configuration example, by providing the filter function 63 in the sensor, even when the sensor signal is sampled in a short cycle and subjected to filter processing such as oversampling, data is output to the communication network in accordance with the sampling cycle. This eliminates the need for network traffic.

  A hardware configuration example of the fail-silent steering angle sensor 41 or the brake pedal position sensor 42 will be described with reference to FIG.

  The steering angle sensor 41 / brake pedal position sensor 42 includes a main sensor element 60A, a reference sensor element 60B, a fail-safe LSI 600, and two communication drivers 65A and 65B.

  The fail safe LSI 600 includes redundant A / D converters 61A and 61B, CPUs 66A and 66B, communication controllers 64A and 66B, comparators 62A and 62B, and one ROM and RAM 67.

  In the fail safe LSI 600, after A / D converting the signals from the respective sensor elements 60A and 60B, the A / D conversion values are exchanged between the CPUs 66A and 66B to be matched. Each of the CPUs 66A and 66B performs a filter operation using the A / D converted values after the matching.

  The calculation result match check is performed by inputting the outputs of the communication controllers 64A and 64B to the comparators 62A and 62B.

  In this embodiment, since there are two communication buses, the communication controller 64 has two channels, and the outputs of each channel are compared by the comparators 62A and 62B.

  In the present embodiment, a fail-silent sensor node can be configured at low cost by integrating the fail-safe function into one chip.

(Fourth embodiment)
A fourth embodiment of the vehicle control apparatus according to the present invention will be described with reference to FIG. In FIG. 26, parts corresponding to those in FIG. 22 are denoted by the same reference numerals as those in FIG. 22, and description thereof is omitted.

  In the third embodiment shown in FIG. 22, a sensor is directly connected to the network. In the fourth embodiment, a sensor signal is input to the HMI • ECU 25, and the HMI • ECU 25 compares the sensor values. After the filter processing is executed, the sensor data is output to the network.

  In this case, the steering angle sensor 41A and the brake pedal position sensor 42A are composed of only two sensor elements.

  It should be noted that the HMI / ECU 25 needs to be configured to be fail-operative in order to prevent a situation in which a backup mechanism is used for both steering and braking due to a single failure.

(Fifth embodiment)
A fifth embodiment of the vehicle control apparatus according to the present invention will be described with reference to FIG. In FIG. 27 as well, portions corresponding to those in FIG. 22 are denoted by the same reference numerals as those in FIG.

  The fifth embodiment is the same as the third embodiment in the node configuration and the network configuration, but between the steering column (steering wheel 51) and the steering force generation mechanism, and between the brake pedal 52 and the brake force generation mechanism. In addition, the vehicle control device has no mechanical coupling. Therefore, it is not possible to expect steering and braking of the vehicle using the mechanical backup mechanism as described in the third embodiment.

Therefore, in the vehicle control device of this embodiment, the steering angle sensor 41B, the brake pedal position sensor 42B, and the SBW driver ECU 81A of the front wheels 72R and 72L are used as fail-operative nodes that continue normal operation even if a failure occurs. Yes.
Further, the steering electric motors for the front wheels 72R and 72L are doubled (M1A and M1B).

  Although not shown, the front wheel SBW driver ECU 81A is composed of two fail silent nodes, and each fail silent node independently controls the dual steering electric motors M1A and M1B. The SBW driver ECU 81A includes a simple control logic unit 811.

  The torque that can be generated as the steering electric motors M1A and M1B is smaller than that of the steering electric motor used in the system in which the steering and the steering force generation mechanism are mechanically coupled (however, they are mechanically coupled). If an electric motor (1/2 or more) is used to generate a torque equivalent to that of the system, an increase in cost due to duplication of the electric motor can be reduced.

  The front wheel SBW driver ECU 81A further controls an electric motor M6 that acts on a mechanism that artificially generates a reaction force from the road surface on the steering column.

  The steering angle sensor 41B and the brake pedal position sensor 42B are configured by duplicating the fail silent sensor shown in FIG. The fail-silent sensor shown in FIG. 25 may be a single fail-operating sensor that has a higher reliability by triple tripping the sensor elements and providing the majority function of three sensor signals.

  If one of the fail silent nodes of the front wheel SBW driver ECU 81A or one of the steering electric motors M1A and M1B (including sensors necessary for electric motor control) fails, this node supplies power to the steering electric motor on the failed side. Is stopped and a failure detection notification is output.

  When the vehicle motion integrated control ECU 30 receives the failure detection notification, the vehicle motion integrated control ECU 30 switches control so that the vehicle is stably steered by the remaining steering electric motor.

  When a failure occurs in a location other than this, the method of causing the vehicle to travel stably without losing the brake and steering functions is as described in the third embodiment.

  According to the fifth embodiment, since the error can be backed up in the entire system, it is sufficient to introduce the minimum necessary fail-operative node even in a vehicle control device without a steering and brake backup mechanism. A highly reliable vehicle control device can be realized at low cost.

(Sixth embodiment)
A sixth embodiment of the vehicle control apparatus according to the present invention will be described with reference to FIG. 28, parts corresponding to those in FIGS. 3 and 22 are denoted by the same reference numerals as those in FIG. 22, and description thereof is omitted.

  In the sixth embodiment, nodes such as a drive system and a safety system are added to the vehicle control apparatus of the third embodiment, and an overall view of a control system related to traveling of the vehicle is shown. Although the present embodiment includes a steering and brake backup mechanism, a vehicle control apparatus that does not include the same can be configured similarly.

  In addition to the nodes related to steering control and brake control described in the third embodiment, the main bus N1A includes a DBW system integrated control ECU 20 that comprehensively controls the drive system of the vehicle, and a suspension electric motor that adjusts the damping force. EAS driver ECUs 84A to 84D for controlling the motors M4A to M4D, an accelerator pedal position sensor 43 for measuring the depression amount of the accelerator pedal 53, a millimeter wave radar / camera 44 for detecting the external state of the vehicle, and controlling the deployment of the airbag. An airbag ECU 85 is connected.

  The front wheel SBW / VGR driver ECU 81 and the four wheel BBW driver ECUs 83 </ b> A to 83 </ b> D incorporate simple control logic units 811 and 831.

  An internal combustion engine control ECU 21, a transmission control ECU 22, an electric motor control ECU 23, and a battery control ECU 24 are connected to the DBW system integrated control ECU 20 through a network N2.

  The vehicle motion integrated control ECU 30 is a network that controls an information system gateway 35 that serves as an entrance to a network that controls information-related equipment such as car navigation systems, and body-related equipment such as door locks, door mirrors, and various meters. Is connected to the body gateway 36 serving as an entrance to the network, and exchanges data with these nodes.

  Although not shown, it is assumed that the airbag ECU 85 is also connected to a safety network that integrates various sensors and actuators necessary for airbag deployment control at another end.

  In this embodiment, the vehicle motion integrated control ECU 30 interprets the driver's intention from the steering angle sensor 41, the brake pedal position sensor 42, and the accelerator pedal position sensor 43, and detects a vehicle state (not shown) such as an acceleration sensor. In addition to the signals from the yaw rate sensor and the wheel speed sensor, the steering angle, braking force, driving force, etc. for realizing the optimal vehicle movement are calculated, and the front wheel SBW / VGR driver ECU 81 and the rear wheel SBW driver are calculated. A steering angle command is transmitted to the ECU 82, a braking force command is transmitted to the four-wheel BBW drivers ECU 83A to 83D, and a driving force command is transmitted to the DBW system integrated control ECU 20.

  The DBW system integrated control ECU 20 receives the driving force command, calculates the driving force that should be generated by each driving force generation source such as an internal combustion engine and an electric motor in consideration of energy efficiency and the like, and outputs the calculated driving force command. It transmits to internal combustion engine control ECU21, electric motor control ECU23, etc. via the network N2.

  The vehicle motion integrated control ECU 30 uses the information of the millimeter wave radar / camera 44 that detects the external state of the vehicle as well as the information of the sensor that detects the driver's request, so Control such as keep driving and danger avoidance driving can be performed.

  Regarding reliability, all the nodes connected to the main bus N1A of the communication network are configured to be fail-silent. Further, as described in the third embodiment, the backup bus N1B is connected to only the minimum necessary nodes related to safe driving of the vehicle, so that the number of nodes that need to make the communication interface redundant is set. To reduce costs.

  The accelerator pedal position sensor 43 is also directly connected to the internal combustion engine control ECU 21 so that the vehicle can be driven even when any of the main bus N1A, the DBW system integrated control ECU 20, and the network N2 fails.

  The error backup method in this embodiment and the effects thereof are as described in the third embodiment.

(Seventh embodiment)
A seventh embodiment of the vehicle control apparatus according to the present invention will be described with reference to FIGS.
The operation amount generation node 610 generates an operation amount 612 and sends the operation amount 612 to the actuator drive node 630.
The correction amount generation node 620 generates a correction amount 622 and sends the correction amount 622 to the actuator drive node 630.

  As shown in FIG. 30, the actuator drive node 630 includes a controller 632 and a switch 634. When the correction amount generation node 620 is normal, the operation amount 612 from the operation amount generation node 610 is added to the correction amount. The actuator 640 is controlled as a control target value 635 by adding the correction amount 622 from the generation node 620. On the other hand, when the correction amount generation node 620 is abnormal, the actuator 640 is controlled using the operation amount 612 from the operation amount generation node 610 as the control target value 635.

  In this embodiment, when the correction amount generation node 620 is normal, finer control is possible depending on the correction amount. On the other hand, when the correction amount generation node 620 fails, there is no correction amount while reducing the function. You can continue to control.

  Since it is necessary to know whether or not the correction amount generation node 620 is normal, it is preferable that the correction amount generation node 620 includes a failure detection function 621. Based on the failure detection result 623 by the failure detection function 621, the switch 634 of the actuator drive node 630 performs a switching operation.

  High-level information processing is required to generate the correction amount, whereas operation amount generation requires relatively simple information processing. For this reason, the correction amount generation node 620 requires higher processing performance than the operation amount generation node 610. As a result, the number of parts increases, the operating frequency (the clock frequency of the processor) increases, and the electrical and thermal Therefore, an operation with a small margin is required. Therefore, the correction amount generation node 620 has a higher failure rate (total sum of component failure rates (number of fits)) than the operation amount generation node 610.

  That is, the correction amount generation node 620 is configured as a node having a higher processing capability than the operation amount generation node 610. For example, the correction amount generation node 620 is configured by a computer (node) having a higher operating frequency than the operation amount generation node 610.

  Therefore, the operation amount generation node 610 that is the minimum necessary for continuing control can be expected to have a lower failure rate than the correction amount generation node 620. That is, the operation amount generation node 610 is a node having a configuration with a lower failure rate than the correction amount generation node 620.

  Furthermore, since the operation amount generation node 610 needs to be normal even when the correction amount generation node 620 fails, it is desirable that the operation amount generation node 610 has a fault tolerance function 611.

  There are various possible failure detection functions 621 included in the correction amount generation node 620. However, as shown in FIG. 31, it can also be realized by duplicating the correction amount generation node 620 and comparing the outputs.

