JPWO2021019715A1 - Vehicle control unit - Google Patents

Abstract

The present invention relates to a vehicle control device, and includes an automatic driving control device that determines a traveling path when executing automatic driving, and a steering control device that controls steering of the vehicle based on the traveling path. The automatic driving control device has an automatic driving controller main system and an automatic driving controller slave system to multiplex the system, and the steering control device has a steering controller main system and a steering controller slave system to multiplex the system for steering. When one of the steering controller main system and the steering controller slave system is detected as an abnormality of the control device, the other that does not detect the abnormality is switched to perform steering control, and the steering control device is the automatic operation control device. When one of the automatic operation controller main system and the automatic operation controller slave system is detected as an abnormality, steering control is performed using the control amount output by the other that has not detected the abnormality.

Description

The present invention relates to a vehicle control device, and more particularly to a vehicle control device that realizes fail-safe.

In-vehicle systems are equipped with a wide variety of electronic devices. The number of control devices called ECUs (Electronic Control Units) for controlling these devices is increasing with the recent increase in functionality and complexity. In particular, in the automatic driving system whose research and development is accelerating these days, a system that realizes highly automatic driving by linking the engine control, brake control, and steering control of the vehicle has been devised.

Such an automatic driving system is composed of an automatic driving ECU that generates optimum control parameters from surrounding conditions, an engine control ECU that realizes vehicle engine control, brake control, and steering control, respectively, a brake control ECU, and a steering control ECU. Will be done. If something goes wrong with the automatic driving system, automatic driving cannot be continued, so maintenance operation (fail operation operation) and transition to a safe state (fail safe operation) until the state where safety can be ensured can be ensured. Is required.

Patent Document 1 proposes a configuration stage in which a plurality of controllers mutually monitor an abnormality in a multiplexed system to switch control when an abnormality occurs to realize a fail operation operation.

Japanese Unexamined Patent Publication No. 2016-199239

In the controller and the electric power steering ECU (steering ECU) that realize the automatic operation, when an abnormality occurs in a part of the system, it is necessary to realize the fail operation operation, so that the controller and the electric power steering ECU (steering ECU) may be multiplexed.

In addition to vehicle control, these controllers need to manage conditions such as automatic driving or manual driving, and abnormality monitoring alone is not sufficient. In Patent Document 1, the monitoring target is the engine controller, and the state management is not mentioned, so it cannot be said that the fail operation operation can be surely realized.

The present invention has been made to solve the above problems, and an object of the present invention is to provide a vehicle control device capable of reliably realizing a fail operation operation.

The vehicle control device according to the present invention is an automatic driving control device that determines a traveling route when executing automatic driving based on vehicle surrounding environment information and position information, and steering control of the vehicle based on the traveling route. The automatic operation control device includes an automatic operation controller main system and an automatic operation controller slave system, and the system is multiplexed. The steering control device includes a steering controller main system and a steering controller slave system. The system is multiplexed with a system, the automatic operation control device and the steering control device detect each other's abnormalities and confirm the state by mutual communication, and the automatic operation control device is an abnormality of the steering control device. When an abnormality of one of the steering controller main system and the steering controller slave system is detected, the other that has not detected the abnormality is switched and controlled so as to perform the steering control, and the steering control device performs the automatic operation. When one of the automatic operation controller main system and the automatic operation controller slave system is detected as an abnormality of the control device, the steering control is performed using the control amount output by the other that has not detected the abnormality.

According to the vehicle control device according to the present invention, even if an abnormality occurs in either the automatic driving ECU or the steering ECU, the respective systems are multiplexed, so that the fail operation operation can be surely realized. ..

It is a block diagram which shows the structure of the vehicle control device of Embodiment 1 which concerns on this invention. It is a flowchart explaining the abnormality determination of the steering controller in the vehicle control device of Embodiment 1 which concerns on this invention. It is a flowchart explaining the abnormality determination of the automatic driving controller in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the state transition of the automatic driving ECU in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the state transition of the steering ECU in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the sequence which performs the abnormality detection and the state confirmation of the automatic driving ECU and the steering ECU in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the sequence at the time of abnormality detection of the steering ECU in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the sequence at the time of abnormality detection of the steering ECU in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the sequence at the time of abnormality detection of the automatic driving ECU in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the sequence at the time of abnormality detection of the automatic driving ECU in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the sequence at the time of the state mismatch in the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the hardware composition which realizes the vehicle control device of Embodiment 1 which concerns on this invention. It is a figure which shows the hardware composition which realizes the vehicle control device of Embodiment 1 which concerns on this invention.

