JP2016165990A - Control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a new and useful control system for an on-vehicle device which has at least one equipment to be used for a plurality of different control purposes.SOLUTION: A control system 10 is sectioned in advance into a plurality of logic blocks 12-26 and constituted by regulating connection relations among the plurality of logic blocks. The plurality of logic blocks operate in cooperation according to the connection relations among the logic blocks so as to control on-vehicle devices 30-36. Each of the plurality of logic blocks has at least one control block. Depending on control purposes, control blocks acting as a management main body taking responsibility for equipment are predetermined as management control blocks. When the control purposes are changed, the management control blocks are changed based on corresponding relations between the predetermined control purposes and the management control blocks. This allows more appropriate control processing to be executed with respect to the equipment.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a control system for an in-vehicle device having at least one equipment used for a plurality of different control purposes.

  For example, Patent Document 1 discloses a vehicle control device that controls a driving mode state of a vehicle. The vehicle control device includes an operation mode management unit and a control unit that drives and controls the actuator in an operation mode included in a control command signal output from the operation mode management unit. When the actuator cannot operate in the designated operation mode, the control unit operates the actuator in another operation mode.

JP 2008-132976 A

  The vehicle control device of Patent Document 1 described above can switch the driving mode of the vehicle to a snow mode, a sports mode, an eco mode, or the like, so that the motion characteristics of the vehicle are suitable for running on a snowy road, or sporty. Or giving priority to improving fuel economy. However, the vehicle control apparatus is configured such that the same control unit always controls the same equipment (engine, brake, etc.) regardless of the switching of the vehicle operation mode. In other words, no consideration is given to changing the control unit that controls the predetermined equipment in accordance with the change in the control purpose.

  The present invention has been made in view of the above points, and an object thereof is to provide a new and useful control system for an in-vehicle device having at least one equipment used for a plurality of different control purposes. .

In order to achieve the above object, a control system according to the present invention employs the following configuration. That is, the control system (10) is for an in-vehicle device (30-36) having at least one equipment (32, 50, 80) used for a plurality of different control purposes, and has a plurality of logics in advance. It is divided into blocks (12 to 26), and is configured by defining a connection relationship between the plurality of logical blocks. To control the device,
Each of the plurality of logical blocks has at least one control block;
Depending on the control purpose, the control block that is the management entity responsible for the control of the equipment is predetermined as the management control block,
Change determination means (S100) for determining whether or not there is a change in the control purpose;
Management control block changing means (S150) for changing the management control block based on the correspondence between the predetermined control purpose and the management control block in response to the change determination means determining that the control purpose has been changed. .

  As described above, when the control purpose is changed, the management control block responsible for controlling the equipment is changed to a management control block corresponding to the changed control purpose. This makes it possible to execute more appropriate control processing for the equipment.

  For example, in a so-called hybrid vehicle including an engine and a motor generator as a vehicle drive source, the same coolant is circulated to the engine and the inverter of the motor generator so that the engine cooling system and the motor generator inverter are cooled. It is possible to make the system common. In this case, depending on the necessity of temperature adjustment (cooling, etc.), using the pump and the flow path switching valve, etc., the state where none of the coolant circulates, the state where the coolant circulates only the engine, Can be switched between a state in which only the inverter circulates and a state in which the coolant circulates through the engine and the inverter.

  When only engine temperature adjustment is required, a control block included in an engine control logic block that controls the operating state of the engine controls the pump and flow path switching valve as equipment. In this way, temperature adjustment control can be performed so that the heat generation temperature of the engine is appropriate. On the other hand, when only the inverter temperature adjustment is required, a control block included in the motor generator control logic block that controls the operation state of the inverter controls the pump and the flow path switching valve. Thereby, it is possible to appropriately adjust the temperature of the inverter that operates to adjust the drive current of the motor generator. Further, when both the engine and the inverter need to be adjusted in temperature, for example, the control block included in the powertrain control logic block for instructing the generated torque to the engine control logic block and the motor generator control logic block. The pump and the flow path switching valve are controlled. In this case, the reason why the operating state of the engine and the operating state of the inverter are both grasped is the powertrain control logic block.

  It is preferable that the management control block described above is also responsible for equipment abnormality determination and fail-safe processing when an abnormality occurs. Thereby, even when the management control block responsible for the control of the equipment is changed, the location of the safety management responsibility for the equipment can be prevented from becoming unclear.

  The reference numerals in the parentheses merely show an example of a correspondence relationship with a specific configuration in an embodiment described later in order to facilitate understanding of the present invention, and are intended to limit the scope of the present invention. Not intended.

  Further, the technical features described in the claims of the claims other than the features described above will become apparent from the description of embodiments and the accompanying drawings described later.

When the vehicle-mounted apparatus in a hybrid vehicle is made into a control object, it is the figure which showed an example of the various functions which a control system has with the functional block. It is explanatory drawing for demonstrating the 1st case where the management control block which bears the responsibility for control with respect to the equipment used for several different control objectives is changed according to the change of a control objective. It is the figure which showed the specific example by which the role as a management control block is transferred from the control block in EMS which is one logical block to the control block in PTC which is another logical block. It is explanatory drawing for demonstrating the 2nd case where a management control block is changed according to the change of the control objective. It is explanatory drawing for demonstrating the 3rd case where a management control block is changed according to the change of the control objective. It is explanatory drawing for demonstrating the 4th case where a management control block is changed according to the change of the control objective. It is a flowchart which shows the main routine of the change process of a management control block. It is a flowchart which shows the route selection process in the change process of a management control block. It is a flowchart which shows the transfer determination process in the change process of a management control block. It is explanatory drawing for demonstrating the example which divided | segmented the function of the management control block and allocated to each different control block.

  Hereinafter, embodiments of a control system according to the present invention will be described with reference to the drawings. In the embodiment described below, an example in which the control system according to the present invention is applied to various in-vehicle devices mounted on a hybrid vehicle having an engine and an electric motor as a travel drive source of the vehicle will be described. However, the control system according to the present invention is not only applied to control of in-vehicle devices in a hybrid vehicle, but is also applied to control of various in-vehicle devices of a normal vehicle having only an engine and an electric vehicle having only an electric motor. May be.

  FIG. 1 is a functional block diagram illustrating an example of various functions of the control system 10 for an in-vehicle device in the hybrid vehicle described above. However, in the example shown in FIG. 1, not all functions of the control system are shown. This is because, for convenience of explanation, FIG. 1 shows only an example of a configuration necessary for explaining the features of the control system 10 according to the present embodiment.

