JP2012245863A - Vehicle control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a vehicle control device capable of achieving both of calculation performance and high reliability.SOLUTION: By performing execution control of a functional module in accordance with a safety level, the function of the vehicle control device is restricted to the minimum required one which is needed for safety of a vehicle, upon the failure of a part of a calculation processing part, and reliability of restricted functions is enhanced, and thereby, reliability upon the failure is improved. Further, when the failure occurs on a part of cores in a microcomputer in which a plurality of cores are incorporated, there is such a possibility that the failure extends to a part other than the core determined as a failure. When the vehicle control device is applied, the calculation processing of the core is restricted to the function necessary for the minimal travelling and consequently, even when the effect of the failure of the part extends to the other part, the effect of the failure can be minimized.

Description

  The present invention relates to a control device for controlling equipment mounted on a vehicle.

  As automobiles become more electronic, vehicle control devices are required to have higher reliability. In particular, higher reliability is required for the control functions of in-vehicle devices related to steering and braking that are directly connected to the safety of passengers.

  When a failure occurs in the vehicle control device, the reliability of the vehicle control device decreases. For example, if a part of the microcomputer of the vehicle control device having a redundant configuration with a plurality of microcomputers and arithmetic processing units installed fails, processing will continue with the microcomputer and arithmetic processing unit that are not faulty, In that case, since the calculation results cannot be compared, the reliability of the in-vehicle control device is lowered.

  Moreover, in order to satisfy the high safety | security standard calculated | required by such a vehicle control apparatus, there exists a problem that the fail safe process for responding to the failure of a vehicle-mounted apparatus will become complicated. Japanese Patent Application Laid-Open No. 2004-151867 describes a technique for restricting an execution program in accordance with a preset operation mode of an in-vehicle device in order to facilitate the design / development for the fail-safe processing of the in-vehicle device.

JP 2010-30506 A

  However, in the prior art, no special consideration is given to the influence of each functional module in the program mounted on the vehicle control device on the entire vehicle control device.

  An object of the present invention is to achieve both maintenance of reliability of a vehicle control device and simplification of fail-safe processing without affecting the entire vehicle control device when a failure occurs in the vehicle control device.

  In order to solve the above problems, the present invention provides a program for a plurality of function modules divided for each function for controlling equipment mounted on a vehicle and an operation system for calling the plurality of function modules in a predetermined order. An abnormality detection unit for detecting an abnormality of the vehicle control device, comprising: a ROM stored as a storage unit; and an arithmetic processing unit that executes the plurality of functional modules and the operation system. Each of the plurality of functional modules has a safety level set in advance according to the influence on the traveling of the vehicle when the execution is stopped, and the operation system detects an abnormality by the abnormality detection unit. When detected, some of the plurality of functional modules are based on the safety level. To provide a vehicle control apparatus characterized by a transition of the execution to the degenerate mode to stop.

  According to the present invention, when a failure occurs in the vehicle control apparatus, the reliability of the vehicle control apparatus can be improved by limiting the functions of the vehicle control apparatus to the minimum functions necessary for traveling.

The program block diagram which shows the Example of this invention. The flowchart which shows operation | movement of OS in the Example of FIG. The block diagram which shows the Example which applied this invention to the electric booster. The program block diagram in the Example of FIG. The flowchart which shows the operation | movement of the failure judgment in the Example of FIG. The block diagram which shows the Example which applied this invention to the electric booster which has a some arithmetic processing part. The operation | movement flow of the motor control apparatus in the Example of FIG. The program block diagram in the Example of FIG. The flowchart which shows the operation | movement of the failure judgment in the Example of FIG.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 shows the configuration of a program built in a read-only memory (hereinafter referred to as ROM) mounted on a vehicle control apparatus according to the present invention. The program includes a function module 10 obtained by dividing the program for each control function, and an OS 11 that executes the function modules in a predetermined execution order. The functional module is given a safety level by the designer, and the safety level for each functional module is stored in a ROM mounted on the vehicle control device. The safety level is set in three stages from level 1 to 3 in consideration of the influence of the functional module on the entire vehicle control device. The safety levels 1 and 2 are set for the function modules necessary for the vehicle to travel at least, and the level 1 and 2 function modules are set so that the vehicle can run if the function modules are healthy. Level 1 is set for a function module that particularly requires reliability, for example, when the function stops, leading to an accident. Level 3 is set for a functional module that can continue running of the vehicle even when stopped. For example, it is set for functions relating to the ride comfort and fuel consumption of the vehicle.

