JP7130983B2 - vehicle controller - Google Patents

Description

The present disclosure relates to vehicle control devices.

Systems that control the behavior of a vehicle on the control device side and that control the behavior of the vehicle by the driver's operation on the control device side are realized as driving support systems and automatic driving systems. In such systems, it is known to take fail-safe measures when detecting that the actual behavior of the vehicle is greater than the desired behavior. In Patent Document 1 below, when the actual behavior temporarily exceeds the required behavior and immediately returns to normal, or in the case of erroneous detection due to disturbance noise, etc., it is intended to avoid executing unnecessary fail-safe measures. is proposed as

In the invention described in Patent Document 1 below, when a "provisional excess state" occurs in which the amount of excess driving force obtained by subtracting the required driving force from the actual driving force or the commanded driving force exceeds a predetermined threshold value, the excessive driving force determination amount is determined. When the excessive driving force determination amount exceeds a predetermined determination threshold, it is determined that the driving force is excessive, and "excessive determination control" is executed to issue a fail-safe action regarding driving. In the excessive determination control, the determination threshold value is lowered when a predetermined "safety parameter" reflecting the behavior related to the running safety of the vehicle satisfies a predetermined condition.

The excessive driving force determination amount is defined as information for confirming that there is a high probability that the vehicle actually has excessive driving force. Specifically, "excessive driving force duration, which is the time during which the excess driving force exceeds a predetermined threshold value from the occurrence of the temporary excessive state", "absolute value of excess driving force", " Time integrated value of excess driving force" etc. shall be adopted.

Safety parameters include brake depression amount, accelerator depression amount, steering wheel steering angle, steering wheel steering speed, steering angle of front and rear wheels, vehicle speed, vehicle acceleration, yaw angular velocity, yaw angular acceleration, speed difference between each wheel speed, and road surface friction coefficient. , shift position, etc. It is described that the "predetermined condition" for the security parameter is set to be satisfied when it is estimated that the risk of vehicle behavior is relatively high and prompt fail-safe action is required.

JP 2015-85831 A

In the invention described in Patent Document 1, a predetermined condition is assumed to be satisfied when the degree of risk of vehicle behavior is estimated to be relatively high, and the determination threshold is lowered when the predetermined condition is satisfied. It is possible to shorten the time required for recovery and activate the fail-safe procedure.

However, since the fail-safe procedure is activated when the vehicle is exposed to danger, albeit for a short period of time, the risk of the vehicle actually falling into a dangerous state remains. Further, whether or not the driving force is excessive is determined based on the state of the amount of excessive driving force, and the device for driving the vehicle and the result of operation of the device are used as safety parameters. If a failure occurs in the system, it is assumed that it may not be possible to perform accurate fail-safe measures.

SUMMARY OF THE INVENTION An object of the present disclosure is to provide a vehicle control device that can further reduce the risk of a vehicle falling into a dangerous state and can accurately shift to a fail-safe process for ensuring the safety of the own vehicle.

The present disclosure relates to a vehicle control device that, as a result of abnormality diagnosis of whether or not a device involved in vehicle behavior is in an abnormal state, determines that the device is in a temporary abnormal state. an abnormality determination unit (101) for performing an abnormality determination and a permanent abnormality determination that confirms the determination that the abnormal state exists on condition that the temporary abnormal state continues for a predetermined time or more; An abnormality response control unit (102) that shifts to fail-safe processing to ensure the safety of the own vehicle, and recognizes the situation of the own vehicle and is in a dangerous state with a high probability that the own vehicle will be in danger, or the own vehicle will be in danger. a danger judgment unit (103) that performs danger judgment processing for judging whether the probability is not high and whether the situation is in a non-dangerous state; a vehicle controller that transitions to the failsafe process, among other things.

In the present disclosure, in order to prevent erroneous determination due to sensor error or the like, provisional abnormality determination is first performed when the device is in an abnormal state as a result of abnormality diagnosis to determine whether the device is in an abnormal state. If the time during which the device is in an abnormal state is temporary, the process ends with a provisional abnormality determination, and normal behavior control is executed. On the other hand, if the device has been in the abnormal state for a predetermined period of time or longer, a final abnormality determination is made to confirm the determination that the device is in the abnormal state. When the abnormality determination unit makes this abnormality determination, the abnormality response control unit shifts to fail-safe processing for ensuring the safety of the own vehicle. The provisional abnormality determination may be made for the own vehicle, or may be made for the other vehicle by acquiring information related to the provisional abnormality determination from the other vehicle. This abnormality determination may also be performed for the own vehicle, or may be performed for another vehicle by acquiring information related to this abnormality determination from another vehicle. Furthermore, in the present disclosure, the danger determination unit determines whether the vehicle is in a dangerous state with a high probability of being in danger or in a non-dangerous state with a low probability of being in danger to the own vehicle. By judging the probability of danger to the own vehicle independently of judging the abnormal state of the device, it is possible to delay danger avoidance, which is a concern when judging actual anomaly after provisional anomaly judgment. is intended to reduce Specifically, when the host vehicle is in a dangerous state, the safety can be further improved by shifting to the fail-safe process even in the state of provisional abnormality determination that does not lead to the actual abnormality determination.

