Vehicle control device

Abstract

In the storage of abnormality cause analysis data in a vehicle control device, there is a problem in the storage of abnormality cause analysis data. A voltage drop due to a driver's power-off operation is determined as a voltage drop due to the occurrence of a power supply abnormality and stored as analysis data due to a variation in charge and discharge characteristics in which the type and number of mounted electric components vary, resulting in that data useful for fault cause analysis is covered and cannot be obtained any more. In order to solve this problem, a vehicle control device according to the present invention stops a vehicle control function when a drop in a supply voltage is detected, and generates analysis data at the same time. When the abnormality is released due to the detection of the increase in the voltage and the duration of the reduction in the voltage has reached a certain time or longer, the vehicle control function is operated in which damage to the power supply system is predicted within a certain time before the stop of the vehicle control function. The analysis data is recorded in the non-volatile memory at any timing when the vehicle control function is operated in which a large voltage fluctuation occurs within a certain period of time before the vehicle control function is stopped.

Description

Technical Field

[0001] The present invention relates to a vehicle control device that stores information used for analyzing a cause of abnormality related to a vehicle. Background Art

[0002] As a prior art, the following technology is known: a vehicle control device performs self-diagnosis on an abnormal state of a vehicle (its own vehicle), and when an abnormality of the vehicle is detected, effective analytical data for analyzing the cause of the abnormality is stored in a non-volatile memory, and the cause of the abnormality can be easily inferred by referring to the analytical data so that qualified maintenance or repair can be quickly performed (for example, refer to the following patent document 1). Prior art literature Patent Literature

[0003] Patent Document 1: Japanese Patent Application Publication No. 2014-231305 Summary of the invention Problem that the invention aims to solve

[0004] However, in the prior art, the capacity for storing analytical data (hereinafter sometimes referred to as analytical data) is limited, and only analytical data that is effective for analyzing the cause of the abnormality must be accurately retained. If analytical data is continuously stored when it is not needed for analysis, it will be squeezed out and overwritten by new analytical data, and when analytical data is needed, the analytical data for the abnormality that was originally intended to be resolved cannot be obtained, resulting in a time-consuming and labor-intensive determination of the cause of the abnormality.

[0005] In particular, when a problem occurs in a vehicle-mounted power supply system such as a battery or a generator, the vehicle control device determines a drop in supply voltage and stops the vehicle control function, while recording analysis data in the hope of using it for repair or maintenance. However, the supply voltage also drops when the driver turns off the vehicle's power supply. The driver turns off the vehicle's power supply on a daily basis, so if the supply voltage drop is detected to store analysis data, the analysis data at the time of the abnormality that was originally intended to be resolved cannot be obtained.

[0006] On the other hand, if the conditions for storing analysis data when the supply voltage drops are set too strict, there is a contradiction that information when a problem occurs in the power supply system cannot be stored as analysis data.

[0007] Furthermore, in recent years, vehicles have become increasingly advanced and electrified in order to improve preventive safety and convenience. External recognition sensors such as cameras, radars, and sonars are also connected to the vehicle's power system. At the same time, electrified actuators such as electric power steering and electric parking brakes are also added. The type of each part, whether it is equipped, and the production batch will cause the charging and discharging characteristics of the power system to change. The time from the driver's power disconnection operation to the voltage drop varies from 1 [ms] to 200 [ms].

[0008] The vehicle control device that provides automatic driving, collision mitigation automatic braking, and automatic steering and obstacle avoidance combines these devices connected to the same power supply system to work in coordination. Therefore, vehicle control must be provided only when all devices can operate correctly, and vehicle control must be stopped immediately when an abnormal voltage drop is detected. On the other hand, there is also the problem of not recording analysis data incorrectly due to the driver's power disconnection operation in vehicles with different charge and discharge characteristics. In order to cope with new vehicle models and parts combinations, parameters must be adjusted according to the charge and discharge characteristics.

[0009] Furthermore, the vehicle control device performs braking control for the purpose of accident avoidance, but there are situations where sensor-based detection cannot be exerted due to the influence of weather, etc., or the braking control cannot exert the target deceleration force due to the influence of the road surface conditions. In addition, when a function failure occurs due to voltage reduction during the control process for the purpose of accident avoidance, there are situations where the accident avoidance control is downgraded and the accident avoidance performance cannot be exerted. In such a case, the inability to avoid the accident may cause the vehicle to hit a solid object such as a wall or surrounding vehicles, thereby causing a ground fault in the power supply system of the vehicle. The occurrence of these problems causes the on-board electronic equipment to stop operating, and there is a problem that important analytical data such as the detection of a fault before the accident cannot be retained.

[0010] The present invention is made in view of the above-mentioned problems, and its purpose is to provide a vehicle control device, which accurately records the analysis data when an abnormal voltage drop is detected and prevents the storage of erroneous analysis data due to the driver's power disconnection operation. When analyzing the abnormality of the vehicle, the required analysis data will not be lost due to the storage crowding caused by unnecessary analysis data, and the analysis data when the abnormality occurs that is most beneficial for investigating the cause of the abnormality can be obtained. Technical means of solving problems

[0011] In response to the above problem, the vehicle control device of the present invention is a vehicle control device that controls its own vehicle by implementing a control function implemented by multiple control devices sharing the same power supply, and is characterized in that it comprises: a voltage measuring unit that measures the voltage of the power supply; an abnormality diagnosis unit that has a control stop function that determines whether it becomes difficult to implement the control function implemented by the multiple control devices due to a decrease in the voltage of the power supply, and stops the control when it becomes difficult; and a storage indication unit that instructs that historical information representing the stop phenomenon of the action under the control stop function be stored in the storage unit; when the voltage of the power supply becomes a voltage higher than a specified voltage that makes it difficult to implement the control function after the control stop function is implemented, the storage indication unit instructs that the historical information be stored in the storage unit. Effects of the Invention

[0012] According to the vehicle control device of the present invention, it is possible to accurately record the analysis data when an abnormal voltage drop is detected and prevent the storage of erroneous analysis data due to the power off operation of the driver. In addition, when analyzing the abnormality of the vehicle, the required analysis data will not be lost due to the storage squeeze caused by the occurrence of unnecessary analysis data, and the analysis data at the time of the abnormality that is most useful for investigating the cause of the abnormality can be obtained.

[0013] Other problems, structures, and effects than those described above will become clear from the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a block diagram showing a system configuration of a vehicle to which a vehicle control device according to an embodiment of the present invention is applied. Figure 2 This is a functional block diagram of a vehicle control device according to one embodiment of the present invention. Figure 3 This is a flowchart of a vehicle control process executed in the vehicle control device according to one embodiment of the present invention. Figure 4 Flowchart of the voltage drop diagnostic process. Figure 5 Flowchart for the event data recorder process. Figure 6 This is a flowchart for common event data recorder processing. Figure 7 Flowchart for voltage drop anomaly processing using event data recorder. Figure 8 Flowchart for the event data recorder process for voltage drop anomalies (to cope with power failure). DETAILED DESCRIPTION

[0015] Hereinafter, a vehicle control device as one embodiment of the present invention will be described with reference to the drawings.

[0016] Figure 1 The system configuration of a vehicle using a vehicle control device according to an embodiment of the present invention is shown in FIG. The vehicle control device 1000 obtains information from an external recognition device 2000 installed on the own vehicle, and controls the own vehicle by giving control instructions to an actuator 3000 installed on the own vehicle based on the result.

