JP6681304B2 - Vehicle control device and vehicle internal combustion engine control device - Google Patents

Description

  BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a vehicle control device for controlling a driving state of a vehicle and an internal combustion engine control device for controlling an operating state of an internal combustion engine, and more particularly to a vehicle control device and an internal combustion engine having a fallback function for dealing with an abnormal state. Control device for a vehicle.

Important systems for vehicle safety (eg electronic anti-lock braking system, electronic stability system, electric / hydraulic braking system, electric power steering system, etc.) are micro-systems that perform the control functions of their respective systems. It is controlled by a control computer that uses a processor core. The control computer is provided with a fallback mode (degenerate mode) so that the control function is not lost when a system failure or abnormality occurs. In the following, failures and abnormalities are collectively referred to as “abnormal state”. For example, in an electronic anti-lock brake system, when an abnormal state occurs in the system, the control computer is shut down and the fallback mode is executed. ing. That is, the hydraulic valve that is uncontrolled when the control computer is shut off is configured to be able to perform a normal braking operation. That is, when the system develops an abnormal condition, emergency operation or limited operation is guaranteed.

  Therefore, in the case of a system having a mechanical fallback function such as hydraulic pressure, it is sufficient to shut off the control computer or disconnect the control computer from the peripheral elements when a fault in the computer or a fault in the memory is recognized.

  This is achieved, for example, by the control computer including the same two control computers (multiprocessor core system) that execute the same program in parallel synchronously. If the calculation results of the two control computers have a deviation, it is considered that an abnormal state has occurred, and the processing of the control computer is stopped. The fault tolerant function provided with such a dual system is described in Japanese Patent Publication No. 2005-512218 (Patent Document 1) and the like.

Japanese Patent Publication No. 2005-512218

  By the way, in the case of a non-hydraulic brake system such as an electric / mechanical brake system, the above-mentioned fallback function using hydraulic pressure cannot be used, so that the control computer cannot be separated to execute the fallback function. It is a thing. Therefore, in Patent Document 1, when a failure occurs in the control computer, the communication controller is shut off so that the control value of the failed control computer is not sent to the data bus, thereby realizing the fault tolerant function. .

  However, in Patent Document 1, two (or two or more) control computers are redundant systems in which the same program is synchronously executed in parallel, and each control computer performs different control function processing, for example, control function. In the case of the configuration in which the process is divided and the control process is distributed and executed, the method of Patent Document 1 cannot be adopted, and a sufficient fallback function cannot be ensured.

  An object of the present invention is to provide a novel vehicle control device and internal combustion engine control device that can execute fallback functions by substituting each other even when two or more control computers perform different control function processes. To provide.

  A feature of the present invention is that each of two or more control computers that perform different control function processing is provided with a fallback function of the control function processing of another control computer, and the abnormal state of one control computer is detected by the monitoring computer. When detected, the control function process by the control computer in the abnormal state is executed by being replaced by another normal control computer.

  According to the present invention, even when two or more control computers perform different control function processing, the control function processing by the control computer in the abnormal state can be executed by another control computer instead. It becomes possible to ensure the function of the system controlled by the state control computer.

1 is a system block diagram of a vehicle control device according to a first embodiment of the present invention. It is explanatory drawing explaining operation | movement of the control apparatus for internal combustion engines which becomes the 2nd Embodiment of this invention.

  Embodiments of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to the following embodiments, and various modifications and applications are also included in the technical concept of the present invention. It is included in the range.

  FIG. 1 shows a system block of a vehicle controller according to a first embodiment of the present invention, which controls, for example, an electric brake system and an electric power steering system. In particular, the electric brake system and the electric power steering system are system elements necessary for the automatic driving system of the automobile.

  In FIG. 1, an automobile control device 10 includes a first control computer 11 and a second control computer 12, and these control computers 11 and 12 are connected to a communication controller 13. These control computers 11 and 12 are control computer systems that operate synchronously by time synchronization or clock synchronization. Here, the control computers 11 and 12 are of a multiprocessor core type, and two processor cores (corresponding to the control computers 11 and 12) are mounted in one processor package. According to this, the mounting area can be reduced and the communication between the processor cores can be speeded up.