In addition, the symbols in parentheses described in "means for solving the problem" and "claims" indicate the corresponding relationship with "modes for carrying out the invention" described later. It is not intended that the "Means for Solving the Problems" and "Claims" are limited to the "Detailed Description" set forth below.

According to the present disclosure, it is possible to provide a vehicle control device capable of further reducing the risk of the vehicle falling into a dangerous state and accurately transitioning to fail-safe processing for ensuring the safety of the own vehicle.

FIG. 1 is a block configuration diagram including a vehicle control device. FIG. 2 is a block configuration diagram including an integrated ECU as another example of the vehicle control device. FIG. 3 is a flowchart for explaining the processing of the vehicle control device. FIG. 4 is a flowchart for explaining the processing of the vehicle control device. FIG. 5 is a flowchart for explaining the processing of the vehicle control device. FIG. 6 is a flowchart for explaining the processing of the vehicle control device. FIG. 7 is a flowchart for explaining the processing of the vehicle control device. FIG. 8 is a timing chart for explaining the processing of the vehicle control device. FIG. 9 is a flowchart for explaining the processing of the vehicle control device. FIG. 10 is a timing chart for explaining the processing of the vehicle control device. FIG. 11 is a timing chart for explaining the processing of the vehicle control device.

Hereinafter, this embodiment will be described with reference to the accompanying drawings. In order to facilitate understanding of the description, the same constituent elements in each drawing are denoted by the same reference numerals as much as possible, and overlapping descriptions are omitted.

A vehicle control device 10 will be described with reference to FIG. Information output from a camera 20 , a radar 21 , an accelerator sensor 22 , an MG sensor 23 , a shift sensor 24 , a steering sensor 25 , a brake sensor 26 and a receiver 27 is input to the vehicle control device 10 .

The camera 20 captures an image of the surroundings of the vehicle in which the vehicle control device 10 is mounted, generates image data, and outputs the image data to the vehicle control device 10 . The number of installed cameras 20 may be one or more, and the imaging direction may be any direction including the front side of the vehicle.

The radar 21 emits radio waves such as millimeter waves from a vehicle in which the vehicle control device 10 is mounted, and measures the reflected waves to measure the distance and direction to an object. The radar 21 generates ranging data including the direction and distance of the object based on the measurement results, and outputs the data to the vehicle control device 10 . The number of installed radars 21 may be one or more, and the measurement direction may be any direction including the front side of the vehicle.

The accelerator sensor 22 is a sensor for measuring the accelerator opening. The accelerator sensor 22 outputs accelerator opening data to the vehicle control device 10 . The MG sensor 23 acquires the driving result of the motor generator 31 and outputs it to the vehicle control device 10 as MG driving data.

The shift sensor 24 acquires the shift position and outputs it to the vehicle control device 10 as shift position data. The steering sensor 25 acquires a steering angle and outputs it to the vehicle control device 10 as steering angle data. The brake sensor 26 acquires the drive result of the ECB 34, which is a brake, and outputs it to the vehicle control device 10 as brake drive data.

The receiving device 27 is a part that receives information transmitted from other vehicles. The receiving device 27 outputs information received from other vehicles to the vehicle control device 10 .

The vehicle control device 10 outputs instruction signals to the throttle 30 , the motor generator 31 , the transmission 32 , the EPS 33 , the ECB 34 , the transmission device 35 and the alarm device 37 .

The throttle 30 adjusts the fuel supplied to the engine in order to adjust the rotation speed of the engine mounted on the vehicle. The throttle 30 adjusts the opening based on an instruction signal from the vehicle control device 10 to adjust the fuel supply amount.

The motor generator 31 can also generate power while generating a driving force according to an instruction signal output from the vehicle control device 10 . The transmission 32 controls the transmission according to an instruction signal output from the vehicle control device 10 .

EPS 33 is an electric power steering. The EPS 33 generates a steering assist force according to an instruction signal output from the vehicle control device 10 .

ECB 34 is an electronically controlled brake system. The ECB 34 generates braking force in accordance with an instruction signal output from the vehicle control device 10 .

The transmission device 35 is a device that transmits information transmitted via a network. The transmission device 35 transmits information output from the vehicle control device 10 .

The vehicle control device 10 is configured as a computer including, as hardware components, an arithmetic unit such as a CPU, a storage unit such as a RAM and a ROM, and an interface unit for exchanging data. Next, functional components of the vehicle control device 10 will be described.

The vehicle control device 10 includes an abnormality determination unit 101, an abnormality response control unit 102, a danger determination unit 103, and a travel control unit 104 as functional components.

The abnormality determination unit 101 determines whether a device related to the vehicle behavior is in an abnormal state as a result of an abnormality diagnosis, and determines that the device is in an abnormal state. It is a part that makes a final abnormality judgment that confirms the judgment that the abnormal state exists on the condition that the state continues for a predetermined time or longer. Devices involved in vehicle behavior include a throttle 30, a motor generator 31, a transmission 32, an EPS 33, and an ECB .