  Specifically, FIG. 1 shows only functional blocks for the control system to control an engine 30 as an in-vehicle device, an ISG (Integrated Starter Generator) 32, a high voltage battery 34, and a heat pump 36. However, the control system 10 may also control all on-vehicle devices that affect the running of the vehicle, such as a transmission, a brake device, and a steering device.

  As shown in FIG. 1, the control system 10 is configured by dividing a plurality of logical blocks (functional blocks) 12 to 26 in advance and defining a connection relationship between the plurality of logical blocks 12 to 26. That is, a logical structure for controlling various vehicle-mounted devices in the control system 10 is defined by the logical blocks 12 to 26 and the connection relationship between the logical blocks 12 to 26. And the control system 10 controls various vehicle-mounted apparatuses, when several logic blocks 12-26 operate | move in cooperation according to the defined connection relation.

  Although not shown in FIG. 1, each of the logical blocks 12 to 26 has at least one, usually a large number of control blocks. Each of the logical blocks 12 to 26 exhibits its function (role) by appropriately combining the arithmetic processing in these many control blocks.

  For example, an engine management system (EMS) 22 as a logic block inputs a sensor signal from various sensors to detect the operating state of the engine and converts it into a signal that can be handled in the logic block. Have In addition, the current generated torque is calculated from the engine operating state grasped from the sensor signal, and when there is a difference with the command torque instructed from the upper logical block (PTC 14), a target for eliminating the difference A control block for calculating the engine operating state. Furthermore, a control block for calculating a fuel injection amount, a fuel injection timing, and an ignition timing for achieving the target engine operating state is provided. In addition, it has a control block for adjusting the engine temperature in accordance with the heat generation temperature of the engine. However, these are merely examples, and the EMS 22 may include a control block that performs other arithmetic processing necessary to exhibit its function. In addition, the control blocks in the EMS 22 including the exemplified control blocks can be appropriately integrated or, on the contrary, can be subdivided.

  The control system 10 is actually embodied by mounting each of the logic blocks 12 to 26 as a program or database in an electronic control unit (ECU). At this time, as long as the connection relationship between the logical blocks can be maintained, the number of electronic control devices on which the logical blocks 12 to 26 are mounted is arbitrary. For example, all the logic blocks 12 to 26 may be mounted on one electronic control device, or each logic block 12 to 26 may be mounted on a separate electronic control device. When each of the logical blocks 12 to 26 is mounted on a plurality of electronic control devices, the plurality of electronic control devices are connected via individual communication lines so that the logical block connection relationship can be maintained. Each electronic control unit is connected to a common network, and desired electronic control units according to a connection relationship are configured to be able to communicate with each other.

  Next, various functions of the control system 10 shown as the logic blocks 12 to 26 in FIG. 1 will be described.

  As shown in FIG. 1, various types of information are input to the control system 10. For example, the human machine interface (HMI) 2 means an operation unit operated by a driver for driving a hybrid vehicle, and corresponds to an accelerator pedal, a brake pedal, a shift lever, a steering wheel, and the like. Each operation amount in the operation unit is detected by a sensor or the like and input to the control system 10.

  When the hybrid vehicle includes an electronic control device for driving support, information from the electronic control device is also input to the control system 10. For example, as an electronic control device for driving support, an adaptive cruise control system (ACC) 4, a parking control system (PCS) 6, a lane keep assist system (LKA) 8, and the like are applicable. In addition, when the hybrid vehicle includes an anti-lock brake system (ABS), a traction control system (TRC), and a vehicle stability control system (VSC), information from these systems is also sent to the control system 10. Entered. This is because the driving torque of the vehicle may be determined by these electronic control devices.

  The various types of information described above are given to the VLC 12 that is a control block responsible for the front-rear behavior adjustment function of the control system 10. However, the input information can be given to other control blocks as needed. The VLC 12 calculates the target acceleration (deceleration) in the front-rear direction so as to control the behavior of the vehicle in the front-rear direction so as to correspond to the operation of the driver in principle, and realizes the target acceleration (deceleration). Target drive torque (axle torque target value) is calculated and output to the PTC 14 which is a logic block responsible for the drive force adjustment function.

  The BATC 24, which is a logic block responsible for the battery control function, detects the voltage, current, and temperature of the high-voltage battery 34, and outputs the detection results to the ELC 20, which is a logic block responsible for the electrical load adjustment function. The BATC 24 determines whether or not an abnormality has occurred in the high voltage battery 34 based on the detected voltage, current, and temperature. Furthermore, the BATC 24 suppresses an increase in the temperature of the high-voltage battery 34 by driving a cooling fan (not shown) based on the detected temperature.

  The ELC 20 calculates a charge level (SOC) that is a ratio of the remaining charge to the battery capacity based on the voltage, current, and temperature of the high-voltage battery 34 provided from the BATC 24. Then, the ELC 20 calculates the maximum allowable discharge amount and the required charge amount of the high-voltage battery 34 based on the charge level, and outputs the calculated maximum allowable discharge amount and the required charge amount to the MGC 16 that is a logic block that bears the motor generator adjustment function.

  In addition to the high voltage battery 34 that provides a drive voltage to the ISG 32 and stores the voltage generated by the ISG 32, the vehicle has various electric loads (ECU, motor, display monitor, A low voltage battery (not shown) is also provided to provide an operating voltage to an audio device or the like. The high voltage battery 34 and the low voltage battery are connected via a step-down converter, and the low voltage battery 34 can be charged by the high voltage battery 34 by operating the step-down converter.

  Therefore, the ELC 20 detects the charge level of the low-voltage battery and the operating state of the electric load described above, and determines whether or not charging is necessary. When charging is necessary, the ELC 20 calculates the maximum allowable discharge amount and the required charge amount of the ISG 32 in consideration of the amount of power necessary for charging the low-voltage battery. However, the ELC 20 may temporarily stop the operation of the electric load when it is determined that priority should be given to the supply of power to the ISG 32.

  The MGC 16, which is a logic block responsible for the motor generator adjustment function, determines the amount of regenerative power that should be generated by the ISG 32 during regenerative braking, according to the required charge amount output from the ELC 20. When regenerative braking is performed, the ISG 32 is instructed about the amount of regenerative power. In addition to the motor body, the ISG 32 includes an inverter and a control unit for controlling the operation of the inverter. The control part of ISG32 controls an inverter so that it may become the instruct | indicated regenerative electric energy.

