Vehicle control device and electronic control system

Abstract

Vehicle control device (11) comprising: a control command generation unit (11b) that generates a control command for a drive device (24) of the vehicle; an outside world detection unit (20b) that detects external information from the vehicle; and a monitoring circuit (11h) comprising a monitoring unit to monitor the operation of the control command generation unit (11b) and a reset generation unit (11t) to reset the control command generation unit (11b) when the monitoring unit detects an anomaly of the control command generation unit (11b), the monitoring unit includes a first monitoring unit (11i) that detects an anomaly in the control command generation unit (11b) at a first anomaly detection time (T1) after an anomaly has occurred in the control command generation unit (11b), and a second monitoring unit (11j) that detects an anomaly in the control command generation unit (11b) at a second anomaly detection time (T2) that is longer than the first anomaly detection time (T1) after an anomaly has occurred in the control command generation unit (11b), and wherein the monitoring circuit (11h) determines whether the control command generation unit (11b) is reset by the reset generation unit (11t) according to the anomaly detection of the first monitoring unit (11i), or the control command generation unit (11b) is reset by the reset generation unit (11t) according to an anomaly detection of the second monitoring unit (11j), based on the vehicle's outside world information detected by the outside world detection unit (20b).

Description

Technical field

[0001] The present invention relates to a vehicle control device and an electronic control system of an automatic driving system. State of the art

[0002] To implement an advanced automated driving system, an ECU (electronic control unit), which is a higher-level control device that manages the automated driving, must continue operation for a certain period of time until driving operation is handed over to the driver, even if a failure has occurred in an arithmetic processing device (microcomputer) that performs calculations for the automated driving control.

[0003] PTL 1 discloses a vehicle control device in which, when the operation of a microcomputer of a main control device is in a normal state and the microcomputer's power supply voltage is outside a suitable range, the control function of several sub-control devices is partially restricted. Furthermore, PTL 2 describes a vehicle control device for autonomous systems with redundant control command generation units. A second unit monitors the first unit by comparing commands. Upon detection of an anomaly in the first unit, a switching unit seamlessly switches to the control commands of the second unit to ensure the safe continuation of vehicle operation. PTL 3 describes a driver assistance system that controls the accelerator pedal's response force based on a risk potential.If a fault is detected in the reaction force generation device, a failsafe control adjusts the engine torque characteristics to prevent a torque increase despite pedal operation and to suppress changes in vehicle behavior. List of prior art patent literature PTL 1: JP 2015 - 093498 A PTL 2: DE 11 2017 005 762 B4 PTL 3: US 2010 / 179 719 A1 Summary of the invention: Technical problem

[0004] An automatic driving system includes, for example, a vehicle control device that issues a control command, and several actuator control devices, each of which performs engine control, brake control, power steering control, and the like based on a control command from the vehicle control device.

[0005] In this automated driving system, from a functional safety perspective, the operation of the microcomputer is monitored by a diagnostic circuit, such as a guard timer, which detects program interruptions in the microcomputer. Failure management is performed by detecting an anomaly in the microcomputer. However, if processing such as a uniform stop (reset) of the microcomputer is carried out in response to the anomaly, the function of the automated driving system will be stopped.

[0006] However, if the automatic driving system suddenly stops functioning, the vehicle occupant must take over driving the vehicle; however, there is time until the vehicle occupant takes over driving, so control interpolation by the vehicle system is necessary, and technology for this case is required.

[0007] As a means of solving the aforementioned problem, PTL 1 describes the control procedure for a case where the microcomputer's power supply voltage is outside a suitable range, while the microcomputer's operation is normal. However, it is necessary to consider the anomalous operation of the microcomputer itself due to factors such as microcomputer overload, and it is difficult to avoid resetting the microcomputer.

[0008] If the ECU's microcomputer, which allocates multiple drive power sources, malfunctions, it also notifies the ECU, which then appropriately controls the drive source and performs idle, emergency stop, etc. Therefore, it is possible to prevent the occurrence of a drive power anomaly.

[0009] Even if the ECU controlling the external drive power source is notified of the microcomputer anomaly, if the microcomputer is anomalous, there is a concern that the control may not be appropriately shifted due to the fact that the amount of the control scale depends on the external situation of the carrier vehicle.

[0010] In a case where an anomaly is detected in the operation of the control microcomputer that controls the operation of the automatic driving system, a procedure for shifting the control from the control microcomputer to a degeneration control microcomputer can then be considered.

[0011] However, it is difficult to avoid a control transition period, i.e., an empty section of the control, so that the degeneration control microcomputer switches the control after receiving the anomaly notification, and this involves a control transition risk.

[0012] Furthermore, there is a problem that the risk of tax transfer differs depending on the relationship to objects around the carrier vehicle.

[0013] The invention was carried out in view of the problems described above, and one object of it is to realize a vehicle control device and an electronic control system in which, even in a case where an operational anomaly occurs in the arithmetic processing unit in the control device, the control can be safely transferred to the degeneration control microcomputer, and safety can be improved. Solution to the problem

[0014] The above problem is solved by the attached claims, wherein dependent claims describe preferred embodiments.

[0015] A vehicle control device described herein comprises a control command generation unit that generates a control command for a propulsion device of the vehicle, an outside world detection unit that detects external information of the vehicle, and a monitoring circuit that includes a monitoring unit to monitor the operation of the control command generation unit and a reset generation unit to reset the control command generation unit when the monitoring unit detects an anomaly of the control command generation unit.The monitoring unit comprises a first monitoring unit that detects an anomaly in the control command generation unit at a first anomaly detection time after an anomaly has occurred in the control command generation unit, and a second monitoring unit that detects an anomaly in the control command generation unit at a second anomaly detection time that is longer than the first anomaly detection time after an anomaly has occurred in the control command generation unit.The monitoring circuit determines whether the control command generation unit is reset by the reset generation unit according to an anomaly detection by the first monitoring unit, or whether the control command generation unit is reset by the reset generation unit according to an anomaly detection by the second monitoring unit, based on outside world information of the vehicle detected by the outside world detection unit.

