Control device and electronic control system for vehicles

Abstract

Vehicle control device comprising: a first control instruction generating unit (21b) that generates a first control instruction for a vehicle drive device; a second control instruction generating unit (22b) that generates a second control instruction for the vehicle drive device; and a monitoring circuit (11h) including: a monitoring unit that monitors an operation of the first control instruction generation unit (21b); an abnormality notification signal generation unit (11q) that outputs an abnormality notification signal (11u) to a second control instruction generation unit (22b) when the monitoring unit detects an abnormality of the first control instruction generation unit (21b); and a reset generation unit (11t) outputting a reset signal (11r) to reset the first control instruction generation unit (21b), wherein the reset generation unit (11t) outputs the reset signal (11r) after a required transition time has elapsed since the output of the anomaly notification signal (11u) from the anomaly notification signal generation unit (11q) in which the second control instruction generation unit (22b) terminates a control transition operation to generate the second control instruction, wherein the vehicle control device is characterized in that an anomaly signal generation unit outputs the anomaly notification signal (11u) to the second control instruction generation unit (22b) in a first anomaly detection time (T1) after the occurrence of an anomaly in the first control instruction generation unit (21b), the reset generation unit (11t) outputs the reset signal (11r) to the first control instruction generation unit (21b) in a second anomaly detection time (T2) longer than the first anomaly detection time (T1) after the occurrence of the anomaly in the first control instruction generation unit (21b), and then, when the first anomaly detection time is (T1), the second anomaly detection time is (T2), and the required transition time is (T3), a time obtained by adding T1 and T3 is equal to or less than T2.

Description

Technical area

[0001] The present invention relates to a control device and an electronic control system for vehicles of an automatic driving system. Technical background

[0002] An advanced automatic driving system requires an electronic control unit (ECU), which is a higher-level control device that controls automatic driving, to continue operation for a certain period of time until driving operation is handed over to a driver, such as even if an error occurs in an arithmetic unit (microcomputer) that performs calculation for automatic driving control.

[0003] PTL 1 discloses a vehicle control device that restricts part of the control functions of multiple sub-control units when a microcomputer of a main control unit is operating normally, but the microcomputer's power supply voltage falls outside a proper range. Furthermore, PTL 2 describes a vehicle control system consisting of two redundant controllers. One is designated as the primary controller and the other as the secondary controller. In the event of a fault, the secondary controller assumes the primary role, while the faulty controller switches to a safe operating mode. Citation listPatent literature

[0004] PTL 1: JP 2015-93498 A, PTL 2: DE 10 2014 102 582 A1 Summary of the inventionTechnical problem

[0005] For example, an automatic driving system is constituted by a vehicle control device that outputs control instructions, and a plurality of actuator control devices that respectively perform engine control, brake control, power steering control, and the like based on the control instructions from the vehicle control device.

[0006] Here, in the automatic driving system, it is desirable to monitor the operation of a microcomputer through a diagnostic circuit, such as a watchdog timer monitoring program running in the microcomputer, or the like, and to perform error processing by detecting an abnormality of the microcomputer for operational reliability. However, if processing such as stopping (resetting) the microcomputer is consistently performed for the microcomputer abnormality, a function of the automatic driving system will stop.

[0007] However, when the function of the automatic driving system suddenly stops, a vehicle occupant must take over driving, but control interpolation by a vehicle system is required because the vehicle occupant takes time to take over driving, and a technology for such control interpolation is needed.

[0008] As a means to solve the problem described above, PTL 1 describes the control when the power supply voltage of the microcomputer falls out of the proper range in the state where the microcomputer is operating normally, however, an operation abnormality of the microcomputer itself due to factors such as microcomputer overload must be considered, and it is difficult to avoid resetting the microcomputer.

[0009] In addition, when the microcomputer of the ECU controlling a plurality of drive power sources becomes abnormal, it is conceivable to appropriately notify the ECU controlling the drive source of such abnormality and to perform idle running, emergency stop, or the like to prevent occurrence of an abnormality in a drive force.

[0010] However, even if the ECU that controls the external travel drive power source is notified of the microcomputer abnormality when the microcomputer abnormality occurs, there is a concern that an appropriate control transition may be impossible due to the size of the control scope depending on external situations of a host vehicle.

[0011] Therefore, it is possible to consider a method of performing a control transition from a control microcomputer to a degeneration control microcomputer when an abnormality is detected in an operation of the control microcomputer that controls an operation of an automatic driving system.

[0012] However, it is difficult to avoid a control transition period, that is, a control-free period in which the degeneration control microcomputer switches the control after receiving the abnormality notification, and such a control transition risk is involved.

[0013] In addition, there is the problem that the control transition risk varies depending on the relationship with objects around the host vehicle.

[0014] The present invention has been made in view of the above-mentioned problems, and one of its objects is to implement a vehicle control device and an electronic control system that can safely perform control transition to a degeneration control microcomputer even when an operation abnormality occurs in an arithmetic unit of a control device, and can improve safety. Solution to the problem

[0015] In order to achieve the above object, the present invention is configured as follows.

[0016] The subject matter of the invention is a vehicle control device comprising the features of claims 1 and 2, as well as an electronic control system comprising the features of claim 8. Further advantageous embodiments of the invention are defined in the subclaims. Advantageous effects of the invention