<Embodiment 1>
FIG. 1 is a functional block diagram showing the configuration of the vehicle control device 10 according to the first embodiment of the present invention. The vehicle control device 10 is mounted on a vehicle (not shown), and various information is provided from a plurality of surrounding environment acquisition units 30, 31, 32 and the own vehicle position information acquisition unit 40, which are also mounted on the vehicle, via the vehicle-mounted network 80. The automatic driving control device (automatic driving ECU) 20 that receives the signal, the steering control device (steering ECU) 50, the brake control device (brake ECU) 60, and the accelerator control device (accelerator) that are connected to the automatic driving ECU 20 via the vehicle-mounted network 81. It has an ECU) 70.

The vehicle control device 10 is connected to a user interface 11 such as a switch, and the driver transmits information to the automatic driving ECU 20 via the user interface 11 to switch between automatic driving and manual driving. Further, during manual operation, the control amount is transmitted from the steering wheel, accelerator and brake (not shown) to the steering ECU 50, the brake ECU 60 and the accelerator ECU 70 via the vehicle-mounted network 81.

The automatic driving ECU 20 requests the driver via the user interface 11 to provide information such as whether the current vehicle state is automatic driving or manual driving and to switch to manual driving when an abnormality occurs. Notice.

Although the surrounding environment acquisition units 30 to 32 are shown in FIG. 1, the number is not limited to this, and various sensors such as cameras, millimeter-wave radars, and sonars, vehicle-to-vehicle communication modules, and road-to-vehicle communication are shown. It can be selected from modules and the like.

The vehicle position information acquisition unit 40 includes a GNSS (Global Navigation Satellite System) receiver such as GPS (Global Positioning System), and the received vehicle position information is combined with a high-precision map such as a dynamic map. By doing so, information on the surrounding environment can also be obtained.

The automatic operation ECU 20 has a controller system multiplexed so that maintenance operation can be performed when an abnormality occurs, and is composed of an automatic operation controller main system 21 and an automatic operation controller slave system 22.

The automatic driving ECU 20 composed of the automatic driving controller main system 21 and the automatic driving controller slave system 22 aggregates the surrounding environment information obtained from the surrounding environment acquisition units 30 to 32 and the position information obtained from the own vehicle position information acquisition unit 40. Then, the traveling path of the own vehicle when the automatic driving is executed is generated, and the control amount based on the traveling path, for example, the target handle angle, the engine drive amount, and the brake drive amount is calculated. The calculation result is sent to the steering ECU 50, the brake ECU 60, and the accelerator ECU 70 via the network 81, and automatic operation is realized by performing actuator control for each.

Similar to the automatic operation ECU 20, the steering ECU 50 has a controller system multiplexed so that it can be maintained when an abnormality occurs, and is composed of a steering controller main system 51 and a steering controller slave system 52.

The steering controller main system 51 and the steering controller slave system 52 each control the steering actuator 54 based on the amount of control from the automatic driving ECU 20. The outputs of the steering controller main system 51 and the steering controller slave system 52 are output to the steering actuator 54 via the switch circuit 53, and the switch circuit 53 is switched and controlled from the automatic operation ECU 20 via the control line 90 to control the steering controller. Only the output of either the main system 51 or the steering controller slave system 52 is output to the steering actuator 54.

Although FIG. 1 is shown so that the automatic operation controller main system 21 controls the switch circuit 53, the automatic operation controller slave system 22 may control the switch circuit 53. Further, the switch circuit 53 may be controlled by arbitrating between the automatic operation controller main system 21 and the automatic operation controller slave system 22.

In the following description, the steering controller main system 51 and the steering controller slave system 52 will be described assuming a completely redundant system capable of performing the same control. However, the configuration does not necessarily have to be a completely redundant system that performs the same control. For example, the slave controller may be configured to limit the output and output only the minimum driving force, as long as safety can be ensured. The concept of the automatic driving controller main system 21 and the automatic driving controller slave system 22 is the same as that of the steering ECU 50, but in the following description, the automatic driving controller main system 21 is a controller and an automatic driving controller for realizing the original automatic driving. The slave system 22 is distinguished as a controller for realizing the minimum automatic operation.