The abnormality response control unit 102 is a part that receives this abnormality determination and shifts to fail-safe processing for ensuring the safety of the own vehicle. The fail-safe process includes a case where the behavior control of the own vehicle is acted on in order to ensure the safety of the own vehicle, and a case where the other vehicle is acted upon to ensure the safety of the own vehicle.

A danger judgment unit 103 recognizes the situation of the own vehicle and performs a danger judgment process to judge whether it is a dangerous state with a high probability that the own vehicle is in danger or a non-dangerous state with a low probability that the own vehicle is in danger. is. If the result of the danger determination process is a dangerous state, the abnormality response control unit 102 shifts to the fail-safe process even during the provisional abnormality determination.

The running control unit 104 is a part that controls the running state of the vehicle in which the vehicle control device 10 is mounted. The travel control unit 104 executes control for adjusting the speed of the vehicle and control for adjusting the traveling direction of the vehicle.

In this embodiment, in order to prevent erroneous determination due to sensor error or the like, provisional abnormality determination is first performed when the device is in an abnormal state as a result of abnormality diagnosis to determine whether the device is in an abnormal state. If the time during which the device is in an abnormal state is temporary, the process ends with a provisional abnormality determination, and normal behavior control is executed. On the other hand, if the device has been in the abnormal state for a predetermined period of time or longer, a final abnormality determination is made to confirm the determination that the device is in the abnormal state.

When the abnormality determination unit 101 makes this abnormality determination, the abnormality response control unit 102 shifts to fail-safe processing for ensuring the safety of the own vehicle. The provisional abnormality determination may be made for the own vehicle, or may be made for the other vehicle by acquiring information related to the provisional abnormality determination from the other vehicle. This abnormality determination may also be performed for the own vehicle, or may be performed for another vehicle by acquiring information related to this abnormality determination from another vehicle.

Furthermore, in this embodiment, the danger determination unit 103 determines whether the vehicle is in a dangerous state with a high probability of being in danger or in a non-dangerous state with a low probability of being in danger. By judging the probability of danger to the own vehicle independently of judging the abnormal state of the device, it is possible to delay danger avoidance, which is a concern when judging actual anomaly after provisional anomaly judgment. is intended to reduce Specifically, when the host vehicle is in a dangerous state, the safety can be further improved by shifting to the fail-safe process even in the state of provisional abnormality determination that does not lead to the actual abnormality determination.

In this embodiment, the abnormality determination unit 101 performs abnormality diagnosis, provisional abnormality determination, and main abnormality determination for the own vehicle, and the danger determination unit 103 acquires the surrounding conditions of the own vehicle, Risk determination processing is performed based on As fail-safe processing, the abnormality handling control unit 102 executes interim fail-safe control equivalent to the fail-safe control for the device corresponding to this abnormal state.

The danger judgment unit 103 acquires data indicating the situation around the own vehicle, such as imaging data from the camera 20 and distance measurement data to obstacles from the radar 21, and performs danger judgment processing. When the own vehicle approaches an obstacle such as a guardrail or another vehicle beyond the allowable distance, it is possible to determine that there is a high probability that the own vehicle is in danger, and that the own vehicle is in a dangerous state. can be done. Furthermore, as a fail-safe process, provisional fail-safe control equivalent to fail-safe control for devices corresponding to this abnormal state is executed, so that the safety of the own vehicle can be ensured more quickly.

In this embodiment, the abnormality determination unit 101 can suspend the execution of the abnormality determination while the abnormality response control unit 102 is executing temporary fail-safe control.

During execution of temporary fail-safe control, the control state is different from normal non-fail-safe control. Therefore, there is a possibility that an abnormality diagnosis as to whether the device is in an abnormal state cannot be performed accurately, and this may affect the actual abnormality determination. Therefore, by withholding the execution of the abnormality determination during execution of the provisional fail-safe control, it is possible to suppress the occurrence frequency of erroneous determinations.

In the present embodiment, when the judgment result of the risk judgment unit 103 transitions from the dangerous state to the non-dangerous state, the abnormality judgment unit 101 terminates the provisional fail-safe control and restarts the provisional abnormality judgment. to resume.

Since the own vehicle is out of the dangerous state, the interim fail-safe control is ended and normal control is started. However, since the temporary abnormal state existed before transitioning to the temporary fail-safe control, the safety can be further improved by resuming the temporary abnormal judgment and the actual abnormal judgment.

In this embodiment, the abnormality determination unit 101 can initialize the duration of the provisional abnormal state and restart the actual abnormality determination.

When the self-vehicle comes out of the dangerous state and ends the provisional fail-safe control, the running state of the self-vehicle may differ from that before the provisional fail-safe control was executed. Therefore, by initializing the duration of the provisional abnormal state, it is possible to redo the process from the initial stage of the device abnormality diagnosis to the actual abnormality determination, thereby suppressing the frequency of erroneous determinations.

