Imaging device and failure detection method

Abstract

[Problem] To provide an imaging device capable of detecting the failure of an arbiter unit and a failure detection method. [Solution] Provided according to the present disclosure is an imaging device comprising: a plurality of pixels that each output a first signal when having detected a predetermined event; an arbiter unit that arbitrates the first signal from each of the plurality of pixels and outputs a second signal based on the result of the arbitration; and a failure detection unit that detects the failure of the arbiter unit on the basis of the first signal and the second signal.

Description

Imaging device and failure detection method

[0001] The present disclosure relates to an imaging device and a failure detection method.

[0002] There is known an imaging device that outputs a request signal when an event is detected in a captured scene. In this imaging device, an arbiter unit arbitrates the request signals and acquires data of the portion where the event occurred. This type of imaging device is sometimes called an EVS (Event-based Vision Sensor).

[0003] Japanese Patent Application Laid-Open No. 2019-145185

[0004] However, even if the arbiter unit fails, the image continues to be displayed, which may make it difficult to detect the failure of the arbiter unit.

[0005] Therefore, the present disclosure provides an imaging device capable of detecting a failure in an arbiter unit, and a failure detection method.

[0006] In order to solve the above problems, according to the present disclosure, there is provided an imaging device comprising: a plurality of pixels that output a first signal when a predetermined event is detected; an arbiter unit that arbitrates the first signals from each of the plurality of pixels and outputs a second signal based on the arbitration result; and a failure detection unit that detects a failure in the arbiter unit based on the first signal and the second signal.

[0007] The failure detection unit may detect a first failure when the second signal corresponding to the first signal is not output within a predetermined time.

[0008] The failure detection unit may detect a second failure when the second signal corresponding to the first signal is not output.

[0009] The failure detection unit may detect a third failure when the second signal corresponding to the first signal is output in a case where the first signal is not input.

[0010] When a plurality of the second signals are output simultaneously, this may be detected as a fourth fault.

[0011] The plurality of pixels may be connected to the arbiter unit via respective wirings, and the arbiter unit may arbitrate the plurality of first signals input via the respective wirings, and transmit the second signal to the wiring to which the first signal selected based on the arbitration was transmitted.

[0012] The failure detection unit may detect the failure based on signals from the respective wirings.

[0013] The failure detection unit may include a first determination circuit that determines whether a predetermined time has elapsed since the first signal was output, and may detect the first failure based on a determination result of the first determination circuit.

[0014] The fault detection unit may further include a second determination circuit that determines whether the state in which the first signal is being output is being maintained, and may detect the first fault based on the determination result of the second determination circuit.

[0015] The fault detection unit may further include a third determination circuit that determines a state in which the second signal corresponding to the first signal is not output, and may detect the first fault based on the determination result of the third determination circuit.

[0016] The fault detection unit may further include a third determination circuit that determines a state in which the second signal corresponding to the first signal is not output, and may detect the second fault based on the determination result of the third determination circuit.

[0017] The fault detection unit may have a fourth determination circuit that determines whether a state in which the second signal corresponding to the first signal is being output is maintained when a state in which the first signal is not being output is maintained, and may detect the first fault based also on a determination result of the fourth determination circuit.

[0018] The fault detection unit may have a fourth determination circuit that, when a state in which the first signal is not being outputted, determines whether a state in which the second signal corresponding to the first signal is being outputted is being maintained, and may detect the third fault based on a determination result of the fourth determination circuit.

[0019] The fault detection unit may have a fifth determination circuit that determines whether the second signal is being output simultaneously to at least two of the wirings, and may detect a fourth fault based on a determination result of the fifth determination circuit.

[0020] The first judgment circuit may receive as input a first count signal that repeats a plurality of different numerical values, and a second count signal that has a time delay from the first count signal and repeats the same numerical value as the first count signal, and the first judgment circuit may include: a sustain circuit that outputs the numerical value of the second count signal at the time the first signal is output; and an exclusive NOR circuit that takes a logical AND of the sustain output signal of the sustain circuit and the first count signal, and outputs a NOR signal indicating a match if they match.

[0021] The second determination circuit may include a second AND circuit that performs a logical AND between a first state signal, which is continuously output when the first signal is input, and the exclusive NOR signal, and outputs a second AND signal indicating a match when the first and exclusive NOR signals match.

[0022] The third determination circuit may have: a second NOT circuit that inverts a second state signal that is continuously output when the second signal is input, and outputs a second inverted signal; and a third AND circuit that takes a logical AND of the second inverted signal and the second AND signal, and outputs a third AND signal indicating a match when the two signals match; and the fault detection unit may detect the first fault when the third AND signal is output.

[0023] The fourth determination circuit may have: a first negation circuit that inverts a first state signal that is continuously output when the first signal is input, and outputs a first inverted signal; and a fourth logical product circuit that takes a logical product of the first inverted signal and the second state signal that is continuously output when the second signal is input, and outputs a fourth logical product signal indicating a match when the first inverted signal and the second state signal match, and the fault detection unit may detect a fourth fault when the fourth logical product signal is output.

[0024] The failure detection unit may further include an OR circuit that outputs a failure detection signal when the third AND signal or the fourth AND signal is input.

[0025] In order to solve the above problem, the present disclosure provides a failure detection method for an imaging device including: a plurality of pixels that output a first signal when a predetermined event is detected; and an arbiter unit that arbitrates the first signals from each of the plurality of pixels and outputs a second signal based on the arbitration result, the failure detection method detecting a failure in the arbiter unit based on the first signal and the second signal.

[0026] 8 is a block diagram showing an example of the system configuration of an imaging system. A block diagram showing an example of the configuration of an imaging device according to a first configuration example. A block diagram showing an example of the configuration of a pixel array unit. A diagram schematically showing signal responses between an arbiter unit and an address event detection unit. A diagram schematically explaining an example of the internal operation of the arbiter unit. A block diagram showing an example of the configuration of a failure detection unit. A diagram showing an interface region of wiring. A diagram showing request signals and enable signals input and output to a first failure detection circuit. A diagram showing an example of signals of wiring in the interface region shown in FIG. 7. A timing chart showing an example of operation of the failure detection circuit in the interface region. A diagram showing an example of the circuit configuration of a first failure detection circuit. A truth table during normal operation. A truth table during operation exceeding a threshold. A truth table during operation in which multiple enable signals are output. A diagram showing an example of the circuit configuration of a second failure detection circuit. A timing chart showing an example of operation of the second failure detection circuit. A flowchart showing an example of the processing operation of the first failure detection circuit. A flowchart showing an example of the processing operation of the second failure detection circuit. A block diagram showing an example of the general configuration of a vehicle control system. An explanatory diagram showing an example of the installation positions of an outside vehicle information detection unit and an imaging unit.

[0027] Hereinafter, embodiments of an imaging device and a fault detection method will be described with reference to the drawings. The following description will focus on the main components of the imaging device and the fault detection method, but the imaging device and the fault detection method may include components and functions that are not shown or described. The following description does not exclude components and functions that are not shown or described.

[0028] FIG. 1 is a block diagram showing an example of the system configuration of an imaging system to which the technology according to the present disclosure is applied.

[0029] 1, an imaging system 10 to which the technology according to the present disclosure is applied includes an imaging lens 11, an imaging device 20, a recording unit 12, a control unit 13, and a CPU 55. The imaging system 10 is an example of an electronic device according to the present disclosure, and examples of such electronic devices include a camera system mounted on an industrial robot and an in-vehicle camera system.

[0030] In the imaging system 10 configured as described above, the imaging lens 11 captures incident light from a subject and forms an image on the imaging surface of the imaging device 20. The imaging device 20 obtains imaging data by photoelectrically converting the incident light captured by the imaging lens 11 on a pixel-by-pixel basis. An imaging device according to the present disclosure, which will be described later, is used as this imaging device 20.

[0031] The imaging device 20 performs predetermined signal processing, such as image recognition processing, on the captured image data, and outputs data indicating the processing results and an address event detection signal (hereinafter, sometimes simply referred to as a "detection signal") to the recording unit 12. A method for generating an address event detection signal will be described later. The recording unit 12 stores data supplied from the imaging device 20 via a signal line 14. The control unit 13 is configured, for example, by a microcomputer, and controls the imaging operation of the imaging device 20. The CPU 55 performs various information processes based on the event signal output from the imaging device 20. The CPU 55 may be provided inside the imaging device 20.

[0032] [Imaging Device (Arbiter System)] FIG. 2 is a block diagram showing an example of the configuration of an imaging device according to a first configuration example, which is used as the imaging device 20 in the imaging system 10 to which the technology according to the present disclosure is applied.