[0017] The following four examples are presented as vehicle control functions provided (implemented) for the purpose of controlling the own vehicle.

[0018] As one of the examples, the following adaptive cruise control (ACC) is provided: the position information of the leading vehicle obtained by the camera 2100 as a part of the external recognition device 2000 and the position information of the leading vehicle obtained by the radar 2200 are used to calculate the front and rear acceleration of the own vehicle for assisting the travel of the own vehicle by maintaining a safe and comfortable distance relative to the leading vehicle in the vehicle control device 1000, thereby automatically controlling the brake 3100 and the engine 3200 as a part of the actuator 3000, thereby assisting the driver's braking and acceleration operations.

[0019] As a second example, the following automatic emergency braking (AEB) is provided: similar to ACC, the risk of collision with the own vehicle is calculated in the vehicle control device 1000 based on the position of a solid object such as a pedestrian obtained by the camera 2100 and the radar 2200, and the instrument 3500 as a part of the actuator 3000 is used to give a visual warning and an audible warning to the driver based on the result, and the brake 3100 is automatically controlled to avoid and reduce the collision damage when the risk of collision further increases. The following automatic emergency steering (AES) is also provided: when it is determined that the collision cannot be avoided by the control of the brake 3100 alone, the electric power steering 3400 is controlled to make the forward direction of the own vehicle face the direction without the solid object, thereby avoiding the collision.

[0020] As a third example, the following lane keeping steering (LKS) is provided: a camera 2100 is used to obtain the position of the outer line of the lane in which the own vehicle is traveling (own lane), and the vehicle control device 1000 calculates how the vehicle's yaw rate and steering angle position should be set so that the own vehicle can travel in the center, that is, the center of the own lane, relative to the left and right outer lines of the lane. Based on the calculation result, an electric power steering device 3400, which is a part of the actuator 3000, is used to control the left and right direction of the own vehicle to reduce the driving burden caused by the steering of the driver.

[0021] As a fourth example, the following automatic parking function is provided: when parking the own vehicle in a parking lot, the driver instructs the vehicle to park at a time point close to the parking position, and the own vehicle starts to park automatically. During the automatic parking, the parking position of the own vehicle is detected by the camera 2100, and it is determined whether it will hit surrounding obstacles or surrounding parked vehicles based on the detection results of the sonar 2300. The brake 3100, the engine 3200, the transmission 3300, and the electric power steering 3400 are used to control the direction and position of the own vehicle to complete the parking without the driver operating the brake pedal, the accelerator pedal, the steering wheel, and the gear lever. Then, the meter 3500 is used to inform the driver that the parking has been completed.

[0022] In order to realize the vehicle control functions listed in the example, the camera 2100, the radar 2200, and the sonar 2300 are illustrated as the external recognition device 2000, and the brake 3100, the engine 3200, the transmission 3300, the electric power steering 3400, and the instrument 3500 are illustrated as the actuator 3000. However, sometimes various sensing devices or communication devices such as GPS, vehicle-to-vehicle communication devices, road-to-vehicle communication devices, illumination sensors, rain sensors, etc. are also equipped as the external recognition device 2000 to realize various vehicle control functions. Conversely, sometimes the radar 2200 and the sonar 2300 are not equipped and only the camera 2100 is used for external recognition. There are countless combinations. In addition, as an actuator 3000, it is also possible to give control instructions for the vehicle's actions other than stopping, turning, and driving, such as headlights, turn signals, brake lights, wipers, door locks, air conditioning devices, audio equipment, and communication devices with a call center. Alternatively, the vehicle control device 1000 of this embodiment may be used for an electric vehicle that is not equipped with an engine 3200 or a transmission 3300 but uses a motor to control the driving force of its own vehicle.

[0023] Furthermore, in addition to the external recognition device 2000 and the actuator 3000, the vehicle control device 1000 also obtains information about the driver's driving operation and the movement state of the own vehicle from the on-board sensor 6000 installed on the own vehicle, such as the operation amount of the accelerator pedal and the driving speed of the own vehicle, and uses this information for feedback on the ACC's vehicle speed control, etc., thereby achieving a more comfortable vehicle control function.

[0024] Furthermore, the vehicle control device 1000 processes information or communicates with various on-board devices by receiving power from the power supply device 4000 mounted on the vehicle. Similarly, the external recognition device 2000, the actuator 3000, and the on-board sensor 6000 are also configured to sense and actuate by receiving power from the power supply device 4000, and provide the driver with driving assistance functions such as ACC, AEB, AES, and LKS in the form of vehicle control functions. That is, the vehicle control device 1000, the external recognition device 2000, the actuator 3000, and the on-board sensor 6000 share the same power supply device 4000 and receive power from the same power supply device 4000.

[0025] Furthermore, the vehicle control device 1000 is connected to the outside recognition device 2000, the actuator 3000, and the vehicle-mounted sensor 6000 in a communication manner, and the vehicle control device 1000 diagnoses whether the outside recognition device 2000, the actuator 3000, and the vehicle-mounted sensor 6000 are normal based on the communicated information, and performs self-diagnosis of whether the vehicle control device 1000 itself is normal. And when an abnormality of the device (1000, 2000, 3000, 4000, 6000) required to realize the vehicle control function is detected through various diagnoses, the driving assistance function based on the vehicle control function is quickly downgraded and the driving operation is handed over to the driver, thereby preventing the vehicle from falling into dangerous behavior such as braking control and steering based on erroneous sensing results.

[0026] Furthermore, the vehicle control device 1000 records the information when an abnormality is detected through various diagnoses as analysis data in the vehicle control device 1000. When analyzing the cause of the abnormality or repairing it, the vehicle mechanic or analyzer connects the analysis device 5000 to the vehicle control device 1000 to obtain and refer to the analysis data, thereby understanding the situation when the abnormality was detected and achieving qualified and rapid mechanic repair.

[0027] Next, the details of the vehicle control device 1000 are described. The vehicle control device 1000 is a control device that operates by being supplied with electric power, and is composed of a microprocessor-based computing device, a communication terminal for data communication, a power supply circuit, a ROM that records information of a program to be executed by the CPU, a volatile memory (RAM) for storing program processing results while the power is on, and a non-volatile memory that continues to store computing results even when the power is off.

[0028] In addition, the functions provided by the vehicle control device 1000 are shown in Figure 2The vehicle control device 1000 uses the information obtained from the external recognition device 2000 and the vehicle-mounted sensor 6000 to process the control quantity for performing vehicle control corresponding to the vehicle control functions such as ACC, AEB, AES, and LKS in the vehicle control application software 1100, and gives the result control instruction to the actuator 3000, thereby performing vehicle control.

[0029] In addition, the vehicle control device 1000 receives power supply from the power supply device 4000, and the voltage acquisition unit 1200 acquires the supply voltage supplied from the power supply device 4000. When the supply voltage acquired by the voltage acquisition unit 1200 becomes lower than the shutdown voltage threshold, the shutdown processing unit 1300 operates to execute the power OFF of the vehicle control device 1000. In addition, the abnormality diagnosis unit 1400 determines whether the supply voltage acquired by the voltage acquisition unit 1200 is lower than the voltage reduction judgment threshold set higher than the shutdown voltage threshold, and detects the abnormality caused by the voltage reduction when the supply voltage is lower than the voltage reduction judgment threshold. In addition, the abnormality diagnosis unit 1400 uses the information obtained from the external recognition device 2000 and the vehicle-mounted sensor 6000 through communication and the internal information of the vehicle control device 1000 to diagnose whether the vehicle control function is in a state that can correctly operate. When a reduction in supply voltage, a communication abnormality, or an internal abnormality is detected, the vehicle control application software 1100 is instructed to perform a downgrade operation or a function stop of the vehicle control function. In this embodiment, the abnormality diagnosis unit 1400 has a control stop function, which determines whether the supply voltage obtained by the voltage acquisition unit 1200 is lower than the voltage reduction judgment threshold (the specified voltage at which it becomes difficult to implement the vehicle control function), that is, whether it becomes difficult to implement the vehicle control function due to the voltage reduction of the power supply device 4000 (causing an abnormality), and stops the control when it becomes difficult.