  Further, the MGC 16 calculates the maximum torque that can be generated by the ISG 32 based on the maximum allowable discharge amount output from the ELC 20, and outputs the calculated maximum torque to the PTC 14 that is a logic block responsible for the driving force adjustment function. The PTC 14 determines the target engine torque and the target motor torque in consideration of the maximum possible torque generated by the ISG 32 in order to generate the target drive torque acquired from the VLC 12 in the vehicle. The target engine torque is output to the EMS 22, which is a logic block responsible for the engine control function. Further, the target motor torque is output to the MGC 16. The EMS 22 controls the ignition timing of the engine and the fuel injection amount and the injection timing in order to generate the given target engine torque. Further, the MGC 16 instructs the control unit of the ISG 32 to generate a given target motor torque. In this case, the control unit of the ISG 32 detects the rotation of the ISG 32 and controls the inverter so that the ISG 32 generates the instructed target motor torque based on the detected rotation state.

  In a hybrid vehicle, if the engine is operated in an efficient region, waste heat is reduced, and thus there is a possibility that necessary heating energy cannot be secured. On the other hand, when the waste heat of the engine is increased in order to secure heating energy, fuel efficiency is deteriorated. In order to prevent such deterioration of fuel consumption due to heating, the vehicle includes a heat pump 36 as a heating heat source.

  The THC 18, which is a logic block responsible for the heat adjustment function, detects the outside air temperature and the set temperature, and calculates the heating energy necessary for heating the passenger compartment. When the heating energy obtained from the engine cooling water is insufficient with respect to the required heating energy, the target operating state of the heat pump 36 is calculated so that the required heating energy can be obtained most efficiently. The THC 18 outputs the calculated target operation state of the heat pump 36 to the HPC 26, which is a logic block responsible for the heat pump control function. The HPC 26 controls the operation state of the heat pump 36 so that the operation state of the heat pump 36 becomes a given operation state.

  Next, features of the control system 10 according to the present embodiment will be described. The above-described control system 10 targets several on-vehicle devices (engine 30, ISG 32, high-voltage battery 34, heat pump 36), and some of these on-vehicle devices are used for a plurality of different control purposes. Some have one piece of equipment. Note that the term “equipment” may refer to the in-vehicle device itself. Under such a premise, in the control system according to the present embodiment, regarding the equipment used for a plurality of different control purposes, the control block (management control block) responsible for the control of the equipment responds to the change of the control purpose. The feature is that it is configured to be changed.

  Hereinafter, specific explanation will be given while showing some cases as examples. First, a 1st case is demonstrated based on FIG.2 and FIG.3.

  In the hybrid vehicle, it is conceivable that the cooling system of the engine 30 and the cooling system of the inverter of the ISG 32 are made common so that the same coolant circulates between the engine 30 and the inverter of the ISG 32. In this case, in the cooling system, in addition to the radiator for cooling the heated cooling water with air, the pump 52 for circulating the cooling liquid and the temperature of the cooling water as shown in FIG. A water temperature sensor 54 to detect, a flow path switching valve 56 such as a three-way valve for switching the circulation path of the cooling water, and the like are provided.

  By controlling the pump 52 and the flow path switching valve 56, according to the necessity of temperature adjustment (cooling, etc.) of the inverter of the engine 30 and the ISG 32, the state in which no coolant circulates, It is possible to switch between a circulating state, a state where the coolant circulates only through the inverter of the ISG 32, and a state where the coolant circulates through both the engine 30 and the inverter.

  When only the temperature adjustment of the engine 30 is necessary, as shown in FIG. 2, the control block belonging to the EMS 22 responsible for the control function of the operation state of the engine 30 controls the equipment 50 including the pump 52 and the water temperature sensor 54. It is reasonable to be a responsible management control block 48. The EMS 22 grasps the operating state and heat generation state of the engine 30 and controls the flow rate by the pump 52 based on the temperature detected by the water temperature sensor 54 so that the heat generation temperature of the engine 30 becomes appropriate. This is because the temperature control can be controlled by circulating the cooling water.

  Note that “responsible for control” means that if the target is an actuator such as the pump 52, the control target value is determined for the actuator and a control signal corresponding to the control target value is output. Means that. In addition, if the target is a sensor such as the water temperature sensor 54, it means that the sensor signal reception processing detected by the sensor is performed.

  When only the temperature adjustment of the inverter of the ISG 32 is necessary, as shown in FIG. 2, the control block belonging to the MGC 16 responsible for the control function of the inverter of the ISG 32 may become the management control block 48 of the equipment 50. Is reasonable. This is because the temperature of the inverter that operates to adjust the drive current of the ISG 32 can be appropriately adjusted.

  Further, when it is necessary to adjust the temperature of both the engine 30 and the inverter of the ISG 32, a control block belonging to the PTC 14 that instructs the generated torque to the EMS 22 and the MGC 16 is provided on the equipment 50 as shown in FIG. It is reasonable to become the management control block 48. In this case, it is the PTC 14 that can grasp both the operating state of the engine 30 and the operating state of the inverter of the ISG 32.

  In this way, by changing the management control block 48 as the control subject in accordance with the change of the control purpose for adjusting the temperature, it is possible to execute more appropriate control for the changed control purpose. Become.

  In the present embodiment, the management control block 48 is responsible for controlling the equipment 50 as a management entity. This responsibility for control is not limited to control signal output processing and sensor signal reception processing as described above. For example, the management control block 48 is responsible for determining the abnormality of the equipment 50 and executing fail-safe processing when an abnormality occurs as one of the control responsibilities. Thereby, even when the management control block 48 responsible for the control of the equipment 50 is changed, the location of the safety management responsibility for the equipment 50 can be prevented from becoming unclear.

  For example, if the equipment is an actuator, the management control block 48 detects how the actuator has operated with respect to the output of the control signal using a sensor or the like. If the operation according to the output control signal is not performed, it is determined that an abnormality has occurred in the actuator. If the management control block 48 determines that an abnormality has occurred, the management control block 48 executes the fail-safe process by transmitting the fact that the abnormality has occurred and the content of the abnormality to another logical block. For example, when an abnormality occurs in the pump 52 and the engine 30 or the like cannot be cooled, that fact is transmitted from the management control block 48 to each control block. As a result, each control block can limit the engine rotation to a predetermined rotation speed or less to prevent overheating, or limit the ISG rotation speed to a predetermined rotation speed or less so that the inverter does not generate excessive heat. You can take action.