[0033] As shown in FIG. 2 , the imaging device 20 as the imaging device of the present disclosure is an asynchronous imaging device called EVS, and is configured to include a pixel array unit 21, a drive unit 22, an arbiter unit (arbitration unit) 23, a column processing unit 24, a signal processing unit 25, and a fault detection unit 26.

[0034] In the imaging device 20 having the above configuration, a plurality of pixels 30 are two-dimensionally arranged in a matrix (array) in the pixel array unit 21. Vertical signal lines VSL (described later) are wired for each pixel column in this matrix-like pixel arrangement.

[0035] Each of the plurality of pixels 30 generates a pixel signal, which is an analog signal of a voltage corresponding to the photocurrent. Each of the plurality of pixels 30 detects the presence or absence of an address event based on whether or not the amount of change in the photocurrent exceeds a predetermined threshold. When an address event occurs, the pixel 30 outputs a request signal to the arbiter unit 23 via the line L23. Note that the request signal according to this embodiment corresponds to the first signal. Although the line L23 is illustrated as a single line for simplicity, it may be configured with multiple lines.

[0036] The driving section 22 drives each of the plurality of pixels 30 to output a pixel signal generated in each pixel 30 to the column processing section 24 .

[0037] The arbiter unit 23 arbitrates the request signals from each of the multiple pixels 30 and transmits a permission signal based on the arbitration result to the pixel 30 via the wiring L23. Upon receiving the permission signal from the arbiter unit 23, the pixel 30 supplies a detection signal indicating the detection result (address event detection signal) to the drive unit 22 and the signal processing unit 25. The detection signals from the pixels 30 can also be read out from multiple rows.

[0038] The column processing unit 24 is composed of, for example, an analog-to-digital converter, and performs processing to convert, into digital signals, analog pixel signals output from the pixels 30 in each pixel column of the pixel array unit 21. Then, the column processing unit 24 supplies the digital signals after analog-to-digital conversion to the signal processing unit 25.

[0039] The signal processing unit 25 performs predetermined signal processing such as CDS (Correlated Double Sampling) processing and image recognition processing on the digital signal supplied from the column processing unit 24. Then, the signal processing unit 25 supplies data indicating the processing result and the detection signal supplied from the arbiter unit 23 to the recording unit 12 (see FIG. 1 ) via the signal line 14.

[0040] The failure detection unit 26 detects a failure of the arbiter unit 23 based on the request signal and the enable signal input / output by the arbiter unit 23 via the wiring L23. The failure detection unit 26 detects a first failure when an enable signal corresponding to a request signal is not output within a predetermined time. The failure detection unit 26 also detects a second failure when an enable signal corresponding to a request signal is output via the wiring L23 when the pixel 30 does not output a request signal via the wiring L23. Furthermore, the failure detection unit 26 detects a third failure when multiple enable signals are output simultaneously.

[0041] When the failure detection unit 26 detects a failure, it outputs a failure detection signal having information on any one of the first to third failures to the control unit 13 (see FIG. 1 ). The control unit 13 executes control processing in response to the failure detection signal on the control device 20. For example, the control unit 13 stops the imaging drive of the imaging device 20.

[0042] 3 is a block diagram showing an example of the configuration of the pixel array unit 21. In the pixel array unit 21, a plurality of pixels 30 are two-dimensionally arranged in a matrix, and each of the plurality of pixels 30 includes a light receiving unit 31, a pixel signal generating unit 32, and an address event detecting unit 33.

[0043] In the pixel 30 having the above configuration, the light receiving unit 31 performs photoelectric conversion on incident light to generate a photocurrent. Then, under the control of the drive unit 22 (see FIG. 2 ), the light receiving unit 31 supplies the photocurrent generated by photoelectric conversion to either the pixel signal generation unit 32 or the address event detection unit 33.

[0044] The pixel signal generation unit 32 generates a pixel signal SIG, which is a voltage signal corresponding to the photocurrent supplied from the light receiving unit 31, and supplies this generated pixel signal SIG to the column processing unit 24 (see Figure 2) via the vertical signal line VSL.

[0045] The address event detector 33 detects whether an address event has occurred based on whether the amount of change in photocurrent from each of the light receiving units 31 has exceeded a predetermined threshold. An address event is, for example, an ON event indicating that the amount of change in photocurrent has exceeded an upper threshold, and an OFF event indicating that the amount of change has fallen below a lower threshold. The address event detection signal is, for example, one bit indicating the detection result of an ON event and one bit indicating the detection result of an OFF event. The address event detector 33 can also be configured to detect only ON events.

[0046] When an address event occurs, the address event detection unit 33 supplies a request signal requesting transmission of an address event detection signal to the arbiter unit 23 (see FIG. 2 ). Then, upon receiving a permission signal in response to the request signal from the arbiter unit 23, the address event detection unit 33 supplies an address event detection signal to the drive unit 22 and the signal processing unit 25.

[0047] 4 is a diagram schematically illustrating signal responses between the arbiter unit 23 and the address event detection unit 33. A line L23 is arranged via an interface F23, which is a pixel-arbiter interface and a signal input / output terminal of the arbiter unit 23. FIG. 4 simply illustrates address event detection units 33a and 33b, which output request signals 1 and 2, within the address event detection unit 33 (see FIG. 3). The address event detection unit 33a outputs request signal 1 to the arbiter unit 23 via the line L23, and the address event detection unit 33b outputs request signal 3 to the arbiter unit 23 via the line L23.

[0048] The arbiter unit 23 outputs an enable signal 1 in response to the request signal 1 that is input first from among a plurality of request signals 1 and 2 input from each wiring L23, for example. At this time, the arbiter unit 23 outputs the enable signal 1 via the wiring L23 that received the request signal 1. A pixel (see FIG. 3 ) having an address event detection unit 33 a that received the enable signal 1 supplies a detection signal (address event detection signal) indicating the detection result to the drive unit 22 and the signal processing unit 25 via the vertical signal line VSL.

[0049] 5 is a diagram illustrating an example of the internal operation of the arbiter unit 23. In Fig. 5, address event detection units 33a and 33b that output request signals 1 and 2 within the address event detection unit 33 (see Fig. 3) are simply illustrated.

[0050] 5, for example, the arbiter unit 23 is configured with a combination of selection holding circuits S23. With this configuration, inside the arbiter unit 23, selection is made stepwise for each selection holding circuit S23 based on the time points at which request signals 1 and 2 are input to the arbiter unit 23. In other words, inside the arbiter unit 23, selection is made stepwise like a tournament based on the time points at which request signals 1 and 2 are input to the arbiter unit 23.

[0051] For example, request signal 1, which was input to the arbiter unit 23 first, is selected by each selection / holding circuit S23 because its input time is earlier than the other request signals. Even in the top-level selection / holding circuit S23a, its input time is earlier than the other request signal 2, and it is finally selected. Once finally selected, permission signal 1 is output to the address event detection unit 33a via the line L23 to which request signal 1 was input. At this time, the other request signal that was not selected is held by the unselected selection / holding circuit S23. For example, request signal 2, which was input after request signal 1, is held by the unselected selection / holding circuit S23a because its input time is later than that of request signal 1. Note that the internal operation and configuration of the arbiter unit 23 are merely examples and are not limited thereto. For example, the arbiter unit 23 may be configured to input and output request signal 1 and the corresponding permission signal 1.

[0052] 6 is a block diagram showing an example configuration of the failure detection unit 26. The failure detection unit 26 is connected to the wiring L23, for example, via the interface F23. The failure detection unit 26 has a plurality of first failure detection circuits 260 and a second failure detection circuit 262. Each of the plurality of first failure detection circuits 260 detects a failure based on the request signal and the enable signal of the corresponding wiring L23. The second failure detection circuit 262 detects a failure based on the enable signals of all the wirings L23.

[0053] As described above, the first failure detection circuit 260 of the failure detection unit 26 detects a first failure when an enable signal corresponding to a request signal is not output within a predetermined time. The first failure detection circuit 260 also detects a second failure when an enable signal corresponding to a request signal is not output. Furthermore, the first failure detection circuit 260 detects a third failure when an enable signal corresponding to a request signal is output via line L23 when the pixel 30 is not outputting a request signal via line L23. The second failure detection circuit 262 of the failure detection unit 26 detects a fourth failure when multiple enable signals are output simultaneously.

[0054] First, an example of the detection operation of the first fault detection circuit 260 will be described using FIGS. 7 and 8. FIG. 7 is a diagram showing interface regions E23 and E24 of the wiring L23. FIG. 8 is a diagram showing request signals and enable signals input and output to the first fault detection circuit 260 via the wiring in the interface region E23. FIG. 8(a) is a diagram showing request signal 1 and enable signal 1 of the wiring L23 in the interface region E23. FIG. 8(b) is a diagram showing request signal 2 of the wiring L23 in the interface region E23. FIG. 8(c) is a diagram showing enable signal 2 of the wiring L23 in the interface region E23.

