Control device

Abstract

To provide a control device that can improve safety of a vehicle and also reduce development man-hours.SOLUTION: The control device comprises a main-ECU 10 that calculates a drive command for the entire of a vehicle and a plurality of MG-ECUs 30 that control motors on the basis of the drive command from the main-ECU 10. Software that meets function safety standards which are relatively low-level in function safety standards is stored in the main-ECU 10 and the plurality of MG-ECU 30, respectively.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a control device. [Background technology]

[0002] Patent Document 1 discloses a technology for a vehicle system that includes a plurality of devices that realize functions for which predetermined safety standards are set for each device, and a control unit that can execute processing related to the safety standards for the plurality of devices and includes a plurality of ECUs (Electronic Control Units) assigned to each level of the safety standards. In this technology, the plurality of ECUs are connected to devices for which safety standards of assigned levels are set, but are not connected to devices for which safety standards of different levels are set, and safety is ensured by executing processing related to the safety standards according to the level assigned to the connected devices. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2023-22863 Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, with the recent development of automated driving systems for automobiles, there is a demand to meet the highest level of automobile safety standard, ASIL (Automotive Safety Integrity Level)-D, defined by ISO26262.

[0005] However, in the above-mentioned Patent Document 1, if ASIL-D compliance is required for the development of just one ECU, the labor and cost involved in the development will be extremely high, resulting in disadvantages in terms of overall man-hours and costs. In addition, if an abnormality occurs in that ECU, there is a risk that the vehicle or aircraft will be put at risk, so there is room for improvement.

[0006] The present disclosure has been made in view of the above, and aims to provide a control device that can improve vehicle safety and reduce development man-hours. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems and achieve the objectives, the control device according to the present disclosure is a control device for controlling a vehicle, and includes a main ECU that calculates a drive command value for the entire vehicle, and a plurality of sub-ECUs that control motors based on the drive command value from the main ECU, and the main ECU and the plurality of sub-ECUs each store software that satisfies a relatively low level of functional safety standards. [Effects of the Invention]

[0008] According to the present disclosure, it is possible to improve the safety of a vehicle and reduce the number of development steps. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram showing the configuration of a vehicle according to one embodiment. [Figure 2] FIG. 2 is a flowchart showing an outline of a process executed by a vehicle according to an embodiment. [Figure 3] FIG. 3 is a schematic diagram showing the configuration of a vehicle according to a first modified example of the embodiment. [Figure 4] FIG. 4 is a schematic diagram showing the configuration of a vehicle according to a second modification of the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] A vehicle equipped with a control device according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the components in the following embodiments include those that are easily replaceable by those skilled in the art, or those that are substantially identical. Furthermore, the drawings referred to in the following description merely show a schematic representation of the shape, size, and positional relationship to the extent that the contents of the present disclosure can be understood. In other words, the present disclosure is not limited to the shape, size, and positional relationship exemplified in each drawing.

[0011] [Vehicle configuration] Fig. 1 is a schematic diagram showing the configuration of a vehicle according to one embodiment. Vehicle 1 shown in Fig. 1 is assumed to be a BEV (Battery Electric Vehicle), HEV (Hybrid Electric Vehicle), FCEV (Fuel Cell Electric Vehicle), PHEV (Plug-in Hybrid Electric Vehicle), or the like.

[0012] The vehicle 1 includes a main-ECU 10 that controls at least one of the drive amount and speed of the vehicle 1, a plurality of MG-ECUs 30 that control at least one of the drive force and speed of at least one of the front wheels 20 and the rear wheels 21, and a plurality of inverters 40 and a plurality of motors 50 that control at least the drive amount and speed of at least one of the front wheels 20 and the rear wheels 21. Note that, hereinafter, when referring to any one of the plurality of MG-ECUs 30, it will be simply referred to as each MG-ECU 30.