[0017] According to the present invention, it is possible to implement the vehicle control device and the electronic control system which can eliminate a control-free period by resetting the control microcomputer after the required transition period of the degeneration control microcomputer has elapsed even if the operation abnormality occurs in the control microcomputer in the vehicle control device, and can improve safety. Brief description of the drawings [ Fig. 1] Fig. 1 is a schematic configuration diagram of the automatic driving system provided in a vehicle to which the present invention is applied. [ Fig. 2] Fig. 2 is a diagram illustrating an internal configuration of an autonomous driving control unit (first ECU) according to a first embodiment. [ Fig. 3] Fig. 3 is a timing chart during a control transition when a degeneration operation is executed according to the first embodiment. [ Fig. 4] Fig. 4 is a diagram illustrating an internal configuration of an autonomous driving control unit (first ECU) according to a second embodiment. [ Fig. 5] Fig. 5 is an explanatory view of an abnormality detection criterion and an abnormality detection time according to a third embodiment of the present invention. [ Fig. 6] Fig. 6 is a diagram illustrating an internal configuration of an autonomous driving control unit (first ECU) according to a fourth embodiment of the present invention. [ Fig. 7] Fig. 7 is a diagram illustrating an internal configuration of an autonomous driving control unit (first ECU) according to a fifth embodiment of the present invention. [ Fig. 8] Fig. 8 is a timing chart during a control transition when a degeneration operation is executed according to the fifth embodiment of the present invention. [ Fig. 9] Fig. 9 is a diagram illustrating a configuration of an autonomous driving control system according to a sixth embodiment of the present invention. Description of the embodiments

[0018] Embodiments of the present invention will now be described with reference to the accompanying drawings. Embodiments (configuration example of an automatic driving system)

[0019] First, a configuration of an automatic driving system (vehicle control system) to which the present invention is applied will be described.

[0020] Fig. 1 is a schematic configuration diagram of the automatic driving system provided in a vehicle to which the present invention is applied. In Fig. 1, the automatic driving system includes: a camera (first sensor) 1, which is an external detection sensor configured to detect an external situation of the vehicle; a radar (second sensor) 2; a host vehicle position sensor (third sensor) 3; and an automatic driving setting unit 4, which is configured to set automatic driving.

[0021] The automatic driving system further includes an autonomous driving control unit 11, a degeneration control unit 12, a brake control unit 13, an engine control unit 14, and a power steering control unit 15.

[0022] It should be noted that the brake control unit 13, the engine control unit 14 and the power steering control unit 15 may be collectively referred to as an actuator control unit that controls the operation of the vehicle.

[0023] The camera 1, the radar 2, the host vehicle position sensor 3, the autonomous driving control unit 11, the degeneration control unit 12, the brake control unit 13, the engine control unit 14, and the power steering control unit 15 are connected to communicate with each other via an in-vehicle network (e.g., a controller area network (CAN) or Ethernet (registered trademark)).

[0024] The degeneration control unit 12 is a control device that operates to perform appropriate degeneration control as a backup when the autonomous driving control unit 11 fails, however, the degeneration control unit 12 is unnecessary if safety can be ensured by providing a degeneration control function in the autonomous driving control unit 11 even when the autonomous driving control unit 11 fails.

[0025] The brake control unit 13 is a control device that performs vehicle braking control (braking force control), and the engine control unit 14 is a control device that controls an engine that generates driving force of the vehicle. Additionally, the power steering control unit 15 is a control device that controls the power steering of the vehicle. Note that the engine has been explained as a means for generating driving force, but it goes without saying that the present invention can be applied to an electric motor.

[0026] The host vehicle position sensor 3 is a device that detects the position of a host vehicle using radio waves from a positioning satellite such as a global positioning system (GPS). The host vehicle position sensor 3 outputs the obtained host vehicle position information to the autonomous driving control unit 11. Note that the host vehicle position sensor 3 can detect the host vehicle position information using a positioning system other than GPS.

[0027] Additionally, the host vehicle position sensor 3 contains a data storage unit for storing map data to be used in autonomous driving. Map data such as road width, number of lanes, gradient, curvature of a curve, shape of an intersection, and speed limit information are stored. Note that the map data may be stored in the autonomous driving control unit 11.

[0028] The automatic driving setting unit 4 is a device that sets a destination, a route, a driving speed, and the like during automatic driving. The automatic driving setting unit 4 has an input device (not shown) configured to allow a passenger to make settings.

[0029] Examples of the input device include not only a start switch configured to allow the passenger to start the automatic driving system, but also a physical input device such as a button and a touch panel, a gesture input device using a camera or infrared rays, a voice input device, and the like. The automatic driving setting unit 4 outputs information input by the passenger via the input device to the autonomous driving control unit 11.

[0030] Here, when a request for automatic driving is received by the automatic driving setting unit 4, the autonomous driving control unit 11 calculates a trajectory of the vehicle based on external information from the camera 1, the radar 2, the host vehicle position sensor 3, and the like, and outputs control instructions such as braking and a driving force to the brake control unit 13, the engine control unit 14, and the power steering control unit 15 to move the vehicle along the above-described route.

[0031] The brake control unit 13, the engine control unit 14, and the power steering control unit 15 receive the control instruction for automatic driving control from the autonomous driving control unit 11 and output an operation signal to each control target (actuator). (First embodiment)

[0032] A first embodiment is described with reference to Fig. 2 and Fig. 3 described.

[0033] As in Fig. 2, in the present embodiment, autonomous driving control is performed by an autonomous driving control unit 11 (also referred to as a first electronic control unit), and degeneration control is performed by a degeneration control unit 12 (also referred to as a second electronic control unit).

[0034] The first electronic control unit 11 includes: a monitoring circuit 11h; an external detection microcomputer 10b that processes signals from external detection sensors 1, 2, and 3; and a control microcomputer 11b that generates a driving control instruction for electronic control units 13, 14, and 15 configured to drive an actuator provided outside, based on a signal from the external detection microcomputer 10b.

[0035] The monitoring circuit 11h monitors the operation of the control microcomputer 11b and resets the control microcomputer 11b when it detects an abnormality. Additionally, when the monitoring circuit 11h is notified of the abnormality of the control microcomputer 11b, it sends an abnormality notification signal to the second electronic control unit to transfer control to the second electronic control unit, which sends the degeneration operation instruction to the electronic control units 13 to 15.

[0036] The present embodiment illustrates an example in which the control microcomputer 11b is reset after the control is transferred to the degeneration control microcomputer 12b when the monitoring circuit 11h detects the operation abnormality of the control microcomputer 11b.

[0037] Here, the control microcomputer 11b is defined as a control instruction generation unit that generates a first control instruction for a first external actuator control unit.

