JP4039291B2 - Vehicle control device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a vehicle control device having a fail-safe function capable of preventing the failure of control of a communication system for performing various controls, for example, for performing wiper driving. It is suitable for application to a wiper drive control apparatus.
[0002]
[Prior art]
When a failure occurs in a communication system for performing vehicle control, measures such as fixing the control to the safe side or limiting the control are taken. This countermeasure is determined for each system, and when the communication system fails, a certain control determined according to it is performed.
[0003]
For example, when the communication system fails, the circuit configuration is such that a Hi level output is inevitably output so that each system is fixed to the safe side so that control corresponding to the Hi level output can be performed. Also, when there is a control form that can still be used even if the communication system fails, for example, when manual control can be used even when auto control is disabled, only manual control can be used. It is set to limit control.
[0004]
[Patent Document 1]
Japanese Patent Laid-Open No. 2002-221075
[Problems to be solved by the invention]
However, only the control function restricted at the time of failure of the communication system can be realized only by taking measures such as fixing the control to the safe side or restricting the control as described above.
[0006]
In addition, by configuring the control system as a dual system, it is possible to consider a continuation method in which when one system fails, the other system can be operated. Absent.
[0007]
In view of the above points, an object of the present invention is to enable control equivalent to that before failure even when a failure occurs in a communication system for performing control.
[0008]
[Means for Solving the Problems]
In order to achieve the above object, according to the first aspect of the present invention, there is provided a first control device (1) mounted on a vehicle and generating a control signal for executing the first control based on a built-in control program. The second control device (2) mounted on the vehicle for executing the second control different from the first control, and the control signal from the first control device are input, and the output is based on the control signal The multiplex communication line (4) which connects between the input / output control device (3) to be generated and the first control device, the second control device and the input / output control device and enables communication between these control devices. The first control device and the second control device are general-purpose control devices that are already mounted on the vehicle for on-vehicle equipment control, and a communication system failure occurs between the first control device and the input / output control device. If predicted, via multiple communication lines The control program built in one control device is transferred to the second control device and installed in the second control device. After the installation, the second control device executes the first control on behalf of the first control device. The control signal is output to the input / output control device, and the input / output control device executes the first control based on the control signal.
[0009]
In the vehicle control device having such a configuration, a program is installed from the first control device to the second control device when a communication system failure is predicted between the first control device and the input / output control device. Yes. For this reason, the program can be surely installed before the first control device completely fails. And even after the communication system failure of the first control device occurs, it is possible to obtain a fail-safe function of causing the second control device to execute the same first control as that executed by the first control device. it can. In addition, since a general-purpose control device that is already mounted on the vehicle is used for on-vehicle device control, a separate control device is installed to install only the program when a failure of the communication system of the first control device is predicted. It is also possible to eliminate the need for installation.
[0010]
In this case, as shown in claim 2, each of the first control device, the second control device, and the input / output control device is configured as a separate chip.
[0011]
Specifically, as shown in claim 3, the first control device receives a reply signal from the input control device even though the first control device transmits a predetermined signal to the input / output control device. If it cannot be received, or even if a reply signal is received, if there is a gap from what is expected as the contents of the reply signal, a communication system failure is predicted and the control program is transferred. Further, as shown in claim 4, when a system failure occurs more than a predetermined frequency, the control program may be transferred.
[0012]
In addition, the code | symbol in the bracket | parenthesis of each said means shows the correspondence with the specific means as described in embodiment mentioned later.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
(First embodiment)
FIG. 1 shows a block configuration of a vehicle control device having a fail-safe function according to the first embodiment of the present invention. The configuration of the vehicle control device will be described based on this figure.
[0014]
As shown in FIG. 1, the vehicle control device includes a wiper ECU 1 as a first control device, another ECU 2 as a second control device that performs control different from the wiper ECU 1, an input / output ECU 3 as an input / output control device, A multiplex communication line (vehicle LAN) 4 and a wiper motor 5 for connecting these ECUs 1 to 3 are provided.
[0015]
The wiper ECU 1 is a control device that executes arithmetic processing related to control of a system mounted on a vehicle. In the present embodiment, the wiper ECU 1 generates a control signal for performing a wiper drive in accordance with a driver's request by executing a control program installed in advance based on a wiper drive request signal from the driver. Specifically, the wiper drive request signal means a signal sent when the driver turns on a switch or the like of a wiper drive lever disposed on the back side of the steering in the vehicle interior.
[0016]
The other ECU 2 is a control device that executes arithmetic processing relating to a system different from the wiper control as control of a system mounted on the vehicle. The other ECU 2 here is configured as a general-purpose control device such as an air conditioner control ECU, an ABS control ECU, or an engine control ECU, and is provided as a chip having a different configuration from the wiper ECU 1. This means that the chip has a free capacity that can store at least a wiper driving program. The other ECU 2 executes only other vehicle control different from the wiper control before the communication system failure of the wiper ECU 1 occurs. When a communication system failure of the wiper ECU 1 occurs, the other ECU 2 installs a wiper driving program stored in the wiper ECU 1 via the multiplex communication line 4 so as to drive the wiper ECU 1 instead of the wiper ECU 1. The control signal is generated.