However, in this embodiment, the number of stages is three, but it may be two or four or more. In accordance with each safety level, the operation of each module when an abnormality or failure occurs in the control device is assigned in advance. For example, a specified number of executions is set for a function module having a safety level of 1 and stored in the ROM. For function modules with a safety level of 3, an abnormal output is set and stored in the ROM.
The safety level may correspond to ASIL in ISO 26262, which is a functional safety standard, for example.

  The OS inputs failure information from failure detection means for monitoring failure of the vehicle control device provided outside the arithmetic processing unit, and determines the operation of the functional module according to the operation assigned in advance.

  FIG. 2 is a flowchart showing the operation of the OS. The OS checks a failure notification that informs that a failure has occurred from a failure detection means that detects a failure of the vehicle control device, for example, the inability to write to the memory (20), and in normal operation, that is, when there is no failure notification The function module is executed (21). After execution, the function module to be executed next is called (22), and the function modules are executed in a predetermined order.

  When the OS receives a failure notification from the failure detection means on the vehicle control device, the failure mode, the stop mode for stopping all the processing of the arithmetic processing unit, and a part of the functional module are operated according to the content of the failure. Switch to the degenerate mode (24).

  When transitioning to the stop mode, the OS does not execute the functional module and stops the arithmetic processing unit (25).

  When transitioning to the degenerate mode, the OS determines the operation of the functional module according to the safety level of the functional module (26).

  For example, when receiving a notification from the failure detection means that a normal operation cannot be performed due to a failure of the arithmetic processing unit, the failure processing unit is switched to the stop mode and the arithmetic processing unit stops all processing. Further, when a part of the memory fails, if the failure is in an area other than the memory area used by the minimum function module required for traveling, the process is continued with the function module limited to the degeneration mode.

  When the safety level is 1, the input data of the functional module, that is, the backup area in which the address and data of the read / write memory (hereinafter referred to as RAM) mounted on the vehicle control device referred to by the functional module are preset on the RAM. (27). The OS initializes a counter for counting the number of executions of the functional module to 0 (28). The OS executes the functional module (29) and increments the counter (210). The OS writes the execution result of the functional module, that is, the address and data of the RAM area written by the functional module in the backup area (211). The OS restores the input data RAM to the state before execution from the address and data of the input data written in the backup area (212). The OS executes the functional module (213) and increments the counter (214). If the counter reaches the specified number of executions or more, the OS compares the execution results (216). If the counter is smaller than the specified number of executions, the execution result is written in the backup area (211). All execution results saved in the backup area are compared with the last execution result (216). If they match, the function module to be executed next is called (219), and if they do not match, the counter is initialized ( 28) Perform the operation of the functional module again. In this way, by comparing the results of executing the functional modules multiple times and performing the same calculation again if they do not match, the calculation processing unit is illegal due to the influence of electrical and magnetic disturbances outside the control device. Even when the operation result becomes invalid as a result of the operation, it is possible to detect and correct the invalid result, and to improve the reliability of the operation result.

  When the safety level is 2, the OS executes the function module only once (217) and calls the function module to be executed next (219). The safety level 2 is assigned to a functional module whose safety requirement and reliability are lower than the functional module to which the safety level 1 is assigned. By carrying out like this, since the calculation is executed a plurality of times only for functional modules with higher reliability requirements, the processing load on the arithmetic processing unit can be reduced.

  When the safety level is 3, the OS does not execute the function module, but writes the emergency output stored in the ROM to the RAM storing the execution result of the function module (218), and sets the function module output as a fixed value. The function module to be executed is called (219). The functional module for setting the safety level 3 is capable of running even when the process is stopped. By stopping the safety level 3 function module, the safety load level 1 function module reduces the processing load that is increased by performing the process a plurality of times.

  After calling the function module to be executed next (219), it is checked whether there is a new failure other than the detected failure (220), and if there is a new failure, the failure determination (23) is performed, If there is no failure, the safety level of the functional module to be executed next is confirmed (26). As described above, if the failure determination is not performed unless there is a new failure notification, the processing load can be further reduced.