[0016] Furthermore, the electronic control system described here comprises an outside-world detection unit, a first control unit that drives a propulsion device, a second control unit that receives information from the outside-world detection unit and transmits a control command to the first control unit, and a third control unit that transfers control to the first control unit to initiate degeneration operation if the second control unit detects an anomaly. If the outside-world detection unit determines an external situation with a high probability of collision with an external object, and an anomaly is detected by the second control unit, the second control unit transfers control to the third control unit and resets the second control unit.In a case where the outside world detection unit determines an external situation in which the possibility of a collision with an external object is low, and the anomaly of the second control unit is detected, the second control unit is reset and a control command operation is returned. Advantageous effects of the invention

[0017] According to the invention, even in a case where an operational anomaly occurs in the arithmetic processing unit in the control device, the control can be safely transferred to the degeneration control microcomputer, and a vehicle control device and an electronic control system capable of improving safety can be realized. Brief description of the drawings [ Fig. 1] Fig. Figure 1 is a schematic configuration diagram of an automatic driving system provided in a vehicle to which the invention is applied. [ Fig. 2] Fig. Figure 2 is a diagram that represents an internal configuration of an autonomous vehicle control unit (first ECU) in a first embodiment of the invention. [ Fig. 3] Fig. Figure 3 is a table that represents a relationship between a degeneration request signal and a reset time of a control microcomputer according to the first embodiment of the invention. [ Fig. 4] Fig. Figure 4 is a time diagram at the time of the control transition in a case where a degeneration operation is carried out, in the first embodiment of the invention. [ Fig. 5] Fig. Figure 5 is a time schedule of an operational control system in a case where the collision potential of a carrier vehicle is low, in the first embodiment of the invention. [ Fig. 6] Fig. Figure 6 is a diagram that represents an internal configuration of an autonomous vehicle control unit (first ECU) in a second embodiment of the invention. [ Fig. 7] Fig. Figure 7 is an explanatory diagram of an anomaly detection criterion and a detection time according to a third embodiment of the invention. [ Fig. 8] Fig. Figure 8 is a diagram that represents an internal configuration of an autonomous vehicle control unit (first ECU) in a fourth embodiment of the invention. [ Fig. 9] Fig. Figure 9 is a table that represents a relationship between a degeneration request signal and a reset time of a control microcomputer in the fourth embodiment of the invention. [ Fig. 10] Fig. Figure 10 is a block diagram illustrating the operating functions of an electronic control system (autonomous driving control system) in a fifth embodiment of the invention. [ Fig. 11] Fig. 11 is a schedule of operations when a failure occurs, in the fifth embodiment. [ Fig. 12] Fig. Figure 12 is an explanatory diagram of how a degeneration request signal is to be determined according to an external situation in the first to fifth embodiments of the invention. Description of embodiments

[0018] Embodiments of the invention are described below with reference to the accompanying drawings. Examples of embodiments (configuration example of an automatic driving system)

[0019] First, the configuration of an automatic driving system (vehicle control system) to which the invention is applied is described.

[0020] Fig. Figure 1 is a schematic configuration diagram of an automatic driving system provided in a vehicle to which the invention is applied. Fig. 1 The automatic driving system comprises a camera (first sensor) 1, a radar (second sensor) 2 and a carrier vehicle position sensor (third sensor) 3, which are external detection sensors for detecting the external situation of the vehicle, and an automatic driving setting unit 4 for setting the automatic operation.

[0021] Furthermore, the automatic driving system includes an autonomous driving control unit (first ECU) 11 (vehicle control device), a degeneration control unit (second ECU) 12, a brake control unit (third ECU) 13, a power engine control unit (fourth ECU) 14 and a power steering control unit (fifth ECU) 15.

[0022] Furthermore, the brake control unit 13, the engine control unit 14 and the power steering control unit 15 can be a driving device control unit or an actuator control unit that controls the operation of the vehicle.

[0023] The camera 1, the radar 2, the carrier vehicle position sensor 3, the autonomous driving control unit 11, the degeneration control unit 12, the brake control unit 13, the power engine control unit 14 and the power steering control unit 15 are connected to an in-vehicle network (for example CAN (controller area network) or Ethernet (registered trademark)).

[0024] The degeneration control unit 12 is a control device that operates to perform appropriate degeneration control as a safeguard if the autonomous driving control unit 11 fails. However, in a case where safety can be ensured by providing a degeneration control function in the control unit 11, even if the autonomous driving control unit 11 fails, the degeneration control unit 12 is unnecessary.

[0025] The brake control unit 13 is a control device that performs vehicle brake control (brake force control), and the engine control unit 14 is a control device that controls an engine which generates a driving force for the vehicle. Additionally, the power steering control unit 15 is a control device that controls the vehicle's power steering.

[0026] The carrier vehicle position sensor 3 is a device that detects the position of the carrier vehicle using radio waves from a positioning satellite such as a GPS (Global Positioning System). The carrier vehicle position sensor 3 outputs the received carrier vehicle position information to the autonomous vehicle control unit 11. Furthermore, the carrier vehicle position sensor 3 can acquire the vehicle position information using a positioning system other than GPS.