As an example, when the target device is the transmission 32, it is erroneously determined that the shift is in the D range (forward range) even though the shift is in the R range (reverse range). A case will be explained.

The abnormality determination unit 101 makes a provisional abnormality determination of the shift, and starts counting up the actual abnormality determination counter. This abnormality determination counter is a counter for counting the duration of the tentative abnormal state. When the driver turns the accelerator while facing backward from parking, the own vehicle accelerates toward the front wall. Here, the danger judgment unit 103 judges that a dangerous state exists based on data such as imaging data and distance measurement data. The abnormality response control unit 102 executes, as provisional fail-safe control, a shift change equivalent to a shift change to the N range (neutral range) of the shift, which is fail-safe control corresponding to the shift during provisional abnormality determination. In this case, it is expected that the vehicle will be temporarily stopped, so the abnormality determination counter can be reset and the determination can be made slowly.

In this embodiment, the abnormality determination unit 101 can resume the actual abnormality determination while holding the duration of the provisional abnormal state.

When the host vehicle exits the dangerous state and ends the provisional fail-safe control, the running state of the host vehicle may differ from that before the provisional fail-safe control was executed. Although there is no significant difference between the two, there are cases where prompt execution of anomaly judgment is required. Therefore, by resuming the abnormality determination while holding the duration of the temporary abnormal state, the result of the temporary abnormality determination before the temporary fail-safe control is executed can be inherited, and a quick determination can be made.

As an example, a case where the target device is the EPS 33 and the EPS 33 is out of order and the steering becomes heavy will be described.

The abnormality determination unit 101 makes a provisional abnormality determination for the EPS 33 and starts counting up the actual abnormality determination counter. If the steering becomes heavy while the driver is cornering, the vehicle will understeer and the vehicle will approach the wall surface on the front side. Here, the danger judgment unit 103 judges that a dangerous state exists based on data such as imaging data and distance measurement data. The anomaly handling control unit 102 executes fail-safe control corresponding to steering during provisional anomaly determination as provisional fail-safe control. In this case, since there is a possibility that the vehicle will continue to run, it is possible to make a quick determination without resetting the abnormality determination counter.

As an example, a case where the target device is the throttle 30 and it is erroneously determined that the accelerator is ON while the accelerator is OFF will be described.

The abnormality determination unit 101 performs provisional abnormality determination of the throttle 30 and starts counting up of the actual abnormality determination counter. Even if the driver turns off the accelerator during cornering and tries to close the throttle 30, the throttle 30 does not actually close as intended and the vehicle does not decelerate, and the vehicle approaches the front side wall surface. Here, the danger judgment unit 103 judges that a dangerous state exists based on data such as imaging data and distance measurement data. The anomaly response control unit 102 executes, as a provisional fail-safe control, control for setting the throttle opening to about 3%, which is a fail-safe control corresponding to the throttle 30 for which the provisional abnormality determination is being made. At this time, the ECB 34 may also be used for braking. In this case, since there is a possibility that the vehicle will continue to run, it is possible to make a quick determination without resetting the abnormality determination counter.

The vehicle control device 10 of this embodiment can cope with the case where the own vehicle is running in a row. In the present embodiment, when the abnormality determination unit 101 makes a provisional abnormality determination based on the results of abnormality diagnosis as to whether or not an acceleration/deceleration device involved in acceleration or braking of the vehicle is in an abnormal state. Furthermore, the danger determination unit 103 determines that the vehicle is in a dangerous state when the vehicle is running in a row.

During platooning, the inter-vehicle distance may be set short on the premise that the acceleration/deceleration device involved in acceleration or braking is normal. Therefore, in the case of a provisional abnormal state based on the abnormality diagnosis of the acceleration/deceleration device involved in the acceleration or braking of the vehicle, and in the case of platooning, it is determined that the vehicle is in a dangerous state, and the system shifts to fail-safe processing. , can be more secure.

In this embodiment, the acceleration/deceleration device is an accelerator sensor 22 that detects the opening of the accelerator, an acceleration device such as a motor, a motor generator 31, an inverter, and software related to them, or a brake sensor. It includes braking system devices such as the brake sensor 26, the ECB 34 including the brake actuator, and the software associated with them.

In this embodiment, as fail-safe processing, the anomaly response control unit 102 executes inter-vehicle distance securing control to secure a safe inter-vehicle distance that increases the possibility of avoiding a collision between the own vehicle and other vehicles running in a platoon. .

Control to secure a safe inter-vehicle distance includes widening the inter-vehicle distance between vehicles in a platoon, moving the vehicle in the platoon to the side of the road, and changing the lane of the vehicle in the platoon. By doing so, it is possible to increase the possibility of avoiding a collision even when the other vehicle in the tentative abnormal state behaves abnormally, thereby further enhancing safety.

In this embodiment, the safe inter-vehicle distance can be obtained as a distance at which vehicles do not collide, which is obtained from the maximum deceleration or maximum acceleration of the vehicles.