  Examples of the electric booster will be described below. The electric booster generates the boost of the driver's brake pedal depression force by using the driving force of the motor without using negative pressure unlike a vacuum booster provided in a vehicle that is generally operated by an internal combustion engine. In this system, a master cylinder is driven by a motor to generate a hydraulic pressure in accordance with a depression amount of a brake pedal or a hydraulic pressure command from the outside of the electric booster.

  FIG. 3 is a block diagram of the electric booster. The electric booster includes a master cylinder 38 that generates a brake hydraulic pressure, a pressure sensor 39 that measures a hydraulic pressure (M / C pressure) generated by the master cylinder 38, a motor 35 that drives the master cylinder 38, a motor A resolver 37 for measuring the position of the motor, a current sensor 36 for measuring a current flowing through the motor, a three-phase bridge 34 for driving the motor, a motor control device 30 for giving a current command to the three-phase bridge 34, and a stepping on a brake pedal. A stroke sensor 310 for detecting the amount and a connection means for the in-vehicle network 311 are provided.

  The motor control device 30 includes an arithmetic processing unit 31, a memory unit 32, and a failure detection unit 33 that monitors a memory failure. The arithmetic processing unit 31 is mutually connected to the memory unit 32, reads a program from the memory unit 32, and inputs a calculation result to the memory unit 32. The memory unit 32 includes a RAM and a ROM. The failure detection unit 33 is connected to the arithmetic processing unit 31 and the memory unit 32 and monitors the failure of the memory unit 32. When the failure detection unit 33 detects a failure of the memory unit 32, the failure detection unit 33 notifies the arithmetic processing unit 31 of failure information of the memory unit 32. The failure information of the memory unit 32 includes at which address of the memory unit the failure has occurred.

  FIG. 4 shows the configuration of a program built in the ROM of the memory unit 32 mounted on the motor control device 30 of the electric booster according to the present invention. The program includes a function module obtained by dividing the program for each control function and an OS that executes the function modules in a predetermined execution order. The OS inputs failure information output from the failure detection unit. The functional module is given a safety level. A specified number of executions is given to a functional module of safety level 1. The functional module of safety level 1 improves the reliability of the calculation result by repeating the process for the given specified number of executions. The function module of safety level 3 is given an abnormal output, stops processing when transitioning to the degenerate mode, and outputs the abnormal output as a fixed value, thereby reducing the processing load. Details of the functional modules are described below. “Position command calculation 41” calculates a position command value from an input from a stroke sensor. “M / C pressure sensor signal processing 42” is a process of converting a voltage value, which is an output of the M / C pressure sensor, into an actual pressure amount. “Motor position calculation 43” calculates the motor position based on the motor angle information from the resolver. “Hydraulic pressure deviation calculation 44” is the difference between the hydraulic pressure command value input to the electric booster from the outside of the electric booster via the in-vehicle network and the M / C pressure calculated by the M / C pressure sensor signal processing. calculate. The “hydraulic pressure equivalent position command calculation 45” generates a position command value (hydraulic pressure equivalent position command value) corresponding to the hydraulic pressure from the hydraulic pressure deviation and the motor position. The “switch flag generation 46” determines whether to select a position command or a hydraulic pressure equivalent position command as a command value based on information from inside and outside the electric booster. “Command value selection 47” selects a command value from either a position command value or a hydraulic pressure equivalent position command value based on the determination result of the switching flag generation. The “position deviation calculation process 48” calculates a deviation (position deviation) between the command value selected in the command value selection and the motor position. The “servo control 49” calculates a current command value from the position deviation. The “current control process 410” outputs a three-phase current command value by applying a current limit or voltage limit generated from a motor current or the like to the current command value.

  The position command value is calculated from the amount of movement of the brake pedal input from the stroke sensor (41). The calculated position command is deviated from the motor position calculated based on the motor angle information input from the resolver (48), and a current command value to the motor is calculated from the deviation (49).

  The hydraulic pressure equivalent position command value calculates a positional deviation corresponding to the hydraulic pressure deviation from the deviation between the hydraulic pressure command value and the M / C pressure, and adds the positional deviation corresponding to the hydraulic pressure deviation and the current motor position, Calculate (45). The motor position and deviation calculated based on the motor angle information input from the resolver as a hydraulic pressure equivalent position command are taken (48), and the current command value to the motor is calculated from the deviation (49).

  Switching between relative position control and hydraulic pressure control is performed by switching position command values. Control switching is determined by switching flag generation (46), and actual position command value switching is performed by command value selection (47).