  In addition, when the equipment is a sensor, the management control block 48 determines the abnormality of the sensor based on the level of the sensor signal, the presence / absence of a temporal change, and the like. When it is determined that the sensor is abnormal, the fail-safe process is executed by transmitting the occurrence of the abnormality to another logic block as in the case of the actuator. At this time, the management control block 48 may generate and output a standard sensor signal for a logic block that requires a sensor signal from the corresponding sensor for control processing.

  As described above, in the present embodiment, the management control block 48 that is a management entity for one piece of equipment 50 is changed (shifted) to a different control block in accordance with a change in control purpose. Therefore, the equipment 50 whose management subject is changed is configured to be able to communicate with a plurality of control blocks that can be the management control block 48. Specifically, one piece of equipment and a plurality of control blocks that can become the management control block 48 may be connected to each other via individual communication lines. Alternatively, the equipment 50 may be connected to a network and configured to be able to communicate with an arbitrary control block among a plurality of control blocks that can be the management control block 48 via the network.

  As a more specific example, FIG. 3 shows an example in which the authority as the management subject is transferred from the control block belonging to the EMS 22 to the control block belonging to the PTC 14.

  As shown in FIG. 3, the EMS 22 includes, as control blocks, a control block 68 that controls injection and ignition, and a control block 72 that adjusts the temperature of the engine 30. It should be understood that FIG. 3 does not show all the control blocks that the EMS 22 has.

  When only the temperature adjustment of the engine 30 is performed, the control block 72 in the EMS 22 becomes a management control block 48 that is a management entity of the pump 52 and the water temperature sensor 54. In this case, the control block 72 performs a sensor signal reception process from the water temperature sensor 54 to acquire the temperature of the cooling water. Then, the control block 72 determines a target flow rate of the cooling water, that is, a target rotational speed of the pump 52 based on the acquired cooling water temperature, and outputs a control signal to the pump 52 so as to be the target rotational speed.

  For example, when it becomes necessary to drive the ISG 32 in addition to the engine 30, not only the engine 30 but also the temperature control of the inverter of the ISG 32 is required. In this case, the authority as the management subject is transferred from the control block 72 in the EMS 22 to the control block 62 in the PTC 14. The PTC 14 has a control block 60 for calculating engine torque and a control block 62 for performing heat management in an integrated manner. However, not all the control blocks are shown in FIG. 3 for the PTC 14 as well.

  When the management entity shifts to the control block 62 in the PTC 14, the control block 62 becomes the management control block 48, and executes processing for receiving sensor signals from the water temperature sensor 54 and processing for outputting control signals to the pump 52. . Further, the control block 62 controls the flow path switching valve 56 to adjust the flow rate of the cooling water flowing toward the engine 30 and the flow rate of the cooling water flowing toward the inverter of the ISG 32. As a result, it is possible to appropriately adjust the temperature of the engine 30 and the inverter of the ISG 32.

  Next, the second case will be described with reference to FIG. The second case shows an example in which the management subject of the temperature sensor 80 that detects the temperature of the ISG 32 is transferred from the control block belonging to the PTC 14 to the control block belonging to the MGC 16.

  When the PTC 14 allocates the target drive torque to the engine 30 and the ISG 32 and determines the target engine torque and the target motor torque, it may be effective to consider the temperature of the ISG 32. This is because it may be necessary to limit the maximum torque that can be generated by the ISG 32 depending on the temperature of the ISG 32. Therefore, normally, the control block in the PTC 14 becomes the management control block 82 as the management subject of the temperature sensor 80.

  Here, when the driver operates the brake pedal and the vehicle is decelerated, the braking torque is adjusted so that the braking torque by the mechanical braking device and the braking torque by the regenerative braking by the ISG 32 match the braking torque requested by the driver. The device and the ISG 32 need to be coordinated and precisely controlled.

  In this case, the PTC 14 instructs the braking torque by the regenerative braking to the MGC 16, and the MGC 16 determines the regenerative electric energy of the ISG 32 so that the instructed braking torque is obtained. However, when the temperature of the ISG 32 (inverter temperature) changes, the on-resistance of the elements constituting the inverter changes, and the regenerative electric energy may change accordingly.

  Therefore, as shown in FIG. 4, at the time of cooperative control of the regenerative brake and the mechanical brake, the management entity of the temperature sensor 80 that detects the temperature of the ISG 32 is shifted to a control block in the MGC 16. Thereby, since the reception process of the sensor signal from the temperature sensor 80 is executed in the MGC 16, the MGC 16 is not affected by a delay when received by another control block or a rounding process during the reception process of the sensor signal. An internal control block can accurately detect the temperature of the ISG 32. Based on this detected temperature, the amount of regenerative electric power corresponding to the instructed braking torque is determined, so that the braking torque by the regenerative braking can be accurately adjusted to the instructed braking torque.

  As in this second case, the control block in the upper logical block usually has the authority as the management entity, but the authority is transferred to the control block in the lower logical block as necessary. Sometimes.

  Next, the third case will be described with reference to FIG. In the third case, an example in which the ISG 32 is installed and the authority as the management entity is transferred between the control block in the EMS 22 and the control block in the MGC 16 is shown.

  The ISG 32 is connected to a crank pulley of the engine 30 via a belt. The ISG 32 exhibits a starter function for starting the stopped engine 30, a motor function for assisting the drive torque generated by the engine 30 during acceleration, and a generator function for generating power during deceleration.

  In this embodiment, when the ISG 32 exhibits the starter function and starts the stopped engine 30, the control block in the EMS 22 that grasps the operating state of the engine 30 becomes the control subject of the ISG 32. That is, the EMS 22 controls the driving of the ISG 32 while constantly monitoring the operating state of the engine 30 when the engine 30 is started. As a result, the drive of the ISG 32 can be controlled so that the engine 30 is started quickly and reliably.

  Further, when the ISG 32 exhibits the motor function to assist the engine 30 and when the generator function performs the power generation, the control block in the MGC 16 responsible for the motor generator adjustment function becomes the controlling entity of the ISG 32. Thereby, adjustment of the assist force by ISG32 and control of regenerative electric energy can be performed appropriately.

  However, as shown in FIG. 5, EMS22 and MGC16 are not directly connected. For this reason, when the management control block 38 is transferred between the control block in the EMS 22 and the control block in the MGC 16, for example, the EMS 22 and the MGC 16 communicate with each other via the PTC 14, and the management control block is between them. 38 can be considered. Indeed, it is possible to move the management control block 38 in this way. However, through the PTC 14, a communication delay or the like occurs, and there is a possibility that the management entity of the ISG 32 may be absent even if temporarily.