[0030] When an abnormality caused by voltage drop is detected by the abnormality diagnosis unit 1400, the event data recorder 1500 collects information useful for analyzing the cause of the abnormality (for example, historical information indicating the stop phenomenon of the operation under the control stop function caused by the abnormality caused by the voltage drop) as analysis data (also called event data), and records it in the non-volatile memory 1600. And it is configured as follows: the analysis device 5000 connected to the vehicle control device 1000 obtains the event data recorded in the non-volatile memory 1600, and provides the analysis data when the abnormality occurs to the vehicle mechanic or the analysis personnel to assist in the analysis of the cause of the abnormality.

[0031] Next, use Figure 3 The flowchart of will explain the overall flow of the program executed in the vehicle control device 1000 (vehicle control processing).

[0032] When the vehicle control device 1000 receives power from the power supply device 4000 and starts, the processing recorded in the flowchart is executed from Start. First, the voltage value (supply voltage) input from the power supply device 4000 is obtained in the voltage acquisition process S1200. Next, in the shutdown determination process S1350, the supply voltage obtained in the voltage acquisition process S1200 is referenced to determine whether the driver has performed a power-off operation for his own vehicle. In the case where it is determined that there is a power-off operation, that is, it is determined that shutdown is required, the shutdown determination process S1350 is established, and the vehicle control device 1000 stops the operation of the program and continues the stopped state of the program until the power is turned on again to prevent the increase of power consumption. On the other hand, if the shutdown determination process S1350 is not established, the abnormality diagnosis process S1400 is executed to diagnose whether it is in a state that allows the vehicle control function to operate normally and whether there are any abnormalities. At this time, a voltage reduction diagnosis is performed in the abnormal diagnosis processing S1400 to diagnose whether the voltage is maintained by the power supply required for the processing of the vehicle control device 1000 and the vehicle control application software 1100 and whether the external recognition device 2000, the actuator 3000, and the vehicle-mounted sensor 6000 can perform the expected actions, and to determine the detection of the voltage reduction abnormality (whether the implementation of the vehicle control function becomes difficult due to the voltage reduction (caused by the abnormality)).

[0033] Next, the event data recorder processing S1500 is executed. When an abnormality is detected in the judgment of the abnormality diagnosis processing S1400 including the result of the voltage reduction diagnosis (making it difficult to implement the vehicle control function due to the voltage reduction (caused abnormality)), information useful for analyzing the cause of the abnormality (for example, historical information indicating the stop phenomenon of the action under the control stop function caused by the abnormality caused by the voltage reduction) is stored in the non-volatile memory 1600 as analysis data (FFD).

[0034] Next, the vehicle control application software processing S1100 is performed, thereby executing the processing of the vehicle control functions such as ACC, AEB, AES, and LKS, and performing the generation calculation of the control amount or control state signal sent to the actuator 3000. At this time, if the diagnosis result given by the abnormality diagnosis processing S1400 is a result indicating an abnormality, the calculation result of each vehicle control function is replaced with a value such that the actuator 3000 does not perform the acceleration and deceleration control or steering control action (stop control) of the vehicle. In addition, a visual warning signal and an audio warning signal are selected to indicate to the driver that the vehicle control function cannot be used or the vehicle control function is limited due to the detection of an abnormality, and are sent to the actuator 3000. In this way, the driver can be informed of the situation that the vehicle control application software 1100 cannot provide the driver with driving assistance, so that the driver can take actions to move the vehicle to a repair shop for repair, and the driver can be prevented from unexpectedly performing such acceleration and deceleration control of the vehicle in an environment where sensing and actuation cannot be performed stably due to voltage reduction.

[0035] Then, when the vehicle control application software process S1100 is completed, the process returns to the voltage acquisition process S1200, and the process from the voltage acquisition process S1200 to the vehicle control application software process S1100 is repeated at a certain periodic interval, for example, 0.01 [s]. This repetition is repeated before the shutdown determination process S1350 is established and the vehicle control device 1000 performs the shutdown process, that is, during the period when the power supply of the vehicle control device 1000 is turned on, thereby providing the driver with appropriate vehicle control according to the external recognition result and the state of the own vehicle that change moment by moment.

[0036] Next, Figure 3 The details of each function and process shown in the flowchart are explained in sequence.

[0037] First, the details of the voltage acquisition process S1200 are described. In the voltage acquisition process S1200, the voltage applied from the power supply device 4000 to the power supply circuit of the vehicle control device 1000 is converted from an analog value to a digital value via an AD converter, thereby acquiring it in the form of a value that can be processed in the microprocessor. Furthermore, the voltage input to the vehicle control device 1000 undergoes attenuation and other changes due to passing through the power supply circuit in the vehicle control device 1000, and the voltage value obtained from the AD converter is different from the voltage value input to the vehicle control device 1000, so the conversion function of the voltage value that changes due to passing through the power supply circuit is reversely calculated so that the voltage value obtained from the AD converter can be processed as the voltage value input to the vehicle control device 1000. In this way, it is possible to infer whether the power supplied from the power supply device 4000 to the external recognition device 2000, the actuator 3000, and the vehicle-mounted sensor 6000 is also appropriate and perform voltage diagnosis.

[0038] Next, the shutdown determination process S1350 is described. In the shutdown determination process S1350, the voltage value obtained in the voltage acquisition process S1200 is referenced to determine whether the driver has performed a power-off operation on the vehicle. Specifically, a shutdown voltage threshold value for determining whether a power-off operation has been performed is set in advance in the ROM, for example, a value of 5 [V], and the shutdown determination is established when the voltage value obtained in the voltage acquisition process S1200 is less than the shutdown voltage threshold value.