[0055] 5, the maximum response time between the request signal 1 and the corresponding permission signal 1 is determined by the configuration of the arbiter unit 23. Therefore, if the difference between the input time of the request signal 1 and the output time of the permission signal 1 exceeds the time determined by the operating characteristics of the arbiter unit 23, it can be determined that a first fault has occurred in the arbiter unit 23.

[0056] 8A, the first fault detection circuit 260 detects a first fault when the time between the request signal 1 and the corresponding permission signal 1 on the wiring L23 in the interface region E23 exceeds a predetermined time. Although the first fault detection circuit 260 according to this embodiment is disposed for each wiring L23, this is not limiting. For example, the first fault detection circuit 260 may store the input time of the request signal for each wiring L23 and detect a first fault based on the difference between the input time and the output time of the permission signal.

[0057] As shown in Fig. 8(b), the first failure detection circuit 260 also detects the case where a request signal 2 is input but the corresponding enable signal is not output as a second failure of the arbiter unit 23. Furthermore, as shown in Fig. 8(c), the first failure detection circuit 260 also detects the case where a request signal is not input but the corresponding enable signal is not output as a third failure of the arbiter unit 23. A detailed configuration example of the first failure detection circuit 260 will be described later.

[0058] An example of the detection operation of the second fault detection circuit 262 will be described using Fig. 9 while referring to Figs. 5 and 7. Fig. 9 is a diagram showing an example of a signal on the wiring L23 of the interface areas E23 and E24 shown in Fig. 7. It is a diagram showing an example in which the permission signal 3 is output simultaneously to the wiring L23 of the interface areas E23 and E24. The request signals 1 and 2 may be either one of them, or they do not have to be input simultaneously.

[0059] As shown in FIG. 5 , the arbiter unit 23 outputs an enable signal 1 to one line L23 in response to a request signal 1. In contrast, in FIG. 9 , an enable signal 3 is simultaneously output to the lines L23 in the interface regions E23 and E24. This situation occurs, for example, due to a short circuit between the lines L23. Therefore, the second fault detection circuit 262 detects a fourth fault in the arbiter unit 23 when multiple enable signals 3 are simultaneously output. A detailed configuration example of the second fault detection circuit 262 will be described later.

[0060] FIG. 10 is a timing chart showing an example of the operation of the first failure detection circuit 260 in the interface region E23. From top to bottom, the diagram shows the clock signal (clk), request signal, permission signal, request signal state, permission signal state, time measurement state, failure detection state, failure detection signal, and the state of the arbiter unit 23. In this embodiment, for example, a high level of the request signal indicates an on state, and a low level indicates an off state. Here, the on state indicates a state in which a signal is being output, and the off state indicates a state in which a signal is not being output. On the other hand, for example, a high level of the permission signal in FIG. 10 indicates an off state, and a low level indicates an on state. Furthermore, in this embodiment, the request signal is maintained at a high level until the permission signal or failure detection signal is output.

[0061] 10, a request signal is input to the first failure detection circuit 260 at timing t1, and the request signal state starts to be maintained as a high-level signal at timing t2 after a predetermined clock deviation has elapsed.

[0062] Next, the permission signal is input to the first fault detection circuit 260 at timing t3, and at timing t4 after a predetermined clock deviation has elapsed, the permission signal state begins to be maintained as a high-level signal. Meanwhile, since the permission signal has been input, the request signal also falls to a low-level signal at timing t5 when the permission signal falls. The time measurement state within the first fault detection circuit 260 shows that timings t2 and t3 are within a predetermined time, so the first fault detection circuit 260 does not detect a fault.

[0063] (State in which an enabling signal is not output) Next, an example of operation in a state in which an enabling signal is not output will be described. As shown in Fig. 10, a request signal is input to the first fault detection circuit 260 at timing t7, and at timing t8, after a predetermined clock deviation has elapsed, the request signal state begins to be maintained as a high-level signal. Because an enabling signal is not input, the time measurement state in the first fault detection circuit 260 changes to a first fault detection state at timing t9, since the elapsed time from timing t8 exceeds a predetermined threshold value.

[0064] The first failure detection circuit 260 also outputs a failure detection signal for a second failure at timing t9. At timing t10, the request signal falls to a low level in response to the failure detection signal, and at timing t11, after a predetermined clock offset has elapsed, the request signal is maintained as a low-level signal. Thus, the first failure detection circuit 260 outputs a failure detection signal when the high-level request signal is maintained for a time exceeding a predetermined threshold.

[0065] (State in which only the enable signal is output) Next, an example of operation in which only the enable signal is output will be described. As shown in FIG. 10 , the enable signal is input to the first fault detection circuit 260 at timing t12, and at timing t13 after a predetermined clock deviation has elapsed, the enable signal state begins to be maintained as a high-level signal. Since the request signal state is maintained as a low-level signal at timing t13, the first fault detection circuit 260 detects a fault in which only the enable signal is output, and outputs a fault detection signal for the third fault. In this way, when the enable signal state becomes a high-level signal and the request signal state becomes a low-level signal, the first fault detection circuit 260 outputs a fault detection signal.

[0066] Here, an example circuit configuration of the first failure detection circuit 260 will be described using FIGS. 11 to 14 . FIG. 11 is a diagram illustrating an example circuit configuration of the first failure detection circuit 260. As illustrated in FIG. 11 , the first failure detection circuit 260 includes a request signal hold circuit 264, an enable signal hold circuit 266, a first judgment circuit 268, and a main judgment circuit 270. A request signal and an enable signal are input to the first failure detection circuit 260 via a line L23. For example, a high level of the request signal indicates an ON state, and a low level indicates an OFF state. Here, the ON state indicates a state in which the request signal is being output, and the OFF state indicates a state in which the request signal is not being output. Meanwhile, for example, a high level of the enable signal indicates an OFF state, and a low level indicates an ON state. A time measurement signal and a reference time measurement signal are also input to the first failure detection circuit 260.

[0067] As shown in FIG. 11 , the request signal hold circuit 264 includes an asynchronous processing circuit 264a and a hold circuit 264b. The permission signal hold circuit 266 includes an asynchronous processing circuit 266a and a hold circuit 266b. The first judgment circuit (time judgment circuit) 268 includes a signal selection circuit 268a, a hold circuit 268b, and an exclusive NOR circuit 268c. The main judgment circuit 270 includes a second judgment circuit 272, a third judgment circuit 274, a fourth judgment circuit 276, and an OR circuit 278. The third judgment circuit 274 includes a NOT circuit 274a and a logical AND circuit 274b. Similarly, the fourth judgment circuit 276 includes a NOT circuit 276a and a logical AND circuit 276b.

[0068] Fig. 12 is a truth table for normal operation. Fig. 13 is a truth table for operation in which the time from input of a request signal to output of an enable signal exceeds a threshold. Fig. 14 is a truth table for operation in which multiple enable signals are output. From top to bottom, the following are shown: the time measurement signal, the reference time measurement signal, the request signal, the enable signal, the output signal of the request signal hold circuit 264 (request signal hold FF), the output signal of the enable signal hold circuit 266 (enable signal hold FF), the control signal (selector) of the signal selection circuit 268a, the output signal of the hold circuit 268b (time count FF), the output signal (Exor) of the exclusive NOR circuit 268c, the output signal (And1) of the second judgment circuit 272, the output signal (And2) of the third judgment circuit 274, the output signal (And3) of the fourth judgment circuit 276, and the output signal (Or1) of the logical OR circuit 278.

[0069] 11 will be used to describe the circuit configuration and operation example of the first fault detection circuit 260, with reference to FIGS. 12 to 14 . As shown in FIGS. 12 to 14 , the reference time measurement signal is a timeline signal in which numbers, for example, 0, 1, 2, 3, 4, 5, 6, and 7, are repeated in chronological order. The time measurement signal is a timeline signal whose numbers are offset from those of the reference time measurement signal. For example, when the reference time measurement signal is 0, 1, 2, 3, 4, 5, 6, and 7, the values ​​are 1, 2, 3, 4, 5, 6, 7, and 0. These numbers can be arbitrarily determined depending on the time used for determination. The request signal has a high-level signal (on state) of 1 and a low-level signal (off state) of 0. Similarly, the permission signal has a high-level signal (on state) of 1 and a low-level signal (off state) of 0 (the high and low levels will be reversed in this description compared to FIG. 10 ).