  In this case, the correction amounts 622a and 622b output from the doubled correction amount generation node 620 are compared in advance on the correction amount generation node 620 side, and one of the correction amounts 622a and 622b and the failure detection result are stored in the actuator drive node 630. 32, and, as shown in FIG. 32, the correction amounts 622a and 622b output from the multiplexed correction amount generation node 620 are transmitted to the actuator drive node 630, and the actuator drive node 630 is transmitted. The comparison function 631 compares the correction amounts 622a and 622b to obtain the failure detection result 623.

  Various fault-tolerant functions 611 provided in the operation amount generation node 610 are also conceivable. However, as shown in FIG. 31, this can also be realized by tripling the operation amount generation node 610 and taking the majority of its outputs.

  In this case, FIG. 32 shows a method in which the operation amounts 612a, 612b, and 612c generated by the redundant operation amount generation node 610 are preliminarily taken on the operation amount generation node 610 side and transmitted to the actuator drive node 630. As described above, there is a method in which the operation amounts 612a, 612b, and 612c generated by the operation amount generation node 610 are transmitted to the actuator drive node 630, respectively, and a majority decision is taken by the majority decision function 633 included in the actuator drive node 630.

  33, the actuator driving node 630 is provided with a gain variable unit 636 and a ramp generator 637 for controlling the gain of the gain variable unit 636, and the failure detection result 623 is displayed as the ramp generator 637. , The value obtained by multiplying the correction amount 622 from the correction amount generation node 620 by the variable gain by the gain variable unit 636 is added to the operation amount 612 from the operation amount generation node 610 to control the actuator 640 as the control target value 635. It is good also as composition to do. In this case, when the correction amount generation node 620 is abnormal, the control target value 635 gradually changes without rapidly changing.

  The operation of this embodiment is shown in FIG. When the correction amount generation node 620 is normal, the lamp output 637 that is the output of the ramp generator 637 has a high value, and the correction amount 622 from the correction amount generation node 620 is preliminarily obtained by the gain variable unit 636. The actuator 640 is controlled as a control target value 635 by being multiplied by a predetermined high-order gain and added to the operation amount 612 from the operation amount generation node 610.

  On the other hand, when the correction amount generation node 620 becomes abnormal, the lamp output 637 gradually increases from a high value to a low value from time when the failure detection result 623 changes from “normal” to “abnormal”. To change.

  As a result, the variable gain multiplied by the correction amount 622 from the correction amount generation node 620 by the gain variable device 636 also gradually changes with time from a high gain to a low gain. As a result, the correction amount 622 from the correction amount generation node 620 added when calculating the control target value 635 gradually decreases with time.

  In the embodiment shown in FIG. 34, the low gain is set to 0, but the magnitude of the low gain may be determined according to the severity of the failure of the correction amount generation node 620. In this embodiment, the lamp output 637 linearly changes from a high value to a low value. However, the lamp output 637 is not limited to a straight line and may be changed in an arbitrary pattern including a curve. It is desirable that the change pattern be monotonously reduced.

  According to the present embodiment described above, the control target value 635 changes gradually rather than suddenly when the correction amount generation node 620 is abnormal, so that the operator does not feel uncomfortable. In addition, since there is no step of the control target value 635 accompanying the switching, it is possible to avoid deterioration of controllability due to an operator's response delay with respect to the step.

  35, the operation amount 612 from the operation amount generation node 610 and the correction amount 622 from the correction amount generation node 620 are driven by an actuator via a single communication path (communication bus) 650. A network configuration for transmission to the node 630 may also be adopted.

  According to this embodiment, since it is not necessary to provide a communication path individually for node-to-node, it leads to wiring saving, and accordingly, the cost of the system can be reduced and the weight can be reduced.

  As shown in FIG. 36, the information transmitted via the communication path 650 in this embodiment is time-divided into a plurality of time slots for each node to transmit, and the operation amount 612 is the operation amount generation. It is transmitted in the time slot 614 assigned to the node 610, and the correction amount 622 is transmitted in the time slot 624 assigned to the correction amount generation node 620.

  Here, in the method of separately transmitting the correction amounts 622a and 622b output from the correction amount generation node 620 described above to the actuator drive node 630, individual time slots are allocated to the respective redundant correction amount generation nodes 620, respectively. The correction amounts 622a and 622b are transmitted in the time slot.

  Further, in the method of separately transmitting the operation amounts 612a, 612b, and 612c generated by the operation amount generation node 610 to the actuator drive node 630, individual time slots are assigned to the redundant operation amount generation nodes 610, respectively. The operation amounts 612a, 612b and 612c are transmitted in the slot.

FIG. 37 shows a specific example in which the present embodiment is applied to a Steer-by-Wire system.
A steering column (steering wheel) 615 is connected to the operation amount generation node 610, and an operation amount 612 that is a steering angle corresponding to the operation angle of the steering column 615 is generated. The operation amount 612 is an actuator via the communication path 650. It is transmitted to the drive node 630.

  An acceleration sensor / yaw rate sensor 625 is connected to the correction amount generation node 620, and a correction amount 622 is generated from the signal from the acceleration sensor / yaw rate sensor 625 and information on the operation amount 612, and this correction amount 622 is transmitted via the communication path 650. To the actuator driving node 630.

  When the correction amount generation node 620 is normal, the actuator drive node 630 controls the steering device 641 using a value obtained by adding the correction amount 622 to the operation amount 612 as a control target value.

  According to the present embodiment described above, when the driver overshoots the steering column 615, when there is no correction amount 622, the front wheels lose grip and the stability of the vehicle is reduced. Since the vehicle slip and spin are detected by the yaw rate sensor 625 and the correction amount 622 is generated so as to suppress the skid and spin by the correction amount generation node 620, the steering stability of the vehicle is improved.

FIG. 38 shows a specific example in which the present embodiment is applied to the Break-by-Wire system.
A brake pedal 616 is connected to the operation amount generation node 610, and an operation amount 612 that is a brake depression force according to the operation of the brake pedal 616 is generated, and this is generated via the communication path 650 via the actuator drive nodes 630-1 to 630-4. Is transmitted.

  An acceleration sensor / yaw rate sensor 625 is connected to the correction amount generation node 620, and correction amounts 622-1 to 622-4 for each brake are generated from signals from the acceleration sensor / yaw rate sensor 625 and information on the operation amount 612. It is transmitted to the actuator drive node 30 via the communication path 650.

  In the actuator drive node 630-i (i = 1 to 4), when the correction amount generation node 620 is normal, a value obtained by adding the correction amount 622-i (i = 1 to 4) to the operation amount 612 is a control target. The brake 642-i (i = 1 to 4) of each wheel is controlled as a value.

  According to the present embodiment described above, when the driver depresses the brake pedal 616 too much, if there is no correction amount 622-i (i = 1 to 4), each wheel loses grip, and the vehicle Although the stability is reduced, the correction amount 622-i (i = 1 to 4) is set so that the acceleration sensor / yaw rate sensor 625 detects the side slip or spin of the vehicle and the correction amount generation node 620 suppresses the side slip or spin. As a result, the driving stability of the vehicle is improved.

  FIG. 39 shows a specific example in which the present embodiment is applied to a system in which Steer-by-Wire and Break-by-Wire are integrated.

  A steering column 615 and a brake pedal 616 are connected to the operation amount generation node 610, and an operation amount 612-0 that is a steering angle according to the operation angle of the steering column 615 and an operation that is a brake depression force according to the operation of the brake pedal 616. Quantities 612-2 are generated and transmitted to actuator drive nodes 630-0 to 630-4 via communication path 650.

  When the correction amount generation node 620 is normal, the actuator driving node 630-0 controls the steering device 641 using a value obtained by adding the correction amount 622-0 to the operation amount 612-0 as a control target value.

  In the actuator drive node 630-i (i = 1 to 4), when the correction amount generation node 620 is normal, a value obtained by adding the correction amount 622-i (i = 1 to 4) to the operation amount 612-i. The brake 642-i (i = 1 to 4) of each wheel is controlled as a target value.

  According to the present embodiment described above, when the driver overshoots the steering column 615 or depresses the brake pedal 616, the front wheel is moved in the absence of the correction amount 622-i (i = 0 to 4). The stability of the vehicle is lowered due to loss of grip, but the correction amount 622-i is detected so that the acceleration sensor / yaw rate sensor 625 detects the side slip or spin of the vehicle and the correction amount generation node 620 suppresses the side slip or spin. Since (i = 0 to 4) is generated, the steering stability of the vehicle is improved.

(Eighth embodiment)
An eighth embodiment of the vehicle control apparatus according to the present invention will be described with reference to FIG.
The vehicle control apparatus according to the present embodiment includes a sensor 500 that detects an operation amount of an accelerator pedal, a brake pedal, a handle, and the like that indicate a driver's request for vehicle motion, vehicle speed, acceleration, and yaw rate that indicate the state of vehicle motion. Is a sensor 550 that detects information outside the vehicle acquired by radio waves, images, etc., a plurality of actuators 400 corresponding to each of a power source, a brake, and steering for realizing driving, braking, and steering, and controls these actuators 400 And a plurality of actuator drive nodes 300 that control the actuator 400 based on the target operation amount generated by the operation amount generation node 100.

  Although not shown in detail in the figure, the operation amount generation node 100 includes a central processing unit (CPU) that executes programs, a nonvolatile storage device (ROM) that stores programs and data, and a volatile storage device. (RAM) and an input / output device (I / O) for connecting to the sensor 500, the sensor 550, and the actuator driving node 300, and a general microcomputer configuration in which these are connected via a bidirectional bus It may be.

  The operation amount generation node 100 may further include an analog / digital conversion device (ADC), and the sensor 500 and the sensor 550 may be connected to the ADC, or may include a serial communication device (SCI). 550, the actuator drive node 300 may be connected to the SCI. Further, these devices may be realized by one or a plurality of semiconductor integrated circuits.

  The operation amount generation node 100 calculates the target operation amount of each actuator 400 based on the driver request signal 200 output from the sensor 500 and the vehicle state signal 201 output from the sensor 550, and uses this as the operation amount command value 120 for the network. To the actuator drive node 300 via The operation amount command value 120 is determined according to each actuator 400, and is a target driving force if the actuator 400 is a power source, a target braking force for each wheel if it is a brake, and a target steering angle if it is a steering.

  Although not shown in detail in the figure, the actuator drive node 300 includes a central processing unit (CPU) that executes a program, a nonvolatile storage device (ROM) that stores a program and data, and a volatile storage device ( RAM), an input / output device (I / O) for connection to the sensor 500 and the operation amount generation node 100, these are connected by a bidirectional bus, and further include a drive circuit for driving the actuator. A general microcomputer connected to / O may be used.

  The actuator drive node 300 may further include an analog / digital conversion device (ADC), and the sensor 500 may be connected to the ADC, or may include a serial communication device (SCI), and the sensor 500 or the operation amount generation node 100. May be connected to the SCI. Further, these devices may be realized by one or a plurality of semiconductor integrated circuits.

  Although not shown, the actuator drive node 300 includes a sensor that detects any one of the driving force, braking force, and steering angle of the actuator 400, or information necessary for estimating them. The driving control of the actuator 400 is executed so that the driving force, the braking force, and the steering angle are equal to the operation amount command value 120 received from the operation amount generation node 100.

