JP6987201B1 - Vehicle control device and vehicle control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique capable of optimizing the timing of switching transmission when a failure occurs. A vehicle control device includes a first control unit capable of vehicle control including at least one of AD control and ADAS control, and a second control unit included in a second system and capable of vehicle control. It is provided with an output switching unit that changes the timing of switching from the first system transmission to the second system transmission based on the failure information and the transmission information, or based on the failure information, the transmission information, and the calculation information. [Selection diagram] Fig. 1

Description

The present disclosure relates to a vehicle control device and a vehicle control method.

In recent years, various technologies have been proposed for systems that control vehicles such as AD (Autonomous Driving) control and ADAS (Advanced Driver Assistance System) control. For example, in Patent Document 1, in a processing system duplicated by two CPUs, when one of the CPUs fails, the transmission (output) of the other CPU is used, so that one of the processing systems fails. However, a fail-safe control system has been proposed in which operation can be continued using the other processing system.

Japanese Patent No. 6675487

In the control system of Patent Document 1, by making the processing system redundant, the continuation of the function is realized even if one of the processing systems fails. However, in the control system, when a failure occurs, the transmission of one processing system is forcibly and immediately switched to the transmission of the other processing system. For this reason, even during the transmission of appropriately calculated data, the transmission may be stopped or the switching may not be in time, so that a fail may occur on the receiving side of the actuator or the like.

Therefore, the present disclosure has been made in view of the above-mentioned problems, and an object of the present disclosure is to provide a technique capable of optimizing the timing of switching transmission in the event of a failure.

The vehicle control device according to the present disclosure is included in the first system, and includes a first control unit capable of vehicle control including at least one of AD (Autonomous Driving) control and ADAS (Advanced Driver Assistance System) control, and a first control unit. The first control unit includes a second control unit included in the two systems and capable of controlling the vehicle, and the first control unit performs a first calculation process of a command value used in the vehicle control of the first control unit. The second control unit includes a unit and a first communication processing unit that performs transmission processing of the command value obtained by the first calculation unit, and the second control unit is a command value used in the vehicle control of the second control unit. A failure monitoring unit that detects a failure of the first system and includes a second calculation unit that performs arithmetic processing and a second communication processing unit that performs transmission processing of the command value obtained by the second calculation unit. Based on the failure information indicating the failure of the first system and the transmission information indicating whether or not the first communication processing unit is in the transmission process, or based on the failure information, the transmission information, and the first. From the first system transmission, which is the transmission of the command value using the first communication processing unit of the first system, based on the calculation information indicating whether or not the calculation unit is in the calculation process, the second system is transmitted. Further, an output switching unit for changing the timing of switching to the second system transmission, which is the transmission of the command value using the second communication processing unit of the system, is provided.

According to the present disclosure, the timing of switching from the first system transmission to the second system transmission is changed based on the failure information of the first system and the transmission information of the first communication processing unit. According to such a configuration, it is possible to optimize the timing of switching transmission when a failure occurs.

It is a block diagram which shows the structure of the vehicle control device which concerns on Embodiment 1. FIG. It is a figure for demonstrating the outline of the operation of the vehicle control device which concerns on Embodiment 1. FIG. It is a flowchart which shows the operation of the vehicle control device which concerns on Embodiment 1. FIG. It is a flowchart which shows the operation of the vehicle control device which concerns on Embodiment 1. FIG. It is a figure for demonstrating the outline of the operation of the vehicle control device which concerns on modification 1-1. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 1-1. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 1-1. It is a figure for demonstrating the outline of the operation of the apparatus related to the vehicle control apparatus which concerns on modification 1-2. It is a figure for demonstrating the outline of the operation of the vehicle control device which concerns on modification 1-2. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 1-2. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 1-3. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 1-3. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 1-5. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 1-5. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 1-6. It is a block diagram which shows the structure of the vehicle control device which concerns on Embodiment 2. FIG. It is a flowchart which shows the operation of the vehicle control device which concerns on Embodiment 2. It is a flowchart which shows the operation of the vehicle control device which concerns on Embodiment 2. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 2-1. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 2-1. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 2-2. It is a flowchart which shows the operation of the vehicle control device which concerns on modification 2-2.

<Embodiment 1>
FIG. 1 is a block diagram showing a configuration of a vehicle control device according to the first embodiment. The vehicle control device of FIG. 1 includes a first system including the ECU 11 and a second system including the ECU 21.

The ECU 11 includes a CPU (Central Processing Unit) 12 which is a first control unit, a failure monitoring unit 13 which is a first failure monitoring unit, a communication circuit 14, and a switch 15. The ECU 21 includes a CPU 22 which is a second control unit, a failure monitoring unit 23 which is a second failure monitoring unit, and a communication circuit 24. In the vehicle control device of FIG. 1, the ECU 11 and the ECU 21 can communicate with each other so that a fail-safe function using the other when one of the CPU 12 and the CPU 22 fails is realized.

The CPU 12 is capable of vehicle control including at least one of AD (Autonomous Driving) control and ADAS (Advanced Driver Assistance System) control. The CPU 22 can perform vehicle control similar to the vehicle control of the CPU 12.

Here, the SIP (Strategic Innovation Creation Program) Automated Driving System Research and Development Plan (Cabinet Office, May 21, 2015) defines the automated driving level (automatic driving level) of automobiles as follows. Has been done.

Level 1: The system performs one of acceleration, steering, and braking Level 2: The system performs multiple operations of acceleration, steering, and braking Level 3: The system performs all of acceleration, steering, and braking, and the system When requested by the driver, the driver responds. Level 4: Acceleration, steering, and braking are all performed by a person other than the driver, and the driver is not involved at all. The "system" here means that the vehicle is an autonomous sensor. It means a mechanism that determines the road environment, etc. from information obtained by communication, etc., and performs all or part of acceleration, steering, and braking of the vehicle.

As can be seen from the definition of each level, the driving authority of the vehicle is on the system side at level 3 and above, and on the driver side at level 2 and below. Vehicle control of level 2 or lower supports the safe driving of the driver and is called "ADAS control". Vehicle control with a higher level than ADAS control is called "AD control". AD control and ADAS control include, for example, automatic brake control, automatic acceleration / deceleration control such as ACC (Adaptive Cruise Control), automatic parking control, lane keeping control, and the like.

In the following description, a vehicle whose vehicle control (AD control, ADAS control) is performed by the CPU 12 and the CPU 22 may be referred to as a "own vehicle".

The CPU 12 includes a calculation unit 12a which is a first calculation unit and a communication processing unit 12b which is a first communication processing unit. The CPU 22 includes a calculation unit 22a which is a second calculation unit, a communication processing unit 22b which is a second communication processing unit, and an output switching unit 22c. The calculation units 12a and 22a, the communication processing units 12b and 22b, and the output switching unit 22c will be described in detail later.

The failure monitoring unit 13 compares the self-diagnosis function for detecting the failure of the first system, the operation of the first system, and the operation of the second system with the failure of either the first system or the second system. It has a mutual diagnosis function to detect. Similarly, the failure monitoring unit 23 compares the self-diagnosis function for detecting the failure of the second system with the operation of the first system and the operation of the second system to determine which of the first system and the second system. It has a mutual diagnosis function to detect the failure.

The self-diagnosis is realized by using, for example, a so-called watchdog timer. In the mutual diagnosis, for example, in each of the first system and the second system, the same application (program) for the purpose of mutual monitoring is executed to perform the same operation, and it is confirmed whether the output results of both are the same. It is realized by doing. By performing self-diagnosis and mutual diagnosis, it is possible to improve the accuracy of determining the failure state of the first system and the second system.

The failure monitoring units 13 and 23 detect failures in a plurality of types of regions in the CPU 12 by a mutual diagnosis function or the like, and detect failures in hardware (H / W) other than the CPU 12 in the first system. The plurality of types of areas include, for example, a communication area such as a memory area related to the communication processing of the communication processing unit 12b, and a calculation area such as a memory area related to the calculation processing of the calculation unit 12a. Hardware (H / W) failures in the first system include, for example, voltage anomalies, communication circuit open and short circuits. For the H / W failure determination, for example, the method for determining a short failure and an open failure described in Japanese Patent No. 4656421 may be used.