[0038] The first electronic control unit 11 has two microcomputers, namely the external detection microcomputer 10b (an external detection unit) and the control microcomputer 11b. The external detection microcomputer 10b includes a communication circuit 10c (communication circuit 0) and a communication circuit 10d (communication circuit 1). In addition, the control microcomputer 11b includes a communication circuit 11c (communication circuit 2).

[0039] In addition, when the first electronic control unit (specifically, the control microcomputer 11b), which is the autonomous driving control unit 11 that generates the control instruction, has failed, the degeneration control unit 12, which operates instead of the autonomous driving control unit 11, includes the degeneration control microcomputer 12b and the communication circuit 12c (communication circuit 3).

[0040] Here, the degeneration control unit 12 is defined as a second control instruction generation unit that generates a second control instruction for the external actuator control unit.

[0041] In Fig. 2, the autonomous driving control unit 11 includes the external detection microcomputer 10b and the control microcomputer 11b, and the degeneration control unit 12 includes the degeneration control microcomputer 12b. However, the external detection microcomputer 10b, the control microcomputer 11b, and the degeneration control microcomputer 12b may be arranged, for example, in the autonomous driving control unit 11.

[0042] In addition, the control microcomputer 11b and the degeneration control microcomputer 12b may be provided in the autonomous driving control unit 11, and the external detection microcomputer 10b may be arranged in a control unit other than the autonomous driving control unit 11.

[0043] Sensor information (external detection information) from the camera 1 (first sensor), the radar 2 (second sensor), and the host vehicle position sensor 3 (third sensor), which are external sensors, is transmitted to the microcomputer 10b for external detection via the communication circuit 10c.

[0044] The external detection microcomputer 10b detects an external situation based on the transmitted sensor information and generates trajectory information in which the host vehicle is moving. Therefore, the external detection microcomputer 10b can be defined as a trajectory information generation unit.

[0045] The external detection microcomputer 10b transmits the generated trajectory information to the control microcomputer 11b via a communication line 10k. The control microcomputer 11b receives pieces of information from an external detection sensor such as a wheel speed sensor, an acceleration sensor, and a yaw rate sensor (not shown) (these pieces of information are also included in the external detection information) externally from an external ECU (control device) via the communication circuit 11c (communication circuit 2).

[0046] The control microcomputer 11b generates actuator control instructions based on the external detection sensor information and the trajectory information calculated by the external detection microcomputer 10b, and sends the generated actuator control instructions to the brake control unit 13 (third electronic control unit), the engine control unit 14 (fourth electronic control unit), and the power steering control unit 15 (fifth electronic control unit), respectively.

[0047] The monitoring circuit 11h that monitors the control microcomputer 11b is connected to the control microcomputer 11b, and the monitoring circuit 11h includes a first monitoring circuit (first monitoring unit) that detects an abnormality in the control microcomputer 11b in an abnormality detection time T1 (first abnormality detection time), and a second monitoring circuit (second monitoring unit) that detects an abnormality in the control microcomputer 11b in an abnormality detection time T2 (second abnormality detection time) longer than the abnormality detection time T1.

[0048] The first monitoring circuit is a watchdog timer 11i (WDT unit), which determines the normal state of program operation of the control microcomputer 11b. A pulse output unit 11d of the control microcomputer 11b outputs a high / low pulse signal 11f having a constant period, and the watchdog timer 11i (WDT unit) determines the normal state of the pulse signal 11f.

[0049] The second monitoring circuit is an arithmetic / logic comparison unit 11j that determines the normal state of an arithmetic unit 11e of the control microcomputer 11b. Through bidirectional communication via a communication line 11g between the monitoring circuit 11h and the control microcomputer 11b, the arithmetic / logic comparison unit 11j regularly sends a query signal (e.g., a specified random numerical value and an arithmetic expression using the numerical value) to the control microcomputer arithmetic unit 11e. A response signal of the control microcomputer arithmetic unit 11e corresponding to the query signal is compared with an expected value calculated in advance by the operation logic comparison unit 11j, thereby determining the normal state of the control microcomputer 11b.

[0050] The second monitoring circuit is configured for a comparison of an arithmetic / logic unit, applies the specification to increment an anomaly counter in the event of a comparison inconsistency, and can adjust an anomaly detection time by setting a criterion for definitively determining the anomaly. In this way, the anomaly detection time T2, which is longer than the anomaly detection time T1, is set in advance.

[0051] The abnormality detected by the first monitoring circuit is a more serious reset factor (factor to reset the control microcomputer 11b) than the abnormality detected by the second monitoring unit.

[0052] The first monitoring circuit and the second monitoring circuit are collectively referred to as a monitoring unit.

[0053] It should be noted that the monitoring circuit 11h which monitors the control microcomputer 11b is a logic circuit and can also be incorporated into the microcomputer 10b for external detection.

[0054] Fig. 3 is a timing chart during a control transition to the degeneration control microcomputer 12b according to the first embodiment.

[0055] In Fig. 3, the control microcomputer 11b outputs a control instruction to the external actuator control unit at time (t0), and the degeneration control microcomputer 12b is in a standby state.

[0056] If a failure occurs in the control microcomputer 11b at time (t2), an abnormality is detected by the first monitoring circuit at time (t3) after the abnormality detection time T1 has elapsed since the occurrence of the failure, an abnormality notification signal (11u) outputted from an abnormality notification signal generating unit 11q becomes high (anomaly detection 1), the degeneration control microcomputer 12b is notified of the control microcomputer abnormality, and the control transition is started.

[0057] At time (t4) when the control transition period (required transition period) T3 has elapsed, the transition preparation of the degeneration control microcomputer 12b is completed. At time (t5) after the abnormality detection time T2 has elapsed since the fault occurred, the abnormality is detected by the second monitoring circuit, the reset signal 11r from the reset generation unit 11t becomes low, and the control microcomputer 11b is reset.