  The actuator driving node 300 transmits the driving force, braking force, and steering angle of the actuator detected by the sensor to the operation amount generation node 100. Thereby, the operation amount generation node 100 can calculate the target operation amount of each actuator 400 with reference to the driving force, braking force, and steering angle of the actuator 400.

  Each of the sensor 500, the operation amount generation node 100, and the actuator drive node 300 includes failure detection functions 210A, 210B, and 210C that detect their own failures.

  The failure detection of the sensor by the failure detection function 210A can be realized by determining that the value detected by the sensor 500 is out of a predetermined range, and the comparison result or majority decision of these detection results using a plurality of sensors. This can also be realized by taking

  Fault detection of the operation amount generation node 100 by the fault detection function 210B can be realized by CPU time-out by a watchdog timer, ROM, RAM and bidirectional bus bit error detection by redundant codes, I / O comparison verification, It can also be realized by using a plurality of manipulated variable generation nodes 100 and comparing or collating these outputs.

  Failure detection of the actuator drive node 300 by the failure detection function 210C can be realized by CPU time-out by a watchdog timer, bit error detection of ROM, RAM and bidirectional buses by redundant codes, and I / O comparison verification. This can also be realized by using a plurality of quantity generation nodes and comparing or comparing these outputs with a majority vote.

  Furthermore, the failure detection function 210 </ b> C also has a function of detecting a failure of the actuator 400 from the difference from the driving force, braking force, change amount of the steering angle, and the operation amount command value 120 of the actuator 400.

  When the failure detection function 210A, 210B, 210C detects a failure of itself or the actuator 400, the failure detection function for notifying the operation amount generation node 100 and the other actuator drive node 300 that it is in a failure state. A notification 230 is output.

  When the sensor 500, the operation amount generation node 100, and the actuator drive node 300 are in a failure state, it is desirable to stop the other outputs only by outputting the failure detection notification 230. If the notification 230 cannot be output normally, it is desirable to stop the failure detection notification 230 as well.

  In addition, each actuator drive node 300 selects a control program (actuator control method) for selecting a control program (actuator control method) based on the failure detection result of each of the other actuator drive nodes 300 and the operation amount generation node 100. It has a function (control method selection means) 220.

  The control program selection function 220 normally selects a control program for controlling the actuator 400 based on the operation amount command value 120 from the operation amount generation node 100. If the operation amount generation node 100 fails, a sensor program is selected. A control program for controlling the actuator 400 based on the driver request signal 200 from 500 is selected, and when the actuator drive node 300 at its own or other specific location fails, the control for safely stopping the control of the actuator 400 is performed. Select a program.

  Thereby, even when the operation amount generation node 100 or the actuator drive node 300 breaks down, the vehicle control can be continued by the actuator drive node 300 in the normal state.

  As shown in FIG. 41, the vehicle control apparatus according to this embodiment may have a configuration in which an operation amount generation node 100, an actuator drive node 300, and a sensor 500 are communicably connected via a network 600 such as CAN. The operation amount generation node 100, the actuator drive node 300, and the sensor 500 can transmit the operation amount command value 120, the failure detection notification 230, the driver request signal 200, and other messages to a desired node via the network 600, respectively. Further, a plurality of nodes can receive a message transmitted by each node.

  Further, as shown in FIG. 42, the vehicle control apparatus according to this embodiment can be configured by connecting the sensor 550 to the network 600 as one node. Thereby, the sensor 550 can transmit the vehicle state signal 201 to a desired node via the network 600. Further, a plurality of nodes can receive a message transmitted from the sensor 550.

  In the vehicle control apparatus shown in FIGS. 41 and 42, the reliability of the network can be improved by providing a plurality of networks 600 to provide redundancy.

  FIG. 43 is a functional block diagram of the operation amount generation node 100. The operation amount generation node 100 incorporates a plurality of control programs for vehicle control in a ROM or RAM, and when a failure is detected by the failure detection function 210B, the sensor 500, the sensor 550, or the actuator drive node 400. When the failure detection notification 230 is received from the control program, the control program is switched in accordance with the failure location and the degree of failure.

  FIG. 44 is a functional block diagram of the actuator drive node 300. The actuator drive node 300 incorporates a plurality of control programs in the ROM or RAM for calculating the operation target value of the actuator 400 based on the operation amount command value 120 received from the operation amount generation node 100. The actuator drive node 300 controls the actuator 400 based on the control program X for controlling the actuator 400 based on the operation amount command value 120 output from the operation amount generation node 100 and the driver request signal 200 output from the sensor 500. The control program Z has a control program Z that maintains the actuator in a predetermined state regardless of the operation amount command value 120 or the driver request signal 200. The control program can be switched according to the failure situation.

  The basic process for continuing the vehicle movement when a failure occurs in the vehicle control apparatus will be described below by taking the vehicle control apparatus of FIGS. 40 to 44 as an example.

  A basic process when the operation amount generation node 100 fails will be described. When the operation amount generation node 100 detects its own failure by the failure detection function, the operation amount generation node 100 stops transmission of the operation amount command value 120 and transmits a failure detection notification 230. When the failure detection notification 230 cannot be transmitted normally, the operation amount generation node 100 also stops transmitting the failure detection notification 230.

  Thereby, each actuator drive node 300 connected to the network 600 can detect that the operation amount generation node 100 has failed by receiving the failure detection notification 230 from the operation amount generation node 100, and can detect in advance. By not receiving the operation amount command value 120 within the determined time, it is possible to detect that some abnormality has occurred in the operation amount generation node 100.

  If the network 600 is set to time division multiple access (TDMA) and each node is configured to execute message transmission in a predetermined time slot, the operation amount generation node 100 sets the operation amount command value 120 to the value. By confirming the presence / absence of reception in the time slot to be transmitted, it is possible to detect that some abnormality has occurred in the operation amount generation node 100.

When each actuator drive node 300 detects the failure detection notification 230 from the operation amount generation node 100 or detects that the operation amount command value 120 is not received, the actuator drive node 300 switches the control program from (X) to (Y), and The driver request signal 200 of the sensor 500 is taken in from 600, and vehicle motion control such as driving force, braking force, and steering angle is executed.
Thereby, even if the operation amount generation node 100 fails, the vehicle motion control is continued.

  Next, a basic process when the actuator drive node 300 or the actuator 400 fails will be described. The failure of the actuator 400 includes a failure of a rotational position sensor, a current sensor, or the like necessary for actuator control (not shown).

  When the actuator drive node 300 or the actuator 400 provided in each of the four-wheel brakes fails, when the actuator drive node 300 detects its own failure by the failure detection function, it transmits a failure detection notification 230, The control program is switched from (X) to (Z) to release the brake braking of the corresponding wheel.

When receiving the failure detection notification 230, the operation amount generation node 100 controls the braking force with the remaining two or three wheels. Alternatively, the driver directly brakes the vehicle using a mechanical backup mechanism such as a hydraulic mechanism.
Thereby, even if the actuator drive node 300 or the actuator 400 provided in each of the four-wheel brakes breaks down, the vehicle motion control can be continued.

  When the actuator drive node 300 or the actuator 400 provided in the steering has failed, when the actuator drive node 300 detects its own failure by the failure detection function 210C, it transmits a failure detection notification 230 and executes a control program ( The steering angle control is stopped by switching from X) to (Z).

The driver directly controls the steering of the vehicle using a mechanical backup mechanism such as a steering column. When there is no mechanical backup mechanism, a plurality of steering actuator drive nodes 300 and actuators 400 are provided, and the steering angle is controlled by at least one actuator drive node 300 and actuator 400.
Thereby, even if the actuator drive node 300 or the actuator 400 provided in the steering breaks down, the vehicle motion control can be continued.

When the actuator drive node 300 or the actuator 400 provided for the driving force fails, when the actuator drive node 300 detects its own failure by the failure detection function, the failure detection notification 230 is transmitted and the control program is executed. The drive control is stopped by switching from (X) to (Z).
Thereby, even if the actuator drive node 300 or the actuator 400 provided for the driving force breaks down, the vehicle can be stopped safely.

When the brake pedal sensor 500 breaks down, the brakes of all the wheels are released, and the driver directly brakes the vehicle using a mechanical backup mechanism such as a hydraulic mechanism. When there is no mechanical backup mechanism, a plurality of brake pedal sensors 500 are provided so that at least one sensor 500 can detect a driver's request.
Thereby, even if the sensor 500 for brake pedals breaks down, vehicle motion control can be continued.

When the steering sensor 500 fails, the steering control is stopped, and the driver directly steers the vehicle using a mechanical backup mechanism such as a steering column. When there is no mechanical backup mechanism, a plurality of brake pedal sensors 500 are provided so that at least one sensor 500 can detect a driver's request.
Thereby, even if the sensor 500 for a handle breaks down, vehicle motion control can be continued.

When the accelerator pedal sensor 500 fails, the driving force control is stopped and the vehicle is safely stopped. Alternatively, a plurality of brake pedal sensors 500 are provided so that a driver's request can be detected by at least one sensor 500.
Thereby, vehicle motion control can be continued.

  When the sensor 550 breaks down, the operation amount generation node 100 continues the vehicle motion based on the vehicle state information 201 acquired normally and the driver request signal 200 acquired from the sensor 500.

As described above, according to this embodiment, since the operation amount generation node 100 and the actuator drive node 300 back up each other, it is not necessary to add a redundant backup device.
However, when the operation amount generation node 100 fails, the actuator drive nodes 300 execute control independently of each other.

  For this reason, it is necessary for the actuator drive nodes 300 to equally detect the failure of the operation amount generation node 100, and even if some of the actuator drive nodes 300 fail in addition to the vehicle motion integrated control ECU 30, the remaining actuator drive It is necessary to control the vehicle safely by the node 300. In particular, when the brake has a difference between the left and right braking forces, the brake is in a one-effect state, and the vehicle spins during braking.

  An operation example of the operation amount generation node 100 and the actuator drive node 300 for avoiding such a dangerous state will be described in detail with reference to FIGS. 45 to 57. Here, each operation will be described using a brake as an example.

  The operation amount generation node 100 repeatedly executes the brake control process at a constant control cycle (A). This control cycle is determined by the required accuracy of vehicle braking control. On the other hand, as will be described later, each actuator drive node 300 repeatedly executes the braking force control of the actuator 400 at a control cycle (B) that is shorter than the control cycle (A) of the operation amount generation node 100. This is because high accuracy is required for the current feedback control of the actuator 400.

  Therefore, while the operation amount generation node 100 executes a series of processes in the control cycle (A), each actuator drive node 300 repeatedly performs braking force control in the control cycle (B) based on the latest operation amount command value 120. The braking force control is not interrupted by communication processing with the operation amount generation node 100 or the like.

  FIG. 45 is a time chart showing the operation of the actuator drive node 300. The horizontal axis shows the passage of time from left to right. Each actuator drive node 300 repeatedly executes the following processing in the control cycle (B).