[0013] The main-ECU 10 is implemented using a processor having hardware such as an FPGA (Field-Programmable Gate Array) or a CPU (Central Processing Unit), and a memory serving as a temporary storage area used by the processor, storing software (programs) capable of processing applications (hereinafter simply referred to as "apps") and ASIL-B safety standard-compliant processes. The main-ECU 10 controls each MG-ECU 30, the inverter 40, and the motor 50 in accordance with the program capable of processing ASIL-B safety standard-compliant processes. The main-ECU 10 calculates a drive command value for the entire vehicle 1 and torque from the motor 50 based on information from various sensors (not shown), such as a speed sensor, accelerator position sensor, and brake position sensor, and outputs the calculation results to each MG-ECU 30. Here, software capable of processing ASIL-B safety standard-compliant processes is software that satisfies a relatively low level of functional safety standards defined by the ISO 26262 standard. Details of ASIL will be described later. In one embodiment, the main-ECU 10 functions as the main ECU.

[0014] Each MG-ECU 30 is realized using a processor having hardware such as an FPGA or a CPU, and a memory serving as a temporary storage area used by the processor, storing software (programs) and the like capable of performing processing related to the ASIL-B safety standard. Each MG-ECU 30 drives the motor 50 by controlling the power of the inverter 40 in accordance with a torque command value and a speed command value based on a drive command value from the main-ECU 10, in accordance with the program capable of performing processing related to the ASIL-B safety standard. Each MG-ECU 30 is provided within the inverter 40. In one embodiment, each MG-ECU 30 functions as a sub-ECU.

[0015] Under the control of the MG-ECU 30 , the inverter 40 controls the drive torque of the motor 50 based on the target drive torque input from the MG-ECU 30 .

[0016] The motor 50 is configured using a three-phase AC motor, etc. The output shaft of the motor 50 drives the rear wheels 21 (drive wheels) of the vehicle 1 via a gear mechanism, a propeller shaft, a differential gear, etc. (not shown).

[0017] The vehicle 1 configured as described above has a powertrain control system for a power tray including an inverter 40 and a motor 50, which is composed of multiple ECUs, including a main-ECU 10 and multiple MG-ECUs 30. These multiple ECUs are designed to meet the ASIL (Automated Safety Integrity Level) of a hazardous event. Here, ASIL refers to the safety standard for the vehicle 1 defined by the ISO 26262 standard and includes four levels, ASIL-A to ASIL-D, depending on the level of the safety standard. The ASIL level increases from ASIL-A to ASIL-D. That is, ASIL-D is the highest level of safety standard, and ASIL-A is the lowest level of safety standard. Therefore, if ASIL-D compliance is required for only one ECU, the development costs and man-hours required to meet ASIL-D would also be high. Therefore, in the vehicle 1, if the ASIL of a hazardous event caused by a failure of one ECU in one of the multiple ECUs is low, the safety restriction functions are shared and distributed among the remaining healthy ECUs. As a result, the development cost per ECU can be kept reasonable, and the overall development cost and man-hours can be reduced. In one embodiment, the main-ECU 10 and the multiple MG-ECUs 30 function as a control device.

[0018] [Vehicle disposal] Next, a description will be given of the processing executed by the vehicle 1. Fig. 2 is a flowchart showing an outline of the processing executed by the vehicle 1.

[0019] As shown in FIG. 2, first, the main-ECU 10 calculates a drive command value for the vehicle (vehicle 1) based on the detection results of various sensors provided in the vehicle 1 (step S1).

[0020] Next, the main-ECU 10 calculates a drive command value to be distributed to each MG-ECU 30 (step S2). Specifically, the main-ECU 10 calculates a drive command value to be realized for each wheel, including the front wheels 20 and the rear wheels 21, in order to realize the drive state of the machine body (vehicle 1) calculated in step S1.

[0021] Thereafter, the main-ECU 10 sets an upper limit on the drive command value to each MG-ECU 30 and restricts it (step S3). Specifically, the main-ECU 10 sets an upper limit on the drive command value to each MG-ECU 30 by restricting the drive command value to the ASIL-B safety standard in each MG-ECU 30. This makes it possible to restrict unintended excessive drive estimated values ​​even if a bug occurs in the software due to some influence when both the main-ECU 10 and each MG-ECU 30 are normal.