[0039] Next, the abnormality diagnosis process S1400 is explained. The abnormality diagnosis process S1400 is a function for diagnosing whether the vehicle control application software (vehicle control function) is in a state where it can be safely executed. The content of the diagnosis varies depending on the content of the vehicle control application software 1100 used in the vehicle control device 1000. For example, when ACC is used, the information obtained from the camera 2100 must be correct, so first diagnose whether the camera 2100 has a fault. Regarding the fault of the camera 2100, the camera 2100 sends the result obtained by the self-diagnosis to the vehicle control device 1000, and if the result shows a fault, it is diagnosed as a fault of the camera 2100. In addition, the fault of the camera 2100 is detected by judging that the data to be sent from the camera 2100 cannot be received within a certain period of time and by giving the data sent from the camera 2100 counter information that is incremented at each transmission to judge that the counter information continues to have the same value. The radar 2200, the brake 3100, and the engine 3200 are similarly arranged, thereby diagnosing whether the device or part required for ACC is faulty or whether the communication path is faulty. In addition, the diagnosis is made for a functional stop state that will cause problems if ACC is executed even though it is not detected as a fault. For example, if the view of the camera 2100 is blocked by bad weather such as rain or fog and the position of the leading vehicle cannot be accurately determined, the correct braking operation cannot be performed on the leading vehicle, which is dangerous, and the ACC function should be stopped. Therefore, the image obtained from the camera 2100 is used to scan the difference in light and dark between pixels to detect image degradation, thereby diagnosing the functional stop caused by the recognition status of the camera 2100 and performing abnormality detection. In addition, the situation that the correct braking control cannot be performed due to the temporary increase in the temperature of the brake pad is sensed to diagnose the functional stop caused by the high temperature of the brake pad, etc., and the situation that various functions and performances required for ACC cannot be exerted is determined as a functional stop diagnosis. Furthermore, not only the camera 2100 and the brake 3100, but also the vehicle control device 1000 that performs the abnormality diagnosis process S1400 is self-diagnosed to determine whether it is in a state of being able to operate correctly. In the self-diagnosis, fault diagnosis is also performed, such as whether the non-volatile memory 1600 can read and write data, whether the content of the data is appropriate, whether it can exchange electrical signals with the communication terminal, etc., so as to determine whether each component, circuit, etc. in the vehicle control device 1000 is operating correctly. In addition, with the help of the temperature sensor equipped in the vehicle control device 1000, it is diagnosed whether the temperature is high compared to the operation guarantee temperature of the microprocessor and the circuit. If it is high temperature, it is determined that the function needs to be stopped and abnormality is detected. In the case of abnormality detection under the function stop diagnosis during high temperature detection, sometimes the function stop is released at the time when the temperature drop is detected, and normal judgment can be made.In addition, the abnormal diagnosis processing S1400 has a voltage reduction diagnosis processing S1410, that is, diagnosing the reduction of the voltage being supplied to the vehicle control device 1000, thereby diagnosing whether the vehicle control device 1000 is supplied with such power that it can operate correctly, and also diagnosing whether the external identification device 2000, the actuator 3000, and the vehicle-mounted sensor 6000 that receive power supply from the power supply device 4000 in the same way as the vehicle control device 100 are in a condition where they can operate correctly.

[0040] use Figure 4 The flowchart of FIG. 14 illustrates the details of the voltage drop diagnostic process S1410. The voltage drop diagnostic process S1410 is a diagnostic process for detecting that an abnormality (voltage drop) has occurred in any power supply system of the power supply device 4000, a wiring harness for supplying power from the power supply device 4000 to the vehicle control device 1000, or a power supply circuit of the vehicle control device 1000.

[0041] In the voltage drop diagnosis process S1410, first, in determination S1411, it is determined whether the supply voltage is less than a threshold value (voltage drop determination threshold value) for determining that the voltage drop is abnormal, for example, 10 [V]. If the condition that the supply voltage is less than 10V is satisfied in determination S1411, a value corresponding to the execution cycle (for example, 0.01 [s]) is added to the voltage drop time in process S1412, and 0 [s] is set to the voltage recovery time. If the condition is not satisfied in determination S1411, 0 [s] is set to the voltage drop time in process S1413, and a value corresponding to the execution cycle is added to the voltage recovery time. Using determination S1411, process S1412, and process S1413, the period during which the supply voltage is less than 10V is measured as the voltage drop time, and the period during which the supply voltage is more than 10V is measured as the voltage recovery time.

[0042] Next, determination S1414 is performed. The vehicle control device 1000 always measures the time after the vehicle control device 1000 turns on the power supply (post-startup time), and determines in determination S1414 whether the post-startup time has passed more than 3 [s]. If the post-startup time has not passed more than 3 [s] in determination S1414, it is deemed that the condition is not satisfied, and a normal value is set for the voltage drop diagnosis result in processing S1419. If the post-startup time has passed more than 3 [s] and the condition is satisfied in determination S1414, the voltage drop time is determined in determination S1415. In determination S1415, it is determined whether the voltage drop time updated in processing S1412 and processing S1413 has passed more than the voltage drop determination time threshold (for example, 0.02 [s]). If the voltage drop time is more than the voltage drop determination time threshold, it is deemed that the condition of determination S1415 is satisfied and processing S1417 is executed, and a value indicating abnormality is set for the voltage drop diagnosis result. In the case where the condition of determination S1415 is not satisfied, determination S1416 is executed to determine the voltage recovery time. In determination S1416, it is determined whether the voltage recovery time has exceeded the voltage recovery determination time threshold (for example, 2 [s]). If the voltage recovery time is above the voltage recovery determination time threshold, it is deemed that the condition of determination S1416 is satisfied and processing S1418 is executed to set a normal value for the voltage reduction diagnosis result. In the case where the condition of determination S1416 is not satisfied, the voltage reduction diagnosis result is not updated, and the value when the voltage reduction diagnosis was performed one cycle ago is maintained. If the voltage reduction diagnosis result is set to a value indicating an abnormality, the abnormal value is maintained, and if the voltage reduction diagnosis result is set to a value indicating a normal value, the normal value is maintained. In this way, it is determined how to update or maintain the value of the voltage reduction diagnosis result and the voltage reduction diagnosis processing S1410 is terminated. In the case where the voltage reduction diagnosis result shows an abnormality, the occurrence of an abnormality based on the voltage reduction diagnosis is detected in the abnormality diagnosis processing S1400.

[0043] In the voltage drop diagnosis process S1410, by performing the post-startup time determination S1414, no abnormality is detected in the voltage drop diagnosis result from the time when the driver performs the power-on operation of the vehicle until a certain time has passed. Most vehicles are configured such that the power supply to each vehicle-mounted component is temporarily reduced or cut off due to the rotation of the starter motor to start the engine immediately after the driver performs the power-on operation of the vehicle. In addition, the power consumption changes when each vehicle-mounted component is sequentially powered on, and the voltage supplied to the vehicle control device 1000 is also prone to become unstable. Furthermore, when the deterioration of the vehicle-mounted battery is aggravated and the temperature is low when the vehicle is started, even if there is no abnormality in the power supply system such as the power supply device, the supply voltage may be lower than the threshold value for judging the voltage drop as abnormal, and abnormality detection based on the voltage drop diagnosis may not be performed during the period when the voltage supplied to the vehicle control device 1000 is unstable.

[0044] In addition, not only will it not be diagnosed as abnormal immediately after the driver turns on the power of his own vehicle, but a voltage drop time determination S1415 is also provided, so that even if a momentary voltage drop is erroneously detected due to the influence of electromagnetic waves, etc., power is correctly supplied to the vehicle control device 1000 and the external recognition device 2000, etc., so that the vehicle control function can continue to operate. On the other hand, if the voltage drop is not caused by noise caused by the influence of electromagnetic waves, etc. but by an abnormality in the power supply system, the vehicle control function can be quickly stopped by the passage of the time set in the voltage drop time determination S1415.

[0045] Furthermore, by setting the voltage recovery time determination S1416, after the voltage reduction during the period that affects the operation of the vehicle control function is detected and the processing S1417 is executed, the processing S1418 will not be executed, but the abnormal state will continue to be maintained until the external recognition device 2000 and the actuator 3000 are both changed to supply voltages that are stable enough to provide normal vehicle control functions, thereby preventing the vehicle control based on transient and unstable data generated by voltage fluctuations and preventing the voltage reduction diagnosis result from repeatedly changing between abnormal and normal. In particular, the voltage reduction determination time threshold and the voltage recovery determination time threshold can be set separately. By setting the voltage recovery determination time threshold with a value longer than the voltage reduction determination time threshold, it is avoided that although the operation of the vehicle control application software is quickly stopped when it is determined that the voltage is abnormal, the vehicle control is performed using transient and unstable data generated by voltage fluctuations when the operation of the vehicle control function is restored, so as to provide the driver with safe vehicle control.