  First, the actuator drive node 300 confirms whether or not the operation amount command value 120 or the failure detection notification 230 has been received from the operation amount generation node 100 and the driver request signal 200 has been received from the sensor 500 (reception of the command value and failure detection notification). Confirmation B1). Since these are transmitted at intervals of the control cycle (A), reception of the operation amount command value 120 and the driver request signal 200 can be confirmed using a timer that measures the time of the control cycle (A). Alternatively, reception can be confirmed by transmitting and receiving these in a predetermined time slot using a time division multiple access (TDMA) type network.

  Next, the actuator drive node 300 transmits the braking force of the actuator 400 detected at the end of the previous control cycle and the diagnosis result by the failure detection function 210C to the operation amount generation node 100 and other actuator drive nodes 300 (response) Message transmission B2). At this time, if the operation amount command value 120 is not received in (command value, failure detection notification reception confirmation B1), the operation amount command value is not received, and if the failure detection notification 230 is received, failure detection is performed. Notification is also received at the same time. These are sent together as one response message.

  Next, the actuator drive node 300 determines whether or not the operation amount command value 120 has been received, whether or not the failure detection notification 230 has been received, whether or not the actuator 400 and its own have failed, and whether or not there is a response message from another actuator drive node 300. A control program is selected based on (Control program selection B3). The control program includes a control program (X) for executing braking force control based on the operation amount command value 120, a control program (Y) for executing braking force control based on the driver request signal 200, and an operation amount command value. There is a control program (Z) for releasing the brake irrespective of any of 120 and the driver request signal 200, and one of them is selected.

  The control program selection routine (B3) will be described with reference to the flowchart of FIG.

  First, the occurrence of an abnormality in its own actuator drive node 300 or actuator 400 is determined under the following conditions (step S1610).

Condition 1: A failure is detected as a result of self and actuator diagnosis.
Condition 2: When the failure detection notification 230 is received from the operation amount generation node 100, a response is made if the other two or more actuator drive nodes 300 have not received the failure detection notification 230.
Condition 3: When the failure detection notification 230 is not received from the manipulated variable generation node 100, the response is that the other two or more actuator drive nodes 300 have received the failure detection notification 230.
Condition 4: When the operation amount command value 120 is received from the operation amount generation node 100, a response is made that the other two or more actuator drive nodes 300 have not received the operation amount command value 120.
Condition 5: When the operation amount command value 120 is not received from the operation amount generation node 100, it is replied that the other two or more actuator drive nodes 300 have received the operation amount command value 120.

  When at least one of the above conditions 1 to 5 is satisfied, it is determined that there is a self-abnormality, the control program (Z) is selected, and the brake is released (step S1680).

  Next, occurrence of an abnormality in the operation amount generation node 100 is determined under the following conditions (step S1620).

Condition 6: A response is received when the failure detection notification 230 is received from the operation amount generation node 100 and the other two or more operation amount generation nodes 100 also receive the failure detection notification 230.
Condition 7: A response is made if the operation amount command value 120 is not received from the operation amount generation node 100, and the other two or more operation amount generation nodes 100 also do not receive the operation amount command value 120.

  If neither of the above conditions 6 and 7 is satisfied, the operation amount generation node 100 determines that it is normal, selects the control program (X) (step S1660), and sets the operation amount command value 120 to Based on this, braking force control is executed.

  On the other hand, when at least one of the conditions 6 and 7 is satisfied, the operation amount generation node 100 determines that an abnormality has occurred, and the occurrence of an abnormality in another actuator drive node 300 or the actuator 400 is determined under the following conditions. (Step S1630).

Condition 8: Another actuator drive node 300 notifies a failure.
Condition 9: Another one actuator drive node 300 does not transmit a response message.
Condition 10: When the failure detection notification 230 is received from the manipulated variable generation node 100, a response is made if only one other actuator drive node 300 has not received the failure detection notification 230.
Condition 11: When the failure detection notification 230 is not received from the manipulated variable generation node 100, only one other actuator drive node 300 responds that the failure detection notification 230 is received.
Condition 12: When the operation amount command value 120 is received from the operation amount generation node 100, it is replied that only one other actuator drive node 300 has not received the operation amount command value 120.
Condition 13: When the operation amount command value 120 is not received from the operation amount generation node 100, only one other actuator drive node 300 responds that the operation amount command value 120 is received.

  If none of the above conditions 8 to 13 is satisfied, it is determined that the other actuator drive node 300 and the actuator 400 are normal, and the control program (Y) is selected (step S1670). Based on the request signal 200, braking force control is executed.

  On the other hand, when at least one of the conditions 8 to 13 is satisfied, the other actuator drive node 300 or the actuator 400 is determined to be abnormal, and a control program selection table to be described later is used in order to avoid one-sided braking. Is selected (step S1640), and the control program (Y) or (Z) is selected (step S1650).

  As described above, the actuator drive node 300 has an abnormality in its own actuator drive node 300 or actuator 400, an operation amount generation node 100 abnormality, an abnormality in another actuator drive node 300 or actuator 400 based on conditions 1 to 13. To select a control program.

  In addition, since said conditions differ with the form of a vehicle system or the form of each component, you may use the conditions according to them.

  Further, not receiving the operation amount command value 120 or the failure detection notification 230 from the operation amount generating node 100 is not determined to be abnormal immediately, but may be determined to be abnormal when it has not been received twice or more. . In this case, the number of unreceived times may be exchanged between the actuator drive nodes 300, and the number of unreceived times may be matched by taking a majority vote.

47A and 47B show control program selection tables.
Table (a) selects a control program to brake the vehicle with either the front two-wheel or the rear two-wheel brake when the other actuator drive node 300 or the actuator 400 is abnormal among the four-wheel brakes. To do.

  On the other hand, when the other actuator drive node 300 or the actuator 400 is abnormal among the brakes of the four wheels, the table (b) is controlled so as to brake the vehicle with the brakes of the front and rear wheels on the diagonal line. Select the program.

  In these tables, when the vehicle cannot be braked with either the front two wheels or the rear two wheels, or one of the front and rear wheels on the diagonal line, the braking by all the actuators 400 is released and the driver can It is assumed that the vehicle is braked via a mechanism.

  Of course, even in such a case, vehicle braking may be executed by the remaining normal actuator 400.

  Further, when there is no backup by the hydraulic mechanism, even if the vehicle cannot be braked with either the front two wheels or the rear two wheels, or one of the front and rear wheels on the diagonal line, the remaining normal actuator 400 can brake the vehicle. Need to run. In these cases, it is desirable to suppress the effect of one-sided braking by controlling the rotational speed of the internal combustion engine to reduce the vehicle speed.

  When the control program selection is completed, the description returns to the description using FIG. 45, the braking force is calculated and the brake control is executed (B4), and then the actual braking force is taken in and the failure information is collected (B5).

  FIG. 48 is a time chart showing operations of the operation amount generation node 100 and the actuator drive node 300 at the start time of the brake control. The horizontal axis shows the passage of time from left to right.

  First, when the operation amount generation node 100 detects the depression of the brake pedal by the driver, the operation amount generation node 100 transmits a brake start notification to the four-wheel actuator drive node 300 (1810).

  Upon receiving the braking start notification, each actuator drive node 300 executes its own failure diagnosis and failure diagnosis of the actuator 400 using the failure detection function 210C (1820), and the diagnosis result is sent to the operation amount generation node 100 by a response message. Transmit (1830). Each actuator drive node 300 receives other diagnosis results from each other.

  The manipulated variable generation node 100 receives the diagnosis result of each actuator drive node 300 and selects a wheel to be brake controlled in accordance with the presence / absence of the failure node and the position of the failure node (1840). In addition, when the actuator drive node 300 does not transmit a diagnosis result, it is considered that the corresponding node is faulty. Alternatively, the brake start notification may be transmitted again and the diagnosis result transmission from the actuator drive node 300 may be attempted once or a plurality of times.

  The operation amount generation node 100 calculates a target operation amount for the wheel to be brake controlled (1850), and transmits an operation amount command value 120 to the target actuator drive node 300 (1860).

  Upon receiving the operation amount command value 120, each actuator drive node 300 updates the target value of the braking force control and executes the braking force control of the actuator 400 (1870).

  Further, each actuator drive node 300 transmits the detection result of the braking force of the actuator 400 and the periodic diagnosis result by the failure detection function 210C to the operation amount generation node 100 by a response message at a constant cycle (1880). Also at this time, the actuator drive nodes 300 receive other diagnosis results from each other.

  FIG. 49 is a time chart showing operations of the operation amount generation node 100 and the actuator drive node 300 during brake control. The horizontal axis shows the passage of time from left to right.

The operation amount generation node 100 executes the following process for each control cycle (A).
First, the operation amount generation node 100 receives a response message from each actuator drive node 300 (1910), and refers to the failure diagnosis result of each actuator drive node 300 included in the response message, to each actuator drive node. The presence / absence of abnormality of the actuator 300 and the actuator 400 and the abnormality location are confirmed, and each actuator drive node 300 to be brake-controlled is selected (1920).

  Next, the operation amount generation node 100 calculates a target value operation amount for the wheel to be brake controlled (1930), and transmits an operation amount command value 120 to the target actuator drive node 300 (1940).

  In FIG. 49, the operation amount generation node 100 detects the depression of the brake pedal by the driver and transmits a brake start notification to the four-wheel actuator drive node 300, but starts the brake control. If the difference in the required amount of the driver is determined by whether or not the brake pedal is depressed by the driver, the operation amount generation node 100 always controls the control cycle (A) regardless of whether or not the driver depresses the brake pedal. ) Can repeatedly execute a series of processes.

FIG. 50 is a flowchart for selecting a wheel for executing the braking control.
First, the operation amount generation node 100 determines the occurrence of its own abnormality under the following conditions (step S2010).

Condition 1: A failure is detected as a result of diagnosis by the own failure detection function 210B.
Condition 2: Response messages from three or more actuator drive nodes 300 are not received.

  When at least one of the above conditions 1 and 2 is satisfied, the operation amount generation node 100 determines that the operation is abnormal, and transmits a failure detection notification 230 to the actuator drive node 300 (step S2040). Transmission of command value 120 is stopped (step S2050).

  On the other hand, when neither the condition 1 nor the condition 2 is satisfied, the operation amount generation node 100 is determined to be normal, and occurrence of an abnormality in the actuator drive node 300 or the actuator 400 is determined under the following conditions ( Step S2020).

Condition 3: A failure detection notification is received from the actuator drive node 300.
Condition 4: Response messages from two or less actuator drive nodes 300 have not been received.

  If neither of the above conditions 3 and 4 is satisfied, it is determined that all actuator drive nodes 300 and actuators 400 are normal, and the braking force control for all four wheels is executed (step S2070).

  On the other hand, when any one of the conditions 3 and 4 is satisfied, the actuator drive node 300 or the actuator 400 determines that an abnormality has occurred, and a braking wheel selection table, which will be described later, is used in order to avoid one-sided braking. Referring to (2030), the braking force control by the selected wheel is executed (step S2060).

  As described above, the operation amount generation node 100 determines its own abnormality and the abnormality of the actuator drive node 300 or the actuator 400 based on the conditions 1 to 4, and if the operation amount generation node 100 is normal, normal operation of the actuator is performed. The brake control is executed using the node 300 so as to avoid the one-side effect of the brake. If the brake control itself is abnormal, the brake control is stopped by itself and the control is shifted to the autonomous brake control by the actuator drive node 300.