[0070] 11 , the request signal hold circuit 264 includes an asynchronous processing circuit 264 a and a hold circuit 264 b. The asynchronous processing circuit 264 a adjusts the timing difference between the signal processing cycle of the failure detection unit 26 and the request signal. The hold circuit 264 b is, for example, a flip-flop circuit, and holds and outputs the value output by the asynchronous processing circuit 264 a. For example, as shown in FIGS. 12 to 14 , the hold circuit 264 b holds and outputs a 1 if the request signal is high level (on state), and holds and outputs a 0 if the request signal is low level (off state).

[0071] The enable signal hold circuit 266 includes an asynchronous processing circuit 266a and a hold circuit 266b. The asynchronous processing circuit 266a adjusts the timing difference between the signal processing cycle of the failure detection unit 26 and the enable signal. The hold circuit 266b is, for example, a flip-flop circuit, and holds and outputs the value output by the asynchronous processing circuit 266a. For example, as shown in FIGS. 12 to 14, the hold circuit 266b holds and outputs 0 if the enable signal is low level (on state), and holds and outputs 1 if the enable signal is high level (off state).

[0072] The first determination circuit 268 is a circuit that measures whether the time from when the request signal is input until when the permission signal is input exceeds a predetermined time. The first determination circuit 268 has a signal selection circuit 268 a, a holding circuit 268 b, and an exclusive NOR circuit 268 c.

[0073] The signal selection circuit 268a is, for example, a multiplexer. As shown in Figures 12 to 14 (selector, request signal holding FF), the output signal of the request signal holding circuit 264 is input as a control signal. If the control signal (selector) is 0, the signal selection circuit 268a selects the reference time measurement signal and outputs it to the holding circuit 268b. On the other hand, if the control signal is 1, the output of the holding circuit 268b is input.

[0074] The hold circuit 268b is, for example, a flip-flop circuit, which holds and outputs the output value of the signal selection circuit 268a. For example, if the output signal (request signal hold FF) of the request signal hold circuit 264 is 0, the hold circuit 268b holds and outputs the value of the reference time measurement signal in the time sequence (time count FF). Therefore, when the output of the request signal hold circuit 264 changes from 0 to 1, the hold circuit 268b continues to hold and outputs the value of the reference time measurement signal (for example, 4).

[0075] The exclusive NOR circuit 268c receives the output value of the hold circuit 268b and the time measurement signal. When the output signal (request signal hold FF) of the request signal hold circuit 264 is 0, the exclusive NOR circuit 268c receives the reference time signal and the time measurement signal. In this case, the reference time signal and the time measurement signal never match, so the exclusive NOR circuit 268c always outputs 0 as the output signal (Exor).

[0076] On the other hand, when the output signal (request signal hold FF) of the request signal hold circuit 264 is 1, the value (e.g., 4) of the reference time signal when the control signal (selector) changes from 0 to 1 and the time measurement signal are input to the exclusive NOR circuit 268c. As a result, when the value of the time measurement signal changes and goes around once, and matches the value of the reference time signal when it changed from 0 to 1, the exclusive NOR circuit 268c outputs 1 as the output signal (Exor). In other words, if the output of the request signal hold circuit 264 becomes 0 (off state) before the value of the time measurement signal goes around once (for example, becomes 4), the circuit does not output 1, but continues to output 0 as the output signal (Exor).

[0077] The second determination circuit 272 is a logical AND circuit that receives as input the output signal (Exor) of the first determination circuit 268 and the output signal (request signal hold FF) of the request signal hold circuit 264. The second determination circuit 272 outputs 1 as the output signal (And1) when both the output signal (Exor) of the first determination circuit 268 and the output signal (request signal hold FF) of the request signal hold circuit 264 are 1, and outputs 0 as the output signal (And1) otherwise. In other words, the second determination circuit 272 outputs 1 as the output signal (And1) when one period of the time measurement signal (corresponding to the time threshold) has elapsed while the request signal remains at a high level.

[0078] As described above, the third determination circuit 274 includes a NOT circuit 274a and a logical AND circuit 274b. The NOT circuit 274a receives the output signal (enable signal hold FF) of the enable signal hold circuit 266, which is then inverted and input to the logical AND circuit 274b. The logical AND circuit 274b receives the output signal (And1) of the second determination circuit 272 and the inverted signal of the output signal (enable signal hold FF) of the enable signal hold circuit 266, which outputs an output signal (And2). In other words, when the output signal (enable signal hold FF) of the enable signal hold circuit 266 is 0 and the output signal (And1) of the second determination circuit 272 is 1, the logical AND circuit 274b outputs 1 as the output signal (And2). As can be seen from this, the logical product circuit 274b outputs 1 when the request signal remains at a high level, one period of the time measurement signal (corresponding to the time threshold) has elapsed, and no permission signal has been input.

[0079] As described above, the fourth determination circuit 276 includes a NOT circuit 276a and a logical AND circuit 276b. The NOT circuit 276a receives the output signal (request signal hold FF) of the request signal hold circuit 264, which is then inverted and input to the logical AND circuit 274b. The logical AND circuit 276b receives the inverted signal of the output signal (request signal hold FF) of the request signal hold circuit 264 and the output signal (enable signal hold FF) of the enable signal hold circuit 266, and outputs an output signal (And3). In other words, the logical AND circuit 276b outputs 1 as the output signal (And3) when the output signal (request signal hold FF) of the request signal hold circuit 264 is 0 and the output signal (enable signal hold FF) of the enable signal hold circuit 266 is 1. As can be seen from this, the logical AND circuit 276b outputs 1 when no request signal is input and an enable signal is input.

[0080] The OR circuit 278 receives the output signal (And2) of the third determination circuit 274 and the output signal (And3) of the fourth determination circuit 276 as inputs, and outputs an output signal (Or1). In other words, if the output signal (And2) of the third determination circuit 274 or the output signal (And3) of the fourth determination circuit 276 is 1, the OR circuit 278 outputs 1. The output signal of the OR circuit 278 serves as a fault detection signal.

[0081] 12 again, when the reference time signal is 4, the request signal changes from 0 to 1, and 4 is held in the holding circuit 268b (time count FF). On the other hand, when the reference time signal becomes 0, the permission signal changes from 0 to 1. As a result, when the reference time signal is 1, the request signal changes from 1 to 0. Therefore, the control signal (selector) becomes 0, and the reference signal is held in chronological order in the holding circuit 268b (time count FF). Therefore, the exclusive NOR circuit 268c continues to output 0 as the output signal (Exor), so the output signal (And2) of the third determination circuit 274 and the output signal (And3) of the fourth determination circuit 276 remain 0. In other words, no failure is detected.

[0082] 13 again, when the reference time signal is 1, the request signal changes from 0 to 1, and 1 is held in the holding circuit 268b (time count FF). Meanwhile, the permission signal maintains 0. As a result, the control signal (selector) maintains 1, and when the reference time signal becomes 0 (one period, which is the time threshold, has elapsed), the time measurement signal becomes 1, which matches the value of the reference time signal held in the holding circuit 268b, which is 1. As a result, the exclusive NOR circuit 268c outputs 1 as the output signal (Exor). Then, the output signal (And1) of the second determination circuit 272 and the output signal (And2) of the third determination circuit 274 become 1, and a failure detection signal is output.

[0083] 14 again, the AND circuit 276b outputs 1 as the output signal (And3) when the output signal (request signal hold FF) of the request signal hold circuit 264 is 0 and the output signal (enable signal hold FF) of the enable signal hold circuit 266 is 1. Then, the output signal (And3) of the fourth determination circuit 276 becomes 1, and a failure detection signal is output.

[0084] 15 and 16 will be used to explain the details of the second failure detection circuit 262. Fig. 15 is a diagram showing an example of the circuit configuration of the second failure detection circuit 262. The second failure detection circuit 262 has a plurality of determination circuits 300, a logical product circuit 302, and a logical sum circuit 310. The enable signal is, for example, 1 if it is at a high level (on state), and is, for example, 0 if it is at a low level (off state).

[0085] 15, the determination circuit 300 is a circuit that receives two inputs, a first input signal and a second input signal, and outputs two outputs, a first output signal and a second output signal. The determination circuit 300 includes an AND circuit 300a that receives the first input signal and the second input signal and outputs the first output signal, and an exclusive OR circuit 300b that receives the first input signal and the second input signal and outputs the second output signal.

[0086] If both the first input signal and the second input signal are high level signals, the AND circuit 300a outputs a high level signal as the first output signal. On the other hand, if both the first input signal and the second input signal are high level signals, the AND circuit 300a outputs a low level signal as the first output signal. The first output signal is also input to the OR circuit 310.