  The level set for each functional module is set based on whether or not the vehicle can run even if the processing is stopped. “Position command calculation 41” is level 2, and “M / C pressure sensor signal processing 42” is set. Level 3, “Motor position calculation 43” is level 2, “Hydraulic pressure deviation calculation 44” is level 3, “Hydraulic pressure equivalent position command calculation 45” is level 3, “Switching flag generation 46” is level 3, “Command value” “Selection 47” is level 2, “Position deviation calculation processing 48” is level 2, “Servo control 49” is level 2, and “Current control processing 410” is level 2.

  The OS operation in the electric booster is as shown in the flowchart shown in FIG. FIG. 5 is a detailed operation of the failure determination (23) in FIG. 2 in the electric booster.

  The OS determines the failure mode from the address of the memory in which the failure has occurred in the failure information of the memory unit output by the failure detection unit. If the memory area used by the function modules of safety level 1 and 2 that are required at least for traveling breaks down, the traveling becomes impossible and the control is stopped as a control device. Since the safety level 3 function module can continue to run even if processing is stopped, if the memory area used by the safety level 3 function module fails, the function is limited and control is continued. The OS calculates the address of the memory used by the functional modules with safety level 1 and 2 (51). Here, the address used by the functional module is calculated, but the address used by the functional module may be stored in the ROM in advance. The address of the failure memory included in the failure information is compared with the address of the memory used by the calculated function module having the safety level of 1 or 2 (52). Since the memory area used by the necessary safety level 1 and 2 functional modules has failed, the failure mode is changed to the stop mode (54). If the comparison results do not match, the memory area used by the safety level 3 functional module has failed, and the failure mode is changed to the degenerate mode (55).

  When the failure mode transitions to the degeneration mode, the function of the motor control device of the electric booster is limited to the minimum necessary one necessary for traveling, and the control is continued. The minimum necessary function for running here is a normal brake operation, and the automatic brake function and the regenerative cooperation function are stopped. Therefore, the safety level of the functional module is a functional module related to relative position control, which is normal brake operation control, that is, “position command calculation 41”, “motor position calculation 43”, “command value selection 47”, “ “Position deviation calculation process 48”, “servo control 49”, “current control process 410” are set to level 2 and other function modules related to the hydraulic pressure control, “M / C pressure sensor signal processing 42”, “liquid control” The safety level of “pressure deviation calculation 44”, “hydraulic pressure equivalent position command calculation 45”, and “switching flag generation 46” is set to level 3. For function modules set to safety level 3, the OS holds the output when abnormal, the OS writes the output when abnormal to the RAM corresponding to the output of the function module, and the function module always outputs the output when abnormal To do. For example, when the abnormal output of the function module “switch flag generation 46” is set to always select the command value from the function module “position command calculation 41”, the OS stores the output value of “switch flag generation 46”. The data for always selecting the command value from the function module “position command calculation (41)” is written into the RAM to be stored, that is, the RAM storing the input value of “command value selection 47”. Thereby, the “command value selection 47” always selects the command value from the “position command calculation 41”.

  As described above, by setting the safety level and the abnormal output, the OS operates only the functional module related to the relative position control, which is set to the safety level 2. Since the output of “Calculation 41” is selected, the motor control device always performs the normal brake operation, and can continue the normal brake operation, which is the minimum necessary function. In the present embodiment, it is assumed that the safety level 1 is not set for the minimum functional modules required for traveling. However, when higher reliability is required, the level 2 functional modules are used. It may be replaced with level 1.

  According to the above embodiment, when a part of the memory fails, unless the functional module that uses the failed memory is the minimum required for traveling, without stopping all control of the arithmetic processing unit, Control can be continued by limiting to the minimum functions required for traveling.

  The block diagram in the Example of the electric booster which has a some arithmetic processing part in FIG. 6 is shown. Here, the case where there are two arithmetic processing units will be described, but in the present invention, the number of arithmetic processing units is not limited.

  In this embodiment, the electric booster drives the master cylinder 38 that generates the brake fluid pressure, the pressure sensor 39 that measures the fluid pressure (M / C pressure) generated by the master cylinder 38, and the master cylinder 38. A motor 35, a resolver 37 for measuring the position of the motor, a current sensor 36 for measuring a current flowing through the motor, a three-phase bridge 34 for driving the motor, and a motor control device 60 for giving a current command to the three-phase bridge 34 And a connecting means for connecting the in-vehicle network 311 and the stroke sensor 310 for detecting the depression amount of the brake pedal.