In this embodiment, when the abnormality determination unit 101 determines that the provisional abnormal state of the acceleration/deceleration device has been resolved in the provisional abnormality determination, the risk determination unit 103 resolves the determination of the dangerous state, and the abnormality response control unit 102 terminates the inter-vehicle distance securing control.

In the present embodiment, the abnormality determination unit 101 compares the time from the diagnosis of the abnormality of the acceleration/deceleration device to the provisional abnormality determination to the time when the host vehicle is not platooning. can be shortened to

In this embodiment, when the abnormality determination unit 101 makes the actual abnormality determination, the abnormality response control unit 102 can stop the execution of the fail-safe process and eliminate the platooning of the own vehicle.

In the above description, an example in which the vehicle control device 10 is provided with the abnormality determination unit 101, the abnormality response control unit 102, the danger determination unit 103, and the travel control unit 104 as functional components has been described. may be provided in a plurality of ECUs (Electronic Control Units). An example in which functional components are provided in a plurality of ECUs will be described with reference to FIG.

As shown in FIG. 2, an integrated ECU 11, an external environment recognition ECU 111, a power train ECU 112, a steering ECU 113, and a brake ECU 114 are provided as a plurality of ECUs.

Detection information is output to the integrated ECU 11 from the external environment recognition ECU 111 , the power train ECU 112 , the steering ECU 113 , and the brake ECU 114 . Instruction information is output from the integrated ECU 11 to the external environment recognition ECU 111 , the power train ECU 112 , the steering ECU 113 and the brake ECU 114 .

Image pickup data from the camera 20 and ranging data from the radar 21 are output to the power train ECU 112 . Accelerator opening degree data from the accelerator sensor 22 , MG drive data from the MG sensor 23 , and shift position data from the shift sensor 24 are output to the powertrain ECU 112 .

Steering angle data is output from the steering sensor 25 to the steering ECU 113 . Brake drive data is output from the brake sensor 26 to the brake ECU 114 .

The power train ECU 112 outputs drive signals to the throttle 30 , the motor generator 31 and the transmission 32 . Steering ECU 113 outputs a drive signal to EPS 33 . Brake ECU 114 outputs a drive signal to ECB 34 .

The configuration described with reference to FIG. 2 can also exhibit the same function as the configuration described with reference to FIG.

Next, a processing flow of the vehicle control device 10 will be described with reference to FIG. In step S101, the abnormality determination unit 101 executes abnormality diagnosis. The abnormality is diagnosed by determining whether the data output from the accelerator sensor 22, the MG sensor 23, the shift sensor 24, the steering sensor 25, and the brake sensor 26 are within normal ranges. If the state in which the data is out of the normal range has continued for a predetermined time or longer, the abnormality determination unit 101 determines that a provisional abnormal state exists.

In step S102 following step S101, the abnormality determination unit 101 determines whether or not it is in a provisional abnormal state. If it is determined that the temporary abnormal state exists, the process proceeds to step S103, and if it is determined that the temporary abnormal state does not exist, the process proceeds to step S106.

In step S103, the danger determination unit 103 determines whether or not the host vehicle is running in a row. If the vehicles are running in a row, the process proceeds to step S104. If the vehicles are not running in a row, the process proceeds to step S105.

In step S104, a platoon fail-safe process is executed. The platoon fail-safe process will be described with reference to FIG.

In step S151 of FIG. 4, the abnormality determination unit 101 determines whether or not the device in the temporary abnormal state is an acceleration device. If the device in the tentative abnormal state is an accelerating device, the process proceeds to step S152, and if the device in the tentative abnormal state is not an accelerating device, the process proceeds to step S153.

In step S152, the abnormality handling control unit 102 executes an acceleration fail-safe process. The acceleration fail-safe process will be described with reference to FIG.

In step S201 of FIG. 5, the abnormality determination unit 101 executes the actual abnormality determination for the device in the tentative abnormal state. As for the actual abnormality determination, the actual abnormality counter is counted up in order to count the duration of the tentative abnormal state.

In step S202 following step S201, the abnormality determination unit 101 determines whether or not the count value of the abnormality counter exceeds the threshold. If the count value of the abnormality counter exceeds the threshold, the process proceeds to step S203, and if the count value of the abnormality counter does not exceed the threshold, the process proceeds to step S205.

In step S203, the abnormality determination unit 101 confirms this abnormality determination. In step S204 following step S203, the abnormality response control unit 102 notifies the preceding vehicle forming a platoon with the own vehicle that the own vehicle is in this abnormal state.

In step S205, the anomaly response control unit 102 notifies the preceding vehicle forming a platoon with the own vehicle that the own vehicle is in a tentative abnormal state. When the processes of steps S204 and S205 are completed, the acceleration fail-safe process is terminated, and the process returns to the process of FIG.

In step S153 of FIG. 4, the abnormality determination unit 101 determines whether or not the device in the provisionally abnormal state is a braking system device. If the device in the tentative abnormal state is a braking device, the process proceeds to step S154, and if the device in the tentative abnormal state is not a braking device, the platoon fail-safe process ends.