  Therefore, in this embodiment, when the management control block 38 is migrated between different logical blocks, the management control block 38 is migrated along the connection relationship between the logical blocks. This is because information can be exchanged smoothly between the connected logical blocks, and the migration process of the management control block 38 can be performed without delay and with certainty.

  Further, as in the third case described above, in the connection relationship between logical blocks, at least between the logical block to which the management control block 38 of the migration source belongs and the logical block to which the management control block 38 of the migration destination belongs. When one independent logical block is interposed, when the management control block 38 is transferred, the control block in the intervening logical block is temporarily set as the management control block 38. As a result, it is possible to prevent the occurrence of a situation in which the equipment management entity is absent at the time of the transition of the management control block 38, even temporarily.

  In the example of the third case described above, when the authority to be a management entity (that is, the role as the management control block 38) is transferred between the control block in the EMS 22 and the control block in the MGC 16. Temporarily sets a control block in the PTC 14 interposed between the EMS 22 and the MGC 16 as a management control block 38. More specifically, for example, when the role of the management control block 38 is transferred from the control block in the EMS 22 to the control block in the MGC 16, the management control block 38 controls the control in the EMS 22 → the control in the PTC 14. Blocks are sequentially transferred to control blocks in the MGC 16.

  However, when the management control block 38 is shifted in order, if the logical block to which the control block that becomes the management control block 38 belongs is stopped or abnormal, and is not operating normally, The process of transferring the management control block 38 is interrupted. In this case, the role as the management control block 38 is returned to the management control block 38 of the migration source. As a result, even when a logical block existing in the migration path of the management control block 38 is not operating normally, it is possible to prevent a situation in which the equipment management entity is absent. The management control block 38 transition process including the logical block state determination will be described in detail later with reference to a flowchart.

  Next, the fourth case will be described with reference to FIG. In the fourth case, an example is shown in which the flow switching valve 56 provided in the cooling water circulation path is equipped, and the authority as the management entity is transferred from the control block in the PTC 14 to the control block in the THC 18. .

  As described above, when the target of temperature adjustment is the inverter of the engine 30 and the ISG 32, the control block in the PTC 14 capable of grasping both the operation state of the engine 30 and the operation state of the inverter of the ISG 32 is a flow path switching valve. 56 management control blocks 58 are obtained. However, when a heating request is generated by a vehicle occupant and the vehicle interior is heated using energy obtained from the cooling water, the control block in the THC 18 is connected to the management control block 58 of the flow path switching valve 56. Become.

  Here, in the case of the fourth case shown in FIG. 6, when the role as the management control block 58 is transferred from the control block in the PTC 14 to the control block in the THC 18, there are two routes. The first route passes through the route PTC14 → MGC16 → THC18, and the second route passes the route PTC14 → MGC16 → ELC20 → THC18.

  As described above, when there are a plurality of routes from the logical block to which the management control block 58 of the migration source to the logical block to which the management control block 58 of the migration destination exists in the connection relationship between the logical blocks, first, the management control is performed. One route is selected for transitioning the role as block 58.

  When selecting a route, safety constraints are evaluated for multiple routes, taking into account at least the presence or absence of power system differences between the logical blocks and the presence or absence of physical communication lines between the logical blocks. A route with less security restrictions is selected.

  For example, the degree of noise countermeasures in which the power level is different from other logic blocks included in the one route because the logic block included in the one route is mounted on a different electronic control device. If the power supply systems are different, such as when operating power is supplied from different power supplies, it is determined that there are many safety restrictions. Conversely, if the power supply of each logical block included in one route is the same power supply level or shares the same power supply device, and there are few differences in the power supply system, it is judged that there are few safety restrictions. To do.

  Further, for example, when logical blocks are connected via a communication line, it is determined that there are many safety restrictions because information exchange between the logical blocks is restricted by a communication protocol. Conversely, if the two connected logical blocks are mounted on the same electronic control unit and communication via a communication line is not necessary for exchanging information, it is determined that there are few safety restrictions. .

  From this point of view, an evaluation value that comprehensively indicates the number of safety restrictions on each route is calculated. Then, the route having the evaluation value with the least safety constraint is selected as the route to which the management control block 58 is transferred. When it is evaluated that the safety restrictions of a plurality of routes are equal, a shorter route having a smaller number of logical blocks is selected.

  In the case of the fourth case shown in FIG. 6 as well, more and less safety restrictions are evaluated between the first route and the second route. A route with less is selected. However, as a matter of fact, in the fourth case shown in FIG. 6, it is considered that the two routes have many overlapping portions and the safety restrictions are often the same. In this case, the first route of PTC14 → MGC16 → THC18 is selected depending on the length of the route.

  Next, the management control block changing process will be described in detail with reference to the flowcharts of FIGS.

  7 to 9 are implemented in the same electronic control unit from the logical block to which the management control block of the migration source belongs to the logical block to which the management control block of the final migration destination belongs. The management control block of the migration source, the management control block of the migration destination, and the control block separate from the management control block of the migration source and the migration destination can be executed. If it is installed in the same electronic control unit, it is possible to acquire and determine information required for changing the management control block, such as whether the management control block can be transferred, in any control block This is because of this. In this case, the management control block changing process may be executed in cooperation with the management control block of the migration source and the management control block of the migration destination.

  However, the logical block to which the migration-source management control block belongs and the logical block to which the final migration-destination management control block belong are mounted on different electronic control devices. When migrating, the processing shown in the flowcharts of FIGS. 7 to 9 is performed in cooperation with one of the control blocks in the migration source electronic control device and one of the control blocks in the migration destination electronic control device communicating with each other. It is necessary to work and execute.

  The flowchart of FIG. 7 shows a main routine of management control block change processing. In step S100 of the flowchart of FIG. 7, it is determined whether or not the control purpose has been changed. If the control purpose has not been changed, there is no need to change the management control block, so the main routine shown in the flowchart of FIG. 7 is terminated. On the other hand, if it is determined that the control purpose has been changed, the process proceeds to step S110.

  In step S110, the control block to which the management control block is to be transferred is specified in accordance with the change of the control purpose. A management control block corresponding to each control purpose is determined in advance, and the corresponding relationship is stored as a map in each electronic control unit. The control block that manages the management control block change process can identify which control block is the management control block with reference to the map.

  Note that this map may be configured so that a master-slave relationship for control purposes can also be defined, assuming that it simultaneously corresponds to a plurality of control purposes. For example, the control currently being processed may be the main, the control corresponding to the control purpose requested later may be the subordinate, and the subordinate control may be executed in the form of correcting the control currently being processed. As a result, control corresponding to a plurality of control purposes can be executed in the management control block that is processing the main control.