  Further, the vehicle control device 10 includes a monitoring computer 14, and the monitoring computer 14 has a monitoring function of monitoring the operating states of the control computers 11 and 12 via a communication line. For example, a mutual diagnosis program is stored in the control computers 11 and 12, and the calculation result of this mutual diagnosis program is monitored by the monitoring computer 14. If it does not match the regular calculation result stored in the monitoring computer, it is determined to be abnormal. can do.

  Furthermore, a monitoring function for monitoring the operating states of the control computers 11 and 12 may be provided by any other method. Further, the monitoring computer 14 has a function of generating a reset signal to reset the control computers 11 and 12 in an abnormal state when the control computers 11 and 12 have an abnormal state.

  The communication controller 13 is connected to the data bus line 15 and has a function of sending various data from the communication controller 13 or receiving various data from the data bus line 15. Therefore, the control value of the actuator calculated by the control computers 11 and 12 can be sent to the data bus line 15. Similarly, a sensor signal from the operation amount detection sensor can be sent from the data bus line 15 to the control computers 11 and 12 via the communication controller. The data bus line 15 is composed of an in-vehicle communication network such as CAN, Flexray, TTCAN, and TTP.

  A first communication unit 16 and a second communication unit 17 are connected to the data bus line 15, a first actuator 18 is connected to the first communication unit 16, and a second communication unit 17 is connected. A second actuator 19 is connected to.

  Therefore, the control value from the first control computer 11 is sent to the first actuator 18 via the data bus line 15 and the first communication unit 16, and similarly, the control value from the second control computer 12 is , The data bus line 15, and the second communication unit 17 to the second actuator 19 to execute the necessary control function.

  For example, if the first control computer 11 is used in an electric brake system, the control function of the first control computer 11 is a braking function, and the first actuator 18 controls the piston of the brake caliper. It is an electric motor. If the second control computer 12 is used for an electric power steering system, the control function of the second control computer 12 is a steering function, and the second actuator 19 is a steering of the electric power steering system. It is an electric motor for assisting.

  Here, the fallback function, which is a feature of this embodiment, will be described. In the memory area of the first control computer 11, a program or a fixed value for executing a function (= function specific to the electric brake system) peculiar to the first control computer 11 itself, and a peculiar to the second control computer 12 are stored. A program for executing a fallback function (= fallback function peculiar to the electric power steering system) or a fixed value is stored.

  Similarly, in the storage area of the second control computer 12, together with a program or a fixed value for executing a function specific to the second control computer 12 itself (= function specific to the electric power steering system), the first control computer 12 is stored. 11, a program for executing a fallback function (= fallback function unique to the electric brake system) or a fixed value is stored.

  As described above, the respective control computers 11 and 12 are provided with the fallback function having redundancy with each other. That is, the control computer 11 can execute the fallback function unique to the other second control computer 12, and the control computer 12 can execute the fallback function unique to the first control computer 11. is there.

  The control value or fixed value obtained by executing the program for the fallback function is used as so-called backup data in each control function process. Of course, this backup data cannot be sent to the data bus line 15 when the control computers 11 and 12 are operating normally.

  In the above-described configuration, the monitoring computer 14 causes the control computers 11 and 12 to operate normally while the control computers 11 and 12 operate to control the actuators 18 and 19 to execute their control functions. The monitoring result is sent to the respective control computers 11 and 12 via the communication controller 13.

  When the monitoring computer 14 determines that an abnormal state has occurred in the control computers 11 and 12, the monitoring computer 14 causes the information of the abnormal control computer, that is, the first control computer 11 is abnormal, or the second control computer 2 Is abnormal, or error information that both control computers 11 and 12 are abnormal is sent to the respective control computers 11 and 12 via the communication line and the communication controller 13.

  For example, when the monitoring computer 14 detects an abnormal state of the first control computer 11, the monitoring computer 14 compares the first control computer 11 with the normal second control computer 12 and the abnormal first control computer 11. Send error information.