FIG. 2 is a flowchart illustrating an abnormality determination of the steering controller in the automatic driving controller. The automatic driving controller confirms whether or not an abnormality has occurred in the steering controller main system 51 (step S101).

Then, when an abnormality has occurred (in the case of Yes), the switch circuit 53 is set to the steering controller after shifting to the late tent mode (EPS late tent mode) of EPS (Electric Power Steering) in step S102. By switching to the slave system 52 side, continuous operation is realized (step S103).

After that, it is confirmed whether or not an abnormality has occurred in the steering controller slave system 52 (step S104).

Then, when an abnormality has occurred (in the case of Yes), that is, when both the steering controller main system 51 and the steering controller slave system 52 are abnormal, the system shifts to the emergency stop mode and executes the emergency stop process (in the case of Yes). Step S105).

Details of the emergency stop processing will be omitted, but examples thereof include processing such as controlling the brake ECU 60 and the accelerator ECU 70 to stop the vehicle on the spot.

On the other hand, in step S104, if no abnormality has occurred in the steering controller slave system 52 (No), the process ends.

Further, in step S101, if no abnormality has occurred in the steering controller main system 51 (if No), the process proceeds to step S106 to confirm whether or not an abnormality has occurred in the steering controller slave system 52.

If an abnormality has occurred in the steering controller slave system 52 in step S106 (in the case of Yes), the mode shifts to the EPS latency mode (step S107), and the process ends. On the other hand, in step S106, if no abnormality has occurred in the steering controller slave system 52 (No), the process ends. The EPS latency mode and the emergency stop mode will be described later.

FIG. 3 is a flowchart illustrating an abnormality determination of the automatic driving controller in the steering controller. The steering controller confirms whether or not an abnormality has occurred in the automatic driving controller main system 21 (step S201).

Then, when an abnormality has occurred (in the case of Yes), the process shifts to the backup mode in step S202, and if the driver is in automatic driving, the driver is requested to switch to manual driving.

After that, the steering actuator 54 is controlled by utilizing the control amount of the automatic driving controller slave system 22 (step S203).

Further, it is confirmed whether or not an abnormality has occurred in the automatic operation controller slave system 22 (step S204).

Then, when an abnormality has occurred (in the case of Yes), that is, when both the automatic operation controller main system 21 and the automatic operation controller slave system 22 are abnormal, the system shifts to the emergency stop mode and the emergency stop process is executed. (Step S205).

On the other hand, in step S204, if no abnormality has occurred in the automatic operation controller slave system 22 (if No), the process ends.

Further, in step S201, if no abnormality has occurred in the automatic operation controller main system 21 (if No), the process proceeds to step S206 to confirm whether or not an abnormality has occurred in the automatic operation controller slave system 22.

In step S206, when an abnormality has occurred in the automatic driving controller slave system 22 (in the case of Yes), the mode shifts to the late tent mode, and if the automatic driving is in progress, the driver is requested to switch to the manual driving (in the case of Yes). Step S207).

After that, the steering actuator 54 is controlled by utilizing the control amount of the automatic driving controller main system 21 regardless of the presence or absence of abnormality in the automatic driving controller slave system 22 (step S208). As a result, continuous operation is realized even if an abnormality occurs in the main system 21 of the automatic operation controller.

On the other hand, in step S206, if no abnormality has occurred in the automatic operation controller slave system 22 (in the case of No), the process proceeds to step S208. The backup mode, latency mode, and emergency stop mode will be described later.

FIG. 4 is a diagram showing a state transition of the automatic operation ECU 20. As shown in FIG. 4, the automatic operation ECU is roughly divided into a manual operation mode (manual operation state) and an automatic operation mode (automatic operation state). The operation from the user interface 11 of the driver, for example, ON / OFF of the automatic operation switch, switches from the manual operation mode to the automatic operation mode.

Further, both the manual operation mode and the automatic operation mode include a normal mode and an EPS ratet mode. Here, the EPS latency mode is a mode in which the steering control is performed on the normal side when an abnormality occurs in the main system or the slave system of the steering controller, and the normal mode is the main system and the slave system of the steering controller. This is a mode in which steering control can be performed by either of the systems when both systems are normal.

When an abnormality in the steering controller main system 51 or the steering controller slave system 52 is detected, the mode shifts to the EPS latency mode as shown in the flowchart of FIG.