[0087] The exclusive OR circuit 300b outputs a high-level signal as a second output signal if one of the first input signal and the second input signal is a high-level signal. On the other hand, the exclusive OR circuit 300b outputs a low-level signal as a second output signal otherwise. The second output signal is input to the determination circuit 300 in the next stage.

[0088] The wiring L23 is divided into two groups, an upper group and a lower group, and two wirings L23 are connected to the upper first-stage decision circuit 300. In the second and subsequent decision circuits 300, the second output signal of the exclusive OR circuit 300b in the previous stage is input to the first input signal side, and the wiring L23 is connected to the second input signal side. This connection is repeated, and the output signal of the exclusive OR circuit 300b in the final stage is input to the AND circuit 302.

[0089] Similarly, two wirings L23 are connected to the first-stage decision circuit 300 on the lower side. In the second-stage and subsequent decision circuits 300, the second output signal of the exclusive OR circuit 300b in the previous stage is input to the first input signal side, and wiring L23 is connected to the second input signal side. This connection is repeated, and the output signal of the exclusive OR circuit 300b in the final stage is input to the AND circuit 302. The output signal of the AND circuit 302 is input to the OR circuit 310.

[0090] 16 is a timing chart showing an example of the operation of the second failure detection circuit 262. From the top, the chart shows the clock signal, the enable signals 1 to 720 (see FIG. 15), the signal increase detection state, and the failure detection signal.

[0091] At timing t1, the enable signal 1 goes high, and at timing t2, it goes low. This causes the upper first-stage exclusive OR circuit 300b to output a high-level signal to the first input signal side of the second stage. At this time, the second input signal of the second-stage exclusive OR circuit 300b is low, so the second-stage exclusive OR circuit 300b outputs a high-level signal to the AND circuit 302. On the other hand, since signals other than the enable signal 1 are low, the inputs to the lower side of the AND circuit 302 are low, and the AND circuit 302 outputs a low-level signal. A low-level signal is output as a failure detection signal for the OR circuit 310.

[0092] At timing t3, the enable signal 2 goes high, and at timing t4, it goes low. This causes the upper first-stage exclusive OR circuit 300b to output a high-level signal to the first input signal side of the second stage. At this time, the second input signal of the second-stage exclusive OR circuit 300b is low, so the second-stage exclusive OR circuit 300b outputs a high-level signal to the AND circuit 302. On the other hand, since signals other than the enable signal 2 are low, the inputs on the lower side of the AND circuit 302 are low, and the AND circuit 302 outputs a low-level signal. A low-level signal is output as a failure detection signal for the OR circuit 310.

[0093] At timing t5, the enable signal 4 goes high, and at timing t6, it goes low. This causes the lower, second-stage exclusive OR circuit 300b to output a high-level signal to the AND circuit 302. On the other hand, because signals other than the enable signal 4 are low, the upper input to the AND circuit 302 is low, and the AND circuit 302 outputs a low-level signal. A low-level signal is output as a failure detection signal for the OR circuit 310.

[0094] At timing t7, the enable signal 3, 720 goes high, and at timing t6, it goes low. This causes the upper first-stage exclusive OR circuit 300b to output a low-level signal to the first input signal side of the second stage. At this time, the second input signal of the second-stage exclusive OR circuit 300b is high, so the second-stage exclusive OR circuit 300b outputs a high-level signal to the AND circuit 302.

[0095] As a result, the lower first-stage exclusive OR circuit 300b outputs a high-level signal to the first input signal side of the second stage. At this time, the second input signal of the second-stage exclusive OR circuit 300b is low, so the second-stage exclusive OR circuit 300b outputs a high-level signal to the AND circuit 302. As a result, the AND circuit 302 outputs a high-level signal to the OR circuit 310. The OR circuit 310 then outputs a high-level signal as a fault detection signal. In this way, when multiple enable signals are output simultaneously, the second fault detection circuit 262 of the fault detection unit 26 detects this as a fourth fault and outputs a high-level signal as a fault detection signal.

[0096] 17 is a flowchart showing an example of the processing operation of the first failure detection circuit 260. Here, the request signal is in the ON state when it is at a HIGH level, and in the OFF state when it is at a low level. The permission signal is in the ON state when it is at a HIGH level, and in the OFF state when it is at a low level.

[0097] First, the first failure detection circuit 260 sets a timer (Timer) to 0 (step S100). Next, it determines whether the request signal has become high level (input) (step S102). If it determines that the request signal has become high level (input) (YES in step S102), it increments the timer by 1 (step S104).

[0098] Next, the first failure detection circuit 260 determines whether the timer (Timer) has exceeded the threshold value (step S106). If it determines that the timer is less than the threshold value (YES in step S106), it further determines whether the enable signal has become high level (input) (step S108). If it determines that the enable signal has become high level (input) (YES in step S108), it repeats the process from step S100. If it determines that the enable signal is maintaining a low level (NO in step S108), it repeats the process from step S104.

[0099] On the other hand, if it is determined that the request signal is maintained at a low level (NO in step S102), it is further determined whether the permission signal has become a high level (input) (step S110). If it is determined that the permission signal has become a high level (input) (YES in step S110), it is detected as a failure (step S112). On the other hand, if it is determined that the permission signal is maintained at a low level (NO in step S110), the process from step S100 is repeated.

[0100] On the other hand, if it is determined that the timer is equal to or greater than the threshold value (NO in step S106), a fault is detected (step S112). In this way, the first fault detection circuit 260 detects a fault when an enabling signal corresponding to a request signal is not output within a predetermined time. Furthermore, the first fault detection circuit 260 detects a fault when an enabling signal corresponding to a request signal is output when a request signal is not being output.

[0101] 18 is a flowchart showing an example of the processing operation of the second failure detection circuit 262. The second failure detection circuit 262 determines whether the number of enable signals input simultaneously is greater than one (step S200). If it determines that the number is greater than one (YES in step S200), it detects a failure (step S202). On the other hand, if it determines that the number is less than or equal to one (NO in step S200), it repeats the processing from step S200. In this way, the second failure detection circuit 262 detects a failure when multiple enable signals are input simultaneously.

[0102] As described above, according to this embodiment, the failure detection unit 26 detects a failure in the arbiter unit 23 based on the request signal and the permission signal. There is a predetermined relationship between the input timing of the request signal to the arbiter unit 23 and the output timing of the permission signal from the arbiter unit 23, so if there is a deviation from this predetermined relationship, the occurrence of a failure can be detected more accurately.

[0103] <<4. Application Examples>> The technology according to the present disclosure can be applied to various products. For example, the technology according to the present disclosure may be realized as a device mounted on any type of moving body, such as an automobile, an electric vehicle, a hybrid electric vehicle, a motorcycle, a bicycle, personal mobility, an airplane, a drone, a ship, a robot, construction machinery, or agricultural machinery (tractor).

[0104] 19 is a block diagram showing a schematic configuration example of a vehicle control system 7000, which is an example of a mobile object control system to which the technology according to the present disclosure can be applied. The vehicle control system 7000 includes a plurality of electronic control units connected via a communication network 7010. In the example shown in FIG. 19 , the vehicle control system 7000 includes a drive system control unit 7100, a body system control unit 7200, a battery control unit 7300, an outside-vehicle information detection unit 7400, an inside-vehicle information detection unit 7500, and an integrated control unit 7600. The communication network 7010 connecting these multiple control units may be an in-vehicle communication network conforming to any standard, such as a Controller Area Network (CAN), a Local Interconnect Network (LIN), a Local Area Network (LAN), or FlexRay (registered trademark).

[0105] Each control unit includes a microcomputer that performs arithmetic processing according to various programs, a memory unit that stores the programs executed by the microcomputer or parameters used in various calculations, and a drive circuit that drives various controlled devices. Each control unit includes a network I / F for communicating with other control units via a communication network 7010, and a communication I / F for communicating with devices or sensors inside and outside the vehicle via wired or wireless communication. Figure 19 illustrates the functional configuration of the integrated control unit 7600, including a microcomputer 7610, a general-purpose communication I / F 7620, a dedicated communication I / F 7630, a positioning unit 7640, a beacon receiving unit 7650, an in-vehicle device I / F 7660, an audio / video output unit 7670, an in-vehicle network I / F 7680, and a memory unit 7690. The other control units also include a microcomputer, a communication I / F, a memory unit, and the like.

[0106] The drivetrain control unit 7100 controls the operation of devices related to the drivetrain of the vehicle in accordance with various programs. For example, the drivetrain control unit 7100 functions as a control device for a drive force generating device for generating drive force for the vehicle, such as an internal combustion engine or a drive motor, a drive force transmission mechanism for transmitting drive force to the wheels, a steering mechanism for adjusting the steering angle of the vehicle, and a braking device for generating braking force for the vehicle. The drivetrain control unit 7100 may also function as a control device for an ABS (Antilock Brake System) or an ESC (Electronic Stability Control), etc.