[0027] Furthermore, the carrier vehicle position sensor 3 has a memory for storing map data used during automated driving, and stores map data such as road width, number of lanes, gradient, curve curvature, intersection shape, and speed limit information. The map data can also be stored within the autonomous driving control unit 11.

[0028] The automatic driving settings unit 4 is a device that sets a destination, route, driving speed, and the like during automatic operation. The automatic driving settings unit 4 has an input device (not shown) to allow the passenger to make settings.

[0029] This input device includes, for example, a start switch for a passenger to start the automatic driving system, a physical input device such as a button or touch panel, a gesture input device using a camera or infrared beams, a voice input device, and the like. The automatic driving settings unit 4 outputs information entered by the passenger via the input device to an automatic driving control unit 11.

[0030] When the autonomous driving control unit 11 receives the request for automatic driving from the automatic driving setting unit 4, the autonomous driving control unit 11 calculates a trajectory along which the vehicle moves, based on external information such as the camera 1, the radar 2, and the carrier vehicle position sensor 3. The autonomous driving control unit 11 issues a control command, such as a braking force and a driving force, to the brake control unit 13, the power unit 14, and the power steering control unit 15 to move the vehicle along the route described above.

[0031] The brake control unit 13, the engine control unit 14 and the power steering control unit 15 output an operating signal to each control target (actuator (drive device)) in response to a control command for automatic driving control from the autonomous driving control unit 11. (First embodiment)

[0032] A first embodiment of the invention is described below.

[0033] Fig. Figure 2 is a diagram that represents an internal configuration of the autonomous driving control unit (first ECU) 11 according to the first embodiment.

[0034] In Fig. 2. An outside world detection microcomputer (outside world detection unit) 10b in the autonomous driving control unit 11 recognizes the outside world information of the vehicle based on information from an external sensor such as the first sensor, the second sensor or the third sensor and determines that the collision potential of the carrier vehicle is high in a case in which the control microcomputer 11b is reset based on the recognized outside world information of the vehicle.

[0035] In this situation, an example is described below in which, if a monitoring circuit 11h detects an anomalous operation of the control microcomputer 11b, the control microcomputer 11b is reset after control is transferred to the degeneration control microcomputer (degeneration control unit) 12b.

[0036] Here, the control microcomputer 11b is defined as a control command generation unit that generates a control command for a control unit of an external actuator (drive device).

[0037] The autonomous driving control unit 11, which is a driving control device for automatic driving, has two microcomputers: the outside world detection microcomputer 10b and the control microcomputer 11b. The outside world detection microcomputer 10b includes a communication circuit 10c (communication circuit 0) and a communication circuit 10d (communication circuit 1). The control microcomputer 11b also includes a communication circuit 11c (communication circuit 2).

[0038] Furthermore, the degeneration control unit 12, which operates in place of the autonomous driving control unit 11 when the autonomous driving control unit 11 fails, comprises the degeneration control microcomputer 12b and a communication circuit 12c (communication circuit 3). The degeneration control microcomputer 12b generates a degenerate control command from the control command generated by the control microcomputer 11b.

[0039] In Fig. 2 The autonomous driving control unit 11 comprises the outside world detection microcomputer 10b and the control microcomputer 11b, and the degeneration control unit 12 comprises the degeneration control microcomputer 12b. Alternatively, the outside world detection microcomputer 10b, the control microcomputer 11b, and the degeneration control microcomputer 12b can be arranged in the autonomous driving control unit 11.

[0040] Furthermore, the control microcomputer 11b and the degeneration control microcomputer 12b can be provided in the autonomous driving control unit 11, and the outside world recognition microcomputer 10b can be arranged in a different control unit than the autonomous driving control unit 11.

[0041] The external world detection microcomputer 10b receives sensor information (external world detection information) from the camera 1 (first sensor), the radar 2 (second sensor), and the carrier vehicle position sensor 3 (third sensor), which are external sensors, via the communication circuit 10c. Based on the transmitted sensor information, the external world detection microcomputer 10b recognizes the external environment and generates trajectory information along which the carrier vehicle is moving.

[0042] For this reason, the outside world detection microcomputer 10b can be defined as a orbit information generation unit.

[0043] The outside world detection microcomputer 10b transmits the generated path information to the control microcomputer 11b via the path information communication line 10k. The control microcomputer 11b receives information externally from an external detection sensor, such as a wheel speed sensor, an accelerometer, and a yaw rate sensor (not shown), via the communication circuit 11c (communication circuit 2) (this information is also included in the outside world detection information) from an external ECU (control unit). Based on this information and the path information calculated by the outside world detection microcomputer 10b, an actuator control command is generated and transmitted to the brake control unit 13 (third ECU), the power unit 14 (fourth ECU), and the power steering control unit 15 (fifth ECU).

[0044] The monitoring circuit 11h for monitoring the control microcomputer 11b is connected to the control microcomputer 11b and the monitoring circuit 11h includes a first monitoring unit that detects an anomaly of the control microcomputer 11b at an anomaly detection time T1 (first anomaly detection time), and a second monitoring unit that detects an anomaly of the control microcomputer 11b at an anomaly detection time T2 (second anomaly detection time) that is longer than the detection time of the anomaly detection time T1.

[0045] The first and second monitoring units are configured such that their anomaly detection criteria differ. The anomaly detection criteria of the first monitoring unit are for minor anomalies, while the anomaly detection criteria of the second monitoring unit are for major anomalies, compared to the anomaly detection criteria of the first monitoring unit.

[0046] The first monitoring unit is a watchdog timer 11i (WDT unit), which determines the normality of the program operation of the control microcomputer 11b. A periodic high / low pulse signal with a fixed period is output from the pulse output unit 11d of the control microcomputer 11b via a communication line 11f, and the watchdog timer 11i (WDT unit) determines the normality of the pulse output unit 11d.