  In addition, since said conditions differ with the form of a vehicle system or the form of each component, you may use the conditions according to them. In addition, if the response message from the actuator drive node 300 is not received, it is not determined immediately that the response message is abnormal, but may be determined as abnormal when the response message is not received twice or more.

51A and 51B show a braking wheel selection table.
The table (a) selects a braking wheel so as to brake the vehicle with either the front two-wheel or the rear two-wheel brake when the actuator drive node 300 or the actuator 400 is abnormal among the four-wheel brakes. It is.

  In the table (b), when the other actuator drive node 300 or the actuator 400 among the four-wheel brakes is abnormal, the table (b) sets the braking wheels so as to brake the vehicle with the brakes of the front and rear wheels on the diagonal line. To choose.

  Although not shown in these tables, if the vehicle cannot be braked with either the front two wheels or the rear two wheels, or one of the front and rear wheels on the diagonal line, the operation amount generation node 100 is set to It is assumed that the operation amount command 120 is calculated so as to release 400 braking, and the driver brakes the vehicle via hydraulic pressure.

  Of course, even in such a case, the operation amount command 120 may be calculated so that vehicle braking is executed by the remaining normal actuator 400.

  Further, when there is no hydraulic back-up mechanism, even if the vehicle cannot be braked with either the front two wheels or the rear two wheels, or one of the front and rear wheels on the diagonal line, the remaining normal actuator 400 can brake the vehicle. Need to run. In these cases, it is desirable to suppress the effect of one-sided braking by controlling the rotational speed of the internal combustion engine to reduce the vehicle speed.

  FIG. 52 is a time chart showing the operations of the operation amount generation node 100 and the actuator drive node 300 when the left rear wheel actuator drive node 300 or the actuator 400 breaks down at the start timing of the brake control. The horizontal axis shows the passage of time from left to right.

  In the time chart, the operation amount generation node 100 selects a wheel for executing the braking force control based on the braking wheel selection table (a) shown in FIG.

  First, when the operation amount generation node 100 detects that the driver depresses the brake pedal, the operation amount generation node 100 transmits a brake start notification to the four-wheel actuator drive node 300 (2210).

  Upon receiving the brake start notification, each actuator drive node 300 executes its own failure diagnosis and failure diagnosis of the actuator 400 using the failure detection function 210C (2220), and the diagnosis result is sent to the operation amount generation node 100 by a response message. Transmit (2230). At this time, the actuator drive node 300 for the left rear wheel can notify the operation amount generation node 100 that a failure has been detected by a response message. Each actuator driving node 300 receives other diagnostic results from each other.

  The operation amount generation node 100 receives the diagnosis result of each actuator drive node 300, detects that the actuator drive node 300 of the left rear wheel has failed, and selects a wheel to execute braking control on the front two wheels ( 2240).

  The operation amount generation node 100 calculates a target operation amount for the front two wheels (2250), transmits an operation amount command value 120 to the actuator drive node 300 for the front two wheels, and controls the actuator drive node 300 for the rear two wheels. An operation amount command value 120 for releasing the power is transmitted (2260).

  Upon receipt of the operation amount command value 120, the actuator driving node 300 for the front two wheels updates the target value of the braking force control and executes the braking force control of the actuator 400. Also, when the actuator drive node 300 for the right rear wheel receives the operation amount command value 120, it updates the target value of the braking force control and executes the braking force control of the actuator 400. Since it is a value to be released, no braking force is actually generated.

  On the other hand, the actuator drive node 300 for the left rear wheel selects the control program (Z) as a result of detecting its own failure, so that no braking force is generated (2270).

  FIG. 53 is a time chart showing the operations of the operation amount generation node 100 and the actuator drive node 300 when the actuator drive node 300 or the actuator 400 for the left rear wheel fails during brake control. The horizontal axis shows the passage of time from left to right.

  In the time chart, the operation amount generation node 100 selects a wheel for executing the braking force control based on the braking wheel selection table (a) shown in FIG.

  First, the operation amount generation node 100 receives a response message from each actuator drive node 300, and from the failure diagnosis result of each actuator drive node 300 included in the response message, the actuator drive node 300 of the left rear wheel fails. This is detected (2310), and the wheel is selected to execute the braking control on the front two wheels (2320).

  Next, the operation amount generation node 100 calculates a target operation amount for the wheel to be brake controlled (2330), transmits the operation amount command value 120 to the actuator drive node 300 for the front two wheels, and the actuator drive node for the rear two wheels. An operation amount command value 120 for releasing the braking force is transmitted to 300 (2240).

  Upon receipt of the operation amount command value 120, the actuator driving node 300 for the front two wheels updates the target value of the braking force control and executes the braking force control of the actuator 400. Further, when the actuator drive node 300 for the right rear wheel receives the operation amount command value 120, it updates the target value of the braking force control and executes the braking force control of the actuator 400. Since it is a value that releases the braking force, no braking force is actually generated.

  On the other hand, the actuator drive node 300 for the left rear wheel does not generate a braking force to select the control program (Z) as a result of detecting its own failure (2270).

  As described above with reference to FIG. 52 and FIG. 53, even when any one of the actuator drive nodes 300 or the actuators 400 fails, the operation amount generation node 100 sets the normal front two-wheel or rear two-wheel actuator drive node 300. Since the operation amount command value 120 is generated so as to brake the vehicle by using the brake, it is possible to avoid one-side effect of the brake.

  FIG. 54 is a time chart showing the operation of the operation amount generation node 100 and the actuator drive node 300 when the left rear wheel actuator drive node 300 or the actuator 400 that has temporarily failed during the brake control is recovered. The horizontal axis shows the passage of time from left to right.

  In the time chart, the operation amount generation node 100 selects a wheel for executing the braking force control based on the braking wheel selection table (a) shown in FIG.

  Since the actuator drive node 300 for the left rear wheel is out of order, the operation amount generation node 100 selects a wheel so as to execute braking control on the front two wheels, and sends an operation amount command value 120 to the actuator drive node 300 for the front two wheels. At the same time, an operation amount command value 120 for releasing the braking force is transmitted to the actuator drive node 300 of the rear two wheels (2410).

  Each actuator drive node 300 performs its own failure diagnosis and failure diagnosis of the actuator 400 using the failure detection function 210C, and transmits the diagnosis result to the operation amount generation node 100 as a response message (2420). At this time, when the failure is recovered, the actuator drive node 300 for the left rear wheel switches the control program from (Z) to (X) and maintains the braking force in the released state based on the operation amount command value 120 for releasing the braking force. In addition, the fact that the failure has been recovered can be reported to the operation amount generation node 100 by a response message. Each actuator driving node 300 receives other diagnostic results from each other.

  The operation amount generation node 100 receives the diagnosis result of each actuator drive node 300, detects that the failure of the actuator drive node 300 for the left rear wheel has been recovered, and selects the wheel to execute the braking control on the four wheels. (2430).

  The operation amount generation node 100 calculates the target operation amount for the four wheels (2440), and transmits the operation amount command value 120 to the four-wheel actuator drive node 300 (2450).

  Upon receipt of the operation amount command value 120, the actuator driving node 300 for the front two wheels updates the target value of the braking force control and executes the braking force control of the actuator 400. Further, when the actuator drive node 300 for the right rear wheel receives the new operation amount command value 120, it updates the target value of the braking force control and executes the braking force control of the actuator 400. Further, when the actuator drive node 300 for the left rear wheel receives the new operation amount command value 120, it updates the target value of the braking force control and executes the braking force control of the actuator 400.

  As described above with reference to FIG. 54, even when the actuator drive node 300 or the actuator 400 that has temporarily failed is recovered, the operation amount generation node 100 makes the actuator drive node 300 or the actuator 400 normal / abnormal. Accordingly, since the operation amount command value 120 is generated, it is possible to return to the normal control state without causing one-side effect of the brake.

  FIG. 55 is a time chart showing the operation of the actuator drive node 300 when the operation amount generation node 100 fails during brake control. The horizontal axis shows the passage of time from left to right.

  In this time chart, the actuator drive node 300 selects a control program based on the control program selection table (a) shown in FIG.

  When detecting a failure by the failure detection function 210B, the operation amount generation node 100 stops transmitting the operation amount command value 120 and transmits a failure detection notification 230 (2510).

  Upon receiving the failure detection notification 230, each actuator drive node 300 transmits a response message to mutually confirm the reception of the failure detection notification 230, and determines that the manipulated variable generation node 100 is abnormal (2520).

  When determining that the operation amount generation node 100 is abnormal, each actuator drive node 300 switches the control program (X) to the control program (Y), and executes the braking force control based on the driver request signal 200.

  As described above with reference to FIG. 55, even when the operation amount generation node 100 fails, the actuator drive nodes 300 mutually confirm that the operation amount generation node 100 has failed and switch the control program as a whole. Since the vehicle is braked using the driver request signal 200, the braking control of the vehicle can be maintained.

  FIG. 56 is a time chart showing the operations of the operation amount generation node 100 and the actuator drive node 300 when the operation amount generation node 100 that has temporarily failed during the brake control is recovered. The horizontal axis shows the passage of time from left to right.

  In this time chart, the actuator drive node 300 selects a control program based on the control program selection table (a) shown in FIG.

    Each actuator drive node 300 executes the braking force control based on the driver request signal 200 using the control program (Y) because the operation amount generation node 100 is out of order.

  When the failure recovers, the operation amount generation node 100 receives a response message from each actuator drive node 300 (2610), and refers to the failure diagnosis result of each actuator drive node 300 included in the response message for each actuator. The presence / absence and abnormality of drive node 300 and actuator 400 are confirmed, and each actuator drive node 300 to be brake-controlled is selected (2620).

  Next, the operation amount generation node 100 calculates the target value operation amount for the wheel to be brake controlled (2630), and transmits the operation amount command value 120 to the target actuator drive node 300 (2640). It should be noted that the operation amount generation node 100 may transmit a failure recovery notification together to notify the actuator drive node 300 that the failure has been recovered.

  Upon receipt of the operation amount command value 120, each actuator drive node 300 transmits a response message to mutually confirm reception of the operation amount command value 120, and determines that the operation amount generation node 100 is normal (2650). . At this time, it may be determined whether or not the operation amount generation node 100 is normal upon receipt of the failure recovery notification.

  When determining that the operation amount generation node 100 is normal, each actuator drive node 300 switches the control program (Y) to the control program (X) and executes the braking force control based on the operation amount command value 120.

  As described above with reference to FIG. 56, even when the operation amount generation node 100 that has temporarily failed is recovered, each actuator drive node 300 can control the control program according to the normality / abnormality of the operation amount generation node 100. Therefore, it is possible to return to a normal control state without generating one-side effect of the brake.

  FIG. 57 is a time chart showing operations of the operation amount generation node 100 and the actuator drive node 300 when the left rear wheel actuator drive node 300 or the actuator 400 fails during brake control. The horizontal axis shows the passage of time from left to right.

  In this time chart, the actuator drive node 300 selects a control program based on the control program selection table (a) shown in FIG.