[0046] Next, use Figure 5The event data recorder process S1500 is described in the flowchart of FIG. The event data recorder process S1500 is a process of generating the status when the abnormality detected in the abnormality diagnosis process S1400 occurs as analysis data (FFD) and storing it in the non-volatile memory 1600. In the event data recorder process S1500, the processes from the repetition process S1501s to the repetition process S1501e are repeatedly executed to a degree corresponding to the type (category) of the abnormality detected in the abnormality diagnosis process S1400.

[0047] In the iterative process, first, the result information of the abnormality diagnosis to be processed and determined by the event data recorder is switched in process S1502. When the process S1502 is executed for the first time between iterative processes S1501s and iterative processes S1501e, it is switched to the diagnosis of the communication abnormality related to the camera 2100 determined in the abnormality diagnosis process S1400, and when the process S1502 is executed for the second time, it is switched to the diagnosis of the communication abnormality related to the radar 2200. In this way, the type of abnormality diagnosis to be processed later is switched according to the number of repetitions. Next, it is determined in determination S1503 whether the abnormality type of the abnormality type switched in process S1502 is a voltage drop abnormality. If it is a voltage drop abnormality, it is considered that the condition of determination S1503 is met, and the process S1510 of the event data recorder for voltage drop abnormality is performed. If the abnormality type of the abnormality type is not a voltage drop abnormality, it is considered that the condition of determination S1503 is not met, and the process S1505 of the event data recorder for normal use is performed, and the process S1501e is performed. In the iterative process S1501e, if the number of abnormality categories diagnosed in the abnormality diagnosis process S1400 has been repeated, the event data recorder process S1500 is terminated. In the iterative process S1501e, if the number of abnormality categories diagnosed in the abnormality diagnosis process S1400 has not been repeated, the process returns to the iterative process S1501s and repeatedly executes the process, and the storage process of the event data recorder under the process S1505 or the process S1510 is performed on all abnormality categories diagnosed in the abnormality diagnosis process S1400.

[0048] Next, use Figure 6 The details of the normal event data recorder in the process S1505 will be described in the flowchart of FIG. The normal event data recorder in the process S1505 performs processing for each target abnormality type selected in the process S1502, and generates and records the analysis data.

[0049] In the normal event data recorder processing S1505, first, in the diagnostic result determination S1506-1, it is determined whether the diagnostic result determined in the abnormal diagnosis processing S1400 is abnormal. If the diagnostic result is abnormal, it is deemed that the condition of determination S1506-1 is established, and the process proceeds to determination S1506-2. If the diagnostic result is not abnormal, it is deemed that the condition of determination S1506-1 is not established, and the process proceeds to processing S1509. In determination S1506-2, it is determined what the diagnostic result was one cycle ago, that is, the previous value. In the case where the previous value of the diagnostic result is a value indicating a normal value, the condition of determination S1506-2 is deemed to be established, and the FFD is updated in processing S1507, and then the FFD updated in processing S1507 is stored in the non-volatile memory 1600 in processing S1508, and then the process proceeds to processing S1509. In the case where the previous value of the diagnostic result in determination S1506-2 is not a value indicating a normal value, the process proceeds to processing S1509. Finally, in process S1509, the diagnosis result is set to the previous value of the diagnosis result used for determination in the next cycle under the condition of determination S1506-2, thereby updating it.

[0050] By setting it as this structure, it can be detected in judgment S1506-1 and judgment S1506-2 that the result of abnormal diagnosis processing S1400 is the result when it changes from normal to abnormal, so that the data at that moment is updated (collected) as analysis data in processing S1507, and recorded (saved) in non-volatile memory 1600 in processing S1508.

[0051] Next, use Figure 7 The flowchart of will now explain the details of the voltage drop abnormality event data recorder in the process S1510.

[0052] In the voltage drop abnormality event data recorder processing S1510, first, the voltage drop diagnosis result determination S1511 is used to determine whether the voltage drop diagnosis result is abnormal. If it is abnormal, it is deemed that the condition of determination S1511 is satisfied, and the determination of the previous result of the voltage drop diagnosis result S1512 is performed. If the voltage drop diagnosis result determination, that is, determination S1511 is not satisfied (normal), the storage standby (recovery) determination S1521 is performed. In the determination S1512 of the previous result of the voltage drop diagnosis result, if the value of the voltage drop diagnosis result one cycle ago (voltage drop diagnosis result (previous)) is normal, it is deemed that the condition of determination S1512 is satisfied, the FFD update processing S1513 is executed, and the storage standby is set to ON in the processing S1514.

[0053] If the condition of determination S1512 is not satisfied (the voltage drop diagnosis result (previous time) is abnormal), the storage standby (abnormality continues) determination S1515 is performed. If the storage standby is ON, it is deemed that the condition of determination S1515 is satisfied, and the duration determination S1516 is performed. If the condition of determination S1515 is not satisfied, no processing and determination are performed, and the branch processing before the processing S1524 is terminated. If the duration in the duration determination S1516 is 3 [s] or more, it is deemed that the condition of determination S1516 is satisfied, and the FFD storage processing S1517 is performed using the FFD information set in the FFD update processing S1513. Thereafter, the storage standby is set to OFF in processing S1518, and the duration is set to 0 [s] in processing S1519. If the condition of the duration determination S1516 is not satisfied, a time corresponding to the processing cycle (for example, 0.01 [s]) is added to the duration in processing S1520.

[0054] In the storage standby (recovery) determination S1521, if the storage standby is ON, it is considered that the condition of the determination S1521 is met, and the FFD storage process S1522 is performed using the FFD information set in the FFD update process 1513. Thereafter, the storage standby is set to OFF in the process S1523. If the storage standby (recovery) determination S1521 is not met, the branch process before the process S1524 is terminated.

[0055] When the branch processing before the processing S1524 described above is completed, the value of the voltage drop diagnosis result is finally set for the voltage drop diagnosis result (previous) in processing S1524 as information used in the judgment S1512 of the previous result of the voltage drop diagnosis result for use in the next cycle.

[0056] In the voltage drop abnormality event data recorder processing S1510, the voltage drop diagnosis result determination S1511 and the previous result determination S1512 of the voltage drop diagnosis result determine whether the voltage drop diagnosis result has changed from normal to abnormal. When the voltage drop diagnosis result changes from normal to abnormal, the data at the time when the voltage drop diagnosis result changes from normal to abnormal is stored in the RAM as the most useful data for analyzing the cause of the fault by performing the FFD update processing S1513, and the storage in the non-volatile memory 1600 is not performed, and the storage standby is set to the ON state in the processing S1514. Then, the FFD stored in the RAM is stored in the non-volatile memory 1600 at any of the following two times.

[0057] The first opportunity is when the state of storage standby holding ON is determined, and the voltage reduction diagnosis result of S1511 becomes a condition that is not met and has become normal. This situation indicates that a voltage reduction was detected, and then the voltage increased and was considered to have become normal. It is a time when a temporary abnormality did occur in the power supply circuit and a voltage reduction occurred, and it is a time when the risk of false detection of a voltage reduction no longer exists. In other words, it is a time when the implementation of the vehicle control function became difficult due to the voltage reduction (caused abnormality) and the control stop function was implemented, and then the voltage became a voltage higher than the specified voltage (voltage reduction judgment threshold) that made it difficult to implement the vehicle control function.