Similarly, the failure monitoring units 13 and 23 detect failures in a plurality of types of regions in the CPU 22 by a mutual diagnosis function or the like, and detect failures in hardware (H / W) other than the CPU 22 in the second system.

Based on the above detection results, the failure monitoring units 13 and 23 output failure information indicating a failure of the first system, failures of a plurality of types of areas in the CPUs 12 and 22, failures of hardware, and the like to the output switching unit 22c. do.

In the mutual monitoring of the dual systems by the failure monitoring units 13 and 23, it is not possible to determine which of the first system and the second system is broken. Therefore, a majority vote may be taken in a triple system system, or the determination of one of the first system and the second system may be prioritized over the determination of the other, as will be described later. Further, instead of the two failure monitoring units (fault monitoring units 13, 23), one failure monitoring unit having the functions of the failure monitoring units 13 and 23 may be provided. Further, the failure monitoring units 13 and 23 may be provided outside the ECUs 11 and 21, or may be provided as a function inside the CPUs 12 and 22.

The communication processing unit 12b performs transmission / reception processing of information necessary for performing vehicle control (AD control, ADAS control) in the first system. Similarly, the communication processing unit 22b performs transmission / reception processing of information necessary for performing vehicle control (AD control, ADAS control) in the second system. Further, the communication processing units 12b and 22b perform transmission / reception processing of information necessary for determining the switching timing.

The communication circuit 14 transmits / receives to / from the system by the transmission / reception processing of the communication processing unit 12b, and the communication circuit 24 transmits / receives to / from the system by the transmission / reception processing of the communication processing unit 22b. The communication processing units 12b and 22b are realized by software, for example, and the communication circuit 14 is composed of hardware such as a CAN (Controller Area Network) IC and a circuit including a harness.

The communication processing units 12b and 22b acquire, for example, information (peripheral information) indicating the state of the surrounding environment of the own vehicle from the external device via the communication circuits 14 and 24. The external device referred to here includes, for example, a GPS (Global Positioning System) device, an in-vehicle communication device, a peripheral sensor, a navigation system, and the like. The GPS device receives GPS signals from a plurality of GPS satellites and positions the own vehicle. The in-vehicle communication device performs communication between the own vehicle and another vehicle (vehicle-to-vehicle communication) and communication between the own vehicle and the roadside unit (road-to-vehicle communication). Peripheral sensors are distance sensing sensors such as millimeter-wave radar and ultrasonic sonar, which detect the position of other vehicles, pedestrians, buildings, obstacles, and other objects around the vehicle, as well as the detected objects. When is a moving object (other vehicle, pedestrian, etc.), its moving speed is also detected. The peripheral sensor is not limited to these, and may be another sensor (for example, an in-vehicle camera) as long as it can recognize the state of the surrounding environment of the own vehicle. The navigation system uses the position information and the map information of the own vehicle acquired by the GPS device to display the position of the own vehicle on the map screen and guide the route to the destination.

Further, the communication processing units 12b and 22b acquire, for example, information (vehicle information) indicating the operating state of the own vehicle from the external device via the communication circuits 14 and 24. The external device referred to here includes, for example, a steering angle sensor, a vehicle speed sensor, a winker sensor, a light sensor, and the like. The steering angle sensor detects the steering angle of the own vehicle. The vehicle speed sensor detects the traveling speed of the own vehicle. The winker sensor detects the direction indicated by the direction indicator of the own vehicle. The light sensor detects whether the light of the own vehicle is on or off. The sensor that detects vehicle information is not limited to these, and any other sensor (for example, a sensor that detects the operating state of a brake, gear, wiper, etc.) can be used as long as it can recognize the operating state of the own vehicle. good.

Further, the communication processing units 12b and 22b acquire, for example, information (driver information) indicating the state of the driver of the own vehicle from the external device via the communication circuits 14 and 24. The driver's condition is, for example, drowsiness, not driving aside, or being calm (not excited). The external device that acquires the driver information detects the movement of the driver's eyeball and face by, for example, an in-vehicle camera that captures the driver and an image analysis of the image taken by the in-vehicle camera, and the driver's line of sight. It includes a determination device that determines the driver's condition from the direction, the direction of the face, and the like. External devices that acquire driver information are not limited to these, and if the behavior of the driver can be detected, other acquisition devices (for example, sound collecting microphones and steering wheels that acquire the driver's voice) are provided instead of the in-vehicle camera. A biological sensor, a brain wave sensor, etc.) may be used.

The communication processing unit 12b transmits the command value to the system (for example, the system of the actuator) by performing the transmission processing of the command value which is the calculation result obtained by the calculation unit 12a described later. Similarly, the communication processing unit 22b transmits the command value to the system (for example, the system of the actuator) by performing the transmission processing of the command value which is the calculation result obtained by the calculation unit 22a described later. The actuator includes, for example, actuators such as steering, throttle, brake, shift, and winker. As the transmission means, for example, CAN communication in which the calculation result is stored in a data frame for each predetermined sampling and transmitted may be used, or Ethernet (registered trademark) communication or SPI (Serial Peripheral Interface) communication is used. May be good.

Further, the communication processing units 12b and 22b output transmission information indicating whether or not the communication processing units 12b and 22b are in the transmission processing to the output switching unit 22c. The transmission information includes, for example, a flag indicating completion / incomplete storage of a command value of vehicle control (AD control, ADAS control) in a data frame, and a register or memory value indicating a transmission permission / disapproval state.

Further, the communication processing units 12b and 22b output information as to whether or not a specific data frame has been transmitted to the output switching unit 22c. This information includes, for example, a flag indicating storage / non-storage of the operation result in the data frame having the highest transmission priority, and a transmission permission / non-permission state of a specific data frame. As the communication means such as transmission information, dedicated communication between the communication processing units 12b and 22b and the output switching unit 22c may be used, or general-purpose communication between the CPU 12 and the CPU 22 may be used. ..

The calculation unit 12a is a command value (control) of an actuator used for vehicle control (AD control, ADAS control) of the CPU 12 based on at least one of peripheral information, vehicle information, and driver information acquired by the communication processing unit 12b. (Command value) is processed. Similarly, the calculation unit 22a is a command of an actuator used for vehicle control (AD control, ADAS control) of the CPU 22 based on at least one of peripheral information, vehicle information, and driver information acquired by the communication processing unit 22b. Performs arithmetic processing of the value (control command value).

Further, the calculation unit 12a performs a calculation every predetermined sampling or every event activation, and records a calculation state indicating whether or not the calculation is in progress in the memory. Then, the arithmetic unit 12a outputs arithmetic information indicating whether or not the arithmetic unit 12a is in the arithmetic processing to the output switching unit 22c. Similarly, the arithmetic unit 22a outputs arithmetic information indicating whether or not the arithmetic unit 22a is in the arithmetic processing to the output switching unit 22c.

The output switching unit 22c changes the timing of switching from the first system transmission to the second system transmission based on the failure information of the first system and the transmission information of the communication processing unit 12b. Here, the first system transmission is the transmission of the command value using the communication processing unit 12b of the first system, and the second system transmission is the transmission of the command value using the communication processing unit 22b of the second system. .. Hereinafter, the timing of switching from the first system transmission to the second system transmission may be referred to as "switching timing".

In the first embodiment, the first system transmission is controlled by controlling the communication circuit 14 via the switch 15, but the first system transmission is controlled by controlling the communication processing unit 12b. You may. Further, in the first embodiment, the second system transmission is controlled by controlling the communication processing unit 22b, but the second system transmission is controlled by controlling the communication circuit 24 via a switch (not shown). May be done. Further, in FIG. 1, the output switching unit 22c is provided in the CPU 22, but the failure monitoring units 13 and 23 may be provided outside the CPU 22 and eventually outside the ECU 21.

<Operation>
FIG. 2 is a diagram for explaining an outline of the operation of the vehicle control device according to the first embodiment. Based on the failure information of the first system and the transmission information of the communication processing unit 12b, the output switching unit 22c has a failure of the first system between the start of the transmission processing of the communication processing unit 12b and the completion of the transmission processing. Judge whether or not. Conversely, the output switching unit 22c is based on the failure information of the first system and the transmission information of the communication processing unit 12b, and the first system is between the completion of the transmission processing of the communication processing unit 12b and the start of the transmission processing. Judge whether or not a failure has occurred.