  When the operation amount generation node 100 detects a failure by the failure detection function 210B, the operation amount generation node 100 stops transmitting the operation amount command value 120 and transmits a failure detection notification 230 (2510). On the other hand, when the failure detection function 210B detects a failure, the left rear wheel actuator drive node 300 switches the control program (X) to the control program (Z).

  Upon receiving the failure detection notification 230, each actuator drive node 300 transmits a response message and mutually confirms reception of the failure detection notification 230. At this time, the actuator drive node 300 of the left rear wheel that has failed reports the failure detection to another actuator drive node 300 using the response message (2720).

  Accordingly, the other actuator drive node 300 determines that the operation amount generation node 100 and the left rear wheel actuator drive node 300 are abnormal, and selects a control program based on the control program selection table (a).

  The left and right front wheel actuator drive nodes 300 switch the control program (X) to the control program (Y) and execute the braking force control based on the driver request signal 200. The right rear wheel actuator drive node 300 switches the control program (X) to the control program (Z) to release the braking force.

  As described above with reference to FIG. 57, even when the operation amount generation node 100 and the actuator drive node 300 fail, each actuator drive node 300 causes the operation amount generation node 100 and the actuator drive node 300 to malfunction. The control program is switched according to the location of each actuator drive node 300 that has failed, and the braking force control or the release of the braking force using the driver request signal 200 is appropriately executed, so that one-side effect of the brake is avoided. However, the braking control of the vehicle can be maintained.

  In the above description, the operation of the operation amount generation node 100 and the actuator drive node 300 has been described by taking the brake as an example, but the present invention can be similarly applied to steering.

  When a failure occurs in the steering angle control actuator drive node 300 or the actuator 400, the steering angle control actuator drive node 300 transmits a failure detection notification to the operation amount generation node 100 and other actuator drive nodes 300. To do.

  When the operation amount generating node 100 receives the failure detection notification from the actuator driving node 300 for steering angle control, if the actuator driving node 300 and the actuator 400 for steering angle control are multiplexed, a normal steering is performed. Steering control can be continued by transmitting the operation amount command value 120 to the actuator driving node 300 for angle control. Alternatively, it is also possible to continue the steering control by transmitting the operation amount command value 120 to the actuator drive node 300 for brake control so that the rotational movement of the vehicle is caused by the braking force difference between the right wheel and the left wheel of the brake.

  On the other hand, when a failure occurs in the operation amount generation node 100, the operation amount generation node 100 transmits a failure detection notification to each actuator drive node 300. Then, the steering angle control actuator drive node 300 can take in the driver request signal 200 of the sensor 500 and continue the steering control.

  When a failure occurs in the steering angle control actuator drive node 300 or the actuator 400, the braking control actuator drive node 300 receives a failure detection notification from the steering angle control actuator drive node 300. Or the failure of the actuator drive node 300 for steering angle control is detected because the response message is not received, and the braking force difference between the right wheel and the left wheel of the brake is detected based on the driver request signal 200 of the sensor 500. Thus, the steering control can be continued while referring to each operation amount through a response message so as to cause the vehicle to rotate.

  In the above description, the vehicle control device having the operation amount generation node 100 and the actuator drive node 300 has been described, but the present invention does not use the operation amount generation node 100 as shown in FIG. The present invention is also effective for a vehicle control apparatus that controls a vehicle with each actuator drive node 300.

  The actuator drive node 300 in the vehicle control device according to the present embodiment selects either the control program (Y) or the control program (Z) to control the actuator 400. This control program is selected by the vehicle control device. In the embodiment described above, this is the same as when the operation amount generation node 100 fails.

  As a result, the actuator drive node 300 that operates independently controls the actuator 400 while cooperating with each other, so that a safe vehicle control device can be realized even when the operation amount generation node 100 is not provided.

(Ninth embodiment)
Next, a ninth embodiment of the vehicle control apparatus of the present invention will be described with reference to FIGS.
FIG. 58 shows a basic configuration of the vehicle control device in the ninth embodiment. The vehicle control device includes a sensor 500 that detects a driver's request, an actuator 400, an operation amount generation node 100, and an actuator drive node 300.

  Among these, the sensor 500 that detects the driver's request, the operation amount generation node 100, and the actuator drive node 300 include failure detection functions 210A, 210B, and 210C, respectively. The failure detection function 210C of the actuator drive node 300 has not only a self-diagnosis function but also a function of detecting a failure of the actuator 400.

  The operation amount generation node 100 calculates an operation amount command value 120 based on the driver's request signal 200 and the vehicle state signal 201. In response to this operation amount command value 120, the actuator drive node 300 controls the actuator 400 to execute driving, steering, braking, etc. of the vehicle.

  When the failure detection function 210A, 210B, 210C detects a failure in the node or the actuator 400, the failure detection function 210A, 210B, 210C outputs a failure detection notification 230 for notifying that it is in a failure state to the outside of the node. All nodes having a failure detection function are configured to stop output to the outside, that is, fail silent, except for outputting this failure detection notification 230 in a failure state.

  Each node includes a data reception table 9100. Although explanation is omitted here, a data transmission table is also provided. The data stored in the transmission table is output to other nodes at a cycle predetermined by the system. Conversely, data received from other nodes is temporarily stored in a data reception table, and is read out and used in accordance with the control cycle of the node.

  In addition to the connection using signal lines as shown in FIG. 59, each node can be connected in a bus configuration or network configuration that uses a common communication path in a time-sharing manner. In this embodiment, it is assumed that data output from one node can be received by a plurality of nodes. Each failure detection function 210A, 210B, 210C has a function of estimating the state of another node according to the contents of the data reception table and reporting the estimation result to a plurality of nodes.

  FIG. 60 shows a specific example of the data reception table 9100. A message number field 9101 for distinguishing a transmission source and a transmission event is included. This may be an actual field or a specific address pre-assigned to the message, and there may be no actual field.

  Other fields of the data reception table 9100 include a validity field 9102 indicating the validity of the message, a time field 9103 for recording the message transmission time, a message data field 9104, and a failure vote field 9105.

  The message output from each node includes such information, and is stored in the table in the field division predetermined in the receiving node.

  Since it is not necessary to store a message that is not required by the node, the valid field can be invalidated (0) from the beginning as shown in the message number (No. 2) in FIG. On the other hand, although it is not necessary for the control, it can be made effective only for signal monitoring. Of course, if there is a failure detection notification 230 from each node, it is reflected in the data field, and it can be determined whether it is valid.

  A fault diagnosis method for another node will be described with reference to FIG. Here, a case where the operation amount generation node has failed is shown, but the same applies to other nodes.

  First, a message number field corresponding to the operation amount generation node is extracted (step S2110). In the embodiment in which this field is an address, the purpose is achieved by accessing the address.

  Next, the valid field 9102 of the data reception table 9100 is referenced, and if valid and the time field 9103 has been updated, control is performed using the data 9104 from the operation amount generation node. Here, whether or not it is updated is determined, for example, based on whether or not the difference between the time information (now) of the own node and the time field (time) 9103 of each message is within a predetermined fixed value (limit). (Step S2120).

  Returning to FIG. 60, the time included in the message of the node 5 is older than the other nodes, and the difference is 50 or more. Based on this, it is determined that it is not operating. If it is determined that these methods are not effective, it indicates that the operation amount generation node is not operating normally, and control is performed using information transmitted from other nodes (step S2140). On the other hand, when it determines with it being effective, it controls using the information transmitted from the operation amount production | generation node (step S2130).

  Thereafter, in order to notify the determination result to another node, a failure vote output is performed (step S2150). This is stored as a failure vote field. The failure voting field 9105 of the data reception table 9100 is expressed in binary numbers and is associated with message numbers in order from the left. In the example of FIG. 60, it is determined that all the valid nodes except the node 5 are faulty (vote = 1).

  Only the node 5 itself outputs an output of normal (vote = 0), but the node 5 is recognized as invalid by a predetermined algorithm, for example, majority vote, and the valid field is invalidated (steps S2160 and S2170).

  Note that, when a node that has become inoperable is restored, it is realized by, for example, eliminating a problem, automatic resetting, or the like.

  As a result, all the nodes involved in the control can simultaneously accept the node 5, and the occurrence of a situation in which the control method differs for each part of the system can be avoided.

  Note that the voting algorithm in the case of resurrection can select a method different from the failure recognition algorithm. For example, the resurrection can be recognized by matching all nodes. In addition, in order to perform failure voting and share the state in the system, even the actuator node performs output processing.

  As described above, this embodiment is not limited to the above, and can be implemented in various forms. For example, the command controller that generates the control command does not necessarily have to be concentrated on one, and may be configured by a plurality of command controllers.

  As shown in FIG. 62, the sensor controller 3000-1 that takes in the information of the handle angle sensor 3000-2 and outputs the handle angle information D3000 to the network, and the information of the brake pedal position sensor 3001-2 takes in the brake pedal depression amount. Sensor controller 3001-1 for outputting the information D3001 to the network, actuator controller 3002-1 for operating the steering angle control electric motor 3002-2, actuator controller 3003-1 for operating the electric brake caliper, and integrated controller A ( 3010-1) and the integrated controller B (3010-2) may be connected by an in-vehicle network N3000.

  By taking such a configuration, by physically separating the arrangement of the command controller 3010-2 that calculates the target braking force D3010-2 and the command controller 3010-1 that calculates the target steering angle D3010-1, It is possible to reduce the probability that all integrated control functions are lost.

The vehicle control device according to the present invention has the following effects.
(1) Even when the vehicle motion integrated control means cannot be used, communication between the driver's steering means and the vehicle control means becomes possible, and the vehicle control can be executed according to the driver's intention.
(2) In the vehicle control device, when a failure occurs in any one of the nodes, a normal node switches the control based on the failure detection notification transmitted by the node in which the failure has occurred, so that an error occurs in the entire system. Since backup can be performed, a sufficiently reliable vehicle control device can be realized at low cost without increasing the redundancy of individual nodes more than necessary.
(3) By correcting the operation amount by the driver with the correction amount generated by the correction generation node, it is possible to obtain appropriate steering operation and brake operation as a result, and the vehicle can be stabilized.
(4) When the correction amount generation node fails, the function can be degenerated and the operation as operated by the driver can be performed without the correction amount.
(5) Whereas advanced information processing is required to generate a correction amount. Operation amount generation is relatively simple information processing. For this reason, the correction amount generation node is required to have an operation with a smaller number of parts, higher operation frequency, and less electrical and thermal margin than the operation amount generation node 10. As a result, the correction amount generation node 20 has a higher failure rate than the operation amount generation node. Therefore, the effect of the present invention for avoiding the influence due to the failure of the correction amount generation node having a higher failure rate is particularly great.
(6) Even when the operation amount generation node fails, the actuator drive node detects an abnormality of the operation amount generation node and switches the control program to continue the vehicle control, so that the operation amount generation node need not be multiplexed. Thus, a safe and low-cost vehicle control device can be realized.
(7) Since an abnormality is detected between the actuator drive nodes and the control program is switched to an appropriate control program, for example, dangerous vehicle motion such as one-sided braking can be avoided, and even when the operation amount generation node fails Safe vehicle control can be maintained.