In this state, an abnormality is detected in the steering controller main system 51 or the steering controller slave system 52, but the automatic operation ECU 20 switches the switch circuit 53 and utilizes the steering controller on which the abnormality has not occurred. Therefore, the operation can be continued. However, if an abnormality occurs further in this state, the steering operation may not be possible. Therefore, in the case of the automatic driving mode, the driver may be notified of the request to switch to the manual driving mode. When recovering from the abnormality, the mode shifts to the normal mode or the EPS latency mode. If an abnormality occurs in both the steering controller main system 51 and the steering controller slave system 52 of the steering ECU 50, the mode transitions to the emergency stop mode, that is, the mode for executing the emergency stop process. In this case, since the steering cannot be operated in either the manual driving mode or the automatic driving mode, a process such as stopping the vehicle is executed as an emergency stop process. The state transition shown in FIG. 4 is an example.

FIG. 5 is a diagram showing a state transition of the steering ECU 50. As shown in FIG. 5, the steering ECU 50 is roughly divided into a manual operation mode (manual operation state) and an automatic operation mode (automatic operation state).

Further, the manual operation mode and the automatic operation mode both include a normal mode, a late tent mode, and a backup mode.

When both the automatic operation controller main system 21 and the automatic operation controller slave system 22 are normal, the normal mode is set. In this case, as shown in the flowchart of FIG. 3, in the automatic operation mode, the steering ECU 50 controls the steering actuator 54 by utilizing the control amount of the automatic operation controller main system 21.

On the other hand, when an abnormality in the main system 21 of the automatic operation controller is detected, the backup mode is entered. The backup mode is a mode in which the steering ECU 50 controls the steering actuator 54 by utilizing the control amount of the automatic operation controller slave system 22 in the automatic operation mode.

On the other hand, when an abnormality of the automatic operation controller slave system 22 is detected, the mode shifts to the late tent mode. In this case, in the automatic operation mode, the steering ECU 50 controls the steering actuator 54 by utilizing the control amount of the automatic operation controller main system 21.

When both the backup mode and the latency mode recover from the abnormality, the mode shifts to the normal mode. If an abnormality occurs in both the main system 21 of the automatic operation controller and the secondary system 22 of the automatic operation controller, the mode transitions to the emergency stop mode, that is, the mode for executing the emergency stop process. In the automatic driving mode, automatic driving cannot be continued, so a process such as stopping the vehicle is executed as an emergency stop process. The state transition shown in FIG. 5 is an example.

FIG. 6 is a diagram showing a sequence of abnormality detection and status confirmation by message communication between the automatic driving ECU 20 and the steering ECU 50. As shown in FIG. 6, the automatic driving ECU 20 periodically transmits a survival confirmation message to the steering ECU 50. Hereinafter, this may be referred to as message transmission. The steering ECU 50 confirms that the automatic operation ECU 20 is operating correctly by periodically confirming the reception of the survival confirmation message. When the steering ECU 50 can confirm the reception of the message, the steering ECU 50 sends a survival confirmation message response to the automatic driving ECU 20. Hereinafter, this may be referred to as response transmission. The automatic operation ECU 20 confirms that the steering ECU 50 is operating correctly by confirming the reception of the survival confirmation message response.

In the example of FIG. 6, the automatic operation ECU 20 is periodically activated, calls and executes a process (function) for confirming a message from the steering ECU 50 received within the period of the previous cycle, and confirms survival based on the result. Send a message and end the process. Index and status information as arguments are added as communication information included in the survival confirmation message. The steering ECU 50 is also periodically activated, calls and executes a process (function) for confirming receipt of the survival confirmation message sent within the period of the previous cycle, and transmits a survival confirmation message response based on the result. End the process. Index and status information as arguments are added as communication information included in the survival confirmation message response. As shown in FIG. 6, one cycle of the automatic operation ECU 20 is from the activation of the process of performing "1: previous cycle message confirmation" to the activation of the process of performing the next "4: previous cycle message confirmation". For the steering ECU 50, one cycle is from the activation of the process of performing "3: confirmation of receipt of the survival confirmation message" to the activation of the next process of "6: confirmation of receipt of the survival confirmation message".

By periodically performing mutual communication between the automatic operation ECU 20 and the steering ECU 50 in this way, it is possible to mutually monitor each other's abnormalities and states (manual operation state or automatic operation state), and only detect the abnormality. Instead, it is possible to monitor the conditions that are essential for autonomous driving systems.