[0047] The second monitoring unit is an arithmetic logic comparison unit 11j, which determines the normality of an arithmetic unit 11e of the control microcomputer 11b. Through bidirectional communication via a communication line 11g between the monitoring circuit 11h and the control microcomputer 11b, the arithmetic logic comparison unit 11j periodically transmits a query signal (for example, a specific random numerical value and an arithmetic expression using the numerical value) to the arithmetic unit 11e of the control microcomputer 11b.

[0048] Then, a response signal from the arithmetic unit 11e, corresponding to the query signal, is compared with an expected value calculated in advance by the arithmetic logic comparison unit 11j, and the normality of the control microcomputer 11b is determined.

[0049] The second monitoring unit is an arithmetic logic comparison. It increments an anomaly counter in cases where the comparison does not match and can adjust the anomaly detection time by defining the criteria for ultimately determining an anomaly. In this way, the anomaly detection time T2, which is longer than the anomaly detection time T1, is predetermined.

[0050] The first monitoring unit and the second monitoring unit are collectively referred to as the monitoring unit.

[0051] Furthermore, the monitoring circuit 11h, which monitors the control microcomputer 11b, is a logic circuit and can be built into the outside world detection microcomputer 10b.

[0052] On the other hand, the outside world recognition microcomputer 10b is a microcomputer that recognizes the situation of the outside world based on the transmitted sensor information, generates the trajectory information of the carrier vehicle, and periodically calculates the collision potential with surrounding objects.

[0053] The outside world detection microcomputer 10b outputs a degeneration request signal 10f, which shifts the automatic driving control from the control microcomputer 11b to the degeneration control microcomputer 12b, to the monitoring circuit 11h in a case where an anomaly occurs in the control microcomputer 11b, and the control microcomputer 11b is reset.

[0054] The degeneration request signal 10f, which is output from the degeneration request signal generation unit 10e of the outside world detection microcomputer 10b, is designed to be a low output in a case where the collision potential of the carrier vehicle is low, and to switch the output to high when the collision potential is high.

[0055] In a reset time switching unit 11s of the monitoring circuit 11h, the anomaly detection signal of the control microcomputer 11b is input by both the WDT unit 11i as the first monitoring unit and the arithmetic logic comparison unit 11j as the second monitoring unit. Then, based on the degeneration request signal 10f, the reset time switching unit 11s determines which of the WDT unit 11i and the arithmetic logic comparison unit 11j resets the control microcomputer 11b.

[0056] In other words, whether a reset should be performed at anomaly detection time T1 or at anomaly detection time T2 is determined by the degeneration request signal 10f. The anomaly notification signal generation unit 11q provides an anomaly notification signal 11u to the outside world detection microcomputer 10b according to the signal supplied by the reset time switching unit 11s.

[0057] Fig. Figure 3 is a table that represents the degeneration request signal 10f, the anomaly notification signal 11u and the reset time of the control microcomputer 11b in the first embodiment of the invention.

[0058] In Fig. 3. In a case where the degeneration request signal 10f is low, the anomaly detection signal 11u is not output, even if an anomaly is detected by the control microcomputer 11b, and the control microcomputer 11b is reset at anomaly detection time T1. Conversely, in a case where the degeneration request signal 10f is high when an anomaly is detected by the control microcomputer 11b, the anomaly notification signal 11u is output and the control microcomputer 11b is reset at anomaly detection time T2.

[0059] Fig. Figure 4 is a time diagram at the time of the control transition in a case where the degeneration operation is carried out, in the first embodiment of the invention.

[0060] In Fig. At time (t0), the control microcomputer 11b issues a control command to an external actuator control unit, and the degeneration control microcomputer 12b is in a standby state. The degeneration request signal is a low output at time (t0), but becomes high at time (t1) due to an increase in the collision potential.

[0061] In the event of a failure in the control microcomputer 11b at the subsequent time (t2), the anomaly notification signal (11u) becomes high at time (t3) after the anomaly detection time T1 has elapsed since the failure occurred (anomaly detection 1 by the WDT unit 11i). The control microcomputer anomaly (control command generation unit anomaly) is reported to the degeneration control microcomputer 12b by the outside world detection microcomputer 10b, the communication circuit 10d, and the communication circuit 12c. The transition of control to the degeneration control microcomputer 12b then begins.

[0062] The transition preparation of the degeneration control microcomputer 12b is completed at time (t4) when the control transition period T3 has expired, and the control microcomputer 11b is reset at time (t5) when the anomaly detection time T2 has expired since the failure occurred (anomaly detection 2 by the arithmetic logic comparison unit 11j).

[0063] In a case where the failure occurring at time (t2) (anomaly of pulse output unit 11d) is temporary, even if the first monitoring unit determines that an anomaly exists, the second monitoring unit performs a lower-level anomaly determination (whether the arithmetic unit 11e is anomalous). Consequently, there are scenarios in which an anomaly determination is not performed. In such a case, the control microcomputer 11b is not reset at time (t5), and the control continues.

[0064] Even if, for example, it is determined that an anomaly has occurred in the pulse output unit 11d due to noise, it can be determined that no anomaly has occurred in the arithmetic unit 11e. In this case, the control microcomputer 11b is not reset by a reset signal 11r from a reset generation unit 11t, and control by the control microcomputer 11b continues.

[0065] Due to noise, the pulse output unit 11d determines that an anomaly exists, so the degeneration control microcomputer 12b performs the degeneration control by the control transition operation, and the degeneration control operation and the control by the control microcomputer 11b are carried out in parallel.