[0017]
The input / output ECU 3 is equivalent to an input / output processing device that inputs a control signal from the wiper ECU 1 or another ECU 2 to generate a predetermined output when executing wiper control, and constitutes a wiper output circuit. . For example, when a control signal from the wiper ECU 1 is sent via the multiplex communication line 4, the input / output ECU 3 generates an output (output voltage) corresponding to the control signal. The input / output ECU 3 is also configured as a separate chip from the wiper ECU 1.
[0018]
The wiper motor 5 is driven by the input / output ECU 3, and performs wiper driving according to the output generated by the input / output ECU 3, for example, low speed driving or high speed driving.
[0019]
The wiper drive and fail safe processing executed by the vehicle control device configured as described above will be described based on the flowcharts shown in FIGS.
[0020]
FIG. 2 is a flowchart of processing executed by the input / output ECU 3, and FIG. 3 is a flowchart of processing executed by the wiper ECU 1. FIG. 4 is a flowchart of processing executed by another ECU 2, and FIG. 5 is a flowchart of processing executed by an OS (Operating System) of the other ECU 2.
[0021]
As shown in FIG. 2, the input / output ECU 3 determines in step 110 whether or not the master ECU that is currently executing the wiper control is another ECU 2. This process is determined, for example, based on whether or not a flag in the input / output ECU 3 is set. This flag is a control master indicating that the master ECU for wiper control has become another ECU 2 in step 440 in FIG. It is set when a switching signal is sent from another ECU 2 to the input / output ECU 3.
[0022]
If a negative determination is made in step 110, the process proceeds to step 120, and a control signal indicating the wiper drive instruction content is acquired from the wiper ECU 1 in order to execute the wiper drive by the wiper ECU 1. On the other hand, if an affirmative determination is made, the process proceeds to step 130, and a control signal indicating the wiper drive instruction content is acquired from the other ECU 2 in order to execute the wiper drive by the other ECU 2.
[0023]
Thereafter, in step 140, an output corresponding to the control signal acquired in step 120 or 130 is generated as a wiper motor drive output. Thereby, the wiper motor 5 performs the wiper drive according to the request | requirement from a driver | operator.
[0024]
As shown in FIG. 3, the wiper ECU 1 predicts whether or not the wiper ECU 1 itself may fail in step 210. In this process, for example, when the wiper ECU 1 is transmitting a predetermined signal to the input / output ECU 3 via the multiplex communication line 4, the reply signal from the input / output ECU 3 cannot be received, Even if it can be received, it is predicted that the wiper ECU 1 may fail when there is a gap from what is expected as the content of the reply signal or when such a state occurs more than a predetermined frequency. If a negative determination is made in this step, it is determined that the communication system failure of the wiper ECU 1 does not occur, and the process proceeds to step 220 to execute (continue) the wiper control. If an affirmative determination is made, the routine proceeds to step 230, the wiper control program stored in the wiper ECU 1 itself is transferred to the other ECU 2, and the process is terminated.
[0025]
As shown in FIG. 4, the other ECU 2 determines in step 310 whether or not a wiper control program is transferred from the wiper ECU 1. When the wiper control program is transferred from the wiper ECU 1 in step 230 in FIG. 3, a flag indicating that is set in the other ECU 2, and this processing is performed by referring to the flag. If a negative determination is made in step 310, it is assumed that the wiper drive is executed by the wiper ECU 1 instead of the other ECU 2, and the process is terminated as it is. On the other hand, if an affirmative determination is made, an additional task generation signal indicating that an additional task has occurred in addition to the program executed by the other ECU 2 itself is written after the received wiper control program is written in the empty area of the other ECU 2 itself. Send to the OS.
[0026]
As shown in FIG. 5, the OSs of the other ECUs 2 determine whether there are additional tasks in step 410. When the OS receives the additional task generation signal in step 330 of FIG. 4, a flag indicating this is set in the OS, and this processing is performed by referring to the flag. Then, if a negative determination is made in step 410, the process is terminated because there is no additional task, and if an affirmative determination is made, task scheduling is reconstructed. For example, when the control programs (1) and (2) that must be executed by another ECU 2 already exist, the wiper control program is transferred to the control program (3) after the control programs (1) and (2). If the only processing that must be executed is the control programs (1) and (2), the order is reset as control programs (1) to (3).
[0027]
Next, the process proceeds to step 430, where execution environment reconstruction processing is executed. That is, the resource allocation of the microcomputer in the OS is changed so that the resource function is given to the wiper control program set as the control program (3).
[0028]
In step 440, a control master switching signal indicating that the master ECU for wiper control has been changed to another ECU 2 is transmitted to the input / output ECU 3, and the process is terminated. When this control master switching signal is transmitted, the input / output ECU 3 receives the signal and performs processing such as setting a flag in the input / output ECU 3.