[0058] The second opportunity is when the storage standby remains in the ON state for a certain period of time and the condition of the duration determination S1516 is satisfied. This situation indicates that the low voltage state has abnormally continued for a certain period of time or more (for example, more than 3 [s]), which is a phenomenon that occurs when the generator is abnormal or a large resistance is generated in the power supply system, and the vehicle control device 1000 cannot obtain the expected power supply, or it is a phenomenon that occurs in the case of a failure in which the voltage obtained from the power supply device 4000 is not completely reduced despite the attempt to disconnect the power supply, indicating that an abnormality has indeed occurred. In other words, it is a time when the implementation of the vehicle control function becomes difficult due to the voltage reduction (caused by the abnormality) and the control stop function is implemented, and the time (voltage reduction state) for implementing the control stop function continues for a certain period of time (for example, 3 [s]) or more.

[0059] When using the normal event data recorder processing S1505 and retaining the FFD in the non-volatile memory 1600 at the time when the voltage reduction diagnosis result changes from normal to abnormal, the following problem will arise, namely, when the driver sets the vehicle power to OFF, the voltage reduction slows down, and an abnormality is detected due to the voltage reduction diagnosis before the shutdown determination is made, thereby storing the FFD. However, by storing in the manner described in the voltage reduction abnormality event data recorder processing S1510 described above, it is possible to suppress the erroneous storage of the FFD when the driver sets the vehicle power to OFF, and the FFD when an abnormality occurs under the power reduction diagnosis can be stored without omission, thereby effectively using it to analyze the cause of the fault.

[0060] Next, the content of the FFD used in the process S1507 and the process S1513 for updating the FFD is described. The FFD is composed of the following data so that the type of abnormality detected, the use of the vehicle, and the load status of each component including the vehicle control device 1000 can be grasped. The FFD stored in the non-volatile memory 1600 includes, for example, historical information indicating the stop phenomenon of the operation under the control stop function caused by the abnormality caused by the voltage drop. Diagnostic Trouble Code (DTC) ... a code assigned to each category of trouble diagnosis · Time after activation of vehicle control devices · Number of times the vehicle control device is powered on Supply voltage Temperature sensor value in vehicle control unit Odometer value Gear · Own vehicle speed Engine speed Accelerator pedal opening Brake pedal operation status Vehicle control application software control status Actuator working status Communication status with actuators and external identification devices

[0061] Furthermore, the following configuration is set: when recording FFD in the non-volatile memory 1600, the FFD is stored in a plurality of storage areas in consideration of the fact that a plurality of types of abnormalities are detected and the fact that abnormalities are detected multiple times at different times. Moreover, each time an abnormality is detected by the abnormality diagnosis process S1400, the FFD is stored in the area allocated for FFD of the non-volatile memory 1600 in a manner that the storage area is staggered in the order in which the abnormality is detected. When an abnormality is detected exceeding the upper limit of the area allocated for FFD, the FFD information is overwritten in order from the oldest data, thereby enabling the abnormality occurrence to be investigated by tracing back from the latest fault to multiple times.

[0062] Next, the vehicle control application software process S1100 is described. In the vehicle control application software process S1100, the control amount and the command value for how to operate the actuator 3000 are calculated and processed based on the information of the external recognition device 2000 and the vehicle-mounted sensor 6000. At this time, the control function is degraded to avoid erroneous control operation when the result of the voltage drop diagnosis process S1410 is abnormal.

[0063] The specific control function downgrade method is described by taking the ACC function of assisting the following of the vehicle ahead as an example. In ACC, the position of the vehicle ahead of the own vehicle (the preceding vehicle) is obtained from the external recognition device 2000, and the speed of the own vehicle is accelerated, decelerated, or maintained in a manner that changes to a distance preset at each speed of the own vehicle, thereby reducing the driving burden caused by the driver's operation of the accelerator pedal and the brake pedal. Therefore, if the preceding vehicle decelerates and approaches the own vehicle, the ACC instructs the brake 3100 to control the amount of deceleration. Conversely, if the preceding vehicle accelerates and moves away from the own vehicle, the ACC instructs the engine 3200 to control the amount of acceleration, thereby controlling the speed of the own vehicle. When the driver is receiving driving assistance under ACC, if an abnormality is detected by the diagnostic function in the vehicle control device 1000 such as voltage drop diagnosis, the indicator meter 3500 first displays the abnormality to inform the driver that the abnormality has been detected, so that the driver can immediately operate the brake pedal and the accelerator pedal to maintain the distance to the preceding vehicle. Furthermore, the instructions for brake control and engine control under ACC are switched to instructions for control release and sent to the actuator 3000, thereby avoiding the generation of brake output and engine output that hinder the driver's driving. However, if the brake control is released hastily when the vehicle is performing brake control because the distance to the vehicle ahead is shortened and an abnormality is detected, the vehicle will stop deceleration control before the driver realizes the abnormality and starts to step on the brake pedal, resulting in a shortened distance between the vehicles, which may become dangerous. Therefore, when an abnormality is detected during the process of performing brake control, the brake control is released in a manner of gradually reducing the brake control in small amounts rather than immediately releasing the brake control. Specifically, the control command value is calculated and indicated to the brake in a manner of reducing the deceleration by 0.02 [G] every 0.01 [s]. For example, if the brake control is being performed at a deceleration of 0.3 [G], the ACC control is downgraded in a manner that the deceleration of the brake becomes 0 [G] after 1.5 [s] of the abnormality, and the brake control is released, so as to prevent the distance between the vehicles from being too close.

[0064] In this way, the supply voltage of the vehicle control processing 1000 can be monitored and diagnosed in the vehicle control processing 1000, and when an abnormality is detected through the voltage reduction diagnosis, an FFD is generated and the vehicle control application software (vehicle control function) is downgraded and stopped, and the FFD is stored in the non-volatile memory 1600 only when an abnormality caused by voltage reduction is detected for a reason different from the vehicle power disconnection operation performed by the driver.

[0065] [Modification 1] The voltage drop abnormality event data recorder process S1510 described above may also be modified as follows.

[0066] The modified voltage drop abnormality event data recorder processing S1510-B infers that the power supply system of the own vehicle will have a problem and increases the opportunity to perform FFD recording. Therefore, the event data recorder 1500 of this modified example has a voltage drop inference unit that infers that the possibility of voltage drop supplied from the power supply system of the own vehicle has increased within a certain time (for example, 2 [s]) before the implementation of the control stop function, and stores FFD in the non-volatile memory 1600 when the voltage drop inference unit infers that a voltage drop has occurred. The voltage drop inference unit, for example, infers that an accident will occur in the own vehicle, resulting in an abnormality in the power supply system and thus a voltage drop.

[0067] use Figure 8 The flowchart (response to power failure) describes the specific deformation content of the voltage drop abnormality event data recorder processing S1510-B. Figure 7 For the process S1510 shown in the flowchart of , the modified voltage drop abnormality event data recorder process S1510-B does not execute process S1514 after the FFD update process S1513 to set the storage standby to ON, but determines in decision S1525 whether the probability of the occurrence of a problem in the power supply system of the own vehicle has increased. In decision S1525, whether the probability of the occurrence of a problem in the power supply system of the own vehicle has increased is determined by whether it is inferred that the possibility of an accident to the own vehicle is high. When it is inferred that the possibility of an accident to the own vehicle is high, the condition of decision S1525 is deemed to be satisfied, and process S1526 is executed to immediately store the FFD generated in the FFD update process S1513 in the non-volatile memory 1600. When it is not inferred that the possibility of an accident to the own vehicle is high, process S1514 is executed and the storage standby is set to ON as in the voltage drop abnormality event data recorder process S1510.