  Then, the first control computer 11 in the abnormal state suspends sending the control value calculated by itself to the communication controller 13. On the other hand, when the normal second control computer 12 receives the error information, it activates the program that executes the fallback function of the first control computer 11 in the abnormal state, and calculates the control value, which is backup data. Alternatively, a fixed value is read and transmitted to the communication controller 13.

  The communication controller 13 sends the backup data obtained by the normal second control computer 12 to the data bus line 15, and the first actuator 18 controlled by the first control computer 11 in the abnormal state, It sends backup data and executes the fallback function.

  On the contrary, when an abnormal state occurs in the second control computer 12, the monitoring computer 14 compares the normal first control computer 11 and the abnormal second control computer 12 with the second control computer 12. Send 12 error information.

  Then, the second control computer 12 in the abnormal state suspends sending the control value calculated by itself to the communication controller 13. On the other hand, when the normal first control computer 11 receives the error information, it activates the program that executes the fallback function of the second control computer 12 in the abnormal state, and calculates the control value, which is backup data. Alternatively, a fixed value is read and transmitted to the communication controller 13.

  The communication controller 13 sends the backup data obtained by the normal first control computer 11 to the data bus line 15, and sends the backup data to the second actuator 19 controlled by the second control computer 12 in an abnormal state. It sends backup data and executes the fallback function.

  When both control computers 11 and 12 are in an abnormal state, the monitoring computer 14 sends error information to the respective control computers 11 and 12 via the communication line and the communication controller 13 and sends a reset signal to the control computers 11 and 12. 12 to reset the control computers 11 and 12. In this case, the control values including the errors of the control computers 11 and 12 are blocked from being sent to the data bus line 15 by the communication controller 13.

  As described above, according to this embodiment, even when two or more control computers perform different control function processing, the fallback function of the control computer in the abnormal state can be executed by another control computer. The function of the system controlled by the control computer in an abnormal state can be secured.

  FIG. 2 shows an operating state of an internal combustion engine controller according to another embodiment of the present invention. The configuration of the basic system block is almost the same as that shown in FIG. 1, except that the control function of the control computer is a function of controlling and adjusting the operating state of the internal combustion engine.

  That is, the internal combustion engine control device 20 includes at least a first control computer 21 and a second control computer 22, and the first control computer 21 controls the fuel injection valve 25 with a fuel control function and an ignition device. It has an ignition control function for controlling 26. The second control computer 22 does not have a fuel control function and an ignition control function, but has a valve timing control function and an electronic control function that controls a variable valve timing device (VTC) 27 that controls the opening / closing phase of the intake valve and the exhaust valve. It has a throttle control function for controlling the throttle valve 28. Although it is possible to provide each of the control computers 21 and 22 with a control function for auxiliary equipment other than this, the control functions that are not the same as each other are provided.

  The control computers 21 and 22 are control computer systems that operate in time synchronization, clock synchronization, or crank angle synchronization. Here, as in the first embodiment, the control computers 21 and 22 are of a multiprocessor core type, and two processor cores (control computers 21 and 22) are mounted in one processor package.

  Further, the internal combustion engine control device 20 includes a monitoring computer 24, and the monitoring computer 24 has a monitoring function of monitoring the operating states of the control computers 21 and 22 via a communication line. Further, the monitoring computer 24 has a function of generating a reset signal to reset the control computers 21 and 22 in an abnormal state when the control computers 21 and 22 have an abnormal state. Further, the communication controller 23 sends the control values calculated by the control computers 21 and 22 to the fuel injection valve 25, the ignition device 26, the VTC device 27, and the electronically controlled throttle valve 28 corresponding to the respective control functions.

  Next, the fallback function, which is a feature of this embodiment, will be described. In the storage area of the first control computer 21, fixed values (fixed fuel injection amount and fixed injection timing, and fixed energization angle and fixed ignition timing) for executing the fuel control function and the ignition control function of the first control computer 21 itself are stored. ) And a fixed value (fixed opening / closing phase and fixed throttle opening) for executing the valve timing control function of the second control computer 22 and the fallback function of the throttle control function are stored.