[0029]
As described above, in this embodiment, it is predicted that a communication system failure of the wiper ECU 1 may occur, and it is assumed that the wiper control by the wiper ECU 1 is becoming impossible. Before the failure occurs, the wiper control program stored in the wiper ECU 1 is surely transferred to another ECU 2. The other ECU 2 installs the transferred wiper control program and, after the installation, executes wiper control instead of the wiper ECU 1.
[0030]
In this embodiment, the wiper ECU 1 and the input / output ECU 3 are configured separately so that the wiper ECU 1 can execute wiper control instead of the wiper ECU 1. About this reason, when the wiper drive ECU similar to the conventional one shown in FIGS. 6A and 6B is used, and when the wiper ECU 1 and the input / output ECU 3 are configured separately as in the present embodiment, the respective communication This will be described with reference to the form.
[0031]
As shown in FIG. 6A, the wiper driving ECU 50 conventionally used for wiper control has a configuration in which the wiper ECU 1 and the input / output ECU 3 shown in the present embodiment are integrated. Yes. In the case of such a configuration, control signals are transferred from other ECUs 51 through the wiper driving ECU 50 in which a communication system failure has occurred, as indicated by an arrow in FIG. 6A. It must be made. For this reason, even if the wiper driving ECU 50 predicts the occurrence of a communication system failure and transfers the wiper control program to the other ECU 51, the other ECU 51 cannot drive the wiper motor 52.
[0032]
However, if the wiper ECU 1 and the input / output ECU 3 are configured separately as in the present embodiment, the wiper ECU 1 in which a communication system failure has occurred as indicated by an arrow in FIG. 6B. It is possible to transfer control signals from other ECUs 2 without passing through the communication path. Therefore, if a wiper control program is transferred to another ECU 2 when the occurrence of a communication system failure in the wiper ECU 1 is predicted, the wiper control can be executed by the other ECU 2.
[0033]
By adopting the vehicle control device having such a configuration, even after the communication system failure of the wiper ECU 1 occurs, the fail safe that causes other ECUs 2 to execute the same wiper control as that performed by the wiper ECU 1 is possible. Function can be obtained.
[0034]
Further, as the other ECU 2, a general-purpose control device that is already mounted on the vehicle is used as the vehicle control. Therefore, when the failure of the communication system of the wiper ECU 2 is predicted, only the wiper control program is installed. It is also possible to eliminate the need to install an ECU.
[0035]
(Other embodiments)
In the first embodiment, the wiper ECU 1 for driving the wiper has been described as an example. However, not only the wiper control program in the wiper ECU 1 but also other control programs such as a headlamp control program are transferred. By doing so, the same fail-safe function as in the first embodiment can be obtained.
[Brief description of the drawings]
FIG. 1 is a diagram showing a block configuration of a vehicle control apparatus according to a first embodiment of the present invention.
FIG. 2 is a flowchart of processing executed by an input / output ECU 3 shown in FIG.
3 is a flowchart of processing executed by a wiper ECU 1 shown in FIG.
FIG. 4 is a flowchart of processing executed by another ECU 2 shown in FIG.
FIG. 5 is a flowchart of processing executed by an OS of another ECU 2 shown in FIG.
6A is a schematic diagram showing a communication form when a wiper drive ECU is configured as in the prior art, and FIG. 6B is a schematic view showing a communication form of the vehicle control device in the present embodiment. FIG.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Wiper ECU, 2 ... Other ECU, 3 ... Input-output ECU, 4 ... Multiple communication line,
5 ... Wiper motor.

Claims (4)

A first control device (1) mounted on a vehicle and generating a control signal for executing a first control based on a built-in control program;
A second control device (2) mounted on the vehicle for executing a second control different from the first control;
An input / output control device (3) that receives a control signal from the first control device and generates an output based on the control signal;
A multiplex communication line (4) for connecting the first control device, the second control device and the input / output control device, and enabling communication between these control devices;
The first control device and the second control device are general-purpose control devices that are already mounted on the vehicle for vehicle-mounted device control,
When a communication system failure is predicted between the first control device and the input / output control device, a control program built in the first control device is transferred to the second control device via the multiple communication line. And installed in the second control device, and after the installation, the second control device outputs a control signal for executing the first control to the input / output control device instead of the first control device. The vehicle control device is characterized in that the input / output control device executes the first control based on the control signal. 2. The vehicle control device according to claim 1, wherein the first control device, the second control device, and the input / output control device are configured as separate chips, respectively. The first control device is unable to receive a reply signal from the input control device even though the first control device is transmitting a predetermined signal to the input / output control device, or a reply Even if a signal is received, if there is a gap from what is expected as the content of the reply signal, it is predicted that the communication system has failed, and the control program is transferred. The vehicle control device according to claim 1 or 2. The vehicle control device according to claim 3, wherein the first control device transfers the control program when the system failure occurs at a predetermined frequency or more.

Images