  The motor control device (60) includes two arithmetic processing units (61a, 61b), two memory units (62a, 62b), and a failure detection unit (63) that monitors failures of the arithmetic processing units (61a, 61b), An arithmetic result comparison unit (64) that compares the arithmetic results of the two arithmetic processing units is provided.

  The arithmetic processing units 61a and 61b are mutually connected to the memory units 62a and 62b, read a program from the memory units 62a and 62b, and input the calculation results to the memory units 62a and 62b. All the arithmetic processing units 61a and 61b have unique identifiers. The memory units 62a and 62b are composed of a RAM and a ROM. The arithmetic processing units 61a and 61b are mutually connected to the arithmetic result comparing unit 64, and give the arithmetic result comparing unit 64 identifier information for specifying which arithmetic processing unit 61a and 61b is the arithmetic result output. The operation result signal is output. All of the arithmetic processing units 61a and 61b are connected to the failure detection unit 63 and output a normal operation signal to which identifier information is added.

  The failure detection unit 63 is connected to the calculation processing units 61a and 61b and the calculation result comparison unit 64, and monitors whether normal operation signals are transmitted from the calculation processing units 61a and 61b. When the normal operation signals from the arithmetic processing units 61a and 61b cannot be received for a certain period of time, a failure notification signal is output to the arithmetic processing units 61a and 61b and the arithmetic result comparison unit 64.

  FIG. 7 is a flowchart showing the operation of the motor control device 60 in the embodiment of FIG. The arithmetic processing units 61a and 61b output a normal operation confirmation signal to the failure detection unit 63 at a fixed timing (710). The failure detection unit 63 inputs a normal operation signal (720), and if there is no input for a certain period of time, it is determined that the operation processing unit has failed, and all the operation processing units 61a and 61b and the operation result comparison unit 64 have failed. A notification signal is output (722). The failure notification signal is given the identifier of the failed arithmetic processing unit 61a or 61b. The arithmetic processing units 61a and 61b confirm the failure notification (711), and if there is a failure notification, notifies the OS executed by the arithmetic processing units 61a and 61b of the failure (713). The arithmetic processing units 61a and 61b execute the calculation (714), and output the calculation result to the calculation result comparing unit 64 (715). The operation result comparison unit 64 checks the failure notification signal output from the failure detection unit 63 (730), and if there is no failure notification, compares the operation results from all the operation processing units 61a and 61b (732). ). If the comparison results match, the calculation result is output to the outside of the motor control device, and an output completion notification is output to the calculation processing units 61a and 61b (736). If they do not match, a recalculation request signal is output to the arithmetic processing units 61a and 61b (734), and the calculation results are compared again (732). When the failure detection signal output from the failure detection unit 63 is confirmed, if there is a failure notification, an operation that has not failed is performed based on the identifier of the failed operation processing unit 61a to 61b included in the failure notification signal. Using the outputs of the processing units 61a to 61b as a comparison result (735), motor control is continued in the arithmetic processing units 61a to 61b that are not in failure.

  The arithmetic processing units 61a and 61b input the recalculation request signal or the output completion notification output from the arithmetic result comparison unit (716), and when the recalculation request is input, execute the calculation again (714). When an output completion notification is input, a normal operation confirmation signal is output (710).

  FIG. 8 shows a configuration of a program built in the ROM of the memory units 62a and 62b mounted on the motor control device 60 in the embodiment of FIG. The program includes a function module obtained by dividing the program for each control function and an OS that executes the function modules in a predetermined execution order. The OS inputs the failure information output from the failure detection unit 63. The functional module is given a safety level. A specified number of executions is given to a functional module of safety level 1. An output at the time of abnormality is given to a functional module of safety level 3. In the present embodiment, since the arithmetic processing unit is made redundant, it is assumed that the reliability required for the control device is high, and the safety function level 1 is assigned to the minimum functional module required for traveling. Although set, this may be set to safety level 2.