[0107] A vehicle state detection unit 7110 is connected to the drivetrain control unit 7100. The vehicle state detection unit 7110 includes at least one of a gyro sensor that detects the angular velocity of the axial rotational motion of the vehicle body, an acceleration sensor that detects the acceleration of the vehicle, or a sensor that detects the amount of operation of the accelerator pedal, the amount of operation of the brake pedal, the steering angle of the steering wheel, the engine rotation speed, the rotation speed of the wheels, etc. The drivetrain control unit 7100 performs arithmetic processing using signals input from the vehicle state detection unit 7110, and controls the internal combustion engine, the drive motor, the electric power steering device, the brake device, etc.

[0108] The body system control unit 7200 controls the operation of various devices equipped in the vehicle body according to various programs. For example, the body system control unit 7200 functions as a control device for a keyless entry system, a smart key system, a power window device, or various lamps such as headlamps, backup lamps, brake lamps, turn signals, and fog lamps. In this case, radio waves transmitted from a portable device that serves as a key or signals from various switches can be input to the body system control unit 7200. The body system control unit 7200 receives these radio waves or signals and controls the vehicle's door lock device, power window device, lamps, etc.

[0109] The battery control unit 7300 controls the secondary battery 7310, which is the power supply source for the drive motor, in accordance with various programs. For example, information such as battery temperature, battery output voltage, or remaining battery capacity is input to the battery control unit 7300 from a battery device equipped with the secondary battery 7310. The battery control unit 7300 performs arithmetic processing using these signals, and controls the temperature regulation of the secondary battery 7310 or a cooling device or the like equipped in the battery device.

[0110] The outside vehicle information detection unit 7400 detects information outside the vehicle equipped with the vehicle control system 7000. For example, at least one of an imaging unit 7410 and an outside vehicle information detection unit 7420 is connected to the outside vehicle information detection unit 7400. The imaging unit 7410 includes at least one of a time-of-flight (ToF) camera, a stereo camera, a monocular camera, an infrared camera, and other cameras. The outside vehicle information detection unit 7420 includes at least one of an environmental sensor for detecting the current weather or climate, or a surrounding information detection sensor for detecting other vehicles, obstacles, pedestrians, etc. around the vehicle equipped with the vehicle control system 7000.

[0111] The environmental sensor may be, for example, at least one of a raindrop sensor that detects rain, a fog sensor that detects fog, a sunshine sensor that detects the degree of sunshine, and a snow sensor that detects snowfall. The surrounding information detection sensor may be at least one of an ultrasonic sensor, a radar device, and a LIDAR (Light Detection and Ranging, Laser Imaging Detection and Ranging) device. The imaging unit 7410 and the outside vehicle information detection unit 7420 may each be provided as an independent sensor or device, or may be provided as a device in which multiple sensors or devices are integrated.

[0112] 20 shows an example of the installation positions of the imaging unit 7410 and the vehicle exterior information detection unit 7420. The imaging units 7910, 7912, 7914, 7916, and 7918 are provided, for example, at least one of the front nose, side mirrors, rear bumper, back door, and upper part of the windshield inside the vehicle cabin of the vehicle 7900. The imaging unit 7910 provided on the front nose and the imaging unit 7918 provided on the upper part of the windshield inside the vehicle cabin mainly acquire images of the front of the vehicle 7900. The imaging units 7912 and 7914 provided on the side mirrors mainly acquire images of the sides of the vehicle 7900. The imaging unit 7916 provided on the rear bumper or back door mainly acquires images of the rear of the vehicle 7900. The imaging unit 7918 provided on the upper part of the windshield inside the vehicle cabin is mainly used to detect leading vehicles, pedestrians, obstacles, traffic lights, traffic signs, lanes, etc.

[0113] 20 shows an example of the imaging ranges of the imaging units 7910, 7912, 7914, and 7916. Imaging range a indicates the imaging range of the imaging unit 7910 provided on the front nose, imaging ranges b and c indicate the imaging ranges of the imaging units 7912 and 7914 provided on the side mirrors, respectively, and imaging range d indicates the imaging range of the imaging unit 7916 provided on the rear bumper or back door. For example, by overlaying the image data captured by the imaging units 7910, 7912, 7914, and 7916, a bird's-eye view image of the vehicle 7900 viewed from above can be obtained.

[0114] The outside vehicle information detection units 7920, 7922, 7924, 7926, 7928, and 7930 provided on the front, rear, sides, corners, and above the windshield inside the vehicle cabin of the vehicle 7900 may be, for example, ultrasonic sensors or radar devices. The outside vehicle information detection units 7920, 7926, and 7930 provided on the front nose, rear bumper, back door, and above the windshield inside the vehicle cabin of the vehicle 7900 may be, for example, LIDAR devices. These outside vehicle information detection units 7920 to 7930 are mainly used to detect preceding vehicles, pedestrians, obstacles, etc.

[0115] Returning to FIG. 19 , the explanation will be continued. The outside-vehicle information detection unit 7400 causes the imaging unit 7410 to capture an image outside the vehicle and receives the captured image data. The outside-vehicle information detection unit 7400 also receives detection information from the connected outside-vehicle information detection unit 7420. If the outside-vehicle information detection unit 7420 is an ultrasonic sensor, a radar device, or a LIDAR device, the outside-vehicle information detection unit 7400 emits ultrasonic waves or electromagnetic waves and receives information on the received reflected waves. Based on the received information, the outside-vehicle information detection unit 7400 may perform object detection processing or distance detection processing for people, vehicles, obstacles, signs, or text on the road surface. Based on the received information, the outside-vehicle information detection unit 7400 may also perform environmental recognition processing for recognizing rainfall, fog, road conditions, etc. Based on the received information, the outside-vehicle information detection unit 7400 may also calculate the distance to an object outside the vehicle.

[0116] The outside vehicle information detection unit 7400 may also perform image recognition processing or distance detection processing to recognize people, vehicles, obstacles, signs, or characters on the road surface based on the received image data. The outside vehicle information detection unit 7400 may perform processing such as distortion correction or alignment on the received image data, and may also generate an overhead image or a panoramic image by combining image data captured by different image capturing units 7410. The outside vehicle information detection unit 7400 may also perform viewpoint conversion processing using image data captured by different image capturing units 7410.

[0117] The interior information detection unit 7500 detects information inside the vehicle. A driver state detection unit 7510 that detects the driver's state is connected to the interior information detection unit 7500, for example. The driver state detection unit 7510 may include a camera that captures an image of the driver, a biosensor that detects the driver's biometric information, or a microphone that collects sound from within the vehicle cabin. The biosensor is provided, for example, on the seat or steering wheel, and detects the biometric information of a passenger sitting in the seat or the driver gripping the steering wheel. The interior information detection unit 7500 may calculate the driver's level of fatigue or concentration based on the detection information input from the driver state detection unit 7510, or may determine whether the driver is dozing off. The interior information detection unit 7500 may perform processing such as noise canceling on the collected audio signal.

[0118] The integrated control unit 7600 controls the overall operation of the vehicle control system 7000 according to various programs. An input unit 7800 is connected to the integrated control unit 7600. The input unit 7800 may be implemented by a device that can be operated by a passenger, such as a touch panel, a button, a microphone, a switch, or a lever. Data obtained by voice recognition of a voice input through a microphone may be input to the integrated control unit 7600. The input unit 7800 may be, for example, a remote control device using infrared or other radio waves, or an externally connected device such as a mobile phone or a personal digital assistant (PDA) that can operate the vehicle control system 7000. The input unit 7800 may be, for example, a camera, in which case the passenger can input information using gestures. Alternatively, data obtained by detecting the movement of a wearable device worn by the passenger may be input. Furthermore, the input unit 7800 may include, for example, an input control circuit that generates an input signal based on information input by the passenger using the input unit 7800 and outputs the input signal to the integrated control unit 7600. Passengers and the like operate this input unit 7800 to input various data to the vehicle control system 7000 and to instruct processing operations.

[0119] The storage unit 7690 may include a ROM (Read Only Memory) that stores various programs executed by the microcomputer, and a RAM (Random Access Memory) that stores various parameters, calculation results, sensor values, etc. The storage unit 7690 may also be realized by a magnetic storage device such as an HDD (Hard Disc Drive), a semiconductor storage device, an optical storage device, a magneto-optical storage device, or the like.