Here, the reception cycle (confirmation cycle) of the survival confirmation message of the steering ECU 50 is set to be equal to or less than the transmission cycle of the survival confirmation message of the automatic driving ECU 20, so that the next message is displayed while the steering ECU 50 confirms the message. It is possible to prevent the situation where the index arrives and cannot be dealt with and the index becomes inconsistent. The transmission cycle of the survival confirmation message is, for example, 100 msec, which is about the same as the control cycle of the automatic driving ECU 20 and the steering ECU 50.

The index given as an argument is defined as an 8-bit variable starting from 0, for example, 0 → 1 → 2 → 3 ... → 255 → 0 → 1 → 2 → 3 ... Up to 255, there is a configuration in which each message is incremented by one. The index variable is not limited to 8 bits, but may be set to a realistic multi-bit variable in consideration of the transmission cycle of the survival confirmation message.

In the example of FIG. 6, if the index of "2: survival confirmation message transmission" transmitted by the automatic driving ECU 20 is "0", the index of "3.1: survival confirmation message response" transmitted by the steering ECU 50 is also "0". ". If they match, it indicates that the response is correct, but if they do not match, it indicates that something is wrong.

In the above description of FIG. 6, the main system and the sub system have been described without distinction, but it is assumed that both operate in the same sequence. That is, the main system and the slave system of the automatic operation ECU 20 send a message to the main system and the slave system of the steering ECU 50, respectively, and the main system and the slave system of the steering ECU 50 are sent to the main system and the slave system of the automatic operation ECU 20, respectively. Returns a response.

Examples of the abnormality occurrence pattern of the steering ECU 50 include (a) no response to the message, (b) a response but an incorrect index, and FIG. 7 shows the abnormality detection of the steering ECU 50 in the case of (a). It is a figure which shows the sequence of time.

As shown in FIG. 7, the automatic operation ECU 20 checks the survival confirmation message response from the steering ECU 50 to the message transmitted in the previous cycle before transmitting the survival confirmation message. If there is no response for several cycles in a row, it is determined that an abnormality has occurred in the steering ECU 50.

In the example of FIG. 7, there is no survival confirmation message response from the steering ECU 50 in response to "2: transmission of survival confirmation message", and the steering ECU 50 also responds to "4: transmission of survival confirmation message" in the next cycle. It shows the case where there is no response from the steering ECU 50 and there is no response from the steering ECU 50 for several consecutive cycles.

The automatic operation ECU 20 further executes the "5.1: Steering control device abnormality determination" process as a result of performing "5: Confirmation of the message in the previous cycle" in the next cycle. The processing after the abnormality determination is as shown in the flowchart of FIG. In the example of FIG. 7, the case where there is no response from the steering ECU 50 for several consecutive cycles is shown, but this is an example, and if there is no response from the steering ECU 50 even once, it may be determined as abnormal. ..

In this way, the normality and abnormality of the steering ECU 50 are detected based on the presence or absence of the survival confirmation message response, so that it is easy to determine the abnormality of the steering ECU 50.

FIG. 8 is a diagram showing a sequence when an abnormality is detected in the steering ECU 50 when “(b) returns a response but the index is incorrect”.

In the example of FIG. 8, there is "3: survival confirmation message response" from the steering ECU 50 in response to "2: survival confirmation message transmission", but the index is incorrect. The automatic operation ECU 20 confirms that an incorrect index has been sent as a result of "4: confirmation of the previous cycle message" in the next cycle, and performs "5: transmission of the survival confirmation message".

On the other hand, although there is "6: Survival confirmation message response" from the steering ECU 50, the index is also incorrect, and indicates a case where the incorrect index is returned from the steering ECU 50 for several consecutive cycles.

The automatic operation ECU 20 further executes the "7.1: Steering control device abnormality determination" process as a result of performing "7: Confirmation of message in the previous cycle" in the next cycle. The processing after the abnormality determination is as shown in the flowchart of FIG. In the example of FIG. 8, the case where the wrong index is returned from the steering ECU 50 for several consecutive cycles is shown, but this is an example, and if the wrong index is returned from the steering ECU 50 even once, it is abnormal. May be determined.

In this way, since the normality and abnormality of the steering ECU 50 are detected based on the correctness of the index, the abnormality of the steering ECU 50 can be determined based on different indexes, which is effective in investigating and eliminating the cause of the abnormality. ..