In step S154, the abnormality response control unit 102 executes braking fail-safe processing. Braking fail-safe processing will be described with reference to FIG.

In step S251 of FIG. 6, the abnormality determination unit 101 executes the actual abnormality determination for the device in the tentative abnormal state. As for the actual abnormality determination, the actual abnormality counter is counted up in order to count the duration of the tentative abnormal state.

In step S252 following step S251, the abnormality determination unit 101 determines whether or not the count value of the abnormality counter exceeds the threshold. If the count value of the abnormality counter exceeds the threshold, the process proceeds to step S253, and if the count value of the abnormality counter does not exceed the threshold, the process proceeds to step S255.

In step S253, the abnormality determination unit 101 confirms this abnormality determination. In step S254 following step S253, the abnormality response control unit 102 notifies the following vehicles that are platooning with the own vehicle that the own vehicle is in this abnormal state.

In step S255, the anomaly handling control unit 102 notifies the following vehicles forming a platoon with the own vehicle that the own vehicle is in a tentative abnormal state. When the processes of steps S254 and S255 are completed, the braking fail-safe process is terminated, and the process returns to the process of FIG.

When the acceleration fail-safe process of step S152 in FIG. 4 and the braking fail-safe process of step S154 are completed, the platoon fail-safe process ends and the process returns to the process of FIG.

In step S106 of FIG. 3, the danger determination unit 103 determines whether or not the own vehicle is running in a row. If the vehicle is running in a row, the process proceeds to step S107, and if it is not running in a row, the process ends.

In step S107, a platoon fail-safe handling process is executed. The platoon fail-safe handling process will be described with reference to FIG.

In step S301 of FIG. 7, the abnormality determination unit 101 determines whether or not an abnormality notification has been received from another vehicle forming a platoon. If the abnormality notification is received, the process proceeds to step S302, and if the abnormality notification is not received, the platoon fail-safe handling process is terminated and the process returns to the process in FIG.

In step S302, the abnormality determination unit 101 determines whether or not the other vehicle that has issued the abnormality notification is the preceding vehicle. If it is the preceding vehicle, the process proceeds to step S303, and if it is not the preceding vehicle but the following vehicle, the process proceeds to step S307.

In step S303, the abnormality determination unit 101 determines whether or not the device that is the target of the abnormality notification is a braking system device. If it is a braking system device, the process proceeds to step S304, and if it is not a braking system device, the platoon fail-safe handling process is terminated and the process returns to the process of FIG.

In step S304, the abnormality determination unit 101 determines whether or not the device that is the target of the abnormality notification is in a tentative abnormal state. If the device is in the temporary abnormal state, the process proceeds to step S305, and if the device is not in the temporary abnormal state but in the actual abnormal state, the process proceeds to step S306.

In step S305, the abnormality response control unit 102 instructs the travel control unit 104 to increase the inter-vehicle distance from the preceding vehicle in the platoon. In step S306, the abnormality response control unit 102 instructs the traveling control unit 104 to cancel the platooning. When the processes of steps S305 and S306 are finished, the platoon fail-safe handling process is finished, and the process returns to the process of FIG.

In step S307, the abnormality determination unit 101 determines whether or not the device that is the target of the abnormality notification is an acceleration device. If it is an acceleration type device, the process proceeds to step S308, and if it is not an acceleration type device, the platoon fail-safe handling process is terminated and the process returns to the process of FIG.

In step S308, the abnormality determination unit 101 determines whether or not the device that is the target of the abnormality notification is in a tentative abnormal state. If the device is in the tentative abnormal state, the process proceeds to step S309, and if the device is not in the tentative abnormal state but in the actual abnormal state, the process proceeds to step S310.

In step S309, the anomaly response control unit 102 instructs the travel control unit 104 to increase the inter-vehicle distance from the following vehicle in the platoon. In step S310, the abnormality handling control unit 102 instructs the traveling control unit 104 to cancel the platooning. When the processes of steps S309 and S310 are finished, the platoon fail-safe handling process is finished and the process returns to the process of FIG.

The relationship between the failed vehicle and the corresponding vehicle will be described with reference to FIG. FIG. 8(A) shows the provisional abnormality flag of the failed vehicle. If it is determined in the process of step S102 in FIG. 3 that there is a provisional abnormal state, a provisional abnormality flag is set.

FIG. 8B shows the counting state of the abnormality determination counter, which is the abnormality counter. When time elapses while the main abnormality flag is set, the main abnormality counter is counted up.

FIG. 8(C) shows the state of the abnormality confirmation flag indicating that the abnormal state has occurred. Since the abnormality confirmation counter is counted up from time t1 to time t2 and exceeds the threshold value, the abnormality confirmation flag is set at time t2, and the abnormal state is confirmed.

FIG. 8(D) shows the state of the gap flag for increasing the distance between the vehicle and the failed vehicle. Since the provisional abnormality flag is set in the broken vehicle at time t1, the gap opening flag is set at time t2 by the notification from the broken vehicle to the service vehicle, and the service vehicle executes processing to open the gap.