[0058] Here, the abnormality detection time T2 is set from the fault occurrence time (t2) to the time (t5) at which the control microcomputer 11b is reset, so that it occurs after the time (t4) at which the control transition preparation of the degeneration control microcomputer 12b is completed. That is, the above-described abnormality detection time T2 is set to have the relationship T2 ≥ T1 + T3 (the time obtained by adding T1 and T3 is equal to or less than T2) using the abnormality detection time T1 and the control transition period T3 of the degeneration control microcomputer 12b.

[0059] It should be noted that if the error occurring at time (t2) (abnormality of the pulse output unit 11d) is a transient error, there is a case where it is not determined as an abnormality by the second monitoring unit that determines the abnormality at a deeper level (whether the arithmetic unit 11e is abnormal or not), even if it has been determined as an abnormality by the first monitoring unit. In such a case, the control microcomputer 11b is not reset at time (t5) but continues control.

[0060] For example, there is a case where it is determined that no abnormality has occurred in the arithmetic unit 11e, even if it is determined that an abnormality due to noise has occurred in the pulse output unit 11d. In such a case, the control microcomputer 11b is not reset by the reset signal 11r from the reset generation unit 11t, and control by the control microcomputer 11b continues.

[0061] When the pulse output unit 11d determines that the abnormality has occurred due to the noise, the degeneration control microcomputer 12b executes the degeneration control through the control transition operation such that the degeneration control operation and the control performed by the control microcomputer 11b are executed in parallel.

[0062] In this case, the brake control unit 13, the engine control unit 14, and the power steering control unit 15 are defined in advance to give priority to the control instruction from the control microcomputer 11b. As a result, control by the control microcomputer 11b continues.

[0063] As described above, according to the first embodiment, the abnormality detection time T2, the abnormality detection time T1, and the control transition period T3 are set to have the relationship T2 ≥ T1 + T3. Thus, when an abnormality is detected by the first monitoring circuit at time T1 after the occurrence of the vehicle fault, the control transition operation of the degeneration control microcomputer 12b is started, and the degeneration control operation by the degeneration control microcomputer 12b is started after the elapse of the control transition time T3.

[0064] Thereafter, when an abnormality is detected by the second monitoring circuit at time T2 after the occurrence of the vehicle fault, the control microcomputer 11b is reset.

[0065] In the present embodiment, when the abnormality is detected by the first monitoring circuit, the first electronic control unit outputs the control transition instruction to the second electronic control unit, and the reset is performed according to a result of the second monitoring circuit after the completion of the transition preparation of the second electronic control unit, instead of immediately performing the reset. Therefore, the reset of the control microcomputer 11b before the start of the degeneration control operation of the degeneration control microcomputer 12b is avoided, a control-free period is eliminated, and it is possible to implement the vehicle control device that can improve the reliability of a control circuit and the safety of the vehicle. In addition, it is possible to prevent immediate resetting with a primary abnormal value such as noise. (Second embodiment)

[0066] Next, a second embodiment will be described with reference to Fig. 4 described.

[0067] A difference from the first embodiment is that the autonomous driving control unit 11 and the degeneration control unit 12 are provided in the same electronic control unit (ECU).

[0068] As in Fig. 4, the autonomous driving control unit 11 (electronic control unit) includes the degeneration control microcomputer 12b in addition to the external detection microcomputer 10b and the control microcomputer 11b.

[0069] The degeneration control microcomputer 12b and the communication circuit 12c (communication circuit 3) are arranged in the autonomous driving control unit 11. The second embodiment is substantially the same as the first embodiment and further includes the reset generation unit 11t, but the abnormality notification signal 11u output from the abnormality notification signal generation unit 11q is supplied to the external detection microcomputer 10b and the degeneration control microcomputer 12b in the autonomous driving control unit 11.

[0070] In the second embodiment, the same effects as those of the first embodiment can be achieved, and further, there is an effect that the latency when an abnormality occurs is improved because the connection of the signal line of the abnormality notification signal 11u is enabled. (Third embodiment)

[0071] Next, a third embodiment will be described with reference to Fig. 5 described.

[0072] The third embodiment is an example in which the internal configuration of the autonomous driving control unit 11 (first ECU) is the same as that of the first or second embodiment, but the abnormality detection time T1 and the abnormality detection time T2 can be changed by the monitoring circuit 11h.

[0073] Fig. 5 is an explanatory view of an abnormality detection criterion and an abnormality detection time according to the third embodiment.

[0074] In Fig. 5, the horizontal axis represents a time elapsed since the occurrence of the error in the control microcomputer 11b, and the vertical axis represents an abnormality counter.

[0075] In the example shown in Fig. As shown in Figure 5, a straight line L along which the anomaly counter increases along with the passage of time is defined in advance, criterion 1 (determination criterion 1) and criterion 2 (determination criterion 2) are set, the time at the point where criterion 1 intersects the straight line L is set as the anomaly detection time T1, and the time at the point where criterion 2 intersects the straight line L is set as the anomaly detection time T2. However, criterion 2 is greater than criterion 1.

[0076] In this way, the anomaly detection time T1 and the anomaly detection time T2 can be set by setting the criterion 1 and the criterion 2 for anomaly determination with respect to an anomaly counter value that is incremented each time an anomaly is detected.

[0077] That is, criterion 1 and criterion 2 are set based on an anomaly detection number, and the anomaly detection number is set to be larger in criterion 2 than in criterion 1. Further, a time difference is set so that the anomaly detection time T2 is longer than the anomaly detection time T1 by setting the anomaly detection time T1 to correspond to criterion 1 and setting the anomaly detection time T2 to correspond to criterion 2.

[0078] Since the above-described abnormality detection time T2 is set to have the relationship T2 ≥ T1 + T3 by using the abnormality detection time T1 and the control transition period T3 of the degeneration control microcomputer 12b, it is possible to improve the reliability of the control circuit by eliminating the control-free period caused by resetting the control microcomputer 11b.