DESCRIPTION OF SYMBOLS 1 Master computer 1A Master function 2 Sensor slave computer 2A Sensor processing function 3 Actuator slave computer 3A Actuator control function 3B Simplified master function 4 Sensor 5 Actuator 10 Vehicle motion integrated control means 11 Steering amount control means 12 Braking force control means 13 Driving force control 13 Means 20 DBW system integrated control ECU
21 Internal combustion engine control ECU
22 Transmission control ECU
23 Electric motor control ECU
24 Battery control ECU
25 HMI / ECU
30 Vehicle motion integrated control ECU
31 Steering angle instruction means 32 Deceleration instruction means 33 Acceleration instruction means 35 Control system gateway 36 Body system gateway 41, 41A Steering sensor (steering angle sensor)
42, 42A Brake pedal position sensor 43 Accelerator pedal position sensor 44 Millimeter wave radar / camera 50 Vehicle 51 Steering wheel 52 Brake pedal 53 Accelerator pedal 54 VGR mechanism 60A, 60B Sensor element 61A, 61B A / D converter 62 Match check function 63 Filter function 64 Communication controller 65A, 65B Communication driver 71 Front wheel steering mechanism 72R, 72L Front wheel 73 Front wheel brake mechanism 74 Rear wheel steering mechanism 75R, 75L Rear wheel 76 Rear wheel brake mechanism 77 Front wheel suspension mechanism 78 Rear wheel suspension mechanism 81, 81A SBW・ VGR driver ECU
811 Simple control logic unit 82 SBW driver ECU
83A-83D BBW driver ECU
831 Simple control logic unit 84A to 84D EAS driver ECU
85 Airbag ECU
DESCRIPTION OF SYMBOLS 100 Operation amount generation node 101 Vehicle state estimation part 102 Target state calculation part 103 Vehicle body operation vector operation moment calculation part 104 Operation amount calculation part 105 Vehicle parameter memory | storage part 110 SBW driver ECU
120 Operation amount command value 201 Vehicle state signal 210 Failure detection function 210A to 210D Failure detection function 220 Control program selection function 230 Failure detection notification 300 Actuator drive node 320 Controller 400 Actuator 500, 550 Sensor 600 Network 610 Operation amount generation node 611 Fault tolerance Functions 612, 612a to c Operation amount 614 Time slot 615 Steering column 616 Brake pedal 620 Correction amount generation node 621 Failure detection function 622 622a, 622b Correction amount 623 Failure detection result 624 Time slot 625 Acceleration sensor / yaw rate sensor 630, 630-0 -4 Actuator drive node 631 Comparator 632 Controller 633 Majority function 634 Switch 635 Controller 636 Gain enabled 637 Ramp generator 640 Actuator 641, 641-0 Steering device 642-1-4 Brake 650, 651, 652 Communication path 9100 Data reception table 3000-1 Sensor controller 3000-2 Handle angle sensor 3001-1 Sensor controller 3001-2 Brake pedal position sensor 3002-1 Actuator controller 3002-2 Steering control motor 3003-1 Actuator controller 3003-2 Electric brake caliper 3010-1 Integrated controller A
3010-2 Integrated Controller B
A10, A100 Controller node A11 Processing routine A12 Time condition A13 Self monitor A20 Sensor node A21 Processing routine A22 Time condition A23 Self monitor A30 Actuator node A31 Processing routine A32 Time condition A33 Self monitor A200 Brake pedal sensor node A210 Radar node A300 Front wheel brake actuator Node A310 Right front wheel brake actuator node A320 Left front wheel brake actuator node A400 Node A410 Normal operation A411 Function stop processing A430 Self-monitoring function AA30 Actuator AA300 Left front wheel brake actuator AA301 Left rear wheel brake actuator AA310 Right front wheel brake actuator AA32 Left front wheel brake actuator B10 Vehicle motion control node B101 Communication driver B102 Vehicle motion observer B103 Driver intention grasper B20 Brake pedal node B201 Communication driver B202 Filter correction processing member B203 A / D converter B204 Data standardization unit B30 Brake actuator node B301 Communication driver B302 Brake caliper control unit B303 A / D converter B304 Pre-driver B305 Autonomous distributed control function D1, D2, D3B Data flow D11 Steering amount target value D12 Braking force target value D13 Driving force target value D31 Steering angle instruction means operation Amount D32 Deceleration instruction means operation amount D33 Acceleration instruction means operation amount D3000 Steering angle information D3001 Brake pedal depression amount information D3010-1 Target rudder Angle D3010-2 Target braking force DA10 Controller data DA20 Sensor data DA100 Right front wheel target braking force DA101 Left front wheel target braking force DA200 Brake pedal state quantity DA210 Inter-vehicle distance DF10, DF20DF30 Data field N1 Network N11 Communication bus N1A Control system network (Main bus) )
N1B control system backup network (backup bus)
N2 DBW system sub-network N3 General network N3000 In-car network M1, M1A, M1B, M2, M3A to M3D, M4A to M4D, M5, M6 Electric motor SA20 Sensor SA200 Brake pedal SA210 Radar

Claims (55)