  Similarly, in the storage area of the second control computer 22, fixed values (fixed opening / closing phase and fixed throttle opening) for executing the valve timing control function and the throttle control function of the second control computer 22 itself, the first value are stored. The fixed values (fixed fuel injection amount and fixed injection timing, and fixed energization angle and fixed ignition timing) for executing the fuel control function and the fallback function of the ignition control function of the control computer 21 are stored.

  Here, the fixed value for the fallback function is used as so-called backup data in each control function process. Of course, this backup data is not sent to the fuel injection valve 25, the ignition device 26, the VTC device 27, and the electronically controlled throttle valve 28 when the control computers 21 and 22 are operating normally.

  In the above configuration, in the process of controlling the fuel injection valve 25, the ignition device 26, the VTC device 27, and the electronically controlled throttle valve 28 so that the control computers 21 and 22 operate to execute their respective control functions, The monitoring computer 24 monitors whether the control computers 21 and 22 are operating normally, and the monitoring result is sent to the respective control computers 21 and 22 via the communication controller 13.

  Here, when the first control computer 21 is operating normally, the first control computer 21 supplies a fuel injection command (calculated injection amount, injection timing) to the fuel injection valve 25, and An ignition command (calculated energization angle, ignition timing) is supplied to the ignition device 26. Similarly, when the second control computer 22 is operating normally, the second control computer 22 supplies the VTC control command (calculated opening / closing phase) to the VTC device 27, and the throttle control command ( The calculated throttle opening) is supplied to the electronically controlled throttle 28.

  On the other hand, when the monitoring computer 24 detects, for example, an abnormal state of the first control computer 21, the first control computer 21 compares the normal second control computer 22 and the abnormal first control computer 21 with the first control computer 21. 21 error information is transmitted.

  Then, the first control computer 21 in the abnormal state suspends sending the fuel injection command and the ignition command calculated by itself to the communication controller 23. On the other hand, when the normal second control computer 22 receives the error information, the normal second control computer 22 executes the fallback function of the first control computer 21 in the abnormal state, and is therefore stored in the storage area of the second control computer 22. The fixed fuel injection amount and the fixed injection timing, the fixed energization angle and the fixed ignition timing, which are the backup data, are read out and transmitted to the communication controller 23.

  The communication controller 23 sends the fixed fuel injection amount and the fixed injection timing, and the fixed energization angle and the fixed ignition timing, which are obtained by the normal second control computer 22, to the fuel injection valve 25 and the ignition device 26, and the abnormal state occurs. The first control computer 21 executes the fallback function of the fuel injection valve 25 and the ignition device 26 controlled by the first control computer 21.

  On the contrary, when an abnormal state occurs in the second control computer 22, the monitoring computer 24 compares the second control computer 22 with the normal first control computer 21 and the abnormal second control computer 22. 22 error information is transmitted.

  Then, the second control computer 22 in the abnormal state suspends sending the VTC control command and the throttle control command calculated by itself to the communication controller 23. On the other hand, when the normal first control computer 21 receives the error information, the normal first control computer 21 executes the fallback function of the second control computer 22 in the abnormal state, and is therefore stored in the storage area of the first control computer 21. The fixed opening / closing phase and the fixed throttle opening which are backup data are read and transmitted to the communication controller 23.

  The communication controller 23 sends the fixed opening / closing phase and the fixed throttle opening determined by the normal first control computer 21 to the VTC device 27 and the electronically controlled throttle 28 so that the second control computer 22 in an abnormal state can The fallback function of the VTC device 27 and the electronically controlled throttle 28 which have been controlled is executed.

  As described above, according to the present embodiment, when the control computer that executes the fuel control function and the ignition control function of the internal combustion engine and the control computer that executes the control function of the internal combustion engine different from these control functions are used. Also in this case, since the fallback function of the control computer in the abnormal state can be executed by another control computer to control the operating state of the internal combustion engine, the control function processing of the internal combustion engine controlled by the control computer in the abnormal state can be performed. The function can be secured.