[0120] The general-purpose communication I / F 7620 is a general-purpose communication I / F that mediates communication with various devices present in the external environment 7750. The general-purpose communication I / F 7620 may implement a cellular communication protocol such as GSM (Global System of Mobile communications), WiMAX (registered trademark), LTE (Long Term Evolution), or LTE-Advanced (LTE-A), or other wireless communication protocols such as a wireless LAN (also referred to as Wi-Fi (registered trademark)) or Bluetooth (registered trademark). The general-purpose communication I / F 7620 may connect to a device (e.g., an application server or a control server) present on an external network (e.g., the Internet, a cloud network, or an operator-specific network) via, for example, a base station or an access point. In addition, the general-purpose communication I / F 7620 may connect to a terminal located near the vehicle (for example, a terminal of a driver, pedestrian, or store, or an MTC (Machine Type Communication) terminal) using, for example, P2P (Peer To Peer) technology.

[0121] The dedicated communication I / F 7630 is a communication I / F that supports a communication protocol designed for use in vehicles. The dedicated communication I / F 7630 may implement a standard protocol such as WAVE (Wireless Access in Vehicle Environment), which is a combination of a lower layer IEEE 802.11p and an upper layer IEEE 1609, DSRC (Dedicated Short Range Communications), or a cellular communication protocol. The dedicated communication I / F 7630 typically performs V2X communication, which is a concept including one or more of vehicle-to-vehicle communication, vehicle-to-infrastructure communication, vehicle-to-home communication, and vehicle-to-pedestrian communication.

[0122] The positioning unit 7640 performs positioning by receiving, for example, GNSS signals from GNSS (Global Navigation Satellite System) satellites (for example, GPS signals from GPS (Global Positioning System) satellites), and generates position information including the latitude, longitude, and altitude of the vehicle. Note that the positioning unit 7640 may identify the current position by exchanging signals with a wireless access point, or may obtain position information from a terminal such as a mobile phone, PHS, or smartphone that has a positioning function.

[0123] The beacon receiving unit 7650 receives, for example, radio waves or electromagnetic waves transmitted from radio stations or the like installed on the road, and acquires information such as the current location, congestion, road closures, required travel time, etc. The function of the beacon receiving unit 7650 may be included in the dedicated communication I / F 7630 described above.

[0124] The in-vehicle device I / F 7660 is a communication interface that mediates connections between the microcomputer 7610 and various in-vehicle devices 7760 present in the vehicle. The in-vehicle device I / F 7660 may establish wireless connections using wireless communication protocols such as wireless LAN, Bluetooth (registered trademark), NFC (Near Field Communication), or WUSB (Wireless USB). Furthermore, the in-vehicle device I / F 7660 may establish a wired connection such as USB (Universal Serial Bus), HDMI (High-Definition Multimedia Interface), or MHL (Mobile High-Definition Link) via a connection terminal (and a cable, if necessary) not shown. The in-vehicle device 7760 may include, for example, at least one of a mobile device or a wearable device owned by a passenger, or an information device carried into or attached to the vehicle. The in-vehicle device 7760 may also include a navigation device that searches for a route to an arbitrary destination. The in-vehicle device I / F 7660 exchanges control signals or data signals with these in-vehicle devices 7760.

[0125] The in-vehicle network I / F 7680 is an interface that mediates communication between the microcomputer 7610 and the communication network 7010. The in-vehicle network I / F 7680 transmits and receives signals in accordance with a predetermined protocol supported by the communication network 7010.

[0126] The microcomputer 7610 of the integrated control unit 7600 controls the vehicle control system 7000 in accordance with various programs based on information acquired via at least one of the general-purpose communication I / F 7620, the dedicated communication I / F 7630, the positioning unit 7640, the beacon receiving unit 7650, the in-vehicle device I / F 7660, and the in-vehicle network I / F 7680. For example, the microcomputer 7610 may calculate control target values ​​for the driving force generating device, the steering mechanism, or the braking device based on the acquired information inside and outside the vehicle, and output control commands to the drivetrain control unit 7100. For example, the microcomputer 7610 may perform cooperative control aimed at realizing functions of an Advanced Driver Assistance System (ADAS), including vehicle collision avoidance or impact mitigation, following driving based on the following distance, vehicle speed maintenance driving, vehicle collision warning, vehicle lane departure warning, etc. In addition, the microcomputer 7610 may perform cooperative control for the purpose of autonomous driving, in which the vehicle travels autonomously without relying on driver operation, by controlling a driving force generating device, a steering mechanism, a braking device, etc. based on information acquired about the vehicle's surroundings.

[0127] The microcomputer 7610 may generate three-dimensional distance information between the vehicle and objects such as surrounding structures and people, and create local map information including information about the vicinity of the vehicle's current location, based on information acquired via at least one of the general-purpose communication I / F 7620, the dedicated communication I / F 7630, the positioning unit 7640, the beacon receiving unit 7650, the in-vehicle device I / F 7660, and the in-vehicle network I / F 7680. Furthermore, the microcomputer 7610 may predict dangers, such as a vehicle collision, the approach of a pedestrian, or entry into a closed road, based on the acquired information, and generate a warning signal. The warning signal may be, for example, a signal for generating a warning sound or turning on a warning lamp.

[0128] The audio / image output unit 7670 transmits at least one of audio and image output signals to an output device capable of visually or audibly notifying vehicle occupants or the outside of the vehicle of information. In the example of FIG. 19 , an audio speaker 7710, a display unit 7720, and an instrument panel 7730 are illustrated as output devices. The display unit 7720 may include, for example, at least one of an on-board display and a head-up display. The display unit 7720 may have an AR (Augmented Reality) display function. The output device may also be other devices, such as headphones, a wearable device such as an eyeglass-type display worn by the occupant, a projector, or a lamp. When the output device is a display device, the display device visually displays results obtained by various processes performed by the microcomputer 7610 or information received from other control units in various formats, such as text, images, tables, and graphs. When the output device is an audio output device, the audio output device converts audio signals, such as reproduced audio data or acoustic data, into analog signals and audibly outputs the analog signals.

[0129] In the example shown in FIG. 19 , at least two control units connected via the communication network 7010 may be integrated into a single control unit. Alternatively, each control unit may be composed of multiple control units. Furthermore, the vehicle control system 7000 may include another control unit not shown. In the above description, some or all of the functions performed by one of the control units may be assigned to another control unit. In other words, as long as information is transmitted and received via the communication network 7010, predetermined arithmetic processing may be performed by one of the control units. Similarly, a sensor or device connected to one of the control units may be connected to another control unit, and multiple control units may transmit and receive detection information to and from each other via the communication network 7010.

[0130] A computer program for realizing each function of the imaging system 10 according to this embodiment described with reference to FIG. 1 can be implemented in any control unit or the like. A computer-readable recording medium storing such a computer program can also be provided. The recording medium can be, for example, a magnetic disk, an optical disk, a magneto-optical disk, or a flash memory. The computer program may also be distributed, for example, via a network, without using a recording medium.

[0131] In the vehicle control system 7000 described above, the imaging system 10 according to the present embodiment described with reference to FIG. 1 can be applied to the imaging unit 7410 of the application example shown in FIG.

[0132] The present technology can be configured as follows:

[0133] (1) An imaging device comprising: a plurality of pixels that output a first signal when a predetermined event is detected; an arbiter unit that arbitrates the first signals from each of the plurality of pixels and outputs a second signal based on the arbitration result; and a failure detection unit that detects a failure in the arbiter unit based on the first signal and the second signal.

[0134] (2) The imaging device according to (1), wherein the failure detection unit detects a first failure when the second signal corresponding to the first signal is not output within a predetermined time.

[0135] (3) The imaging device according to (1), wherein the failure detection unit detects a second failure when the second signal corresponding to the first signal is not output.

[0136] (4) The imaging device according to (1), wherein the failure detection unit detects a third failure when the second signal corresponding to the first signal is output in a case where the first signal is not input.

[0137] (5) The imaging device according to (1), wherein a case in which a plurality of the second signals are output simultaneously is detected as a fourth failure.

[0138] (6) The imaging device according to (1), wherein the plurality of pixels are connected to the arbiter unit via respective wirings, and the arbiter unit arbitrates the plurality of first signals input via the respective wirings, and transmits the second signal to the wiring to which the first signal selected based on the arbitration was transmitted.

[0139] (7) The imaging device according to (6), wherein the failure detection unit detects the failure based on signals from the respective wirings.

[0140] (8) The imaging device according to (2), wherein the failure detection unit has a first determination circuit that determines whether a predetermined time has elapsed since the first signal was output, and detects the first failure based on a determination result of the first determination circuit.

[0141] (9) The imaging device according to (8), wherein the failure detection unit further includes a second determination circuit that determines whether the state in which the first signal is being output is being maintained, and detects the first failure based on the determination result of the second determination circuit.