[0022] Next, the main-ECU 10 transmits the limited drive command value to each MG-ECU 30 (step S4).

[0023] Thereafter, each MG-ECU 30 sets an upper limit on the drive command value received from the main-ECU 10 and restricts it (step S5). Specifically, each MG-ECU 30 sets an upper limit on the drive command value by restricting the drive command value received from the main-ECU 10 to the ASIL-B safety standard. As a result, even if an abnormality occurs in the main-ECU 10 and an excessive drive command value is transmitted, each MG-ECU 30 can restrict the abnormal drive command value, thereby preventing excessive acceleration by the vehicle 1.

[0024] Subsequently, each MG-ECU 30 controls the inverter 40 and the motor 50 in accordance with the drive command value (step S6).

[0025] Thereafter, the main-ECU 10 detects a control abnormality in the inverter 40 and the motor 50 (step S7). The main-ECU 10 detects a control abnormality in the inverter 40 and the motor 50 based on detection results from a rotational speed sensor or the like provided on a propeller shaft (not shown), and information on the current flow, rotation speed, generated torque information, and whether or not there is a communication system abnormality notified from the inverter 40. If the main-ECU 10 detects a control abnormality in the inverter 40 and the motor 50 (step S7: Yes), the main-ECU 10 controls a switch that electrically connects the inverter 40 to a power source such as a battery (not shown), thereby disconnecting the inverter 40 from the power source such as a battery (not shown), and stops issuing drive command values ​​to each MG-ECU 30 (step S8). This makes it possible to avoid excessive acceleration of the vehicle 1. After step S8, the vehicle 1 ends this process.

[0026] In step S7, if no abnormality in the control of the inverter 40 and the motor 50 has been detected (step S7: No), the vehicle 1 ends this process.

[0027] According to the embodiment described above, the main-ECU 10 and each of the multiple MG-ECUs 30 store software that satisfies a relatively low level of functional safety standards, thereby improving the safety of the vehicle 1 and reducing development man-hours.

[0028] Furthermore, according to one embodiment, by distributing functions to each ECU and providing redundancy, the safety of the vehicle 1 can be improved compared to when the vehicle drive units such as the inverter 40 and the motor 50 are controlled by only one ECU, and the ASIL level can be lowered, thereby reducing development costs.

[0029] In the embodiment, the MG-ECU 30 is provided on the rear wheel 21 side of the vehicle 1, but the present invention can also be applied to a case where the MG-ECU 30 is provided on all wheels including the front wheels 20 and the rear wheels 21, and each MG-ECU 30 controls an individually driven motor 50 and inverter 40, as shown in a vehicle 1A in Fig. 3. Also, the present invention can be applied to a powertrain configuration where the MG-ECU 30 is provided on each of the front wheels 20 and the rear wheels 21, and each MG-ECU 30 controls a motor & differential 60, as shown in a vehicle 1B in Fig. 4.

[0030] Further advantages and modifications will readily occur to those skilled in the art. The invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents.

[0031] Although some of the embodiments of the present application have been described in detail above with reference to the drawings, these are merely examples, and the present invention can be implemented in other forms that have undergone various modifications and improvements based on the knowledge of those skilled in the art, including the aspects described in the disclosure of the present invention. [Explanation of symbols]

[0032] Vehicles 1, 1A, 1B 10 main-ECU 20 front wheels 21 rear wheel 30MG-ECU 40 inverter 50 motor 60 Motor & Differential

Claims

[Claim 1] A control device for controlling a vehicle, a main ECU that calculates a drive command value for the entire vehicle; a plurality of sub-ECUs that control motors based on drive command values ​​from the main ECU; Equipped with The main ECU and the plurality of sub-ECUs include: Each of the functional safety standards stores software that satisfies a relatively low level of functional safety standards. Control device.

Images