FIG. 8(E) shows the state of the platoon cancel flag for canceling platooning. At time t2, it is determined that the malfunctioning vehicle is in this abnormal state, so the platoon cancel flag is set in place of the gap opening flag, and the corresponding vehicle executes processing for leaving the platoon.

FIG. 8F shows the inter-vehicle distance between the corresponding vehicle and the failed vehicle. Since normal platooning is performed until time t1, the inter-vehicle distance is 0.5 m. At time t1, the gap flag is set, so the inter-vehicle distance has increased to 20 m. At time t2, platooning is canceled, so the inter-vehicle distance is further increased to 100 m.

In step S105 of FIG. 3, a single fail-safe process is executed. The single fail-safe process will be described with reference to FIG.

In step S501 of FIG. 9, the danger determination unit 103 determines whether the own vehicle is in a non-dangerous state or a dangerous state. If the host vehicle is in a non-dangerous state, the process proceeds to step S502, and if the host vehicle is in a dangerous state, the process proceeds to step S506.

In step S502, the abnormality determination unit 101 executes the actual abnormality determination for the device in the tentative abnormal state. As for the actual abnormality determination, the actual abnormality counter is counted up in order to count the duration of the tentative abnormal state.

In step S503 following step S502, the abnormality determination unit 101 determines whether or not the count value of the abnormality counter exceeds the threshold. If the count value of the abnormality counter exceeds the threshold, the process proceeds to step S504, and if the count value of the abnormality counter does not exceed the threshold, the process ends.

In step S504, the abnormality determination unit 101 confirms this abnormality determination. In step S506, the determination of whether or not the abnormal state is present is stopped. At step S506, either the count of the abnormality counter is reset or held. Depending on the conditions, the anomaly counter may continue to count up.

In steps S504 and S505, the abnormality handling control unit 102 executes fail-safe processing corresponding to the device in the temporary abnormal state or the permanent abnormal state. For example, when the device is the transmission 32, as the fail-safe process, the shift change equivalent to the shift change to the N range (neutral range) of the shift, which is the fail-safe control corresponding to the shift during the tentative abnormality determination, is provisionally failed. Run as safe control.

A chronological example of the processing described with reference to FIG. 9 will be described with reference to FIG. FIG. 10(A) shows a provisional abnormality flag. If it is determined in the process of step S102 in FIG. 3 that there is a provisional abnormal state, a provisional abnormality flag is set. In the example of FIG. 10, the temporary abnormality flag is set at time t1.

FIG. 10B shows the vehicle danger flag. If it is determined in step S501 in FIG. 10 that the vehicle is in a dangerous state, a vehicle danger flag is set. In the example of FIG. 10, the vehicle danger flag is set at time t2 after a certain amount of time has passed from time t1. Further, at time t3, when the host vehicle exits the dangerous state, the vehicle danger flag is reset.

FIG. 10(C) shows the state of the abnormality confirmation flag indicating that the abnormal state has occurred. In the example of FIG. 10, the abnormality determination counter counts up from time t1 to time t3. Since the vehicle danger flag is set at time t2 between time t1 and time t3, the abnormality determination in step S502 of FIG. 9 is not executed, and the abnormality confirmation counter is counted up even if it exceeds the threshold.

At time t3, the host vehicle comes out of the dangerous state, but since there is a possibility that an error may be included in the abnormality diagnosis from time t2 to time t3, the abnormality determination counter is reset. Since the provisional abnormal state continues, the abnormality determination counter restarts counting up from time t3 when the vehicle danger flag is no longer set, and exceeds the threshold at time t4 after a certain amount of time has passed since time t3. ) is set.

FIG. 10D shows a failsafe flag for executing failsafe processing. At time t2, the vehicle is in a dangerous state and provisionally abnormal state, so a fail-safe flag is set and fail-safe processing is executed. At time t3, the vehicle is out of the dangerous state, so the fail-safe process ends. At time t4, the failure determination flag is raised again, so fail-safe processing is executed.

Another time-series example of the processing described with reference to FIG. 9 will be described with reference to FIG. FIG. 11A shows the provisional abnormality flag. If it is determined in the process of step S102 in FIG. 3 that there is a provisional abnormal state, a provisional abnormality flag is set. In the example of FIG. 10, the temporary abnormality flag is set at time t1.

FIG. 11B shows the vehicle danger flag. If it is determined in step S501 in FIG. 11 that the vehicle is in a dangerous state, a vehicle danger flag is set. In the example of FIG. 10, the vehicle danger flag is set at time t2 after a certain amount of time has passed from time t1. Further, at time t3, when the host vehicle exits the dangerous state, the vehicle danger flag is reset.

FIG. 11(C) shows the state of the abnormality confirmation flag indicating that the abnormal state has occurred. In the example of FIG. 11, the abnormality determination counter counts up from time t1 to time t2. Since the vehicle danger flag is set at time t2 between time t1 and time t3, the abnormality determination counter stops counting up.