Examples of the abnormality occurrence pattern of the automatic operation ECU 20 include (a) no message is transmitted and (b) the index of the message is incorrect. FIG. 9 shows the case of (a) when the abnormality is detected in the automatic operation ECU 20. It is a figure which shows the sequence.

As shown in FIG. 9, the steering ECU 50 is periodically activated, and a process (function) for confirming the reception of the survival confirmation message sent from the automatic driving ECU 20 within the period of the previous cycle is called and executed, and the result is The survival confirmation message response is transmitted based on the above, but in the example of FIG. 9, the case where the survival confirmation message is not transmitted from the automatic operation ECU 20 is shown.

That is, the steering ECU 50 executes "1: Confirmation of reception of survival confirmation message", but cannot transmit the survival confirmation message response because the survival confirmation message from the automatic driving ECU 20 has not been received.

Similarly, "2: Confirmation of reception of survival confirmation message" is executed in the next cycle, but since the survival confirmation message from the automatic operation ECU 20 has not been received, the survival confirmation message response cannot be transmitted.

Further, as a result of performing "3: Confirmation of reception of the survival confirmation message" in the next cycle, the steering ECU 50 assumes that the automatic operation ECU 20 does not transmit the survival confirmation message for several consecutive cycles. Execute the "operation ECU abnormality determination" process. The processing after the abnormality determination is as shown in the flowchart of FIG. The example of FIG. 9 shows a case where the automatic operation ECU 20 does not send a survival confirmation message for several consecutive cycles, but this is just an example, and if the survival confirmation message is not sent even once, it is determined to be abnormal. You may.

In this way, since the normality and abnormality of the automatic driving ECU 20 are detected by the presence or absence of the transmission of the survival confirmation message, it is easy to determine the abnormality of the automatic driving ECU 20.

FIG. 10 is a diagram showing a sequence at the time of abnormality detection of the automatic operation ECU 20 when “(b) message index is incorrect”.

In the example of FIG. 10, in response to "1: survival confirmation message transmission" from the automatic driving ECU 20, "2.1: survival confirmation message response" is transmitted from the steering ECU 50, and "3:: survival confirmation message response" is transmitted from the automatic driving ECU 20. "Send survival confirmation message", but the index is incorrect.

The steering ECU 50 executes "4: Confirmation of reception of survival confirmation message" in the next cycle and transmits "5: Response of survival confirmation message", but the index in "3: Transmission of survival confirmation message" is incorrect. Therefore, the steering ECU 50 also transmits an incorrect index.

On the other hand, the index in "6: Transmission of survival confirmation message" from the automatic driving ECU 20 is also incorrect, and the steering ECU 50 further performs "7: Confirmation of reception of survival confirmation message" in the next cycle. Assuming that the survival confirmation message of the wrong index is transmitted from the automatic operation ECU 20 in a continuous cycle, the "7.1: Automatic operation ECU abnormality determination" process is executed. The processing after the abnormality determination is as shown in the flowchart of FIG.

As described above, when the automatic driving ECU 20 adopts a configuration in which the index is incremented by one each time a message is sent, the steering ECU 50 stores the index of the message in the previous cycle and newly starts the automatic driving ECU 20. You can check the index error by comparing it with the index of the sent message.

In the example of FIG. 10, the case where the wrong index survival confirmation message is transmitted for several consecutive cycles is shown, but this is an example, and when the index survival confirmation message is transmitted even once, it is abnormal. May be determined.

In this way, since the normality and abnormality of the automatic operation ECU 20 are detected based on the correctness of the index, the abnormality of the automatic operation ECU 20 can be determined based on different indexes, which is effective for investigating and eliminating the cause of the abnormality. Is.

FIG. 11 is a diagram showing a sequence at the time of state mismatch. As a cause of the disagreement of states, for example, it is conceivable that an abnormality occurs in the main system of the steering ECU 50 during system operation and the main system of the steering ECU 50 is restarted, so that the disagreement of states occurs. ..

In the example of FIG. 11, a sequence is shown in the case where the automatic operation ECU 20 is in automatic operation and the steering ECU 50 is in manual operation. As described with reference to FIG. 6, the automatic driving ECU 20 transmits a survival confirmation message to the steering ECU 50, and confirms the survival confirmation message response from the steering ECU 50. As a result, when the state of the steering ECU 50 is different from the state of the automatic driving ECU 20, the automatic driving ECU 20 sends a state change request to the steering ECU 50. Upon receiving the state change request, the steering ECU 50 changes the state and notifies the automatic operation ECU 20 of the change.