A sensor controller that captures a sensor signal indicating a vehicle state quantity and a driver's operation quantity;
A command controller that generates a control target value based on a sensor signal captured by the sensor controller;
An actuator controller for operating an actuator for receiving a control target value from the command controller to control the vehicle, and a vehicle control device connected via a network,
The actuator controller generates a control target value based on the sensor value of the sensor controller on the network received by the actuator controller when an abnormality occurs in the control target value generated by the command controller. And a control target value generated by the control target value generating means for controlling the actuator. The sensor controller is a deceleration instruction means, an acceleration instruction means and a steering angle instruction means, the actuator controller is a braking force control means, a driving force control means and a steering angle control means, and the command controller is a vehicle controller. Vehicle motion integrated control means for controlling the motion state;
When an abnormality occurs in the command controller, the braking force control means controls the braking force based on the operation amount of the deceleration instruction means, and the driving force control means drives based on the operation amount of the acceleration instruction means. The vehicle control device according to claim 1, wherein the vehicle control device controls force, and the steering angle control means controls the steering angle based on an operation amount of the steering angle instruction means. The command controller includes vehicle state estimating means for estimating a vehicle motion state;
A target state calculating means for calculating a target motion state to be taken by the vehicle, an operating force / moment calculating means for calculating an operating force / moment to be generated in the vehicle based on the estimated vehicle motion state and the target motion state; An operation amount calculating means for calculating a control target value for the braking force control means, the driving force control means and the steering angle control means based on force / moment,
The vehicle control apparatus according to claim 1, comprising a vehicle motion integrated control unit including   The vehicle control device according to claim 3, wherein the motion state and the target motion state of the vehicle are state quantities in a rigid body motion of the vehicle.   The vehicle state estimating means includes a motion state in a local coordinate system fixed to the vehicle, a motion state in a coordinate system fixed to a specific point, a surrounding environment in which the vehicle is traveling, and a control means provided in the vehicle. The vehicle control device according to claim 3, wherein the failure state is estimated and managed.   The target state calculation means calculates the driver's steering intention based on the operation amount of the deceleration instruction means, the acceleration instruction means, and the steering angle instruction means and the vehicle motion state, The limit motion state that the vehicle can take is calculated based on the specifications of the control means provided in the vehicle and the failure state of the control means provided in the vehicle, and based on the vehicle motion state, the driver's intention to drive, and the limit motion state. 6. The vehicle control device according to claim 3, wherein a target motion state is calculated.   The vehicle control device according to any one of claims 3 to 6, wherein the operation force / moment calculation means calculates an operation force / moment in a local coordinate system fixed to the vehicle.   The operation amount calculation means includes a tire vector calculation means for calculating a tire force vector to be generated for each tire based on the operation force / moment, the braking force control means and the driving force control means based on the tire force vector. The vehicle control device according to claim 3, further comprising: an operation amount distribution unit that calculates a control target value in the steering angle control unit.   9. The vehicle control apparatus according to claim 8, wherein the tire vector calculation means calculates a force vector in a local coordinate system fixed to the vehicle.   10. The vehicle control according to claim 8, wherein the operation amount distribution unit is provided corresponding to a configuration of the braking force control unit, the driving force control unit, and the steering angle control unit provided in the vehicle. apparatus. The vehicle control device according to any one of claims 2 to 10, further comprising driving force control means having a configuration in which at least one driving force generation source is shared by a plurality of driving wheels.
The driving force control means receives driving force to be generated on each driving wheel from the vehicle integrated control means for each driving wheel, and drives by driving at least any two of the internal combustion engine, the transmission, and the electric motor. A vehicle control apparatus that performs control to generate a driving force on a wheel. An operation amount generation node that calculates an operation amount command value based on a driver request signal and a vehicle state signal from a sensor, and an actuator drive node that controls an actuator based on an operation amount command value from the operation amount generation node; A vehicle control device for driving, steering and braking the vehicle,
Each of the nodes has a failure detection function, and when a failure in the node is detected by the failure detection function, an action other than notifying that the node is in a failure state is exerted outside the node. When a failure occurs in any node, the control is switched in a normal node other than the node based on the failure detection notification from the node in the failure state, so that the system as a whole operates normally. A vehicle control device characterized by being continued.   The sensor that detects the driver's request is connected to the communication network, and when detecting a failure of the sensor, it has no effect other than notifying the outside of the sensor that the sensor is in a failure state. The vehicle control device according to claim 12, configured as described above.   The vehicle control device according to claim 12 or 13, wherein the sensor that detects the driver's request, the operation amount generation node, and the actuator drive node are connected to the same communication network.   15. The operation amount generation node, when receiving a failure detection notification from a node in a failure state, switches control according to the failure location and stably maintains the traveling state of the vehicle. The vehicle control device described in 1.   When the actuator drive node cannot receive an operation amount command value from the operation amount generation node, an operation amount command value generation that generates an operation amount command value based on a signal of a sensor that detects a driver's request When the operation amount command value from the operation amount generation node cannot be received, the control is switched from the normal control to the control that realizes the operation amount command value generation function, and the running state of the vehicle is stably maintained. The vehicle control device according to claim 14 or 15, characterized in that   The vehicle control device according to any one of claims 14 to 16, wherein the communication network is made redundant. The communication network includes a main bus and a backup bus. The main bus includes all of the sensors that detect a driver's request, the operation amount generation node, and the actuator drive node. The backup bus is connected to a part of the sensor for detecting a driver's request and a part of the actuator drive node. When the main bus is faulty, the actuator drive node itself detects a sensor signal. The vehicle control device according to claim 17, wherein an operation amount command value is generated based on the vehicle to stably maintain a traveling state of the vehicle.   The sensor includes a plurality of sensor elements, an A / D converter that converts the outputs of the plurality of sensor elements into digital values, a matching check function of a plurality of A / D conversion values, a filter function, a communication interface, The vehicle control device according to any one of claims 13 to 18, wherein the vehicle control device is configured by. Sensors that detect the driver's request are a steering angle sensor that measures the rotation angle of the steering wheel, a brake pedal position sensor that measures the depression amount of the brake pedal, and an accelerator pedal position sensor that measures the depression amount of the accelerator pedal.
The operation amount generation node interprets the driver's intention from the signal of the sensor that detects the driver's request, and controls the vehicle motion comprehensively in combination with the sensor signal that detects the vehicle state. It is a drive system integrated control controller that comprehensively controls the controller and the drive system of the vehicle,
The actuator drive node includes a steering actuator drive controller that controls a steering actuator that generates a steering force, a brake actuator drive controller that controls a brake actuator that generates a braking force, and a suspension actuator drive that controls a suspension actuator that adjusts a damping force Controller,
The vehicle control device according to any one of claims 14 to 19, wherein these nodes are connected to the same communication network.   21. The vehicle control device according to claim 20, wherein a radar or a camera that detects a state of an external environment of the vehicle is connected to the communication network.   The accelerator pedal position sensor is connected to the communication network and receives a torque command value from the drive system integrated control controller, and is also connected to an engine control controller that controls the internal combustion engine based on the torque command value. The vehicle control device according to claim 20 or 21, characterized in that   The brake pedal position sensor is configured to continue normal operation even at the time of a single failure when the brake pedal and the brake force generation mechanism are not mechanically coupled. The vehicle control device according to 20 or 21.   When the steering and the steering force generation mechanism are not mechanically coupled, the steering angle sensor and the steering actuator drive controller are configured to continue normal operation even in the event of a single failure, and the steering actuator The vehicle control device according to claim 20 or 21, wherein the vehicle control device is made redundant.   25. The vehicle control device according to claim 24, wherein a force generated by each steering actuator is smaller than that of a steering actuator used in a system in which a steering and a steering force generation mechanism are mechanically coupled. .   When the steering actuator drive controller detects a failure in the node, the drive actuator configured so as not to exert an action other than notifying that the node is in a failure state outside the node is made redundant. 25. The vehicle control device according to claim 24, wherein each of the drive nodes is independently driven by the redundant steering actuator.   The brake pedal position sensor and the steering angle sensor include a plurality of sensor elements, an A / D converter that converts the outputs of the plurality of sensor elements into digital values, and a matching check function of the plurality of A / D conversion values. The vehicle control device according to claim 23 or 24, comprising a filter function and a communication interface to be redundant.   The brake pedal position sensor and the steering angle sensor include at least three sensor elements, an A / D converter that converts outputs of the plurality of sensor elements into digital values, and a majority function of a plurality of A / D conversion values, The vehicle control device according to claim 23 or 24, comprising a filter function and a communication interface. An operation amount generation node for generating an operation amount, a correction amount generation node for generating a correction amount, and an actuator drive node for driving an actuator,
When the correction amount generation node is normal, the actuator drive node controls the actuator using a value obtained by adding the correction amount to the operation amount as a target value, and when the correction amount generation node is abnormal, A vehicle control device that controls the actuator with an operation amount as a target value. An operation amount generation node for generating an operation amount, a correction amount generation node for generating a correction amount, and an actuator drive node for driving an actuator,
When the correction amount generation node is normal, the actuator drive node controls the actuator using a value obtained by adding the correction amount to the operation amount as a target value, and when the correction amount generation node is abnormal, A vehicle control apparatus that controls the actuator using a value obtained by multiplying an operation amount by a coefficient of a correction amount before occurrence of an abnormality as a target value.   31. The vehicle control device according to claim 30, wherein the coefficient is decreased with a predetermined time constant along with an elapsed time from a time when the correction generation node becomes abnormal.   The vehicle control device according to any one of claims 29 to 31, wherein the operation amount generation node generates an operation amount based on an operation angle of a steering column, and the actuator drive node drives a steering mechanism.   The operation amount generation node generates an operation amount based on an operation angle or an operation force of a brake pedal, and the actuator drive node drives a brake provided on a wheel. The vehicle control device described in 1.   The vehicle control according to any one of claims 29 to 33, wherein the correction amount generation node is connected to an acceleration sensor or a yaw rate sensor, and generates a correction amount based on an output of the acceleration sensor or the yaw rate sensor. apparatus.   30. The correction amount generation node connects an acceleration sensor or a yaw rate sensor, and generates a correction amount based on an output of the acceleration sensor or yaw rate sensor and an operation amount generated by the operation amount generation node. 34. The vehicle control device according to any one of 34.   36. The vehicle control device according to any one of claims 29 to 35, wherein the correction amount generation node is a node having higher processing performance than the operation amount generation node. 37. The vehicle control device according to claim 29, wherein the correction amount generation node is a node having an operating frequency higher than that of the operation amount generation node.   The vehicle control device according to any one of claims 29 to 37, wherein the operation amount generation node is a node having a lower failure rate than the correction amount generation node.   The vehicle control device according to any one of claims 29 to 38, wherein the correction amount generation node has a failure detection function. A plurality of actuator driving means for controlling the actuator based on the driver's request and the vehicle state; and a communication means for connecting the plurality of actuator driving means;
A vehicle control device that controls at least one of driving, steering, and braking of the vehicle,
The vehicle drive apparatus according to claim 1, wherein the actuator drive means includes control method selection means for selecting a control method of the actuator based on its own operation state and the operation state of the other actuator drive means.   The actuator driving means includes a failure detecting means for detecting a failure of itself and notifying the occurrence of a failure to the other actuator driving means via the communication means, the failure state of the own actuator and the failure of the other actuator driving means 41. The vehicle control device according to claim 40, wherein a control method of the actuator is selected based on a state. A plurality of actuator driving means for controlling the actuator based on a driver's request or a vehicle state; and a communication means for connecting the plurality of actuator driving means to control at least one of driving, steering and braking of the vehicle In the vehicle control device
The said actuator drive means is provided with the control method selection means which selects the control method of the said actuator based on the reception state of the message via the said communication means from the said other actuator drive means, The vehicle control apparatus characterized by the above-mentioned.   The actuator driving means transmits a message for notifying the operation state to another actuator driving means via the communication means, and the actuator based on whether the message is received from the other actuator driving means. 43. The vehicle control device according to claim 42, wherein the control method is selected. At least one operation amount generating means for calculating an operation amount command value based on a driver's request and a vehicle state; and a plurality of actuator driving means for controlling an actuator based on the operation amount command value from the operation amount generation means; A vehicle control device that controls at least one of driving, steering, and braking of the vehicle, comprising: a communication unit that connects the operation amount generating unit and the actuator driving unit;
The actuator driving unit includes a control method selection unit that selects a control method of the actuator based on its own operation state, the operation state of the other actuator drive unit, and the operation state of the operation amount generation unit. The vehicle control apparatus characterized by the above-mentioned. The operation amount generation means includes a failure detection means for detecting a failure of itself and notifying the actuator driving means or the operation amount generation means of the failure via the communication means,
The actuator driving means includes a failure detecting means for detecting a failure of itself and notifying the other actuator driving means or the operation amount generating means of the failure via the communication means, 45. The vehicle control device according to claim 44, wherein a control method of the actuator is selected based on a failure state of another actuator driving unit and a failure occurrence state of the operation amount generation unit. At least one operation amount generating means for calculating an operation amount command value based on a driver's request or a vehicle state; and a plurality of actuator driving means for controlling an actuator based on the operation amount command value from the operation amount generation means; A vehicle control device that controls at least one of driving, steering, and braking of the vehicle, comprising: a communication unit that connects the operation amount generating unit and the actuator driving unit;
The vehicle drive apparatus according to claim 1, wherein the actuator drive means includes control method selection means for selecting a control method of the actuator based on a reception state of a message from another actuator drive means or the operation amount generation means.   The manipulated variable generation means transmits an manipulated variable command value to each of the actuator drive means via the communication means. When the actuator drive means receives the manipulated variable command value, a response message is generated for the manipulated variable generation. Or the other actuator driving means via the communication means, and the actuator driving means has received an operation amount command value from the operation amount generating means or a response message from the other actuator driving means. The vehicle control device according to claim 46, wherein a control method of the actuator is selected based on whether or not. Sensor means for detecting a driver's request or vehicle state, at least one operation amount generation means for calculating an operation amount command value based on information from the sensor means, and an operation amount command value from the operation amount generation means Or a plurality of actuator driving means for controlling an actuator based on information from the sensor; and a communication means for connecting the sensor means, the operation amount generating means, and the actuator driving means, and driving and steering the vehicle. A vehicle control device for controlling at least one of braking,
The actuator drive means uses the operation amount command value from the operation amount generation means based on its own operation state, the operation state of the other actuator drive means, and the operation state of failure of the operation amount generation means. A vehicle control apparatus comprising: a control method selection unit that selects any one of a control method using the information from the sensor, a control method using information from the sensor, and a control method for bringing the actuator into a predetermined state. The operation amount generation means includes a failure detection means for detecting a failure of itself and notifying the actuator driving means or the operation amount generation means of the failure via the communication means,
The actuator driving means includes a failure detecting means for detecting a failure of itself and notifying the other actuator driving means or the operation amount generating means of the failure via the communication means, A control method using an operation amount command value from the operation amount generation means based on a failure state of another actuator driving means and a failure occurrence state of the operation amount generation means, and control using information from the sensor 49. The vehicle control device according to claim 48, wherein one of a method and a control method for bringing the actuator into a predetermined state is selected. Sensor means for detecting a driver's request or vehicle state, at least one operation amount generation means for calculating an operation amount command value based on information from the sensor means, and an operation amount command value from the operation amount generation means Or a plurality of actuator driving means for controlling an actuator based on information from the sensor; and a communication means for connecting the sensor means, the operation amount generating means, and the actuator driving means, and driving and steering the vehicle. A vehicle control device for controlling at least one of braking,
The actuator driving means is a control method using an operation amount command value from the operation amount generating means based on a reception state of a message from the other actuator driving means or the operation amount generating means, information from the sensor A vehicle control apparatus comprising control method selection means for selecting one of a control method using a control method and a control method for bringing the actuator into a predetermined state.   The manipulated variable generation means transmits an manipulated variable command value to each of the actuator drive means via the communication means. When the actuator drive means receives the manipulated variable command value, a response message is generated for the manipulated variable generation. Or the other actuator driving means via the communication means, and the actuator driving means has received an operation amount command value from the operation amount generating means or a response message from the other actuator driving means. The control method using the operation amount command value from the operation amount generating means, the control method using the information from the sensor, or the control method for bringing the actuator into a predetermined state is selected based on whether or not The vehicle control device according to claim 50, wherein: In a vehicle control device for driving, steering, and braking a vehicle,
Based on a node that detects a driver's request and outputs a signal, calculates an operation amount command value based on the request signal, outputs a signal, and an operation amount command value from the operation amount generation node It has a configuration in which actuator drive nodes that control actuators are distributed and arranged.
Each of the nodes has a data reception table for storing each signal output, and determines the contents thereof, and has a failure detection function for other nodes.   The data reception table includes information indicating the time of the message, and when the time delay is larger than a predetermined value, the transmission source or its communication path is not operating normally or has returned to a normal state. 53. The vehicle control device according to claim 52, which has a function of determining.   54. The vehicle control device according to claim 52 or 53, wherein the data reception table includes a failure voting unit and has a function of identifying a failed node or a node that has returned to a normal state according to a predetermined algorithm.   55. The vehicle control device according to claim 54, wherein the failure determination status of each node is shared by outputting failure diagnosis information of another node as a failure vote.