At time t3, the host vehicle exits the dangerous state, so the abnormality determination counter restarts counting up from time t3. Since the tentative abnormal state continues, the threshold value is exceeded at time t41 after a certain amount of time has passed since time t3, so the abnormality confirmation flag shown in FIG. 11(E) is set.

FIG. 11D shows a failsafe flag for executing failsafe processing. At time t2, the vehicle is in a dangerous state and provisionally abnormal state, so a fail-safe flag is set and fail-safe processing is executed. At time t3, the vehicle is out of the dangerous state, so the fail-safe process ends. At time t41, the failure determination flag is raised again, so fail-safe processing is executed.

The present embodiment has been described above with reference to specific examples. However, the present disclosure is not limited to these specific examples. Design modifications to these specific examples by those skilled in the art are also included in the scope of the present disclosure as long as they have the features of the present disclosure. Each element included in each specific example described above and its arrangement, conditions, shape, etc. are not limited to those illustrated and can be changed as appropriate. As long as there is no technical contradiction, the combination of the elements included in the specific examples described above can be changed as appropriate.

101: Abnormality determination unit 102: Abnormality response control unit 103; Danger determination unit

Claims (11)

A vehicle control device,
Provisional abnormality determination for determining that the device is in an abnormal state as a result of an abnormality diagnosis as to whether or not the device involved in vehicle behavior is in an abnormal state, and the provisional abnormal state for a predetermined time an abnormality determination unit (101) that performs a final abnormality determination that confirms the determination that the abnormal state exists on the condition that the above continues;
an anomaly response control unit (102) that, upon receiving the main anomaly determination, shifts to a fail-safe process for ensuring the safety of the own vehicle;
a danger judgment unit (103) that recognizes the situation of the own vehicle and performs danger judgment processing for judging whether it is in a dangerous state with a high probability that the own vehicle will be in danger or a non-dangerous state with a low probability that the own vehicle will be in danger; , and
When the result of the risk determination process is the dangerous state, the abnormality response control unit transitions to the fail-safe process even during the provisional abnormality determination,
When the abnormality determination unit performs the provisional abnormality determination based on the result of performing an abnormality diagnosis as to whether or not an acceleration/deceleration device involved in acceleration or braking of the vehicle as the device is in an abnormal state,
The vehicle control device , wherein the danger determination unit determines that the vehicle is in the dangerous state when the vehicle is running in a row . The vehicle control device according to claim 1,
The abnormality determination unit performs the abnormality diagnosis, the provisional abnormality determination, and the main abnormality determination for the own vehicle,
The risk determination unit acquires a situation around the own vehicle, performs the risk judgment process based on the acquired situation around the vehicle,
The vehicle control device, wherein the abnormality response control unit executes, as the fail-safe processing, interim fail-safe control equivalent to fail-safe control for devices corresponding to the abnormal state. The vehicle control device according to claim 2,
The vehicle control device, wherein the abnormality determination unit suspends execution of the main abnormality determination while the temporary fail-safe control is being performed by the abnormality response control unit. The vehicle control device according to claim 3,
The abnormality determination unit terminates the provisional fail-safe control to resume the provisional abnormality determination when the result of determination by the risk determination unit transitions from the dangerous state to the non-dangerous state. vehicle controller. The vehicle control device according to claim 4,
The vehicle control device, wherein the abnormality determination unit initializes the duration of the provisional abnormal state and restarts the actual abnormality determination. The vehicle control device according to claim 4,
The vehicle control device, wherein the abnormality determination unit resumes the actual abnormality determination while holding the duration of the provisional abnormal state. The vehicle control device according to claim 1 ,
The acceleration/deceleration device is an acceleration system device such as a sensor that detects the opening of the accelerator, a motor, a motor generator, an inverter, and software related to them, or a brake sensor, a brake actuator, and software related to them. vehicle controller, including system devices. The vehicle control device according to claim 1 ,
As the fail-safe process, the anomaly response control unit executes inter-vehicle distance securing control for ensuring a safe inter-vehicle distance that increases the possibility of avoiding a collision between the own vehicle and other vehicles running in a platoon . 2. A vehicle control device according to claim 1, wherein the safe inter-vehicle distance is a distance obtained from the maximum deceleration or maximum acceleration of the vehicles so that the vehicles do not collide with each other . The vehicle control device according to claim 8 ,
When the abnormality determination unit determines that the provisional abnormality state of the acceleration/deceleration device has been resolved in the provisional abnormality determination,
The danger judgment unit cancels the judgment of the dangerous state,
The vehicle control device, wherein the abnormality response control unit terminates the inter-vehicle distance securing control. The vehicle control device according to claim 1 ,
The abnormality determination unit shortens the time from performing the abnormality diagnosis of the acceleration/deceleration device to performing the provisional abnormality determination when the host vehicle is running in a platoon compared to when the host vehicle is not running in a platoon. , vehicle controller. The vehicle control device according to claim 1 ,
When the abnormality determination unit performs the main abnormality determination,
The vehicle control device, wherein the abnormality response control unit stops execution of the fail-safe process and eliminates platooning of the own vehicle.

Images