[0079] The present embodiment provides the abnormality detection times T1 and T2 by changing the criterion using the same abnormality detection method, while the first and second embodiments provide the abnormality detection times T1 and T2 using different abnormality detection methods. Even in the present embodiment, the same effects as those of the first and second embodiments can be achieved, and it is also possible to set the abnormality detection times T1 and T2 in accordance with a vehicle or the like to which the present invention is applied, and to perform appropriate degeneration operation transition control in accordance with the vehicle or the like to which the present invention is applied. (Fourth embodiment)

[0080] Next, a fourth embodiment will be described with reference to Fig. 6. Note that the same configurations as those of the first to third embodiments are not described.

[0081] The fourth embodiment is an example using two monitoring circuits and logic gates. Note that the degeneration control unit 12 may be provided inside the autonomous driving control unit 11 or may be provided externally.

[0082] As in Fig. 6, the first monitoring circuit 11i, which monitors the control microcomputer 11b, and the second monitoring circuit 11j are connected to the control microcomputer 11b by means of an AND gate 11p.

[0083] The first monitoring circuit 11i is, for example, a watchdog timer that determines the normal state of program operation of the control microcomputer 11b, and the second monitoring circuit 11j is, for example, an arithmetic / logic comparison unit that determines the normal state of the arithmetic unit 11e of the control microcomputer 11b. Thus, different monitoring units are provided from the first embodiment. In other words, a first monitoring unit for the abnormality detection time T1 and a second monitoring unit for the abnormality detection time T2 are provided.

[0084] It should be noted that the third embodiment can be applied.

[0085] Normality determination results of the first monitoring circuit 11i and the second monitoring circuit 11j are connected as a signal 11k and a signal 11m to an input terminal of the AND gate 11p, which is a reset generating unit, and an input terminal of an OR gate 11w, which is an abnormality notification signal generating unit, respectively.

[0086] In the present embodiment, the first monitoring circuit 11i, the second monitoring circuit 11j, the AND gate 11p and the OR gate 11w constitute the monitoring circuit 11h.

[0087] A gate output of the OR gate 11w responds when an abnormality is detected in a monitoring circuit between the first monitoring circuit 11i and the second monitoring circuit 11j, and the microcomputer 10b for external detection is notified via the abnormality notification signal 11u.

[0088] On the other hand, an output of the AND gate 11p responds when an anomaly is detected by the monitoring circuits of both the monitoring circuit 111i and the monitoring circuit 211j (monitoring circuit 2), thereby enabling reliable anomaly detection.

[0089] Therefore, the gate output of the OR gate 11w and the output of the AND gate 11p respond at different timings, and thus, the resetting of the control microcomputer after completion of the control transition to the degeneration control unit can be carried out similarly to the first embodiment so that the generation of the free period can be prohibited.

[0090] As described above, according to the fourth embodiment, the abnormality detection time T1 and the abnormality detection time T2 are generated by diagnosing the control microcomputer 11b with two types of monitoring units similarly to the first embodiment, and it is possible to implement the resetting of the control microcomputer 11b after the abnormality notification to the degeneration control microcomputer 12b and the completion of the control transition to the degeneration control microcomputer 12b.

[0091] In addition, when a failure of the control microcomputer 11b is a transient failure such as noise, the control is continued without transition, so that the control of the control microcomputer 11b is ensured. (Fifth embodiment)

[0092] Next, a fifth embodiment will be described with reference to Fig. 7 and Fig. 8 described.

[0093] The same configurations as those of the first and second embodiments will not be described.

[0094] An example that Fig. 7 is an example in which the control microcomputer 11b is reset after the control is transferred to the degeneration control microcomputer 12b when the monitoring circuit 11h detects the operation abnormality of the control microcomputer 11b.

[0095] This point is the same as that in the first and second embodiments, but the fifth embodiment is an example obtained by further ensuring that the control microcomputer 11b does not need to be reset unless control has transferred to the degeneration control microcomputer 12b.

[0096] As in Fig. As shown in Fig. 7, the autonomous driving control unit 11, which is a traveling control device for automatic driving of the present embodiment, includes three microcomputers, namely, the external detection microcomputer 10b, the control microcomputer 11b, and the degeneration control microcomputer 12b. The external detection microcomputer 10b includes the communication circuit 10c (communication circuit 0), and the control microcomputer 11b includes the communication circuit 11c (communication circuit 2). In addition, the control microcomputer 12b includes the communication circuit 12c (communication circuit 3).

[0097] As described above, the autonomous driving control unit 11 includes the external detection microcomputer 10b, the control microcomputer 11b, and the control microcomputer 12b. However, for example, the external detection microcomputer 10b and the control microcomputer 11b may be arranged in a first electronic control unit, which is the autonomous driving control unit 11, and the degeneration control microcomputer 12b may be arranged in a second electronic control unit.

[0098] In addition, the control microcomputer 11b and the degeneration control microcomputer 12b may be arranged in the autonomous driving control unit 11, and the external detection microcomputer 10b may be arranged in a control unit other than the autonomous driving control unit 11.

[0099] Sensor information (external detection information) from the camera 1 (first sensor), the radar 2 (second sensor), and the host vehicle position sensor 3 (third sensor), which are external sensors, is transmitted to the external detection microcomputer 10b via the communication circuit 10c. The external detection microcomputer 10b detects an external situation based on the transmitted sensor information and generates trajectory information in which the host vehicle is moving.

[0100] The external detection microcomputer 10b transmits the generated trajectory information to the control microcomputer 11b via a communication line 10k. The control microcomputer 11b receives pieces of information from an external detection sensor such as a wheel speed sensor, an acceleration sensor, and a yaw rate sensor (not shown) (these pieces of information are also included in the external detection information) externally from an external ECU (control device) via the communication circuit 11c (communication circuit 2).

[0101] The control microcomputer 11b, based on the information of the external detection sensor and the trajectory information calculated by the external detection microcomputer 10b, and an actuator control instruction is generated and sent to the brake control unit 13 (third ECU), the engine control unit 14 (fourth ECU), and the power steering control unit 15 (fifth ECU).