  Details of the functional modules are described below. “Position command calculation 81” calculates a position command value from an input from a stroke sensor. “M / C pressure sensor signal processing 82” is a process of converting a voltage value, which is an output of the M / C pressure sensor, into an actual pressure amount. “Motor position calculation 83” calculates the motor position based on the motor angle information from the resolver. “Hydraulic pressure deviation calculation 84” is the difference between the hydraulic pressure command value input to the electric booster from the outside of the electric booster via the in-vehicle network and the M / C pressure calculated by the M / C pressure sensor signal processing. calculate. “Hydraulic pressure equivalent position command calculation 85” generates a position command value (hydraulic pressure equivalent position command value) corresponding to the hydraulic pressure from the hydraulic pressure deviation and the motor position. The “switch flag generation 86” determines whether to select a position command or a hydraulic pressure equivalent position command as a command value based on information from inside and outside the electric booster. “Command value selection 87” selects a command value from either a position command value or a hydraulic pressure equivalent position command value based on the determination result of the switching flag generation. The “position deviation calculation process 88” calculates a deviation (position deviation) between the command value selected in the command value selection and the motor position. The “servo control 89” calculates a current command value (d-axis q-axis) from the position deviation. The “current control process 810” outputs a three-phase current command value by applying a current limit or voltage limit generated from a motor current or the like to the current command value.

  The position command value is calculated from the amount of movement of the brake pedal input from the stroke sensor (81). Based on the calculated position command, the motor position and deviation calculated based on the motor angle information input from the resolver are taken (88), and the current command value to the motor is calculated from the deviation (89).

  The hydraulic pressure equivalent position command value is calculated by calculating a positional deviation corresponding to the hydraulic pressure deviation from the deviation between the hydraulic pressure command value and the M / C pressure, and adding the positional deviation corresponding to the hydraulic pressure deviation and the current motor position. (85). The motor position and deviation calculated based on the motor angle information input from the resolver as a hydraulic pressure equivalent position command is taken (88), and the current command value to the motor is calculated from the deviation (89).

  Switching between relative position control and hydraulic pressure control is performed by switching position command values. Control switching is determined by switching flag generation (86), and actual position command value switching is performed by command value selection (87).

  The OS operation in the embodiment of FIG. 6 is as shown in the flowchart of FIG.

  When a failure occurs in some of the arithmetic processing units, control is continued with the remaining arithmetic processing units, but the reliability of the arithmetic result is lowered. Therefore, the reliability of the limited function is improved by limiting the functions of the control device to the minimum necessary ones necessary for traveling and performing a plurality of calculations for the limited functions.

  FIG. 9 is a detailed operation of the failure determination 23 of FIG. 2 in the embodiment of FIG. The OS determines the failure mode from the identifiers of the failed arithmetic processing units 62a to 62b included in the failure information output by the failure detection unit. The identifier of the failed arithmetic processing unit 62a to 62b included in the failure information is compared with the identifier of the arithmetic processing unit 62a to 62b on which the OS is executed (90). If the processing unit is an arithmetic processing unit on which the OS is executed, there is a possibility of runaway. Therefore, the failure mode is changed to the stop mode (91), the processing is stopped, and the arithmetic processing unit does not output illegally. Like that. At this time, the arithmetic processing unit may have already stopped processing due to a failure. If the comparison results do not match, that is, if the failed arithmetic processing unit is not the arithmetic processing unit in which the OS is executed, the failure mode is changed to the degenerate mode (92).

  When the failure mode transitions to the degenerate mode, the function of the motor control device 60 of the electric booster is limited to the minimum necessary for traveling, and parallel calculation is performed by the plurality of arithmetic processing units 62a and 62b in normal operation. The remaining reliability is ensured by executing the same process a plurality of times in the remaining arithmetic processing units 62a to 62b, and the control is continued. The minimum necessary function for running here is a normal brake operation, and the automatic brake function and the regenerative cooperation function are stopped. Therefore, the safety level of the functional module is the functional module related to the relative position control, that is, “position command calculation 81”, “motor position calculation 83”, “command value selection 87”, “position deviation calculation processing 88”, “ Servo control 89 ”and“ current control processing 810 ”are set to level 1, and the safety level of other functional modules related to hydraulic pressure control is set to level 3. The function module set to the safety level 3 holds the abnormal output, and the OS writes the abnormal output to the RAM. When the abnormal output of the function module “switch flag generation 86” is set to always select the command value from the function module “position command calculation 81”, the RAM in which the output value of “switch flag generation 86” is stored. The data for always selecting the command value from the functional module “position command calculation 81” is written in the RAM in which the input value of “command value selection 87” is stored.