[0066] In this case, the brake control unit 3, the engine control unit 14, and the power steering control unit 15 are preset to give priority to a control command from the control microcomputer 11b. Consequently, control is continued by the control microcomputer 11b.

[0067] As described above, according to the first embodiment of the invention, even in a case where an anomaly is detected in the control microcomputer 11b in a scene with high collision potential, control can be safely transferred to the degeneration control microcomputer 12b without an empty control period. Furthermore, in the event of a temporary failure, such as the generation of noise, control is not transferred to the main degeneration control, and control by the control microcomputer 11b can continue, thus ensuring safety.

[0068] In particular, by setting the anomaly detection time T2 in a relationship of T2 ≥ T1 + T3 using the anomaly detection time T1 and the control transition period T3 of the degeneration control microcomputer 12b, an empty control period can be eliminated by resetting the control operation by the control microcomputer 11b after the degeneration control operation starts, and the reliability of the control circuit can be improved.

[0069] Next, an operation in a case where the collision potential of the carrier vehicle is low is described in the first embodiment.

[0070] Fig. 5 is a time schedule for operational control in a case where the collision potential of the carrier vehicle is low.

[0071] Fig. 5 represents an operational control when the monitoring circuit 11h detects anomalous operation of the control microcomputer 11b in a situation where the outside world detection microcomputer 10b in the autonomous driving control unit 11 determines that the collision potential of the carrier vehicle is low. In this example, the control microcomputer 11b is reset without transferring control to the degeneration control microcomputer 12b.

[0072] In Fig. At time (t0), the control microcomputer 11b issues a control command to an external actuator control unit, and the degeneration control microcomputer 12b is in a standby state. If a failure occurs in the control microcomputer 11b at time (t2) in a scene where the collision potential is low and the degeneration request signal 11u is a low output, the control microcomputer 11b is reset at time (t3) after the anomaly detection time T1 has elapsed since the failure occurred. In this case, the degeneration request signal 11u is a low output, control does not transfer to the degeneration control microcomputer 12b, and the control microcomputer 11b returns control from the reset state at time (t6) after a certain time has elapsed since time (t5).

[0073] In other words, the monitoring circuit 11h determines whether the control microcomputer 11b should be reset, according to whether the degeneration request signal 10f is high or low, based on the determination result of the first monitoring unit or the determination result of the second monitoring unit.

[0074] As described above, in a case where an anomaly is detected in the control microcomputer 11b in a scene where the collision potential is low, the control microcomputer 11b is reset early so that, after the time expires, control can be restored before the external situation of the carrier vehicle changes and the risk increases (the control command generation operation of the control microcomputer 11b (control command generation unit) can be restored).

[0075] Therefore, even in a case where an operational anomaly occurs in the arithmetic processing unit of the control device, the control can be safely transferred to the degeneration control microcomputer and a vehicle control device capable of improving safety can be realized. (Second embodiment)

[0076] Next, a second embodiment of the invention will be described.

[0077] Fig. Figure 6 is a diagram showing an internal configuration of the autonomous driving control unit (first ECU) 11 according to the second embodiment. Fig. Figure 6 presents an example in a case where the degeneration control microcomputer 12b is arranged in the autonomous driving control unit 11 in addition to the outside world recognition microcomputer 10b and control microcomputer 11b.

[0078] The degeneration control microcomputer 12b and the communication circuit 12c (the communication circuit 3) are arranged in the autonomous driving control unit 11. The second embodiment has essentially the same configuration as the first embodiment, except that the anomaly notification signal 11u is connected to the outside world detection microcomputer 10b and the degeneration control microcomputer 12b within the autonomous driving control unit 11.

[0079] Even in the second embodiment, the same effect as in the first embodiment can be obtained, and since the signal line of the anomaly detection signal 11u is easily connected to the degeneration control microcomputer 12b, the latency at the time of the anomaly occurrence is improved. (Third embodiment)

[0080] Next, a third embodiment of the invention will be described.

[0081] The third embodiment has essentially the same internal configuration of the autonomous driving control unit (first ECU) 11 as the first or second embodiment, but the anomaly detection time T1 and the anomaly detection time T2 can be changed by the monitoring circuit 11h.

[0082] Fig. Figure 7 is an explanatory diagram for defining an anomaly detection criterion (determination reference) and the detection times T1 and T2 in the third embodiment.

[0083] In Fig. 7 represents the horizontal axis as the elapsed time since the failure of the control microcomputer 11b and the vertical axis as the anomaly counter.

[0084] In the Fig. In the example shown, a straight line L, along which the anomaly counter increases over time, is determined, and criteria 1 (detection reference 1) and criteria 2 (detection reference 2) are set. The time at which criteria 1 and the straight line L intersect is called the anomaly detection time T1, and the time at which criteria 2 and the straight line L intersect is called the anomaly detection time T2. However, criteria 2 are larger than criteria 1.

[0085] As described above, by defining criteria 1 and criteria 2 for anomaly determination in relation to the anomaly counter value, which is incremented each time an anomaly is detected, the anomaly detection time T1 and the anomaly detection time T2 can be determined. In other words, criteria 1 and criteria 2 are set according to the number of times anomaly detection occurs, and the number of times anomaly detection occurs is greater for criteria 2 than for criteria 1. By setting the anomaly detection time T1 to match criteria 1 and setting the anomaly detection time T2 to match criteria 2, the time difference is then set such that the anomaly detection time T2 is longer than the anomaly detection time T1.

[0086] By setting the anomaly detection time T2 in a relationship of T2 ≥ T1 + T3, using the anomaly detection time T1 and the control transition period T3 of the degeneration control microcomputer 12b, an empty control period is eliminated by resetting the control microcomputer 11b. Therefore, the reliability of the control circuit can be improved.