[0102] The monitoring circuit 11h that monitors the control microcomputer 11b is connected to the control microcomputer 11b, and the monitoring circuit 11h includes the first monitoring circuit 11i that detects the abnormality in the control microcomputer 11b in an abnormality detection time T1, and the second monitoring circuit 11j that detects an abnormality in the control microcomputer 11b in the abnormality detection time T2 that is longer than the abnormality detection time T1.

[0103] In addition, the above-described first monitoring circuit 11i and the above-described second monitoring circuit 11j are connected to the control microcomputer 11b through the communication line 11f and the communication line 11g, respectively, and monitor the control microcomputer 11b by sending and receiving signals in the communication lines 11f and 11g.

[0104] The first monitoring circuit 11i may, for example, be a watchdog timer, as in the first embodiment. Meanwhile, the second monitoring circuit 11j is desired to perform a particularly robust diagnosis to reset the control microcomputer 11b based on the monitoring result, and may, for example, employ a system that compares arithmetic / logic similar to the first embodiment.

[0105] The first monitoring circuit 11i and the second monitoring circuit 11j set the abnormality detection time T2 longer than the abnormality detection time T1, for example, by setting respective diagnosis criteria.

[0106] When the first monitoring circuit 11i detects an abnormality in the control microcomputer 11b, the abnormality notification signal 11u is input to the degeneration control microcomputer 12b via the abnormality notification signal generation unit 11q, and the degeneration control is transferred to the degeneration control microcomputer 12b.

[0107] On the other hand, when the abnormality of the control microcomputer 11b is detected by the second monitoring circuit 11j, the abnormality signal 11m is input to an input terminal of the AND gate 11x in the monitoring circuit 11h.

[0108] After the abnormality notification signal 11u is input and the control transition after the start of the transition to the degeneration control is completed, the degeneration control microcomputer 12b outputs a transition preparation completion signal 12y to the further input terminal of the AND gate 11x in the monitoring circuit 11h by means of a preparation completion notification output circuit 12x (control transition operation end detection unit).

[0109] That is, the preparation completion notification output circuit 12x detects that the control transition has been completed after the degeneration control microcomputer 12b has started to transition to the degeneration control, and outputs the transition preparation completion signal 12y to the other input terminal of the AND gate 11x.

[0110] Then, when the abnormality occurs in the control microcomputer 11b, the degeneration control microcomputer 12b completes the control transition after receiving the abnormality notification 11u of the first monitoring circuit 11i, and the second monitoring circuit 11j detects the abnormality, with the operation described above, both the input terminals of the AND gate 11x become high and the output signal 11n of the AND gate 11x become high.

[0111] When the output signal 11n of the AND gate 11x becomes high, the reset generating unit 11t outputs the reset signal 11r to the control microcomputer 11b to reset the control microcomputer 11b.

[0112] Fig. 8 is an operation timing chart during the control transition to the degeneration control microcomputer 12b according to the fifth embodiment.

[0113] In Fig. 8, the control microcomputer 11b outputs a control instruction to the external actuator control unit at time (t0), and the degeneration control microcomputer 12b is in a standby state.

[0114] If a failure occurs in the control microcomputer 11b at time (t2), the abnormality notification signal 11u from the first monitoring circuit 11i becomes high at time (t3) after the abnormality detection time T1 has elapsed since the failure occurred, the degeneration control microcomputer 12b is notified of the control microcomputer abnormality, and the control transition is started.

[0115] When the transition preparation of the degeneration control microcomputer 12b is completed at time (t4) after the elapse of the control transition period T3 since the start of the control transition, the transition preparation completion signal 12y from the degeneration control microcomputer 12b becomes high.

[0116] Meanwhile, if the second monitoring circuit 11j detects an abnormality at time (t5) after the abnormality detection time T2 has elapsed since the fault occurred, the abnormality notification signal 11m becomes high. When both the abnormality notification signal 11m and the preparation completion notification signal 12y become high, the output signal 11n of the AND gate 11w becomes high, and the reset signal becomes low, thereby resetting the control microcomputer 11b.

[0117] Here, the time point (t5) at which the control microcomputer 11b is reset after the above-described abnormality detection time T2 has elapsed is set to occur after the time point (t4) at which the control transition preparation of the degeneration control microcomputer 12b is completed. That is, the above-described abnormality detection time T2 is set to have the relationship T2 ≥ T1 + T3 using the abnormality detection time T1 and the control transition period T3 of the degeneration control microcomputer 12b.

[0118] That is, when the first monitoring circuit 11i detects the abnormality of the control microcomputer 11b, the abnormality notification signal 11u is output, and the degeneration control microcomputer 12b starts transition preparation to the early stage. Further, when the degeneration control microcomputer 12b completes the control transition, the transition preparation completion signal 12y is input, and after the completion of the transition preparation, the second monitoring circuit 11j determines an abnormality by setting the abnormality detection time T2, as described above. Then, the control microcomputer 11b is reset.

[0119] Even if the control transition of the degeneration control microcomputer 12b exceeds the control transition period T3 and the abnormality notification signal 11m first becomes high, the control microcomputer 11b is not reset unless the degeneration control microcomputer preparation completion notification signal 12y becomes high.

[0120] In the present embodiment, the reset of the control microcomputer 11b can be prevented from being executed before the control transition to the degeneration control unit (degeneration control microcomputer 12b) by applying an AND operation to the signal indicating the completion of the control transition from the degeneration control unit and the abnormality signal from the second monitoring circuit, thus enabling the control transition with high safety. (Sixth Embodiment)

[0121] Next, a sixth embodiment will be described.

[0122] The above-described example is an example in which the present invention is applied to a passenger car. However, the present invention is not limited to the passenger car and can also be applied to a motorcycle, a baggage handling machine for factories, a driving robot, and the like, as long as it is a moving object.

[0123] The sixth embodiment is an example of an electronic control system applicable to various moving objects.