When the output switching unit 22c determines that a failure of the first system has occurred between the start of the transmission process of the communication processing unit 12b and the completion of the transmission process, as shown in FIG. 2A, after the transmission process. First system Stops transmission. In the first embodiment, the output switching unit 22c stops the first system transmission by controlling the communication circuit 14 via the switch 15, but stops the first system transmission by controlling the communication processing unit 12b. You may.

When the output switching unit 22c determines that a failure of the first system has occurred between the completion of the transmission processing of the communication processing unit 12b and the start of the transmission processing, as shown in FIG. 2B, immediately after the determination, the output switching unit 22c determines. First system Stops transmission.

FIG. 3 is a flowchart showing the operation of the first system according to the first embodiment. The operation of FIG. 3 is performed when a failure of the first system is detected by the failure monitoring unit 13.

First, in step S1, the failure monitoring unit 13 outputs the failure information of the first system to the output switching unit 22c via the failure monitoring unit 23, and the communication processing unit 12b outputs the transmission information of the communication processing unit 12b. Output to the switching unit 22c.

In step S2, the failure monitoring unit 13 determines whether or not the first system transmission has stopped. If it is determined that the first system transmission has stopped, the process proceeds to step S4, and if it is not determined that the first system transmission has stopped, the process proceeds to step S3. In the latter case, the failure monitoring unit 13 cannot acquire the information for determining that the first system transmission is stopped and the failure monitoring unit 13 cannot acquire the information for determining the stop of the first system transmission. Including the case.

In step S3, the failure monitoring unit 13 determines whether or not the time elapsed since the determination in step S2 is equal to or greater than a predetermined threshold value, that is, whether or not a timeout has occurred. If it is determined that the time-out has occurred, the process proceeds to step S4, and if it is not determined that the time-out has not occurred, the process returns to step S2. The threshold value may be set to infinity so that the process does not proceed from step S3 to step S4.

In step S4, the failure monitoring unit 13 resets the CPU 12 and performs a recovery process of the CPU 12. As a result, the failure monitoring unit 13 times out when it cannot determine that the first system transmission is stopped (Yes in step S3), and resets (returns).

In step S5, the failure monitoring unit 13 determines whether or not the first system has returned to normal. If it is determined that the first system has returned to normal, the operation of FIG. 3 ends, and if it is not determined that the first system has returned to normal, the operation of FIG. 3 is performed again.

FIG. 4 is a flowchart showing the operation of the second system according to the first embodiment. The operation of FIG. 4 is performed when a failure of the first system is detected by the failure monitoring unit 13.

First, in step S11, the failure monitoring unit 23 receives the failure information of the first system from the failure monitoring unit 13 and outputs it to the output switching unit 22c.

In step S12, the output switching unit 22c is based on the failure information of the first system and the transmission information of the communication processing unit 12b, during the period from the start of the transmission processing of the communication processing unit 12b to the completion of the transmission processing of the first system. Judge whether or not a failure has occurred. If it is determined that a failure of the first system has occurred between the start of the transmission process of the communication processing unit 12b and the completion of the transmission process, the process proceeds to step S13, and the transmission process is completed from the start of the transmission process of the communication processing unit 12b. If it is not determined that the failure of the first system has occurred in the meantime, the process proceeds to step S15. In the latter case, the output switching unit 22c determines that a failure of the first system has occurred between the completion of the transmission processing of the communication processing unit 12b and the start of the transmission processing, and the output switching unit 22c determines that a failure has occurred. Including the case where the transmission information could not be obtained.

In step S13, the output switching unit 22c determines whether or not the first system transmission including the transmission processing of the communication processing unit 12b is completed. This determination is made based on, for example, the transmission information newly output from the communication processing unit 12b. If it is determined that the first system transmission is completed, the process proceeds to step S15, and if it is not determined that the first system transmission is completed, the process proceeds to step S14. In the latter case, the output switching unit 22c cannot acquire the information for determining the completion of the first system transmission and the output switching unit 22c cannot acquire the information for determining the completion of the first system transmission. Including the case.

In step S14, the output switching unit 22c determines whether or not the time elapsed since the determination in step S13 is equal to or greater than a predetermined threshold value, that is, whether or not a timeout has occurred. If it is determined that the time-out has occurred, the process proceeds to step S15, and if it is not determined that the time-out has occurred, the process returns to step S13. The threshold value may be set to infinity so that the process does not proceed from step S14 to step S15.

In step S15, the output switching unit 22c stops the first system transmission.

In step S16, the output switching unit 22c starts the second system transmission. After that, the operation of FIG. 4 ends. After the operation of step S15 is performed, the operation may be performed from step S2 of FIG.

<Summary of Embodiment 1>
In the vehicle control device (vehicle control method) according to the first embodiment as described above, the first system transmission to the second system transmission are based on the failure information of the first system and the transmission information of the communication processing unit 12b. Change the timing to switch to. According to such a configuration, even in the case of FIG. 2A, it is possible to optimize the timing of switching transmission when a failure occurs. Therefore, it is possible to suppress the occurrence of a fail on the receiving side of the actuator or the like, and smooth switching can be expected.

<Modification 1-1>
In the first embodiment, the output switching unit 22c changes the switching timing based on the failure information of the first system and the transmission information of the communication processing unit 12b, but the present invention is not limited to this. For example, the output switching unit 22c may change the switching timing in consideration of the calculation information of the calculation unit 12a. That is, the output switching unit 22c may change the switching timing based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation information of the calculation unit 12a.

FIG. 5 is a diagram for explaining an outline of the operation of the vehicle control device according to the present modification 1-1. The output switching unit 22c is based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation information of the calculation unit 12a, from the completion of the calculation processing of the calculation unit 12a to the communication processing immediately after the completion of the calculation processing. It is determined whether or not a failure of the first system has occurred until the transmission process of the unit 12b is completed. Conversely, the output switching unit 22c is based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation information of the calculation unit 12a, and the communication processing immediately after the calculation processing of the calculation unit 12a is completed. It is determined whether or not a failure of the first system has occurred between the completion of the transmission processing of the unit 12b and the completion of the calculation processing of the calculation unit 12a.

As shown in FIG. 5A, the output switching unit 22c states that a failure of the first system occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing. If it is determined, the first system transmission is stopped after the transmission process.

As shown in FIG. 5B, the output switching unit 22c has a failure of the first system between the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the calculation processing of the calculation unit 12a and the completion of the calculation processing of the calculation unit 12a. If it is determined that it has occurred, the first system transmission is stopped immediately after the determination.

FIG. 6 is a flowchart showing the operation of the first system according to the present modification 1-1. The operation of FIG. 6 is the same as the operation of changing step S1 of the operation of FIG. 3 to step S1a.

In step S1a, the failure monitoring unit 13 outputs the failure information of the first system to the output switching unit 22c, and the communication processing unit 12b outputs the transmission information of the communication processing unit 12b to the output switching unit 22c. Further, the calculation unit 12a outputs the calculation information of the calculation unit 12a to the output switching unit 22c.

FIG. 7 is a flowchart showing the operation of the second system according to the present modification 1-1. The operation of FIG. 7 is the same as the operation of changing step S12 of the operation of FIG. 4 to step S12a and deleting the time-out determination of step S14. In FIG. 7, step S14 is deleted to show variations, but of course step S14 may be performed, and this also applies to the following description.

In step S12a, the output switching unit 22c processes the calculation from the completion of the calculation process of the calculation unit 12a based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation information of the calculation unit 12a. It is determined whether or not a failure of the first system has occurred until the transmission processing of the communication processing unit 12b is completed immediately after the completion.

If it is determined that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing, the processing proceeds to step S13. On the other hand, if it is not determined that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing, the processing proceeds to step S15. .. In the latter case, the output switching unit 22c has a failure of the first system between the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the calculation processing of the calculation unit 12a and the completion of the calculation processing of the calculation unit 12a. This includes a case and a case where the output switching unit 22c cannot acquire transmission information or calculation information.

In step S13, the output switching unit 22c determines whether or not the first system transmission including the transmission processing of the communication processing unit 12b is completed. If it is determined that the first system transmission is completed, the process proceeds to step S15, and if it is not determined that the first system transmission is completed, the process of step S13 is performed again.