[0087] Even in the third embodiment, the same effects as those of the first and second embodiments can be achieved. Furthermore, the anomaly detection times T1 and T2 can be set according to the vehicle used, etc. A suitable degradation operating transition control can also be implemented according to the vehicle used, etc. (Fourth embodiment)

[0088] Next, a fourth embodiment of the invention is described. The fourth embodiment is a configuration example using two monitoring circuits and a logic gate.

[0089] Fig. Figure 8 is a diagram that represents an internal configuration of the autonomous driving control unit (first ECU) 11 according to the fourth embodiment.

[0090] In Fig. Figure 8 shows a monitoring circuit 11i (first monitoring unit) for monitoring the control microcomputer 11b and a monitoring circuit 11j (second monitoring unit) connected to the control microcomputer 11b. As in the first embodiment, the monitoring circuit 11i is a watchdog timer that determines the normality of the program operation of the control microcomputer 11b, and the monitoring circuit 11j is an arithmetic logic comparison unit that determines the normality of the arithmetic unit 11e of the control microcomputer 11b. Each circuit comprises different monitoring means.

[0091] The normality determination results of the monitoring circuit 11i (first monitoring unit) and the monitoring circuit 11j (second monitoring unit) are connected to an input terminal of an AND gate 11p and an input terminal of an OR gate 11w as signal 11k and signal 11m respectively.

[0092] The gate output of the OR gate 11w responds in a case where an anomaly is detected by either of the monitoring circuits 11i and 11j, and the anomaly notification signal 11u is reported to the outside world detection microcomputer 10b.

[0093] On the other hand, an output signal 11v of the AND gate 11p responds in a case where an anomaly is detected by both monitoring circuits 11i and 11j, thus enabling more reliable anomaly detection.

[0094] Since the gate output of the OR gate 11w and the output of the AND gate 11p react at different times, it is therefore possible to generate the anomaly detection time T1 and the anomaly detection time T2 as in the first embodiment.

[0095] Similar to the first embodiment, in a case where the control microcomputer 11b is reset due to the occurrence of an anomaly in the control microcomputer 11b, the outside world detection microcomputer 10b outputs the degeneration request signal 10f to a reset time switching circuit 11s to determine whether the automatic driving control should be transferred from the control microcomputer 11b to the degeneration control microcomputer 12b.

[0096] Fig. Figure 9 is a table that shows the degeneration request signal 10f and the reset time of the control microcomputer 11b in the fourth embodiment.

[0097] In Fig. In a case where the degeneration request signal 10f is low, the reset time switching circuit 11s is connected to the side of the signal 11u, and if an anomaly is detected by the control microcomputer 11b, the control microcomputer 11b is reset to the anomaly detection time T1.

[0098] In a case where the degeneration request signal 10f is low, even if an anomaly is detected by the control microcomputer 11b, the outside world detection microcomputer 10b does not output an anomaly detection signal to the degeneration control unit 12, so that the control does not shift, and the control microcomputer 11b is reset and returns the control.

[0099] On the other hand, if the degeneration request signal 10f is high, the reset time switching circuit 11s is connected to the side of signal 11v, and if an anomaly is detected by the control microcomputer 11b, the control microcomputer 11b is reset at the anomaly detection time T2. If the degeneration request signal 10f is high when an anomaly is detected in the control microcomputer 11b, signal 11u is switched so that the outside world detection microcomputer 10b outputs an anomaly detection signal to the degeneration control unit 12, and the control microcomputer 11b is reset at the anomaly detection time T2.

[0100] As described above, according to the fourth embodiment, similar to the first embodiment, even in a case where an anomaly is detected in the control microcomputer 11b in a scene with a high collision potential, control can be safely transferred to the degeneration control microcomputer 12b. Furthermore, in the event of a temporary failure, control continues without being shifted, thus ensuring safety. (Fifth embodiment)

[0101] Next, a fifth embodiment of the invention will be described.

[0102] The example described above illustrates a case in which the invention is applied to a motor vehicle. However, the invention is not limited to motor vehicles and can be applied to any moving body, such as a motorcycle, a factory luggage rack, a mobile robot, and the like.

[0103] The fifth embodiment is an example of an electronic control system applicable to various moving bodies.

[0104] Fig. Figure 10 is an operating function block diagram of the electronic control system (autonomous driving control system) of the fifth embodiment.

[0105] In Fig. 10 The electronic control system comprises an outside world detection unit 20b, a first control unit 23 that controls an actuator (drive device) 24, a second control unit 21b that receives information from the outside world detection unit 20b and transmits a control command to the first control unit 23, and a third control unit 22 that performs a control to command the degeneration operation to the first control unit 23 in a case in which the second control unit 21b detects an anomaly.

[0106] In a case where the outside world detection unit 20 determines that there is an external situation in which the collision potential with an external object is high, and detects an anomaly of the second control unit 21b itself, the second control unit 21b transfers control to the third control unit 22b and resets the second control unit 21b itself.

[0107] In a case where the outside-world detection unit 20 determines an external situation in which the collision potential with the external object is low, and if an anomaly of the second control unit 21b itself is detected, the second control unit 21b also immediately resets itself and returns to control command operation. If an anomaly signal is supplied by the second control unit 21b, the third control unit 22b issues a degeneration control command to the first control unit 23.

[0108] Fig. 11 is an operating time schedule in the event of a failure, in the fifth embodiment.

[0109] In Fig. Section 11 describes an external situation in which the collision potential is high. At time (t0) no failure has occurred, the second control unit 21b issues a control command to the first control unit 23, and the third control unit 22b is in a standby state.