[0124] Fig. 9 is a functional block diagram of an operation of the electronic control system (autonomous driving control system) according to the sixth embodiment.

[0125] In Fig.9, the electronic control system includes: an actuator control unit 23 that controls an actuator (drive device) 24 provided in a moving body such as a vehicle; a first control microcomputer (control instruction generation unit) 21b that outputs a first control instruction to the actuator control unit 23; a second control microcomputer (control instruction generation unit (degeneration control unit)) 22b that outputs a degeneration control instruction, which is a second control instruction, to the actuator control unit 23; a monitoring circuit 21h that monitors an abnormality of the first control microcomputer 21b; and a reset generation unit 21t that resets the first control microcomputer 21b.

[0126] The monitoring circuit 21h includes a first monitoring circuit and a second monitoring circuit similar to those of the first embodiment.

[0127] When an abnormality of the first control microcomputer 21b is detected, the first monitoring circuit of the monitoring circuit 21h outputs an abnormality notification signal to the second control microcomputer 22b. When the abnormality notification signal is received by the monitoring circuit 21h, the second control microcomputer 22b begins to transition to degeneration operation control.

[0128] Then, when the transition to the degeneration operation control is completed (after a required transition period has elapsed), the second control microcomputer 22b outputs a preparation completion notification signal to the reset generation unit 21t and outputs a degeneration control instruction to the actuator controller 23.

[0129] When the abnormality of the first control microcomputer 21b is detected, the second monitoring circuit of the monitoring circuit 21h outputs an abnormality notification signal to the reset generation unit 21t.

[0130] The reset generation unit 21t outputs a reset signal to the first control microcomputer 21b only after both the abnormality signal from the monitoring circuit 21h and the preparation completion notification from the second control microcomputer 22b are received. Even if only one of the abnormality signal from the monitoring circuit 21h and the preparation completion notification from the second control microcomputer 22b is input, the reset generation unit 21t does not output the reset signal to the first control microcomputer 21b.

[0131] As a result, it is ensured that the first control microcomputer 21b is reset after the end of the control transition operation of the second control microcomputer 22b, and it is possible to transition to the degeneration operation control of the actuator control device 23 without generating the free period between the control of the actuator control device 23 by the first control microcomputer 21b and the control of the actuator control device 23 by the second control microcomputer 22b.

[0132] As described above, according to the sixth embodiment of the present invention, even if the abnormality is detected in the first control microcomputer 21b, the control can be surely transferred to the second control microcomputer 22b without generating the control-free period, so that the control-free period can be eliminated and the reliability of the control circuit can be improved.

[0133] That is to say, it is possible to implement the electronic control system for the moving object such as the vehicle, which can safely perform the control transition to the degeneration control microcomputer even if the operation abnormality occurs in the arithmetic unit of the control device and improve the safety.

[0134] In the sixth embodiment, the first control microcomputer 21b and the second control microcomputer 22b may be arranged in the same electronic control unit or may be arranged in separate electronic control units.

[0135] It should be noted that the examples described above are configured such that the control and detection are performed by the microcomputer such as the control microcomputer 11b, the degeneration control microcomputer 12b, the external detection microcomputer 10b, the first control microcomputer 21b, and the second control microcomputer 22b, but the present invention is not limited to the microcomputer and may be configured using other logic circuits.

[0136] In addition, in the example described above, the control transition operation of the degeneration control microcomputer 12b and the second control microcomputer 22b during the control transition was not described in detail, but can be set appropriately for each vehicle to which the invention is applied.

[0137] In the above-described embodiments of the present invention, for the control transition operation, during the control transition period, the degeneration control microcomputer 12b (the second control microcomputer 22b) may be configured to perform an operation (transfer operation or copy operation) for adopting the control data of the control microcomputer 11b (the first control microcomputer 21b).

[0138] Another embodiment of the present invention is a vehicle control method. This vehicle control method is a vehicle control method for executing an automatic driving mode, and includes: a first automatic driving mode for performing automatic driving in a normal state; and a second automatic driving mode for degenerating from the first automatic driving mode and detecting whether or not an abnormality has occurred in the first automatic driving mode.

[0139] Then, if it is detected that the abnormality has occurred in the first automatic driving mode, preparation for transitioning to the second automatic driving mode is started. During a transition preparation period to the second automatic driving mode, the first automatic driving mode continues, and the first automatic driving mode is reset after the second automatic driving mode has been started since the completion of the transition preparation period to the second automatic driving mode.

[0140] As a result, even if the abnormality occurs in the first automatic driving mode, it is possible to safely perform the control transition to the second automatic driving mode for degeneration, and thus it is possible to implement the vehicle control method that can improve safety. List of reference symbols 1 camera 2 radars 3 Carrier vehicle position sensor 4 Setting unit for automatic driving 10b Microcomputer for external detection 10c, 10d, 11c, 12c communication circuit 10k railway information transmission line 11 Control unit for autonomous driving 11h monitoring circuit 11i first monitoring circuit (WDT unit) 11j second monitoring circuit 2 (arithmetic / logic comparison unit) 11q Anomaly notification signal generating unit 11r reset signal 11t reset generation unit 11u anomaly notification signal 11p, 11x AND gate 11w OR gate 12 Degeneration control unit 12b Degeneration control microcomputer 13 Brake control unit 14 Engine control unit 15 Power steering control unit 21b first control microcomputer 21h monitoring circuit 21t reset generation unit 22b second control microcomputer 23 Actuator control device 24 Actuator