According to the present modification 1-1 as described above, the first system transmission to the second system transmission are based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation information of the calculation unit 12a. Change the timing to switch to. According to such a configuration, it is possible to optimize the timing of switching transmission when a failure occurs.

<Modification 1-2>
In the modification 1-1, the output switching unit 22c has a failure of the first system between the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the calculation processing of the calculation unit 12a and the completion of the calculation processing of the calculation unit 12a. When it was determined, the transmission of the first system was stopped immediately after the determination. In this case, as shown in FIG. 8, it is conceivable that the output switching unit 22c may not be able to switch to the second system transmission in time, and a fail may occur on the receiving side of the actuator or the like.

Therefore, as shown in FIG. 9, the output switching unit 22c transmits the first system even if it is determined that a failure of the first system has occurred between the completion of the transmission process immediately after the completion of the calculation process and the completion of the calculation process. If there is data in progress, the transmission may be stopped after the transmission of the first system is completed.

The flowchart showing the operation of the first system according to the present modification 1-2 is the same as the flowchart of FIG. FIG. 10 is a flowchart showing the operation of the second system according to the present modification 1-2. The operation of FIG. 10 is the same as the operation of adding steps S17 and S18 to the operation of FIG.

In FIG. 10, when it is not determined in step S12a that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing. The process proceeds to step S17.

In step S17, the output switching unit 22c determines whether or not the first system transmission is being executed, that is, whether or not there is data during the execution of the first system transmission. This determination is made based on, for example, the transmission information newly output from the communication processing unit 12b. If it is determined that the first system transmission is being carried out, the process proceeds to step S18, and if it is determined that the first system transmission is not being carried out, the process proceeds to step S15.

In step S18, the output switching unit 22c determines whether or not the first system transmission including the transmission processing of the communication processing unit 12b is completed. If it is determined that the first system transmission is completed, the process proceeds to step S15, and if it is determined that the first system transmission is not completed, the process of step S18 is performed again.

According to the present modification 1-2 as described above, it is possible to optimize the timing of switching transmission when a failure occurs.

<Modification 1-3>
The output switching unit 22c may change the switching timing in consideration of the type of the area of the CPU 12 in which the failure is detected by the failure monitoring unit 13. That is, the output switching unit 22c may change the switching timing based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the type of the region where the failure is detected. Alternatively, the output switching unit 22c changes the switching timing based on the failure information of the first system, the transmission information of the communication processing unit 12b, the calculation information of the calculation unit 12a, and the type of the region where the failure is detected. You may. The latter will be described below, but the former explanation is almost the same as the following explanation.

Further, when the failure monitoring unit 13 does not detect a failure in the communication area, the output switching unit 22c may determine whether or not to stop the first system transmission, and the failure monitoring unit 13 may determine whether or not to stop the transmission in the communication area. When a failure is detected, the failure monitoring unit 13 or the output switching unit 22c may determine whether or not to stop the first system transmission.

FIG. 11 is a flowchart showing the operation of the first system according to the present modification 1-3. The operation of FIG. 11 is the same as the operation of adding step S6, step S7, and step S8 to the operation of FIG. 6 and changing step S1a to step S1b.

First, in step S6, the failure monitoring unit 13 determines whether or not the communication area of the communication processing unit 12b has failed. If it is determined that the communication area has failed, the process proceeds to step S7, and if it is determined that the communication area has not failed, the process proceeds to step S1b.

In step S1b, the failure monitoring unit 13 outputs the failure information of the first system and the type of the region where the failure is detected to the output switching unit 22c. The communication processing unit 12b outputs the transmission information of the communication processing unit 12b to the output switching unit 22c. The calculation unit 12a outputs the calculation information of the calculation unit 12a to the output switching unit 22c.

In step S7, the failure monitoring unit 13 determines whether or not the failure monitoring unit 13 can stop the transmission of the first system by turning off and resetting the hardware of the first system and stopping the transmission processing of the software. judge. If the failure monitoring unit 13 determines that the first system transmission can be stopped, the process proceeds to step S8, and if the failure monitoring unit 13 determines that the first system transmission cannot be stopped, the process proceeds. Proceed to step S2.

In step S8, the failure monitoring unit 13 instead of the output switching unit 22c stops the first system transmission. After that, the process proceeds to step S4.

FIG. 12 is a flowchart showing the operation of the second system according to the present modification 1-3. The operation of FIG. 12 is the same as the operation of adding step S19, step S20, and step S21 to the operation of FIG. 7.

In step S19 after step S11, the output switching unit 22c determines whether or not the failure monitoring unit 13 can stop the first system transmission. If the failure monitoring unit 13 determines that the first system transmission can be stopped, the process proceeds to step S15, and if the failure monitoring unit 13 determines that the first system transmission cannot be stopped, the process proceeds. Proceed to step S20.

If the process proceeds from step S19 to step S15, the output switching unit 22c of the second system may stop the transmission of the first system before the transmission of the first system by the first system is stopped. There is sex. Therefore, the output switching unit 22c may turn off the communication circuit 14 via the switch 15 at a timing sufficiently later than the processing cycle of the CPU 12, or the switch after confirming that the output of the communication processing unit 12b is stopped. The communication circuit 14 may be turned off via 15.

In step S20, the output switching unit 22c determines whether or not the communication area of the communication processing unit 12b has failed. If it is determined that the communication area of the communication processing unit 12b has failed, the processing proceeds to step S15, and the first system transmission is stopped. If it is determined that the communication area of the communication processing unit 12b has not failed, the process proceeds to step S21.

In step S21, the output switching unit 22c determines whether or not the calculation area of the calculation unit 12a has failed. If it is determined that the calculation area of the calculation unit 12a has failed, the process proceeds to step S13, and the first system transmission is stopped after the first system transmission is completed. If it is determined that the calculation area of the calculation unit 12a has not failed, the process proceeds to step S12a.

According to the present modification 1-3 as described above, since the transmission of the first system can be appropriately stopped according to the failure location, it is possible to suppress the occurrence of a fail on the receiving side of the actuator or the like. ..

The output switching unit 22c may change the switching timing in consideration of the failure of the H / W other than the CPU 12 in the first system. For example, as in step S21, if it is determined that the H / W has failed, the process proceeds to step S13, and if it is determined that the H / W has not failed, the process proceeds to step S12a. The output switching unit 22c may be configured.

<Modification 1-4>
Instead of step S13 from the first embodiment to the modified example 1-4, the output switching unit 22c may determine whether or not a specific data frame has been transmitted by the first system transmission. This determination may be determined by using, for example, a flag indicating storage / non-storage of the operation result in the data frame having the highest transmission priority, or a state of permission / non-permission of transmission of a specific data frame.

<Modification 1-5>
When the first system returns from the failure state to the normal state, the output switching unit 22c may perform the first system transmission after stopping the second system transmission. Further, the output switching unit 22c may change the timing of switching from the second system transmission to the first system transmission based on the return information of the first system and the transmission information of the communication processing unit 22b. Alternatively, the output switching unit 22c changes the timing of switching from the second system transmission to the first system transmission based on the return information of the first system, the transmission information of the communication processing unit 22b, and the calculation information of the calculation unit 22a. You may.

FIG. 13 is a flowchart showing the operation of the first system according to the present modification 1-5. The operation of FIG. 13 is performed when the first system returns to normal.

First, in step S31, the failure monitoring unit 13 outputs the return information of the first system to the second system via the failure monitoring unit 23.

In step S32, the calculation unit 12a starts a calculation such as a command value, and outputs the calculation result to the communication processing unit 12b.

In step S33, the CPU 12 determines whether or not transmission permission has been received from the second system. If it is determined that the transmission permission has been received, the process proceeds to step S34, and if it is determined that the transmission permission has not been received, the process of step S33 is performed again.

In step S34, the first system starts the transmission of the first system. After that, the operation of FIG. 13 ends.

FIG. 14 is a flowchart showing the operation of the second system according to the present modification 1-5. The operation of FIG. 14 is performed when the first system returns to normal.

First, in step S41, the failure monitoring unit 23 receives the return information of the first system from the failure monitoring unit 13 and outputs it to the output switching unit 22c.