  For example, a clutch is provided between a portion where the ISG 32 is connected to the rotation shaft of the engine 30 and the engine 30, and the ISG 32 can rotate the rotation shaft of the engine 30 independently of the engine 30, When the torque required for traveling is small, it is conceivable that only the ISG 32 generates the assist torque with the engine 30 stopped. In this case, the control block in the MGC 16 becomes a management control block, and controls the torque generated by the ISG 32. From such a state, when the torque required for traveling of the vehicle increases and the engine 30 needs to be started, the ISG 32 has two control purposes: assist torque generation and engine start. In this case, the control for generating the assist torque currently being executed is the main control, and the control for starting the engine is the subordinate. Then, the management control block corrects the control content of the ISG 32 so that the torque for starting the engine 30 is also generated in addition to the generation of the assist torque while maintaining the control block in the MGC 16.

  In step S110, it is determined whether the migration source management control block and the final migration destination management control block belong to the same logical block.

  If the management control block of the migration source and the management control block of the final migration destination belong to the same logical block, the management control block must be migrated without considering any safety restrictions. Is possible. For this reason, when it is determined in step S110 that they belong to the same logical block, the process proceeds to step S150 to change the management control block.

  On the other hand, if the management control block of the migration source and the management control block of the final migration destination do not belong to the same logical block, the route to which the management control block is migrated or the logical block of the migration destination ( It is necessary to check the state of the control block. Therefore, if it is determined in step S110 that they do not belong to the same logical block, the process proceeds to step S120.

  In step S120, a migration route selection process for migrating the management control block is executed. The details of this migration route selection processing are shown in the flowchart of FIG. Hereinafter, the migration route selection process will be described with reference to the flowchart of FIG.

  In step S200 in the flowchart of FIG. 8, first, the management control block of the migration source and the management control block of the final migration destination are specified. In the subsequent step S210, a candidate route for shifting the management control block of the migration source to the final management control block of the migration destination is calculated. As described above, in this embodiment, when the management control block is transferred between different logical blocks, the management control block is transferred along the connection relationship between the logical blocks. Therefore, when calculating the candidate route, the connection relationship between the logical blocks is taken into consideration, and the candidate route is calculated so as to follow the connected logical blocks. In addition, when there are a plurality of routes from the logical block to which the management control block of the migration source belongs to the logical block to which the final management control block of the migration destination belongs, the plurality of routes are calculated as candidate routes.

  In step S220, it is determined whether or not a plurality of routes are calculated as candidate routes. At this time, if it is determined that a plurality of routes are not calculated, the process proceeds to step S270, and the calculated only candidate route is selected as a transfer route for transferring the management control block. On the other hand, if it is determined that a plurality of routes have been calculated as candidate routes, the process proceeds to step S230.

  In step S230, an evaluation value related to the above-described safety constraint is calculated for each of the plurality of candidate routes. In step S240, based on the calculated evaluation value of each candidate route, it is determined whether or not the evaluation values of each candidate route are equal, that is, whether there is a difference in the security restrictions of each candidate route. . At this time, if it is determined that the evaluation values are the same, it can be considered that there is no difference in safety restrictions between the candidate routes, so the process proceeds to step S260, and the number of logical blocks that pass through is small. A shorter candidate route is selected as the transition route. On the other hand, if it is determined in step S240 that the evaluation values of the candidate routes are not equivalent, the process proceeds to step S250, and a candidate route with less safety restrictions is selected as a transition route.

  Again, returning to the flowchart of FIG. When a transition route is selected in the process of step S120, a transition determination process for determining whether or not the transition is possible is performed in step S130. Details of this transition determination processing are shown in the flowchart of FIG. Hereinafter, the migration determination process will be described with reference to the flowchart of FIG.

  In step S300 of the flowchart of FIG. 9, it is first determined whether or not the management control block at the migration destination is operating normally. For example, if the management control block of the transfer destination is sleeping, power supply is stopped, or some operation abnormality occurs, it is determined that the management control block is not operating normally. Note that sleep and power supply stoppage are executed in units of logical blocks, so in practice, the operation state of the logical block to which the management control block of the migration destination belongs is confirmed. In addition, the “migration destination management control block” in step S300 includes not only the final management control block but also all management control blocks that pass through to reach the final management control block.

  If it is determined in step S300 that the management control block at the migration destination is not operating normally, the process proceeds to step S340, and the migration prohibited state is set. On the other hand, if it is determined that the management control block of the migration destination is operating normally, the process proceeds to step S310.

  In step S310, it is determined whether or not the control before the change of the control purpose (current control) has been completed with the change of the control purpose. When the control purpose is changed, the control content is also changed, and a new control is started. For this purpose, the control before the control purpose change needs to be terminated. Therefore, in step S310, it is confirmed whether or not the current control has been completed. If it is determined that the current control has not been completed, the process proceeds to step S320, and the logical block executing the control is determined. And command to stop the current control. Thereafter, the process returns to step S300. On the other hand, if it is determined in step S310 that the current control has been completed, the process proceeds to step S330 to set the transition permitted state.

  Again, returning to the flowchart of FIG. When the transition determination processing in step S130 is completed, it is next determined in step S140 whether or not the determination result in step S130 is a transition permission state. At this time, if it is determined that the migration is permitted, the process proceeds to step S150, and a migration process for changing the management control block is started. On the other hand, if it is determined in step S140 that the transition is not permitted, that is, the transition is prohibited, the process proceeds to step S160, the management control block transition process is not executed, and the management control block remains unchanged.

  Even after the management control block migration process is started, it is preferable to continue to determine whether or not the migration-destination management control block is operating normally. If any management control block until the final management control block of the migration destination is not operating normally before the role of the management subject reaches the management control block of the final migration destination When it is determined, it is preferable to return the management control block to the original management control block before starting the migration process. Even when the management control block is returned to the original management control block, similarly to the above, the management control block is shifted so that the intervening logical blocks are sequentially traced along the logical block connection relationship. If it does in this way, it can return to the state which can continue at least original control.

  The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. .

  For example, a logic block having a control block to which the role of a certain equipment as a management control block is transferred is designed to satisfy the same safety requirement level according to a functional safety standard for vehicles (for example, ISO 26262 standard). It is preferable.