By the above operation, the disagreement between the states of the automatic driving ECU 20 and the steering ECU 50 can be resolved.

In the example of FIG. 11, in "2: transmission of survival confirmation message" from the automatic operation ECU 20, the state of the automatic operation ECU 20 is automatic operation, but in "3.1: survival confirmation message response" from the steering ECU 50, steering is performed. The state of the ECU 50 is manual operation.

As a result of "4: Confirmation of message in the previous cycle" in the next cycle, the automatic operation ECU 20 executes "4.1: State mismatch processing" and requests the steering ECU 50 to change the state (4.1.1: State change). Manual operation → automatic operation) is sent.

The steering ECU 50 executes "5: status change request reception process" and transmits "6: reply to status change request" to the automatic operation ECU 20. As a result of the state change, the state of the steering ECU 50 changes from manual operation to automatic operation.

If the steering ECU 50 does not notify that the state has been changed, the automatic driving ECU 20 may determine the steering ECU 50 as abnormal.

As described above, by monitoring each other's abnormalities and states by message communication between the automatic driving ECU 20 and the steering ECU 50, it is possible to perform a fail operation operation even if a failure occurs in a part of the system.

Each part of the vehicle control device 10 of the first embodiment described above can be configured by using a computer, and is realized by executing the program by the computer. That is, the vehicle control device 10 shown in FIG. 1 is realized by, for example, the processing circuit 100 shown in FIG. A processor such as a CPU or DSP (Digital Signal Processor) is applied to the processing circuit 100, and the functions of each part are realized by executing a program stored in the storage device.

Dedicated hardware may be applied to the processing circuit 100. When the processing circuit 100 is dedicated hardware, the processing circuit 100 corresponds to, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof. do.

Further, FIG. 13 shows a hardware configuration when the vehicle control device 10 shown in FIG. 1 is configured by using a processor. In this case, the functions of each part of the vehicle control device 10 are realized by a combination of software or the like (software, firmware, or software and firmware). The software or the like is described as a program and stored in the memory 120. The processor 110 that functions as the processing circuit 100 realizes the functions of each part by reading and executing the program stored in the memory 120 (storage device).

Although the present invention has been described in detail, the above description is exemplary in all aspects and the invention of the present invention is not limited thereto. It is understood that innumerable variations not illustrated can be assumed without departing from the scope of the present invention.

In the present invention, the embodiments can be appropriately modified or omitted within the scope of the invention.

The vehicle control device according to the present invention is an automatic driving control device that determines a traveling route when executing automatic driving based on vehicle surrounding environment information and position information, and steering control of the vehicle based on the traveling route. The automatic operation control device includes an automatic operation controller main system and an automatic operation controller slave system, and the system is multiplexed. The steering control device includes a steering controller main system and a steering controller slave system. The system is multiplexed with a system, the automatic operation control device and the steering control device detect each other's abnormalities and confirm the state by mutual communication, and the automatic operation control device is an abnormality of the steering control device. When an abnormality of one of the steering controller main system and the steering controller slave system is detected, the other that has not detected the abnormality is switched and controlled so as to perform the steering control, and the steering control device performs the automatic operation. as fault in the control device, when detecting one of an abnormality of said automatic operation controller main system and the automatic operation controller slave, have rows the steering control by using the control amount of the other does not detect the abnormality outputs, The state is two states of whether the vehicle is in the automatic driving state or the manual driving state, and the automatic driving control device has an abnormality of one of the automatic driving controller main system and the automatic driving controller slave system. Is detected, or when one of the steering controller main system and the steering controller slave system is detected, if the state is the automatic operation state, a request for switching to manual operation is output .