In step S42, the calculation unit 22a outputs the calculation information of the calculation unit 22a to the output switching unit 22c, and the communication processing unit 22b outputs the transmission information of the communication processing unit 22b to the output switching unit 22c.

In step S43, the output switching unit 22c performs the arithmetic processing from the completion of the arithmetic processing of the arithmetic unit 22a based on the return information of the first system, the transmission information of the communication processing unit 22b, and the arithmetic information of the arithmetic unit 22a. It is determined whether or not the first system has been restored by the time the transmission processing of the communication processing unit 22b is completed immediately after the completion.

If it is determined that the first system has been restored between the completion of the arithmetic processing of the arithmetic unit 22a and the completion of the transmission processing of the communication processing unit 22b immediately after the completion of the arithmetic processing, the processing proceeds to step S44. On the other hand, if it is not determined that the first system has been restored between the completion of the arithmetic processing of the arithmetic unit 22a and the completion of the transmission processing of the communication processing unit 22b immediately after the completion of the arithmetic processing, the processing proceeds to step S45.

In step S44, the output switching unit 22c determines whether or not the second system transmission including the transmission processing of the communication processing unit 22b is completed. If it is determined that the second system transmission is completed, the process proceeds to step S45, and if it is not determined that the first system transmission is completed, the process of step S44 is performed again.

In step S45, the output switching unit 22c stops the second system transmission.

In step S46, the output switching unit 22c outputs the transmission permission to the first system. As a result, the first system transmission is started in step S34 of FIG. After that, the operation of FIG. 14 ends. After the operation of step S46 is performed, the operation may be performed from step S33 of FIG.

According to the present modification 1-5 as described above, the first system transmission can be appropriately started.

<Modification example 1-6>
It is assumed that the second system fails, that is, the CPU 22 or the like fails (redundant system collapses) from the state where both the first system and the second system, which can transmit the calculation result of the second system, are normal. do. In this case, the CPU 12 may perform degenerate control without switching the transmission by the output switching unit 22c. The degenerate control is, for example, a control that notifies the driver that the CPU 22 has failed, lowers the level to the driver-centered automatic driving level, and automatically stops a safe vehicle in the space by the first system. Including what to do.

FIG. 15 is a flowchart showing the operation of the first system and the second system according to the present modification 1-5. The operation of FIG. 15 is performed when a failure of the second system is detected by the failure monitoring unit 23.

In step S51, the failure monitoring unit 23 transmits the failure information of the second system to the first system.

In step S52, the failure monitoring unit 23 resets the CPU 22 and performs a recovery process of the CPU 22.

In step S53, the failure monitoring unit 13 receives the failure information of the second system from the failure monitoring unit 23 and outputs it to the CPU 12.

In step S54, the CPU 12 performs degeneration control. After that, the operation of FIG. 15 ends.

According to the present modification 1-5 as described above, appropriate vehicle control can be performed when the second system fails.

<Modification example 1-7>
In the above description, both the failure monitoring unit 13 and the failure monitoring unit 23 have a mutual monitoring function (comparison function), but the function may be provided to only one of them. For example, the CPU 22 may have a configuration in which the failure rate is lower than that of the CPU 12, and only the failure monitoring unit 23 may have a mutual monitoring function.

Further, in the above description, the failure monitoring unit 23 of the CPU 22 may be configured with the failure monitoring units 13 and 23 so that the failure rate is lower and the reliability is higher than the failure monitoring unit 13 of the CPU 12. In that configuration, the result of the failure diagnosis by the failure monitoring unit 23 may be set with a higher priority than the result of the failure diagnosis by the failure monitoring unit 13. That is, when the diagnosis result by the failure monitoring unit 23 and the diagnosis result by the failure monitoring unit 13 are different from each other, the diagnosis result of the failure monitoring unit 23 may be prioritized. For example, if a failure is not detected by the failure monitoring unit 13 of the CPU 12, but a failure is detected by the mutual monitoring function of the failure monitoring unit 23 of the CPU 22, even if it is determined that the failure has occurred on the CPU 12 side. good.

In the above configurations of the present modification 1-7, the priority of the failure monitoring unit 23 and the failure monitoring unit 13 is set according to their failure rates, but the priority is not limited to this. For example, in accordance with the ASIL (Automotive Safety Integrity Level) defined in ISO 26262, the higher ASIL level may be given a higher priority. Further, the second system may be a preventive safety system, and the first system may be an automated driving system having a higher automation level than the second system.

<Embodiment 2>
FIG. 16 is a block diagram showing the configuration of the vehicle control device according to the second embodiment. Hereinafter, among the components according to the second embodiment, the same or similar components as those described above will be designated by the same or similar reference numerals, and different components will be mainly described.

In the second embodiment, the output switching unit includes not only the output switching unit 22c (second output switching unit) included in the second system but also the output switching unit 12c (first output switching unit) included in the first system. including. Then, as in the modification 1-1, each of the output switching unit 12c and the output switching unit 22c is based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation information of the calculation unit 12a. Change the switching timing. Further, as in the modification 1-3, each of the output switching unit 12c and the output switching unit 22c changes the switching timing in consideration of the type of the region in which the failure is detected by the failure monitoring unit 13.

<Operation>
FIG. 17 is a flowchart showing the operation of the first system according to the second embodiment. The operation of FIG. 17 is performed when a failure of the first system is detected by the failure monitoring unit 13.

First, in step S61, the failure monitoring unit 13 outputs the failure information of the first system and the type of the region where the failure is detected to the output switching units 12c and 22c. The communication processing unit 12b outputs the transmission information of the communication processing unit 12b to the output switching units 12c and 22c. The calculation unit 12a outputs the calculation information of the calculation unit 12a to the output switching units 12c and 22c.

In step S62, the failure monitoring unit 13 determines whether or not the communication area of the communication processing unit 12b has failed. If it is determined that the communication area has failed, the process proceeds to step S63, and if it is determined that the communication area has not failed, the process proceeds to step S66.

In step S63, the failure monitoring unit 13 determines whether or not the failure monitoring unit 13 can stop the transmission of the first system by turning off and resetting the hardware of the first system and stopping the transmission processing of the software. judge. If the failure monitoring unit 13 determines that the first system transmission can be stopped, the process proceeds to step S71, and if the failure monitoring unit 13 determines that the first system transmission cannot be stopped, the process proceeds. The process proceeds to step S64. When the process proceeds to step S64, the transmission of the first system is stopped by the operation of the second system (step S15 in FIG. 18) described later.

In step S64, the failure monitoring unit 13 determines whether or not the first system transmission has stopped. If it is determined that the first system transmission has stopped, the process proceeds to step S72, and if it is not determined that the first system transmission has stopped, the process proceeds to step S65.

In step S65, the failure monitoring unit 13 determines whether or not the time elapsed since the determination in step S64 is equal to or greater than a predetermined threshold value, that is, whether or not a timeout has occurred. If it is determined that the time-out has occurred, the process proceeds to step S72, and if it is not determined that the time-out has not occurred, the process returns to step S64.

In step S66, the failure monitoring unit 13 determines whether or not the failure monitoring unit 13 can stop the first system transmission by stopping the CPU 12. If the failure monitoring unit 13 determines that the first system transmission can be stopped, the process proceeds to step S67, and if the failure monitoring unit 13 determines that the first system transmission cannot be stopped, the process proceeds. The process proceeds to step S64. When the processing proceeds to step S67, as described below, the output switching unit 12c is a part of the processing after step S21 in FIG. 12 performed by the output switching unit 22c in the modification 1-3. Perform the same processing as.

In step S67, the output switching unit 12c determines whether or not the calculation area of the calculation unit 12a has failed. If it is determined that the arithmetic area of the arithmetic unit 12a has failed, the process proceeds to step S69, and if it is determined that the arithmetic area of the arithmetic unit 12a has not failed, the process proceeds to step S68.

In step S68, the output switching unit 12c starts the arithmetic processing from the completion of the arithmetic processing of the arithmetic unit 12a based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the arithmetic information of the arithmetic unit 12a. It is determined whether or not a failure of the first system has occurred until the transmission processing of the communication processing unit 12b is completed immediately after the completion.

If it is determined that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing, the processing proceeds to step S69. On the other hand, if it is not determined that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing, the processing proceeds to step S71. ..