  ISO 26262 was established to ensure safety when electronically controlling a vehicle, and each system is identified as a dangerous event (hazard) when a function of the electronically controlled system fails. Ranking is performed using an index called ASIL (Automotive Safety Integrity Level) according to three parameters of level, occurrence frequency, controllability (difficulty of avoidance). In ASIL, five ranks of QM (Quality Management), A, B, C, and D are defined in order from the lowest risk level.

  Furthermore, it is preferable that the logical block existing on the route when shifting from the management control block of the migration source to the final management control block of the migration destination is also designed to satisfy the same safety requirement level. In this way, even if the management entity of the equipment is changed according to the change in the control purpose, it is possible to maintain a state that satisfies the same safety standard.

  In the first to fourth cases described above, the sensor signal reception process, the calculation of the actuator control target value, the control signal output process according to the control target value, the abnormality determination process, and the fail safe according to the abnormality determination result An example has been described in which a management control block having a role such as processing is changed from one control block to another while retaining all roles. However, the role of the management control block may be divided, and only a part of the divided roles may be transferred to another control block.

  A specific example will be described below with reference to FIG. FIG. 10 shows an example in which a rotation sensor 84 that detects the rotation of the engine 30 is equipped, and a part of the role of the management control block is transferred from the control block in the EMS 22 to the control block in the upper PTC 14. ing.

  The rotation sensor 84 is, for example, a crank angle sensor that outputs a rotation detection signal according to the rotation angle of the crankshaft of the engine 30. For example, the rotation sensor 84 is configured to output a pulse signal as a rotation detection signal every time the crankshaft of the engine 30 rotates 10 ° CA. Therefore, based on the rotation detection signal output from the rotation sensor 84, the rotation angle and rotation speed of the engine 30, which are very important information for controlling the operating state of the engine 30, can be calculated. Therefore, normally, the control block in the ESM 22 that controls the operating state of the engine 30 becomes the management control block 86, and in addition to the process of receiving the rotation detection signal of the rotation sensor 84, an abnormality determination process and a fail-safe process when an abnormality occurs And so on.

  When the control block in the EMS 22 receives the rotation detection signal of the rotation sensor 84, for example, the interrupt process is started by a pulse signal as the rotation detection signal. In the interrupt process, the input pulse signal is counted, and the rotation angle of the engine 30 is calculated from the counted number. Further, the rotational speed of the engine 30 is calculated from the interval with the pulse signal input in the past. The calculation processing of the rotation angle and rotation speed of the engine 30 by such interrupt processing requires a relatively high calculation capability. Therefore, the EMS 22 is mounted on an electronic control device having the capability of enabling arithmetic processing by such an interrupt, and is connected to the rotation sensor 84 by a dedicated communication line.

  On the other hand, when the engine 30 and the ISG 32 are driven simultaneously, the PTC 14 needs to control the generated torque of the engine 30 and the generated torque of the ISG 32 in a coordinated manner in order to achieve the target drive torque as a vehicle. That is, it is necessary to match the fluctuations in the torque generated by the engine 30 and the ISG 32 that change from moment to moment. As a trigger for performing this cooperative control, a rotation detection signal from the rotation sensor 84 can be used. Therefore, in the case illustrated in FIG. 10, when the PTC 14 executes cooperative control between the engine 30 and the ISG 32, a part of the role of the management control block of the rotation sensor 84 is transferred to the control block in the PTC 14.

  Hereinafter, the role left in the control block in the EMS 22 and the role transferred to the control block in the PTC 14 will be described.

  As described above, the rotation sensor 84 and the EMS 22 are connected by a dedicated communication line, and the control block in the EMS 22 needs to continuously receive a rotation detection signal from the rotation sensor 84.

  Therefore, in the example shown in FIG. 10, the management control block functions as a receiving unit 86a that performs a process of receiving a rotation detection signal from the rotation sensor 84, and a management unit that performs an abnormality determination process and a fail-safe process other than the receiving process. 86b. Then, the role of the receiving unit 86a is left in the control block in the original EMS 22, and only the role of the management unit 86b is transferred to the control block in the PTC 14.

  By doing so, the physical constraints as described above, i.e., the sensor is connected only to a certain logical block and / or receives a signal from the sensor and processes the received signal. Even in the case where a configuration for preparing is provided only for a specific logical block, it is possible to transfer a part of the role of the management control block 86 to another control block in accordance with the change of the control purpose.

  In addition, when the role of the management control block is divided into the reception unit 86a and the management unit 86b, the reception unit 86a and the management unit 86b need to cooperate closely. Therefore, the reception of the rotation detection signal in the reception unit 86a and the calculated rotation angle and rotation speed of the engine 30 are sequentially transmitted to the management unit 86b. Conversely, when executing the fail safe process based on the result of the abnormality determination in the management unit 86b and the abnormality determination result, the management unit 86b transmits the information to the reception unit 86a.

  In the case described above, the equipment is related to the sensor. However, when the equipment is an actuator, the management control block can be divided based on the same concept. For example, if a certain actuator is connected to a specific logic block via a dedicated communication line, the control block in that specific logic block is left with only an output section that performs control signal output processing to the actuator. A control unit that performs control target value calculation processing, abnormality determination processing, fail-safe processing, and the like can be transferred to the control block in the logical block.

  For example, as in the third case described above, when the ISG 32 is equipped and the ISG 32 is connected to the MGC 16 via a dedicated communication line, the control block in the EMS 22 for starting the engine 30 is used. Is the control subject, only the management unit is moved to the control block in the EMS 22. In this case, the control block in the EMS 22 determines a control target value of the ISG 32 for starting the engine 30. This control target value is given to a control block as an output unit in the MGC 16, and the control block outputs a control signal corresponding to the control target value to the ISG 32.

  On the other hand, when the ISG 32 exhibits the motor function and assists the engine 30, or when the ISG 32 exhibits the generator function and generates electric power, the control block in the MGC 16 serves as a management unit and an output unit. In this case, for example, the ISG 32 and the engine 30 are connected via a clutch. The ISG 32 can rotate independently of the engine 30 and the vehicle is traveling on a gentle downhill. When the PTC 14 determines that only the assist torque of the ISG 32 is sufficient to maintain the desired vehicle speed based on the driving operation, the PTC 14 instructs the EMS 22 to stop the engine 30 and also instructs the MGC 16 to the ISG 32. It is conceivable to indicate the assist torque that should be generated. In response to this instruction, the control block in the MGC 16 determines a control target value and outputs a control signal to the ISG 32. In this state, for example, when an increase in the vehicle speed is instructed by the driver, the PTC 14 instructs the EMS 22 to start the engine, and the MGC 16 generates the ISG 32 by the torque for starting the engine. Instruct to increase torque. Then, the control block in the MGC 16 determines a new control target value and outputs a control signal corresponding to the new control target value to the ISG 32.