  As described above, by setting the safety level and the abnormal output, the OS executes the function module related to the relative position control that is set to the safety level 1 multiple times, and compares the results to confirm the reliability. Since the output of “position command calculation 81” is always selected when the command value is switched, the motor control device always performs a normal brake operation, which is the minimum necessary function. The normal braking operation can be continued while ensuring the reliability of the calculation result.

  As described above, by executing the execution control of the function modules according to the safety level, it is possible to limit the functions limited to the minimum necessary functions for vehicle safety when some arithmetic processing units fail. By improving the reliability, the reliability at the time of failure is improved.

  Further, when a failure occurs in some cores in a microcomputer incorporating a plurality of cores, there is a possibility that the failure has spread to portions other than the core determined to be a failure. If the present invention is applied, the core calculation processing is limited to the functions required for running at the minimum, so even if the effects of some core failures have spread to other parts, the effects of the failure are minimized. can do.

10 Function module 11, 80 OS
20 Failure existence determination 21, 29, 213, 217 Functional module execution 22, 219 Execution module update 23, 50, 712, 721, 731 Failure determination 24 Failure mode determination 25 Process stop 26 Safety level determination 27 Initial RAM information save 28 Execution Number of times initialization 30, 60 Motor control device 31, 61 Arithmetic processing unit 32, 62 Memory unit 33, 63 Failure detection unit 34 Three-phase bridge 35 Motor 36 Current sensor 37 Resolver 38 Master cylinder 39 Pressure sensor 41, 81 Position command calculation 42 , 82 M / C pressure sensor signal processing 43, 83 Motor position calculation 44, 84 Hydraulic pressure deviation calculation 45, 85 Hydraulic pressure equivalent position command calculation 46, 86 Switching flag generation 47, 87 Command value selection 48, 88 Position deviation calculation processing 49, 89 Servo control 51 Function module address calculation 52 Add Comparison 53 Fault memory judgment 54, 91 Stop mode selection 55, 92 Degeneration mode selection 64 Operation result comparison unit 90 Identifier comparison 210, 214 Count up 211 Execution result saving 212 Rollback 215 Execution time judgment 216,732 Operation result comparison 218 Emergency Time output writing 220 New failure notification 310 Stroke sensor 311 In-vehicle network 410, 810 Current control processing 710 Normal operation confirmation signal output 711, 730 Failure notification signal input 713 Failure notification to OS 714 Calculation execution 715 Calculation result output 716 Recalculation request signal Input 717 Recalculation judgment 720 Normal operation confirmation signal input 722 Failure notification signal output 734 Recalculation request signal output 735 Operation result switching 736 Comparison result output

Claims (5)

ROM that stores a plurality of function modules divided for each function for controlling devices mounted on a vehicle and an operation system that calls the plurality of function modules in a predetermined order as a program;
An arithmetic processing unit for executing the plurality of functional modules and the operation system;
A vehicle control device comprising:
An abnormality detection unit for detecting an abnormality of the vehicle control device,
In each of the plurality of functional modules, a safety level is set in advance according to the influence on the travel of the vehicle when execution is stopped,
When the operation system detects an abnormality by the abnormality detection unit,
The vehicular control device is configured to shift to a degeneration mode in which execution of some of the plurality of functional modules is stopped based on the safety level. The vehicle control device according to claim 1,
A RAM for storing execution results of the plurality of functional modules;
The safety level is determined when the operation system transitions to the degenerate mode.
A result of executing the function module a plurality of times is stored in the RAM, and a first level for comparing the execution results;
A second level that executes the functional module only once,
And a third level for stopping the execution of the function module and outputting a predetermined abnormal time. The vehicle control device according to claim 2,
According to the type of abnormality detected by the abnormality detection unit, the operation system
A control device that makes a transition to one of a stop mode in which all of the plurality of functional modules are stopped and the degeneration mode. The vehicle control device according to claim 3,
The operation system transitions to the stop mode when a failure occurs in an area used by the functional module in which the first level or the second level is set in the RAM.
The control device, wherein a failure mode occurs in a region used by a functional module in which a level other than the first level and the second level is set, makes a transition to the transition mode. The vehicle control device according to claim 2,
The arithmetic processing unit comprises a plurality of arithmetic processing units,
The plurality of arithmetic processing units give an identifier representing which output processing unit outputs to the output signal, and periodically output a normal operation signal with the identifier,
A vehicle control device that detects an abnormality of the vehicle control device based on comparison of output results of the plurality of arithmetic processing units or output of the normal operation signal.

Images