In step S69, the output switching unit 12c determines whether or not the first system transmission including the transmission processing of the communication processing unit 12b is completed. This determination is made based on, for example, the transmission information newly output from the communication processing unit 12b. If it is determined that the first system transmission is completed, the process proceeds to step S71, and if it is not determined that the first system transmission is completed, the process proceeds to step S70.

In step S70, the output switching unit 12c determines whether or not the time elapsed since the determination in step S69 is equal to or greater than a predetermined threshold value, that is, whether or not a timeout has occurred. If it is determined that the time-out has occurred, the process proceeds to step S72, and if it is not determined that the time-out has not occurred, the process returns to step S69.

In step S71, the output switching unit 12c stops the first system transmission.

In step S72, the failure monitoring unit 13 resets the CPU 12 and performs a recovery process of the CPU 12.

In step S73, the failure monitoring unit 13 determines whether or not the first system has returned to normal. If it is determined that the first system has returned to normal, the operation of FIG. 17 ends, and if it is not determined that the first system has returned to normal, the operation of FIG. 17 is performed again.

FIG. 18 is a flowchart showing the operation of the second system according to the second embodiment. The operation of FIG. 18 is performed when a failure of the first system is detected by the failure monitoring unit 13. The operation of FIG. 18 is the same as the operation of adding step S14 of FIG. 4 to the operation of FIG.

In step S13, the output switching unit 22c determines whether or not the first system transmission including the transmission processing of the communication processing unit 12b is completed. If it is determined that the first system transmission is completed, the process proceeds to step S15, and if it is not determined that the first system transmission is completed, the process proceeds to step S14.

In step S14, the output switching unit 22c determines whether or not the time elapsed since the determination in step S13 is equal to or greater than a predetermined threshold value, that is, whether or not a timeout has occurred. If it is determined that the time-out has occurred, the process proceeds to step S15, and if it is not determined that the time-out has occurred, the process returns to step S13.

After the operation of step S15 is performed, the operation may be performed from step S64 of FIG.

<Outline of operation>
The outline of the operation of FIGS. 17 and 18 described above will be described.

When the failure monitoring unit 13 detects a failure in the communication area and the failure monitoring unit 13 can stop the first system transmission (Yes in step S63 of FIG. 17), the failure monitoring unit 13 transmits the first system transmission. Stop (step S71 in FIG. 17).

It is assumed that the failure monitoring unit 13 detects a failure in the communication area and the failure monitoring unit 13 cannot stop the transmission of the first system (No in step S63 in FIG. 17 and No in step S19 in FIG. 18). In this case, the output switching unit 22c determines the failure information of the first system, the transmission information of the communication processing unit 12b, the calculation information of the calculation unit 12a, and the type of the region where the failure is detected by the failure monitoring unit 13. Based on this, the first system transmission is stopped (step S20, step S21, step S12a, step S13, step S15 in FIG. 18).

When the failure monitoring unit 13 does not detect the failure in the communication area and the failure in the calculation area is detected (Yes in step S67 in FIG. 17), the output switching unit 12c is the first after the transmission process of the communication processing unit 12b. The system transmission is stopped (step S69, step S71 in FIG. 17).

Neither the failure of the communication area nor the failure of the calculation area is detected by the failure monitoring unit 13 (No in step S67 in FIG. 17), and the communication processing unit 12b immediately after the calculation processing is completed in the calculation unit 12a. It is assumed that a failure of the first system has occurred before the transmission process is completed (Yes in step S68 in FIG. 17). In this case, the output switching unit 12c stops the first system transmission after the transmission processing of the communication processing unit 12b (step S69, step S71 in FIG. 17).

Neither the failure of the communication area nor the failure of the calculation area is detected by the failure monitoring unit 13 (No in step S67 in FIG. 17), and from the completion of the transmission processing of the communication processing unit 12b immediately after the calculation processing of the calculation unit 12a is completed. It is assumed that a failure of the first system has occurred until the calculation process of the calculation unit 12a is completed (No in step S68 of FIG. 17). In this case, the output switching unit 12c stops the first system transmission immediately after the determination (step S71).

The output switching unit 12c may change the switching timing in consideration of the failure of the H / W other than the CPU 12 in the first system. For example, instead of step S67, the output switching unit 12c may use a determining doctor as to whether or not an H / W other than the CPU 12 in the first system is out of order.

<Summary of Embodiment 2>
In the vehicle control device according to the second embodiment as described above, each of the output switching unit 12c and the output switching unit 22c has the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation unit 12a. Change the switching timing based on the calculation information. According to such a configuration, even if any of the output switching unit 12c and the output switching unit 22c fails, the transmission can be appropriately switched.

<Modification 2-1>
In the second embodiment, each of the output switching unit 12c and the output switching unit 22c sets the switching timing based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation information of the calculation unit 12a. changed. However, the present invention is not limited to this, and each of the output switching unit 12c and the output switching unit 22c does not have to consider the arithmetic information of the arithmetic unit 12a when changing the switching timing. That is, each of the output switching unit 12c and the output switching unit 22c may change the switching timing based on the failure information of the first system and the transmission information of the communication processing unit 12b.

Further, in the second embodiment, the output switching unit 12c and the output switching unit 22c each change the switching timing in consideration of the type of the region in which the failure is detected by the failure monitoring unit 13, but the switching timing may not be considered. ..

FIG. 19 is a flowchart showing the operation of the first system according to the present modification 2-1. The operation of FIG. 19 is performed when a failure of the first system is detected by the failure monitoring unit 13.

First, in step S81, the failure monitoring unit 13 outputs the failure information of the first system to the output switching unit 22c via the failure monitoring unit 23, and the communication processing unit 12b outputs the transmission information of the communication processing unit 12b. Output to the switching unit 22c.

In step S82, the failure monitoring unit 13 determines whether or not the failure monitoring unit 13 can stop the transmission of the first system by turning off and resetting the hardware of the first system and stopping the transmission processing of the software. judge. If the failure monitoring unit 13 determines that the first system transmission can be stopped, the process proceeds to step S85, and if the failure monitoring unit 13 determines that the first system transmission cannot be stopped, the process proceeds. The process proceeds to step S83.

In step S83, the failure monitoring unit 13 determines whether or not the first system transmission has stopped. If it is determined that the first system transmission has stopped, the process proceeds to step S89, and if it is not determined that the first system transmission has stopped, the process proceeds to step S84.

In step S84, the failure monitoring unit 13 determines whether or not the time elapsed since the determination in step S83 is equal to or greater than a predetermined threshold value, that is, whether or not a timeout has occurred. If it is determined that the time-out has occurred, the process proceeds to step S89, and if it is not determined that the time-out has not occurred, the process returns to step S83.

In step S85, the output switching unit 12c is based on the failure information of the first system and the transmission information of the communication processing unit 12b, during the period from the start of the transmission processing of the communication processing unit 12b to the completion of the transmission processing of the first system. Judge whether or not a failure has occurred. If it is determined that a failure of the first system has occurred between the start of the transmission process of the communication processing unit 12b and the completion of the transmission process, the process proceeds to step S86, and the transmission process is completed from the start of the transmission process of the communication processing unit 12b. If it is not determined that the failure of the first system has occurred in the meantime, the process proceeds to step S88.

In step S86, the output switching unit 12c determines whether or not the first system transmission including the transmission processing of the communication processing unit 12b is completed. This determination is made based on, for example, the transmission information newly output from the communication processing unit 12b. If it is determined that the first system transmission is completed, the process proceeds to step S88, and if it is not determined that the first system transmission is completed, the process proceeds to step S87.

In step S87, the output switching unit 12c determines whether or not the time elapsed since the determination in step S86 is performed is equal to or greater than a predetermined threshold value, that is, whether or not a timeout has occurred. If it is determined that the time-out has occurred, the process proceeds to step S89, and if it is not determined that the time-out has not occurred, the process returns to step S86. The threshold value of step S87 may be set to infinity so that the process does not proceed from step S87 to step S89.

In step S88, the output switching unit 12c stops the first system transmission.

In step S89, the failure monitoring unit 13 resets the CPU 12 and performs a recovery process of the CPU 12.