[0110] If a failure occurs at time (t2), an anomaly is detected at time (t3) (anomaly detection 1), and the third control unit 22b initiates the shift to degeneration control according to the anomaly signal from the second control unit 21b. Anomaly detection 1 is a detection of an anomaly in program operation, which is determined by the first monitoring unit similarly to the first to fourth embodiments.

[0111] When the transition to degeneration control of the third control unit 22b ends at time (t4), the third control unit 22b then issues a control command to the first control unit 23 at the time of degeneration. Afterwards, an anomaly is detected at time (t5) (anomaly detection 2) and the second control unit 21b resets itself.

[0112] The anomaly detection 2 is a detection of an anomaly of the arithmetic unit, which is determined by the second monitoring unit similar to the first to fourth embodiments.

[0113] Next, an external situation in which the collision potential is low will be considered with reference to Fig. 11 described. At time (t0) no failure has occurred, the second control unit 21b is issuing a control command to the first control unit 23 and the third control unit 22b is in a standby state.

[0114] If a failure occurs at time (t2), an anomaly is detected at time (t3) (anomaly detection 1) and the second control unit (21b) resets itself. Anomaly detection 1 is a detection of an anomaly in program operation, which is determined by the first monitoring unit similarly to the first to fourth embodiments.

[0115] At time (t5) an anomaly is detected (anomaly detection 2), but the second control unit 21b maintains the reset state.

[0116] The anomaly detection 2 is a detection of an anomaly of the arithmetic unit, which is determined by the second monitoring unit similar to the first to fourth embodiments.

[0117] Then the second control unit 21b returns the control signal.

[0118] The third control unit 22b maintains the readiness state in an external situation where the collision potential is low.

[0119] As described above, according to the fifth embodiment of the invention, in a case where an anomaly is detected in the second control unit 21b in a scene with a high collision potential, the control is safely transferred to the third control unit 22b without generating an empty control period; the empty control period can be eliminated and the reliability of the control circuit can be improved.

[0120] In a case where an anomaly is detected in the second control unit 21b in a scene where the collision potential is low, control can also be restored by resetting the second control unit 21b early, before the external situation of the carrier vehicle changes and the risk increases after a certain period of time.

[0121] Therefore, even in a case where an operational anomaly occurs in the arithmetic processing unit in the control device, the control can be safely transferred to the degeneration control microcomputer and an electronic control system capable of improving safety can be implemented.

[0122] In the first to fifth embodiments, the next step is to describe how the degeneration request signal is to be determined according to the external situation.

[0123] Fig. Figure 12 is a table that illustrates the relationship between the external situation and the degeneration demand signal. With reference to Fig. Section 12 describes the switching of the reset time of the control microcomputer 11b according to the external situation and the amount of outside world information.

[0124] In Fig. In a case where the external situation is that the road is straight, the distance to the surrounding object is long, and the amount of external information is small, the outside-world detection microcomputer 10b determines that the collision potential (the possibility of collision) between the carrier vehicle and the surrounding object is low. Therefore, the outside-world detection microcomputer 10b does not request degeneration (the degeneration request signal 10f is a low output) and resets the control microcomputer 11b to the anomaly detection time T1.

[0125] The outside-world detection microcomputer 10b periodically predicts and generates the trajectory along which the carrier vehicle travels. The collision potential in the generated trajectory of the carrier vehicle is then determined. In a case where the route is straight, it is taken into account that the trajectory itself remains almost unchanged even in the empty section of the control system. In a case where the control microcomputer 11b is reset during control, it is possible to estimate that the collision potential is low (determinable).

[0126] In other words, it is possible to determine the possibility of a collision according to the shape of the road on which the carrier vehicle is predicted to travel.

[0127] On the other hand, in a case where the external situation is a curve in the route, in a case where the distance to surrounding objects of the carrier vehicle is short, or in a case where the amount of information about the outside world is large, the collision potential with the carrier vehicle may be high, so that the degeneration request is carried out (the degeneration request signal is output as high). The transition preparation for degeneration control is started by notifying the degeneration control microcomputer 12b of the anomaly in the control microcomputer 11b at anomaly detection time T1, and the control microcomputer 11b is reset at anomaly detection time T2 after the transition preparation is complete.

[0128] In other words, it is possible to determine the possibility of a collision according to the amount of information about the outside world in which the carrier vehicle is traveling.

[0129] As described above, when the degeneration request signal is switched according to the external situation, in a case where an anomaly is detected in the control microcomputer 11b in a scene where the collision potential is low, the control microcomputer 11b is reset early so that control can be restored before the external situation of the carrier vehicle changes and the risk increases after the time expires.

[0130] In a case where an anomaly is detected in the control microcomputer 11b in a scene with high collision potential, the degeneration control microcomputer 12b also starts preparations for the transition early and resets the control microcomputer 11b to the anomaly detection time T2 after the transition preparation is complete. Therefore, an empty section of the control is eliminated, and a control transfer with high safety is possible.