  As described above, according to the present invention, each of two or more control computers that perform different control function processing stores a program for executing the fallback function of the control function processing of another control computer, or a fixed value. When a monitoring computer detects an abnormal state of one control computer with a storage area, the fallback function of the control function process by the control computer in the abnormal state is executed by another normal control computer.

  According to this, even when two or more control computers perform different control function processing, the fallback function of the control computer in the abnormal state can be executed by the other control computer, so that the control computer in the abnormal state is executed. The function of the system controlled by will be able to be secured.

  It should be noted that the present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of a certain embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of a certain embodiment. Further, it is possible to add / delete / replace other configurations with respect to a part of the configurations of the respective embodiments.

  10 ... Automotive control device, 11 ... First control computer, 12 ... Second control computer, 13 ... Communication controller, 14 ... Monitoring computer, 15 ... Data bus line, 16 ... First communication unit, 17 ... 2 communication unit, 18 ... 1st actuator, 19 ... 2nd actuator, 20 ... Internal-combustion-engine control device, 21 ... 1st control computer, 22 ... 2nd control computer, 23 ... Communication controller, 24 ... Monitoring computer, 25 ... Fuel injection valve, 26 ... Ignition device, 27 ... VTC device, 28 ... Electric throttle.

Claims (5)

Two control computers which are connected to the data bus and perform different control function processing for controlling the driving state of the vehicle, and different actuators which are connected to the data bus via a communication unit and correspond to the different control computers, respectively. And a communication controller for transmitting a control signal from the control computer to each of the corresponding actuators, and each of the control computers is provided with a fallback function of control function processing of the other control computer, and is monitored. When the computer detects an abnormal state of one of the control computers, the communication controller sends abnormal information to the two control computers, and the control computer having the abnormal state outputs the control value calculated by itself. To send to the communication controller While cross, by the fallback normal the control computer generates a substitute control signal to alternate the control function processing by the abnormal state has occurred and the control computer, the abnormal condition is caused by the communication controller the control A vehicle control device, characterized in that the actuator controlled by a computer is driven by applying the alternative control signal via the data bus. The vehicle control device according to claim 1,
Each of the two control computers is composed of a multi-processor core, and a normal processor core of the multi-processor core executes the control function process by the processor core in an abnormal state of the multi-processor core in an alternate manner to cause an abnormality A control device for an automobile, wherein the actuator controlled by the processor core in a state is controlled by backup data obtained by executing the fallback function of the normal processor core. A first control computer connected to the data bus and having at least a fuel control function and an ignition control function of an internal combustion engine mounted on the vehicle; and the fuel control function and the ignition control function which are connected to the data bus and are different from each other. A second control computer having an operation state control function for controlling an operation state of the internal combustion engine, and a second control computer connected to the data bus via a communication unit and corresponding to the first control computer and the second control computer, respectively. An actuator; and a communication controller for transmitting a control signal from the first control computer and the second control computer to the respective corresponding actuators, and the first control computer is provided with the operation state control function. A fallback function is provided, and the fuel controller is added to the second control computer. And a fallback function of the ignition control function are provided, and when the monitoring computer detects an abnormal state in one of the two control computers, the communication controller sends the abnormal information to the two control computers to detect the abnormal state. Occurs, the control computer interrupts sending the control value calculated by itself to the communication controller, and the normal control computer's fallback function causes an abnormal condition to occur in the control computer. To generate an alternative control signal, and to drive the actuator controlled by the control computer in an abnormal state by the communication controller by applying the alternative control signal via the data bus. Internal combustion engine control device for automobile. The vehicle internal combustion engine controller according to claim 3,
Each of the first control computer and the second control computer is composed of a multiprocessor core, and a normal processor core of the multiprocessor core performs control function processing by the processor core in an abnormal state of the multiprocessor core. An internal combustion engine for an automobile, characterized in that the actuator, which is executed instead and is controlled by the processor core in an abnormal state, is controlled by backup data obtained by executing the fallback function of the normal processor core. Control device. The vehicle internal combustion engine controller according to claim 4,
The internal combustion engine control device for an automobile, wherein the backup data is a fixed value that controls the actuator controlled by the fuel control function, the ignition control function, or the operation state control function by a predetermined amount.

Images