In step S90, the failure monitoring unit 13 determines whether or not the first system has returned to normal. If it is determined that the first system has returned to normal, the operation of FIG. 19 ends, and if it is not determined that the first system has returned to normal, the operation of FIG. 19 is performed again.

FIG. 20 is a flowchart showing the operation of the second system according to the present modification 2-1. The operation of FIG. 20 is performed when a failure of the first system is detected by the failure monitoring unit 13.

First, in step S101, the failure monitoring unit 23 receives the failure information of the first system from the failure monitoring unit 13 and outputs it to the output switching unit 22c.

In step S102, the output switching unit 22c determines whether or not the failure monitoring unit 13 can stop the first system transmission. If the failure monitoring unit 13 determines that the first system transmission can be stopped, the process proceeds to step S106, and if the failure monitoring unit 13 determines that the first system transmission cannot be stopped, the process proceeds. The process proceeds to step S103.

In step S103, the output switching unit 22c is based on the failure information of the first system and the transmission information of the communication processing unit 12b, during the period from the start of the transmission processing of the communication processing unit 12b to the completion of the transmission processing of the first system. Judge whether or not a failure has occurred. If it is determined that a failure of the first system has occurred between the start of the transmission process of the communication processing unit 12b and the completion of the transmission process, the process proceeds to step S104, and the transmission process is completed from the start of the transmission process of the communication processing unit 12b. If it is not determined that the failure of the first system has occurred in the meantime, the process proceeds to step S106.

In step S104, the output switching unit 22c determines whether or not the first system transmission including the transmission processing of the communication processing unit 12b is completed. This determination is made based on, for example, the transmission information newly output from the communication processing unit 12b. If it is determined that the first system transmission is completed, the process proceeds to step S106, and if it is not determined that the first system transmission is completed, the process proceeds to step S105.

In step S105, the output switching unit 22c determines whether or not the time elapsed after the determination in step S104 is equal to or greater than a predetermined threshold value, that is, whether or not a timeout has occurred. If it is determined that the time-out has occurred, the process proceeds to step S106, and if it is not determined that the time-out has not occurred, the process returns to step S104.

In step S106, the output switching unit 22c stops the first system transmission. If the process proceeds from step S102 to step S106, the output switching unit 22c of the second system may stop the transmission of the first system before the transmission of the first system by the first system is stopped. There is sex. Therefore, the output switching unit 22c may turn off the communication circuit 14 via the switch 15 at a timing sufficiently later than the processing cycle of the CPU 12, or the switch after confirming that the output of the communication processing unit 12b is stopped. The communication circuit 14 may be turned off via 15.

In step S107, the output switching unit 22c starts the second system transmission. After that, the operation of FIG. 20 ends. After the operation of step S106 is performed, the operation may be performed from step S83 of FIG.

<Outline of operation>
The outline of the operation of FIGS. 19 and 20 will be described.

The failure monitoring unit 13 can stop the transmission of the first system (Yes in step S82 of FIG. 19), and the failure of the first system occurred between the start of the transmission process and the completion of the transmission process of the communication processing unit 12b. Assume a case (Yes in step S85 of FIG. 19). In this case, the output switching unit 12c stops the first system transmission after the transmission processing of the communication processing unit 12b (step S86, step S88 in FIG. 19).

The failure monitoring unit 13 can stop the transmission of the first system (Yes in step S82 of FIG. 19), and a failure of the first system has occurred between the completion of the transmission processing of the communication processing unit 12b and the start of the transmission processing. A case (No in step S85 of FIG. 19) is assumed. In this case, the output switching unit 12c stops the first system transmission immediately after the determination (step S88 in FIG. 19).

When a time-out occurs because the transmission information cannot be acquired (Yes in step S105 of FIG. 20), the output switching unit 22c stops the first system transmission (step S106 of FIG. 20).

It is assumed that the failure monitoring unit 13 cannot stop the transmission of the first system (No in step S82 of FIG. 19 and No in step S102 of FIG. 20). In this case, the output switching unit 22c stops the transmission of the first system based on the failure information of the first system and the transmission information of the communication processing unit 12b (step S103, step S104, step S105, FIG. 20). Step S106).

When the failure monitoring unit 13 can stop the transmission of the first system (Yes in step S102 of FIG. 20), preferably after the first system stops the transmission of the first system, the output switching unit 22c is the first system. The transmission is stopped (step S106 in FIG. 20).

After stopping the transmission of the first system, the failure monitoring unit 13 resets the CPU 12 and performs a recovery process of the CPU 12 (step S89 in FIG. 19). Further, the failure monitoring unit 13 times out when it cannot determine that the first system transmission is stopped (Yes in step S87 of FIG. 19), and resets (returns) (step S89 of FIG. 19).

<Modification 2-2>
In the second embodiment, the output switching unit 12c and the output switching unit 22c each change the switching timing in consideration of the type of the region in which the failure is detected by the failure monitoring unit 13, but the switching timing may not be considered.

FIG. 21 is a flowchart showing the operation of the first system according to the present modification 2-2. The operation of FIG. 21 is the same as the operation in which step S81 and step S85 of the operation of FIG. 19 are changed to step S81a and step S85a, respectively.

In step S81a, the failure monitoring unit 13 outputs the failure information of the first system to the output switching unit 22c, and the communication processing unit 12b outputs the transmission information of the communication processing unit 12b to the output switching unit 22c. Further, the calculation unit 12a outputs the calculation information of the calculation unit 12a to the output switching unit 22c.

In step S85a, the output switching unit 12c starts the arithmetic processing from the completion of the arithmetic processing of the arithmetic unit 12a based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the arithmetic information of the arithmetic unit 12a. It is determined whether or not a failure of the first system has occurred until the transmission processing of the communication processing unit 12b is completed immediately after the completion.

If it is determined that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing, the processing proceeds to step S86. On the other hand, if it is not determined that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing, the processing proceeds to step S88. ..

FIG. 22 is a flowchart showing the operation of the second system according to the present modification 2-2. The operation of FIG. 22 is the same as the operation in which step S103 of the operation of FIG. 20 is changed to step S103a.

In step S103a, the output switching unit 22c processes the calculation from the completion of the calculation process of the calculation unit 12a based on the failure information of the first system, the transmission information of the communication processing unit 12b, and the calculation information of the calculation unit 12a. It is determined whether or not a failure of the first system has occurred until the transmission processing of the communication processing unit 12b is completed immediately after the completion.

If it is determined that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing, the processing proceeds to step S104. On the other hand, if it is not determined that a failure of the first system has occurred between the completion of the arithmetic processing of the arithmetic unit 12a and the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing, the processing proceeds to step S106. ..

<Outline of operation>
The outline of the operation of FIGS. 21 and 22 described above will be described.

The failure monitoring unit 13 can stop the transmission of the first system (Yes in step S82 of FIG. 21), and from the completion of the arithmetic processing of the arithmetic unit 12a to the completion of the transmission processing of the communication processing unit 12b immediately after the completion of the arithmetic processing. It is assumed that a failure of the first system occurs during that time (Yes in step S85a in FIG. 21). In this case, the output switching unit 12c stops the first system transmission after the transmission processing of the communication processing unit 12b (step S86, step S88 in FIG. 21).

The failure monitoring unit 13 can stop the transmission of the first system (Yes in step S82 of FIG. 21), and the operation processing of the calculation unit 12a is performed from the completion of the transmission processing of the communication processing unit 12b immediately after the calculation processing of the calculation unit 12a is completed. It is assumed that a failure of the first system occurs before the completion (No in step S85a of FIG. 21). In this case, the output switching unit 12c stops the first system transmission immediately after the determination (step S88 in FIG. 21).

If the transmission information cannot be acquired and a time-out occurs (Yes in step S105 in FIG. 22), the output switching unit 22c stops the first system transmission (step S106 in FIG. 22).

It is assumed that the failure monitoring unit 13 cannot stop the transmission of the first system (No in step S82 of FIG. 21 and No in step S102 of FIG. 22). In this case, the output switching unit 22c stops the transmission of the first system based on the failure information of the first system and the transmission information of the communication processing unit 12b (steps S103a, S104, and S105 in FIG. 22). Step S106).

When the failure monitoring unit 13 can stop the transmission of the first system (Yes in step S102 of FIG. 22), preferably, after the first system stops the transmission of the first system, the output switching unit 22c is the first system. The transmission is stopped (step S106 in FIG. 22).