[0131] Furthermore, it is the case with every in Fig. The determination criterion 12 shown also makes it possible to determine the possibility of a collision with the carrier vehicle on the basis of only the shape of the road, only the distance to the surrounding object, or only the amount of information about the outside world. Reference symbol list 1 camera 2 Radar 3 Carrier vehicle position sensor 4 Automatic driving mode setting unit 11 Autonomous driving control unit 12 Degeneration control unit 13 Brake control unit 14 Power engine control unit 15 Power steering control unit 10b Outside world perception microcomputer 10c, 10d, 11c, 12c communication circuit 10f Degeneration request signal 10k railway information transmission line 11b Control microcomputer 12b Degeneration control microcomputer 11h monitoring circuit 11i WDT unit 11j arithmetic logic comparison unit 11p AND gate 11q Anomaly Notification Signal Generation Unit 11r Reset signal 11s reset time switch circuit 11t Reset generation unit 11u Anomaly Notification Signal 11w OR gate 20b Outside world detection unit 21b second control unit 22b third control unit 23 first control unit 24 actuator

Claims

[1] Vehicle control device (11) comprising: a control command generation unit (11b) that generates a control command for a drive device (24) of the vehicle; an outside world detection unit (20b) that detects external information from the vehicle; and a monitoring circuit (11h) comprising a monitoring unit to monitor the operation of the control command generation unit (11b) and a reset generation unit (11t) to reset the control command generation unit (11b) when the monitoring unit detects an anomaly of the control command generation unit (11b), the monitoring unit includes a first monitoring unit (11i) that detects an anomaly in the control command generation unit (11b) at a first anomaly detection time (T1) after an anomaly has occurred in the control command generation unit (11b), and a second monitoring unit (11j) that detects an anomaly in the control command generation unit (11b) at a second anomaly detection time (T2) that is longer than the first anomaly detection time (T1) after an anomaly has occurred in the control command generation unit (11b), and wherein the monitoring circuit (11h) determines whether the control command generation unit (11b) is reset by the reset generation unit (11t) according to the anomaly detection of the first monitoring unit (11i), or the control command generation unit (11b) is reset by the reset generation unit (11t) according to an anomaly detection of the second monitoring unit (11j), based on the vehicle's outside world information detected by the outside world detection unit (20b). [2] Vehicle control device (11) according to claim 1, wherein the drive device (24) for the vehicle further comprises a degeneration control unit (12) which generates a control command which is degenerated from the control command generated by the control command generation unit (11b), wherein the second anomaly detection time (T2) is set to be equal to or greater than the time when a control transition of the degeneration control unit (12) ends after an anomaly has occurred in the control command generation unit (11b), and wherein in a case where it is determined that the degeneration control unit (12) must generate the degeneration control command, on the basis of the vehicle's outside world information detected by the outside world detection unit (20b), the monitoring circuit (11h) resets the control command generation unit (11b) by means of the reset generation unit (11t) according to an anomaly detection by the second monitoring unit (11j). [3] Vehicle control device (11) according to claim 2, wherein the degeneration control unit (12) comprises a monitoring circuit (11h). [4] Vehicle control device (11) according to claim 2 or 3, wherein the outside world detection unit (20b) determines whether the possibility of the vehicle colliding with an object around the vehicle is high or low, and in a case where the possibility of collision is low, the monitoring circuit (11h) resets the control command generation unit (11b) by means of the reset generation unit (11t) on the basis of an anomaly detection result of the first monitoring unit (11i) and a control command generation operation of the control command generation unit (11b) is restored after the reset. [5] Vehicle control device (11) according to claim 2 or 3, wherein the outside world detection unit (20b) determines whether the vehicle has a high or low probability of collision with an object around the vehicle, and in a case where it is determined that a probability of collision is high, the monitoring circuit (11h) notifies the degeneration control unit (12) of the control command generation unit anomaly based on an anomaly detection result of the first monitoring unit (11i), and resets the control command generation unit (11b) by means of a reset generation unit (11t) based on an anomaly detection result of the second monitoring unit (11j). [6] Vehicle control device (11) according to one of claims 1 to 5, wherein the determination reference 1, which is determined by the number of times the anomaly is detected, and the determination reference 2, whose number of times the anomaly is detected is greater than the determination reference 1, are determined, and the first anomaly detection time (T1) is created to correspond to the determination reference 1, and the second anomaly detection time (T2) is created to correspond to the determination reference 2, and a time difference between the first anomaly detection time (T1) and the second anomaly detection time (T2) is provided. [7] Vehicle control device (11) according to one of claims 1 to 5, wherein the first monitoring unit (11i) and the second monitoring unit (11j) are different from each other in a determination reference of an anomaly detection. [8] Vehicle control device (11) according to claim 7, wherein the determining reference for the anomaly detection in the second monitoring unit (11j) for a serious anomaly is compared to the determining reference for the anomaly detection in the first monitoring unit (11i). [9] Vehicle control device (11) according to claim 5, wherein the outside world detection unit (20b) predicts and generates a driving trajectory of the vehicle and determines a possibility of a collision on the generated driving trajectory of the vehicle. [10] Vehicle control device (11) according to claim 5, wherein the outside world detection unit (20b) determines a possibility of a collision according to a distance from the vehicle to a surrounding object. [11] Vehicle control device (11) according to claim 5, wherein the outside world detection unit (20b) determines a possibility of a collision according to a shape of a road on which the vehicle is traveling. [12] Vehicle control device (11) according to claim 5, wherein the outside world detection unit (20b) determines a possibility of collision according to the amount of outside world information of the vehicle. [13] Electronic control system, which includes: an outside world detection unit (20b); a first control unit (23) that controls a drive device (24); a second control unit (21b) that receives information from the outside world detection unit (20b) and transmits a control command to the first control unit (23); and a third control unit (22b) which shifts the control to the first control unit (23) in order to command a degeneration operation in a case in which the second control unit (21b) detects an anomaly, wherein in a case where the outside world detection unit (20b) determines an external situation with a high probability of collision with an external object, and an anomaly of the second control unit (21b) is detected, the second control unit (21b) transfers control to the third control unit (22b) and resets the second control unit (21b), and wherein in a case where the outside world detection unit (20b) determines an external situation in which the possibility of a collision with an external object is low, and the anomaly of the second control unit (21b) is detected, the second control unit (21b) is reset and a control command operation is returned.

Images