[0068] At this time, as a condition for inferring the occurrence of an accident in determination S1525, specifically, if any of the following conditions is satisfied within a certain time (for example, 2 [s]) from the time point when determination S1525 is performed, it is considered that the occurrence of an accident is being inferred. The airbag of your own vehicle is working The predicted collision time (relative distance ÷ relative speed) between the solid objects including vehicles, pedestrians, walls, etc. detected by the external recognition device 2000 and the vehicle itself is less than a certain value. The predicted time (relative distance ÷ relative speed) until the vehicle enters the shoulder of the road including a cliff, sea, river, etc. detected by the external recognition device 2000 is less than a certain value When the vehicle control application software 1100 is warning the driver of a collision with a solid object The vehicle control application software 1100 is executing a control instruction for the brake 3100 or the electric power steering 3400 for the purpose of avoiding or reducing collision damage. When the vehicle control application software 1100 is warning the driver of lane departure The vehicle control application software 1100 is executing a control instruction for the brake 3100 or the electric power steering 3400 for the purpose of avoiding lane departure or mitigating the speed of departure.

[0069] That is, the voltage reduction inference unit (judgment S1525) of the present variant example, for example, includes the fact that the accident damage avoidance and reduction vehicle control function is operating (being executed) through the vehicle control device 1000 in the judgment (inference) establishment condition. The accident damage avoidance and reduction vehicle control function is intended to avoid or reduce damage caused by an accident of the vehicle itself. The accident damage avoidance and reduction vehicle control function includes collision avoidance and reduction automatic braking control, collision avoidance and reduction automatic steering control, driving force suppression control caused by accelerator pedal depression error, etc.

[0070] By setting up a configuration that utilizes this deformation, the following situation can be prevented: although the diagnostic result of the voltage reduction diagnostic processing S1410 shows an abnormality, a collision accident or a fall accident occurs when both the FFD storage processing S1517 and the FFD storage processing S1522 cannot be executed, resulting in damage to the power supply system of the vehicle itself and cutting off the power supply to the vehicle control device 1000 (power failure), thereby making it impossible to retain the FFD in the vehicle control device 1000 when the voltage reduction abnormality occurs.

[0071] [Modification 2] The voltage drop abnormality event data recorder process S1510 and the voltage drop abnormality event data recorder process S1510-B may be modified as follows: The modified voltage drop abnormality event data recorder process S1510-C infers that the power supply system of the own vehicle has voltage fluctuations and increases the timing of performing FFD recording.

[0072] The voltage drop abnormality event data recorder process S1510-C is configured as follows: a voltage change estimation condition is added to the condition of the determination S1525 added in the voltage drop abnormality event data recorder process S1510-B, which estimates that the voltage of the power supply system of the vehicle has changed. When it is estimated that the voltage change will occur, the determination S1525 is also determined to be established, and the FFD storage process S1526 is executed. Regarding the voltage change estimation condition, the voltage change when the vehicle control application software 1100 is operated is measured in advance at the design stage, and when a control instruction with high power consumption is issued within a certain time (for example, 2 [s]) from the time point of the determination S1525, it is considered that the voltage change will occur. For example, the power usage for driving the motor for enhancing the deceleration of the vehicle in the automatic braking control under AEB, the power usage for driving the electric power steering under AES, and the starter drive instruction for starting the engine that has been idle stopped before starting from a parking state under ACC.

[0073] That is, the voltage reduction inference unit (judgment S1525) of the present variant includes the fact that the power-using vehicle control function is being operated (executed) by the vehicle control device 1000 in the judgment (inference) establishment condition and infers that a voltage reduction has occurred in the power supply system based on the judgment (inference) establishment condition. The power-using vehicle control function consumes power to operate the actuator 3000 according to the actuator control instruction from the vehicle control device 1000, and the power-using vehicle control function operates the braking device, electric power steering device, engine starting device (starter), vehicle acceleration and deceleration motor device, etc. of the vehicle itself.

[0074] By setting it to this configuration, the following situation can be prevented: when the vehicle as a whole is in a high power consumption state, although the diagnostic result of the voltage reduction diagnostic processing S1410 shows an abnormality, the power supply to the vehicle control device 1000 is cut off when both the FFD storage processing S1517 and the FFD storage processing S1522 cannot be executed, so that the FFD cannot be retained.

[0075] Furthermore, the conditions for voltage variation estimation may be used simultaneously with the determination in the accident occurrence estimation described in Modification 1, or only the conditions for voltage variation estimation may be used without using the accident occurrence estimation.

[0076] [Variation 3] The vehicle control device 1000 described in this embodiment is described in the form of a component that executes the application software for vehicle control, but either the external recognition device 2000 or the actuator 3000 may be integrated with the program and function used in the vehicle control device 1000. For example, the following configuration is adopted: the vehicle control device 1000 and the camera 2100 are integrated, and the camera 2100 performs calculations related to the vehicle control application software such as ACC and AEB, and also performs the abnormality diagnosis process S1400, and sends the control instruction value for the vehicle action to the actuator 3000. In addition, the function of the vehicle control device 1000 may be mounted in the microprocessor built in the brake 3100, and the brake 3100 receives data from the external recognition device 2000 and performs calculations related to the vehicle control application software such as ACC and AEB, and also performs the abnormality diagnosis process S1400, and sends the control instruction value to the engine 3200 and the meter 3500. In addition, the vehicle control device 1000 may be divided into a plurality of parts for operation. For example, the vehicle control device 1000 may be divided into the vehicle control device 1000-A and the vehicle control device 1000-B, and vehicle control application software such as AEB and ACC for controlling the front and rear acceleration of the vehicle may be deployed in the vehicle control device 1000-A, and vehicle control application software such as LKS for controlling the steering of the vehicle may be deployed in the vehicle control device 1000-B. The abnormal diagnosis processing S1400 and the event data recorder processing S1500 may be performed in each vehicle control device. Therefore, the present embodiment is not limited to the case where one vehicle control device is mounted on the vehicle as one component.

[0077] [Summarize] As described above, the vehicle control device 1000 of the present embodiment is a vehicle control device 1000 that controls its own vehicle by implementing a control function (vehicle control function) implemented by multiple control devices (1000, 2000, 3000, 6000) that share the same power supply (power supply device 4000) (receive power supply from the same power supply), and it includes: a voltage measuring unit (voltage acquisition unit 1200) that measures the voltage of the power supply; an abnormality diagnosis unit 1400 that has a control stop function that determines whether the implementation of the multiple control devices is due to a decrease in the voltage of the power supply (obtained by comparison with a voltage reduction judgment threshold) The control function to be implemented by the device becomes difficult, and the control is stopped when it becomes difficult; and a storage indication unit (event data recorder 1500) which indicates that the historical information (FFD) representing the stop phenomenon of the action (control) under the control stop function is stored in the storage unit (non-volatile memory 1600); when the voltage of the power supply becomes a voltage higher than the specified voltage (voltage reduction judgment threshold) at which it becomes difficult to implement the control function after the control stop function is implemented (voltage reduction diagnosis result judgment S1511: No), the storage indication unit (event data recorder 1500) indicates that the historical information is stored in the storage unit (FFD storage processing S1522).