The vehicle control device according to the present invention is an automatic driving control device that determines a traveling route when executing automatic driving based on vehicle surrounding environment information and position information, and steering control of the vehicle based on the traveling route. The automatic operation control device includes an automatic operation controller main system and an automatic operation controller slave system, and the system is multiplexed, and the steering control device is a steering controller main system and a steering controller slave system. The system is multiplexed with a system, the automatic operation control device and the steering control device detect each other's abnormalities and confirm the state by mutual communication, and the automatic operation control device is an abnormality of the steering control device. When an abnormality of one of the steering controller main system and the steering controller slave system is detected, the other that has not detected the abnormality is switched and controlled so as to perform the steering control, and the steering control device performs the automatic operation. When one of the automatic operation controller main system and the automatic operation controller slave system is detected as an abnormality of the control device, the steering control is performed using the control amount output by the other that has not detected the abnormality. The state is two states of whether the vehicle is in the automatic driving state or the manual driving state, and the automatic driving control device causes an abnormality in one of the automatic driving controller main system and the automatic driving controller slave system. When it is detected, or when one of the steering controller main system and the steering controller slave system is detected, if the state is the automatic operation state, a request for switching to manual operation is output, and the automatic operation control is performed. The mutual communication between the device and the steering control device is periodically executed, and the abnormality is detected by the presence / absence of periodic response transmission to the periodic message transmission and the communication information included in the message transmission and the response transmission. At the same time, the state is confirmed by the state information of the automatic operation state or the manual operation state included in the communication information, and the communication information included in the message transmission from the automatic operation control device. When the state information of the above is different from the state information of the communication information included in the response transmission from the steering control device, the automatic operation control device transmits a state change request to the steering control device. , The steering system The device changes the state information and transmits the change to the automatic operation control device.

Claims (8)

An automatic driving control device that determines the driving route when executing automatic driving based on the surrounding environment information and position information of the vehicle,
A steering control device that controls the steering of the vehicle based on the traveling path is provided.
The automatic operation control device is
The system is multiplexed with an automatic operation controller main system and an automatic operation controller slave system.
The steering control device is
The system is multiplexed with a steering controller main system and a steering controller slave system.
The automatic driving control device and the steering control device detect each other's abnormalities and confirm the state by mutual communication.
The automatic operation control device is
When one of the steering controller main system and the steering controller slave system is detected as an abnormality of the steering control device, switching control is performed so that the other that has not detected the abnormality performs the steering control.
The steering control device is
When one of the automatic driving controller main system and the automatic driving controller slave system is detected as an abnormality of the automatic driving control device, the steering control is performed using the control amount output by the other that has not detected the abnormality. Vehicle control device to perform. The state in which the automatic driving control device and the steering control device confirm each other is
The vehicle control device according to claim 1, wherein the vehicle is in two states, an automatic driving state and a manual driving state. The intercommunication between the automatic driving control device and the steering control device is periodically executed.
The abnormality is detected by the presence / absence of periodic response transmission to the periodic message transmission and the communication information included in the message transmission and the response transmission, and whether the automatic operation state is included in the communication information or not. The vehicle control device according to claim 2, wherein the state is confirmed by state information as to whether or not the vehicle is in a manual driving state. The abnormality detected by the mutual communication is
The abnormality of the steering control device when the steering control device does not transmit the response to the message transmission from the automatic driving control device, and the abnormality.
The vehicle control device according to claim 3, further comprising the abnormality of the automatic driving control device when the message is not transmitted from the automatic driving control device to the steering control device. The communication information is
Includes indexes assigned to each of the message transmission and the response transmission.
The abnormality detected by the mutual communication is
The abnormality of the automatic driving control device when the index given to the message transmission from the automatic driving control device is incorrect, and the abnormality of the automatic driving control device.
The vehicle control device according to claim 3, further comprising the abnormality of the steering control device when the index given to the response transmission from the steering control device is incorrect. The index is defined as a multi-bit variable starting from 0.
The index given to the message transmission from the automatic operation control device is incremented by one each time the message is transmitted when the automatic operation control device is normal.
The index given to the response transmission from the steering control device is the same numerical value as the index given to the message transmission from the automatic driving control device when the steering control device is normal. 5. The vehicle control device according to 5. The reception cycle of the message transmission in the steering control device is
The vehicle control device according to claim 3, which is equal to or less than the transmission cycle of the message transmission from the automatic driving control device. The state information of the communication information included in the message transmission from the automatic operation control device, and the state information.
When the state information of the communication information included in the response transmission from the steering control device is different from the state information.
The automatic driving control device transmits a state change request to the steering control device, and the automatic driving control device transmits a state change request to the steering control device.
The vehicle control device according to claim 3, wherein the steering control device changes the state information and transmits the changed state to the automatic driving control device.

Images