  In this way, even if the actuator as the equipment is not configured to be able to communicate with a plurality of control blocks that can serve as management control blocks, the appropriate control block can be substantially managed according to the change of the control purpose. It becomes possible to be a control block.

  Therefore, for example, if the management unit of the equipment related to engine starting (injection, ignition device, electronic throttle, ISG32) is concentrated in a certain control block, it is easy to operate these equipments in a coordinated manner. Yes. Furthermore, even when an abnormality occurs and the engine is stopped, it is possible to easily align the operation of each equipment (for example, injection stops fuel injection, electronic throttle fully closes, ignition device ignites Cut and ISG regenerative operation to encourage engine stop).

10 Control System 12-26 Control Block 30 Engine 32 ISG
34 Battery 36 Heat pump

Claims (19)

A control system (10) for an in-vehicle device (30-36) having at least one equipment (32, 50, 80) used for a plurality of different control purposes,
The control system is divided into a plurality of logical blocks (12 to 26) in advance, and is configured by defining a connection relationship between the plurality of logical blocks, and the plurality of logical blocks are connected between the logical blocks. By controlling the in-vehicle device by operating in accordance with the relationship,
Each of the plurality of logical blocks has at least one control block;
In accordance with the control purpose, a control block that is a management entity responsible for controlling the equipment is predetermined as a management control block,
Change determination means (S100) for determining whether or not the control purpose has been changed;
Management control block change for changing the management control block based on a predetermined correspondence between the control purpose and the management control block in response to the change determination means determining that the control purpose has been changed Means (S150).   The control system according to claim 1, wherein the management control block is also responsible for determining abnormality of the equipment and executing fail-safe processing when the abnormality occurs. The equipment is an actuator for operating an in-vehicle device,
The control system according to claim 1, wherein the management control block having control responsibility for the actuator gives a control signal for controlling the actuator to the actuator.   The role of the management control block is divided into a management unit that determines a control target value of the actuator, and an output unit that performs processing to output the control signal according to the control target value to the actuator, and the role of the output unit The control system according to claim 3, wherein a management control block responsible is fixed to a specific control block, and the management control block serving as the management unit is changed according to a change in the control purpose.   The control system according to claim 4, wherein the management control block that plays a role of the management unit also executes failure determination of the actuator and fail-safe processing when the abnormality occurs.   When a control block that has become a management control block under a certain control purpose determines a control target value for achieving the control purpose and executes control on the actuator, another control purpose may be used. When there is a need to respond simultaneously, the control block that has become a management control block under a certain control objective corrects the control target value so that the other control objective can be achieved at the same time, and the corrected control. The control system according to claim 3, wherein the actuator is controlled according to a target value. The equipment is a sensor for detecting a predetermined physical quantity,
The control system according to claim 1, wherein the management control block having control responsibility for the sensor executes a reception process of a detection signal detected by the sensor.   The role of the management control block is divided into a management unit that performs abnormality determination of the sensor and a fail-safe process when an abnormality occurs, and a reception unit that performs reception processing of a sensor signal from the sensor. The control system according to claim 7, wherein a management control block having a role is fixed to a specific control block, and the management control block having a role as the management unit is changed according to the change of the control purpose. Furthermore, when the authority as the management subject is transferred from the management control block corresponding to the control purpose before the change to the management control block corresponding to the control purpose after the change, A state determination unit (S130) for determining whether or not the authority as the management subject can be transferred;
9. The management control block changing unit according to claim 1, wherein the management control block changing unit changes the management control block when it is determined by the state determining unit that the state can be shifted. Control system.   The control system according to claim 9, wherein the state determination unit determines whether or not a transition is possible based on whether or not the control block of the transfer destination is operating normally.   The control system according to claim 9, wherein the state determination unit determines whether or not the state can be shifted based on whether or not the control for the control purpose before the change is finished.   When the management control block changing means needs to move the management control block between the different logical blocks in order to change the management control block, the management control block changing means follows the connection relationship between the logical blocks. The control system according to claim 1, wherein the control system is configured to shift blocks.   In the connection relationship between the logical blocks, the logical block to which the management control block corresponding to the control purpose before the change belongs and the logical block to which the management control block corresponding to the control purpose after the change belongs. When at least one independent logical block intervenes, the management control block changing means temporarily transfers the control block in the intervening logical block as the management control block when transferring the management control block. The control system according to claim 12, thereby preventing occurrence of a situation in which the management entity of the equipment is absent when the management control block is transferred. A plurality of logical blocks reaching from the logical block to which the management control block corresponding to the control purpose before the change belongs to the logical block to which the management control block corresponding to the control purpose after the change belongs in the connection relationship between the logical blocks Route selection means (S120) for selecting one route when there is a route of
The control system according to claim 12 or 13, wherein the management control block changing unit is configured to change the management control block by shifting the management control block according to the route selected by the route selecting unit. .   The route selection means evaluates safety constraints with respect to the plurality of routes in consideration of at least whether there is a difference in power supply system of each logical block and whether there is a physical communication line between each logical block, and relative The control system according to claim 14, wherein the control system is configured to select a route with a minimum safety constraint.   The control system according to claim 15, wherein the route selection unit is configured to select a shorter route when it is evaluated that safety constraints of the plurality of routes are equivalent.   The logical block to which the management control block corresponding to the control purpose before the change belongs and the logical block to which the management control block corresponding to the control purpose after the change belong to the same safety requirement level according to the functional safety standard The logical block that is designed so as to satisfy the above-described requirements and that is present on the route selected by the route selection means is also designed to satisfy the same safety requirement level. The described control system.   From the logical block to which the management control block corresponding to the control purpose before change belongs to the logical block to which the management control block corresponding to the control purpose after change belongs to the same electronic control unit In this case, any of the management control block corresponding to the control purpose before the change, the management control block corresponding to the control purpose after the change, and a control block separate from the management control block is the The control system according to claim 1, wherein the control system is configured to execute a process for changing a management control block.   The logical block to which the management control block corresponding to the control purpose before the change belongs and the logical block to which the management control block corresponding to the control purpose after the change belong to different electronic control units, When the management control block is transferred between different electronic control devices, any control block in the transfer-source electronic control device and any control block in the transfer-destination electronic control device cooperate with each other while communicating with each other. 18. The control system according to claim 1, wherein the control system is configured to operate and execute processing for changing the management control block.

Images