Claims

[1] Vehicle control device comprising: a first control instruction generating unit (21b) that generates a first control instruction for a vehicle drive device; a second control instruction generating unit (22b) that generates a second control instruction for the vehicle drive device; and a monitoring circuit (11h) including: a monitoring unit that monitors an operation of the first control instruction generation unit (21b); an abnormality notification signal generation unit (11q) that outputs an abnormality notification signal (11u) to a second control instruction generation unit (22b) when the monitoring unit detects an abnormality of the first control instruction generation unit (21b); and a reset generation unit (11t) outputting a reset signal (11r) to reset the first control instruction generation unit (21b), wherein the reset generation unit (11t) outputs the reset signal (11r) after a required transition time has elapsed since the output of the anomaly notification signal (11u) from the anomaly notification signal generation unit (11q) in which the second control instruction generation unit (22b) terminates a control transition operation to generate the second control instruction, wherein the vehicle control device characterized by is that an anomaly signal generation unit outputs the anomaly notification signal (11u) to the second control instruction generation unit (22b) in a first anomaly detection time (T1) after the occurrence of an anomaly in the first control instruction generation unit (21b), the reset generation unit (11t) outputs the reset signal (11r) to the first control instruction generation unit (21b) in a second anomaly detection time (T2) longer than the first anomaly detection time (T1) after the occurrence of the anomaly in the first control instruction generation unit (21b), and then, when the first anomaly detection time is (T1), the second anomaly detection time is (T2), and the required transition time is (T3), a time obtained by adding T1 and T3 is equal to or less than T2. [2] Vehicle control device comprising: a first control instruction generating unit (21b) that generates a first control instruction for a vehicle drive device; and a monitoring circuit (11h) including: a monitoring unit that monitors an operation of the first control instruction generation unit (21b); an abnormality notification signal generation unit (11q) that outputs an abnormality notification signal (11u) to a second control instruction generation unit (22b) when the monitoring unit detects an abnormality of the first control instruction generation unit (21b); and a reset generation unit (11t) outputting a reset signal (11r) to reset the first control instruction generation unit (21b), wherein the reset generation unit (11t) outputs the reset signal (11r) after a required transition time has elapsed since the output of the anomaly notification signal (11u) from the anomaly notification signal generation unit (11q) in which the second control instruction generation unit (22b) terminates a control transition operation to generate the second control instruction, wherein the vehicle control device characterized by is that an anomaly signal generation unit outputs the anomaly notification signal (11u) to the second control instruction generation unit (22b) in a first anomaly detection time (T1) after the occurrence of an anomaly in the first control instruction generation unit (21b), the reset generation unit (11t) outputs the reset signal (11r) to the first control instruction generation unit (21b) in a second anomaly detection time (T2) longer than the first anomaly detection time (T1) after the occurrence of the anomaly in the first control instruction generation unit (21b), and then, when the first anomaly detection time is (T1), the second anomaly detection time is (T2), and the required transition time is (T3), a time obtained by adding T1 and T3 is equal to or less than T2. [3] The vehicle control device according to claim 1, wherein a determination criterion 1 set based on an abnormality detection number and a determination criterion 2 being an abnormality detection number greater than the determination criterion 1 are set, the first abnormality detection time (T1) corresponds to the determination criterion 1, the second abnormality detection time (T2) corresponds to the determination criterion 2, and a time difference is provided between the first abnormality detection time (T1) and the second abnormality detection time (T2). [4] The vehicle control device according to claim 1, wherein the monitoring unit includes: a first monitoring unit (11i) that detects that an abnormality has occurred in the first control instruction generation unit (21b) in the first abnormality detection time (T1) after the occurrence of an abnormality in the first control instruction generation unit (21b), and a second monitoring unit (11j) that detects that an abnormality has occurred in the first control instruction generation unit (21b) in the second abnormality detection time (T2) after the occurrence of an abnormality in the first control instruction generation unit (21b). [5] A vehicle control device according to claim 4, wherein the abnormality detected by the first monitoring unit (11i) is a more serious reset factor than the abnormality detected by the second monitoring unit (11j). [6] Vehicle control device according to one of claims 1 to 5, wherein the second control instruction generation unit (22b) further includes a control transition operation end detection unit that detects that the control transition operation has ended and outputs a transition preparation completion signal to reset the generation unit, and the reset generation unit (11t) outputs the reset signal (11r) when the second monitoring unit (11j) detects that an abnormality has occurred in the first control instruction generation unit (21b) and the transition preparation completion signal is output from the control transition operation end detection unit. [7] The vehicle control device according to any one of claims 1 to 6, wherein the control transition operation of the second control instruction generation unit (22b) is an operation for transmitting control data of the first control instruction generation unit (21b) to the second control instruction generation unit (22b). [8] Electronic control system comprising: an actuator control device (23) which controls an actuator of a moving body; a first control instruction generating unit (21b) that outputs a first control instruction to the actuator control device (23); a second control instruction generating unit (22b) which outputs a second control instruction to the actuator control device (23); a monitoring circuit (11h) that monitors an abnormality of the first control instruction generation unit (21b) and outputs an abnormality notification signal (11u) to the second control instruction generation unit (22b) when the abnormality of the first control instruction generation unit (21b) is detected; and a reset generation unit that resets the first control instruction generation unit (21b), wherein the reset generation unit outputs the reset signal (11r) after a required transition time has elapsed since the output of the abnormality notification signal (11u) from the monitoring circuit (11h) in which the second control instruction generation unit (22b) ends a control transition operation for generating the second control instruction, wherein the electronic control system characterized by is that an anomaly signal generation unit outputs the anomaly notification signal (11u) to the second control instruction generation unit (22b) in a first anomaly detection time (T1) after the occurrence of an anomaly in the first control instruction generation unit (21b), the reset generation unit outputs the reset signal (11r) to the first control instruction generation unit (21b) in a second anomaly detection time (T2) longer than the first anomaly detection time (T1) after the occurrence of the anomaly in the first control instruction generation unit (21b), and then, when the first anomaly detection time is (T1), the second anomaly detection time is (T2), and the required transition time is (T3), a time obtained by adding T1 and T3 is equal to or less than T2. [9] An electronic control system according to claim 8, wherein the first control instruction generating unit (21b) and the second control instruction generating unit (22b) are arranged in an electronic control unit. [10] An electronic control system according to claim 8, wherein the first control instruction generating unit (21b) and the second control instruction generating unit (22b) are arranged in separate electronic control units, respectively.

Images