[0078] When the implementation time of the control stop function (voltage reduction state) continues for more than a certain time (for example, 3 [s]) after the control stop function is implemented (duration judgment S1516: yes), the storage indication unit (event data recorder 1500) indicates that the history information is stored in the storage unit (FFD storage processing S1517).

[0079] The storage indication unit (event data recorder 1500) has a voltage drop inference unit (determination S1525) for inferring that the possibility of a voltage drop supplied from the power supply system of the own vehicle has increased within a certain time (for example, 2 [s]) before the implementation of the control stop function. When the voltage drop inference unit (determination S1525) infers that a voltage drop has occurred (determination S1525: yes), it instructs the storage of the history information in the storage unit (FFD storage processing S1526).

[0080] The voltage drop estimation unit (determination S1525) estimates that an accident occurred in the own vehicle, causing an abnormality in the power supply system and thus causing a voltage drop.

[0081] That is, the vehicle control device 1000 of the present embodiment stops the vehicle control function and generates analysis data (FFD) at the same time when a decrease in the supply voltage is detected, and records the analysis data (FFD) to the non-volatile memory 1600 at any time when the abnormality is resolved due to the detection of a voltage increase or when the duration of the voltage decrease exceeds a certain time.

[0082] In addition, it has analysis data storage timing control, that is, when a reduction in supply voltage is detected during the operation of a vehicle control function that predicts damage to the power supply system or a vehicle control function that causes a large voltage change within a certain period of time before stopping the vehicle control function, analysis data (FFD) is generated and then the analysis data (FFD) is immediately stored in the non-volatile memory 1600.

[0083] According to the vehicle control device 1000 of this embodiment, the analysis data when the abnormal voltage drop is detected can be accurately recorded and the storage of erroneous analysis data due to the power off operation of the driver can be prevented. In addition, when analyzing the abnormality of the vehicle, the necessary analysis data will not be lost due to the storage squeeze caused by the occurrence of unnecessary analysis data, and the analysis data when the abnormality occurs that is most useful for investigating the cause of the abnormality can be obtained.

[0084] To further summarize the present invention, the following problem exists in the storage of abnormal cause analysis data in the vehicle control device 1000: due to the deviation of the charging and discharging characteristics that change according to the type and number of vehicle-mounted electronic parts and electric parts, the voltage drop caused by the driver's power disconnection operation is judged as a voltage drop caused by a power abnormality and stored as analysis data, resulting in data useful for fault cause analysis being overwritten and no longer available.

[0085] In response to the above problem, the vehicle control device 1000 of the present embodiment stops the vehicle control function and generates analysis data (FFD) at the same time when a decrease in supply voltage is detected, and records the analysis data (FFD) in the non-volatile memory 1600 at any of the following times: when the abnormality is resolved due to detection of a voltage increase; when the duration of the voltage decrease has exceeded a certain time; when the vehicle control function is operating to predict damage to the power supply system within a certain time before stopping the vehicle control function; when the vehicle control function is operating to cause a large voltage change within a certain time before stopping the vehicle control function.

[0086] According to the vehicle control device 1000 of this embodiment, even if there are deviations in the charge and discharge characteristics that vary depending on the types and number of vehicle-mounted electronic components and electric components, erroneous analysis data will not be recorded due to the driver's power disconnection operation. Only analysis data when an abnormal voltage drop is detected will be accurately recorded, thereby making it easy to analyze the cause of the abnormality.

[0087] Furthermore, the present invention includes various modifications and is not limited to the above-described embodiments. For example, the above-described embodiments are described in detail to explain the present invention in an easy-to-understand manner, and are not necessarily limited to having all the described configurations.

[0088] In addition, the above-mentioned various structures, functions, processing units, processing methods, etc. can be implemented in part or in whole by hardware, for example, by designing with integrated circuits. In addition, the above-mentioned various structures, functions, etc. can also be implemented in software by interpreting and executing programs that implement various functions by a processor. Information such as programs, tables, files, etc. that implement various functions can be placed in a recording device such as a memory, a hard disk, an SSD (Solid State Drive) or a recording medium such as an IC card, an SD card, or a DVD.

[0089] In addition, the control lines and information lines are shown as those considered necessary for explanation, and not all control lines and information lines may be shown on the product. In fact, it can be considered that almost all components are connected to each other. Explanation of symbols

[0090] 1000…Vehicle control device 1100…Vehicle control application software 1200…voltage acquisition unit (voltage measurement unit) 1300…Shutdown Processing Department 1400…Abnormality Diagnosis Department 1500…Event data recorder (storage indicator) 1600 ... non-volatile memory (storage unit) 2000…External identification device 2100…Camera 2200…Radar 2300…Sonar 3000...Actuator 3100…Brake 3200…Engine 3300…Transmission 3400…Electric power steering 3500…meters 4000…Power supply unit 5000…Analysis device 6000…In-vehicle sensors.

Claims

1. A vehicle control device that controls a vehicle by implementing a control function implemented by a plurality of control devices that share a common power supply, the vehicle control device comprising: a voltage measuring unit configured to measure a voltage of the power source; an abnormality diagnosis unit having a control stop function for determining whether or not the control function implemented by the plurality of control devices becomes difficult to implement due to a decrease in the voltage of the power supply, and stopping control in the case of difficulty; as well as a storage instruction unit for instructing to store the history information indicating the stop phenomenon of the operation under the control stop function in the storage unit; The storage instruction unit instructs the storage unit to store the history information when the voltage of the power source becomes higher than a predetermined voltage at which it becomes difficult to perform the control function after the control stop function is performed.

2. The vehicle control device according to claim 1, characterized in that: The storage instruction unit instructs the storage unit to store the history information when the execution time of the control stop function continues for a predetermined time or longer after the control stop function is executed.

3. The vehicle control device according to claim 1, characterized in that: The storage instruction unit includes a voltage drop estimation unit that estimates that the possibility of a voltage drop supplied from the power supply system of the own vehicle has increased within a certain period of time before the implementation of the control stop function. When the voltage drop estimation unit estimates that a voltage drop has occurred, the storage instruction unit instructs the storage of the history information.

4. The vehicle control device according to claim 3, characterized in that: The voltage drop estimation unit estimates that an accident occurred in the own vehicle, causing abnormality in the power supply system and thus causing a voltage drop.

5. The vehicle control device according to claim 4, characterized in that: The voltage reduction inference unit includes the fact that the accident damage avoidance and mitigation vehicle control function is operating through the vehicle control device in the determination establishment condition, and the accident damage avoidance and mitigation vehicle control function is intended to avoid or reduce the damage caused by the accident of the own vehicle.

6. The vehicle control device according to claim 3, characterized in that: The voltage reduction inference unit includes the fact that a power-using vehicle control function is operating through the vehicle control device in the determination condition, and infers that a voltage reduction has occurred in the power supply system based on the determination condition. The power-using vehicle control function consumes power to operate the actuator according to the actuator control instruction from the vehicle control device.

7. The vehicle control device according to claim 5, characterized in that: The accident damage avoidance mitigation vehicle control function is any one of collision avoidance mitigation automatic braking control, collision avoidance mitigation automatic steering control, and driving force suppression control caused by accelerator pedal stepping error.

8. The vehicle control device according to claim 6, characterized in that: The electric power vehicle control function operates any one of a braking device, an electric power steering device, an engine starting device, and a vehicle acceleration / deceleration motor device of the own vehicle.

Images