[0142] (10) The imaging device according to (9), wherein the failure detection unit further includes a third determination circuit that determines a state in which the second signal corresponding to the first signal is not output, and detects the first failure based on a determination result of the third determination circuit.

[0143] (11) The imaging device according to (3), wherein the failure detection unit further includes a third determination circuit that determines a state in which the second signal corresponding to the first signal is not output, and detects the second failure based on a determination result of the third determination circuit.

[0144] (12) The imaging device according to (10), wherein the failure detection unit has a fourth determination circuit that determines whether a state in which the second signal corresponding to the first signal is being output is being maintained when a state in which the first signal is not being output is maintained, and detects the first failure based also on a determination result of the fourth determination circuit.

[0145] (13) The imaging device according to (4), wherein the failure detection unit has a fourth determination circuit that determines whether a state in which the second signal corresponding to the first signal is being output is being maintained when a state in which the first signal is not being output is maintained, and detects the third failure based on a determination result of the fourth determination circuit.

[0146] (14) The imaging device according to (6), wherein the failure detection unit has a fifth determination circuit that determines whether the second signal is being output simultaneously to at least two of the wirings, and detects a fourth failure based on a determination result of the fifth determination circuit.

[0147] (15) The imaging device described in (12), wherein a first count signal that repeats a plurality of different numerical values ​​and a second count signal that has a time delay from the first count signal and repeats the same numerical value as the first count signal are input to the first judgment circuit, and the first judgment circuit has: a sustain circuit that outputs the numerical value of the second count signal at the time when the first signal is output; and a NEXOR circuit that takes a logical AND of the sustain output signal of the sustain circuit and the first count signal and outputs a NEXOR signal indicating a match when they match.

[0148] (16) The imaging device described in (15), wherein the second determination circuit has a second AND circuit that takes a logical AND of a first state signal that is continuously output when the first signal is input and the exclusive NOR signal, and outputs a second AND signal indicating a match when the first state signal and the exclusive NOR signal match.

[0149] (17) The imaging device described in (16), wherein the third determination circuit includes: a second NOT circuit that inverts a second state signal that is continuously output when the second signal is input, and outputs a second inverted signal; and a third AND circuit that takes a logical AND of the second inverted signal and the second AND signal, and outputs a third AND signal indicating a match when the third AND signal is output. The failure detection unit detects the first failure when the third AND signal is output.

[0150] (18) The imaging device described in (17), wherein the fourth determination circuit includes: a first NOT circuit that inverts a first state signal that is continuously output when the first signal is input, and outputs a first inverted signal; and a fourth AND circuit that takes a logical AND of the first inverted signal and a second state signal that is continuously output when the second signal is input, and outputs a fourth logical AND signal indicating a match when the first inverted signal and the second state signal match, and the fault detection unit detects a fourth fault when the fourth logical AND signal is output.

[0151] (19) The imaging device according to (18), wherein the failure detection unit further includes a logical sum circuit that outputs a failure detection signal when the third logical product signal or the fourth logical product signal is input.

[0152] (20) A failure detection method for an imaging device including: a plurality of pixels that output a first signal when a predetermined event is detected; and an arbiter unit that arbitrates the first signals from each of the plurality of pixels and outputs a second signal based on the arbitration result, wherein the failure detection method detects a failure in the arbiter unit based on the first signal and the second signal.

[0153] The aspects of the present disclosure are not limited to the individual embodiments described above, but include various modifications that may be conceived by those skilled in the art, and the effects of the present disclosure are not limited to the above-described contents. In other words, various additions, modifications, and partial deletions are possible within the scope of the conceptual idea and spirit of the present disclosure, which is derived from the contents defined in the claims and their equivalents.

[0154] 20: imaging device, 23: arbiter unit, 26: fault detection unit, 30: pixel, 268: first judgment circuit, 268c: exclusive NOR circuit, 272: second judgment circuit, 274: third judgment circuit, 274a: negation circuit, 274b: logical product circuit, 276: fourth judgment circuit, 276a: negation circuit, 276b: logical product circuit.

Claims

1. An imaging device comprising: a plurality of pixels that output a first signal (request signal) when a specified event is detected; an arbiter unit that arbitrates the first signals from each of the plurality of pixels and outputs a second signal (permission signal) based on the arbitration result; and a failure detection unit that detects a failure of the arbiter unit based on the first signal and the second signal.

2. The imaging device according to claim 1, wherein the failure detection unit detects a first failure when the second signal corresponding to the first signal is not output within a predetermined time.

3. The imaging device according to claim 1, wherein the failure detection unit detects a second failure when the second signal corresponding to the first signal is not output.

4. The imaging device according to claim 1, wherein the fault detection unit detects a third fault when the second signal corresponding to the first signal is output when the first signal is not input.

5. The imaging device according to claim 1, wherein when a plurality of the second signals are output simultaneously, this is detected as a fourth fault.

6. The imaging device described in claim 1, wherein the plurality of pixels are connected to the arbiter unit via respective wirings, and the arbiter unit arbitrates the plurality of first signals input via the respective wirings, and transmits the second signal to the wiring to which the first signal selected based on the arbitration was transmitted.

7. The imaging device according to claim 6, wherein the failure detection section detects the failure based on signals in the respective wirings.

8. The imaging device according to claim 2, wherein the failure detection unit has a first determination circuit that determines whether a predetermined time has elapsed since the first signal was output, and detects the first failure based on a determination result of the first determination circuit.

9. The imaging device according to claim 8, wherein the failure detection unit further has a second judgment circuit that judges whether the state in which the first signal is being output is being maintained, and detects the first failure based also on the judgment result of the second judgment circuit.

10. The imaging device described in claim 9, wherein the failure detection unit further has a third judgment circuit that judges a state in which the second signal corresponding to the first signal is not output, and detects the first failure based also on the judgment result of the third judgment circuit.

11. The imaging device of claim 3, wherein the failure detection unit further has a third judgment circuit that judges a state in which the second signal corresponding to the first signal is not output, and detects the second failure based also on the judgment result of the third judgment circuit.

12. The imaging device described in claim 10, wherein the failure detection unit has a fourth judgment circuit that judges whether or not a state in which the second signal corresponding to the first signal is being output is maintained when a state in which the first signal is not being output is maintained, and detects the first failure based also on a judgment result of the fourth judgment circuit.

13. The imaging device described in claim 4, wherein the failure detection unit has a fourth judgment circuit that judges whether or not a state in which the second signal corresponding to the first signal is being output is maintained when a state in which the first signal is not being output is maintained, and detects the third failure based on a judgment result of the fourth judgment circuit.

14. The imaging device described in claim 6, wherein the fault detection unit has a fifth judgment circuit that judges whether the second signal is being output simultaneously to at least two of the respective wirings, and detects a fourth fault based on the judgment result of the fifth judgment circuit.

15. The imaging device of claim 12, wherein a first count signal that repeats a number of different numerical values ​​and a second count signal that has a time delay from the first count signal and repeats the same numerical value as the first count signal, and the first judgment circuit has: a sustain circuit that outputs the numerical value of the second count signal at the time when the first signal is output; and a NEXOR circuit that takes the logical product of the sustain output signal of the sustain circuit and the first count signal and, if they match, outputs a NEXOR signal indicating a match.

16. The imaging device described in claim 15, wherein the second judgment circuit has a second AND circuit that takes a logical AND of a first state signal that is continuously output when the first signal is input and the exclusive NOR signal, and outputs a second logical AND signal indicating a match if the two match.

17. The imaging device described in claim 16, wherein the third judgment circuit has: a second NOT circuit that inverts the second state signal that is continuously output when the second signal is input, and outputs a second inverted signal; and a third AND circuit that takes a logical AND of the second inverted signal and the second AND signal, and outputs a third AND signal indicating a match when the two match, and the fault detection unit detects the first fault when the third AND signal is output.

18. The imaging device described in claim 17, wherein the fourth judgment circuit has: a first NOT circuit that inverts a first state signal that is continuously output when the first signal is input, and outputs a first inverted signal; and a fourth AND circuit that takes a logical AND between the first inverted signal and the second state signal that is continuously output when the second signal is input, and outputs a fourth logical AND signal indicating a match when they match; and the fault detection unit detects a fourth fault when the fourth logical AND signal is output.

19. The imaging device according to claim 18, wherein the failure detection section further comprises a logical sum circuit that outputs a failure detection signal when the third logical product signal or the fourth logical product signal is input.

20. A failure detection method for an imaging device having a plurality of pixels that output a first signal when a specified event is detected, and an arbiter unit that arbitrates the first signals from each of the plurality of pixels and outputs a second signal based on the arbitration result, the failure detection method detecting a failure of the arbiter unit based on the first signal and the second signal.

Images