After stopping the transmission of the first system, the failure monitoring unit 13 resets the CPU 12 and performs a recovery process of the CPU 12 (step S89 in FIG. 21). Further, the failure monitoring unit 13 times out when it cannot determine that the first system transmission is stopped (Yes in step S87 of FIG. 21), and resets (returns) (step S89 of FIG. 21).

<Others>
The vehicle control device described above may be realized by the cooperation of hardware such as a CPU and memory and software such as a control program for controlling the operation of the vehicle control device, or a processing circuit or the like. It may be realized by the dedicated hardware of.

It is possible to freely combine each embodiment and each modification, and appropriately modify or omit each embodiment and each modification.

12, 22 CPU, 12a, 22a calculation unit, 12b, 22b communication processing unit, 13,23 failure monitoring unit, 12c, 22c output switching unit.

Claims (13)

A first control unit included in the first system and capable of vehicle control including at least one of AD (Autonomous Driving) control and ADAS (Advanced Driver Assistance System) control.
A second control unit included in the second system and capable of controlling the vehicle is provided.
The first control unit is
The first calculation unit that performs calculation processing of the command value used in the vehicle control of the first control unit, and the first calculation unit.
Including a first communication processing unit that performs transmission processing of the command value obtained by the first calculation unit.
The second control unit
The second calculation unit that performs calculation processing of the command value used in the vehicle control of the second control unit, and the second calculation unit.
Including a second communication processing unit that performs transmission processing of the command value obtained by the second calculation unit.
The failure monitoring unit that detects the failure of the first system and
Based on the failure information indicating the failure of the first system and the transmission information indicating whether or not the first communication processing unit is in the transmission process, or based on the failure information, the transmission information, and the first. From the first system transmission, which is the transmission of the command value using the first communication processing unit of the first system, based on the calculation information indicating whether or not the first calculation unit is in the calculation process, the first system transmission. A vehicle control device further comprising an output switching unit for changing the timing of switching to the second system transmission, which is the transmission of the command value using the second communication processing unit of the system. The vehicle control device according to claim 1.
The output switching unit is
When it is determined that a failure of the first system has occurred between the start of the transmission process and the completion of the transmission process of the first communication processing unit based on the failure information and the transmission information, the above-mentioned after the transmission process. Stop the first system transmission,
When it is determined that a failure of the first system has occurred between the completion of the transmission process and the start of the transmission process of the first communication processing unit based on the failure information and the transmission information, the above-mentioned immediately after the determination. First system A vehicle control device that stops transmission. The vehicle control device according to claim 1.
The output switching unit is
Based on the failure information, the transmission information, and the calculation information, the first system is between the completion of the calculation process of the first calculation unit and the completion of the transmission processing of the first communication processing unit immediately after the completion of the calculation process. If it is determined that a failure has occurred, the first system transmission is stopped after the transmission process.
From the completion of the transmission processing of the first communication processing unit immediately after the completion of the calculation processing of the first calculation unit to the completion of the calculation processing of the first calculation unit based on the failure information, the transmission information, and the calculation information. A vehicle control device that stops transmission of the first system immediately after the determination when it is determined that a failure of the first system has occurred. The vehicle control device according to any one of claims 1 to 3.
The failure monitoring unit is
Further detecting failures in a plurality of types of regions in the first control unit,
The output switching unit is
A vehicle control device that changes the timing in consideration of the type of region in which a failure is detected by the failure monitoring unit. The vehicle control device according to claim 4.
The plurality of types of regions
A vehicle control device including at least one of a communication area which is an area related to communication processing of the first communication processing unit and a calculation area which is an area related to calculation processing of the first calculation unit. The vehicle control device according to any one of claims 1 to 5.
The failure monitoring unit is
Further detecting a hardware failure in the first system,
The output switching unit is
A vehicle control device that changes the timing in consideration of the hardware failure. The vehicle control device according to any one of claims 1 to 3.
The failure monitoring unit is
Further detecting a failure in the communication area including the first failure monitoring unit included in the first system and being the area related to the communication processing of the first communication processing unit.
When the failure monitoring unit does not detect a failure in the communication area, the output switching unit determines whether or not to stop the first system transmission.
A vehicle control device that determines whether or not to stop transmission of the first system by the first failure monitoring unit or the output switching unit when a failure in the communication area is detected by the failure monitoring unit. The vehicle control device according to any one of claims 1 to 7.
The output switching unit is
A vehicle control device that performs transmission of the first system after stopping transmission of the second system when the first system returns from a failure state to a normal state. The vehicle control device according to any one of claims 1 to 8.
The second system is a preventive safety system.
The first system is a vehicle control device, which is an automated driving system having a higher automation level than the second system. The vehicle control device according to any one of claims 1 to 4.
The output switching unit is
The first output switching unit included in the first system and
Including the second output switching unit included in the second system,
Each of the first output switching unit and the second output switching unit
A vehicle control device that changes the timing based on the failure information and the transmission information, or based on the failure information, the transmission information, and the calculation information. The vehicle control device according to claim 10.
The failure monitoring unit is
Further detecting failures in a plurality of types of regions in the first control unit,
Each of the first output switching unit and the second output switching unit
A vehicle control device that changes the timing in consideration of the type of region in which a failure is detected by the failure monitoring unit. The vehicle control device according to claim 11.
The plurality of types of regions
Includes a communication area that is an area related to communication processing of the first communication processing unit, and a calculation area that is an area related to calculation processing of the first calculation unit.
The failure monitoring unit is
Including the first failure monitoring unit included in the first system,
The first failure monitoring unit is
When the failure monitoring unit detects a failure in the communication area and the first failure monitoring unit can stop the first system transmission, the first system transmission is stopped.
The second output switching unit is
When the failure monitoring unit detects a failure in the communication area and the first failure monitoring unit cannot stop the transmission of the first system, the failure information, the transmission information, the calculation information, and the failure Based on the type of area in which the failure was detected by the monitoring unit, the first system transmission was stopped.
The first output switching unit is
When the failure monitoring unit does not detect the failure in the communication area and the failure in the calculation area is detected, the transmission of the first system is stopped after the transmission processing of the first communication processing unit.
Neither the failure of the communication area nor the failure of the calculation area is detected by the failure monitoring unit, and the calculation process of the first calculation unit is completed based on the failure information, the transmission information, and the calculation information. If it is determined that a failure of the first system has occurred between the time when the operation processing is completed and the transmission processing of the first communication processing unit is completed, the transmission of the first system is stopped after the transmission processing.
Neither the failure of the communication area nor the failure of the calculation area is detected by the failure monitoring unit, and the calculation process of the first calculation unit is completed based on the failure information, the transmission information, and the calculation information. When it is determined that a failure of the first system has occurred between the completion of the transmission processing of the first communication processing unit immediately after the completion of the calculation processing of the first calculation unit and the completion of the calculation processing of the first calculation unit, the first system transmission is performed immediately after the determination. To stop the vehicle control device. It is a vehicle control method using a vehicle control device.
The vehicle control device is
A first control unit included in the first system and capable of vehicle control including at least one of AD (Autonomous Driving) control and ADAS (Advanced Driver Assistance System) control.
A second control unit included in the second system and capable of controlling the vehicle is provided.
The first control unit is
The first calculation unit that performs calculation processing of the command value used in the vehicle control of the first control unit, and the first calculation unit.
Including a first communication processing unit that performs transmission processing of the command value obtained by the first calculation unit.
The second control unit
The second calculation unit that performs calculation processing of the command value used in the vehicle control of the second control unit, and the second calculation unit.
Including a second communication processing unit that performs transmission processing of the command value obtained by the second calculation unit.
The vehicle control method is
Detecting the failure of the first system,
Based on the failure information indicating the failure of the first system and the transmission information indicating whether or not the first communication processing unit is in the transmission process, or based on the failure information, the transmission information, and the first. From the first system transmission, which is the transmission of the command value using the first communication processing unit of the first system, based on the calculation information indicating whether or not the first calculation unit is in the calculation process, the first system transmission. A vehicle control method for changing the timing of switching to the second system transmission, which is the transmission of the command value using the second communication processing unit of the second system.

Images