CN100545771C - vehicle control device - Google Patents

Abstract

A vehicle control device comprising a sensor controller that takes in a sensor signal representing a state quantity of a vehicle and a driver's operation amount through a network connection, and an instruction controller that generates a control target value based on the sensor signal taken in by the sensor controller, and an actuator controller that receives a control target value from the instruction controller to operate an actuator for controlling the vehicle; The controller generates a control target value generating means for generating a control target value from the sensor value of the sensor controller on the network received by the controller, and controls the actuator by the control target value generated by the control target generating means. In this vehicle control device, the redundancy of each controller is not increased more than necessary, and by preventing errors in the entire system, high reliability, real-time performance, and expandability are ensured with a simple ECU configuration and low cost.

Description

vehicle control device

technical field

The present invention relates to a vehicle control device (vehicle control system) for controlling the running state of a vehicle, and more particularly to a vehicle control device for driving, steering, and braking a prime mover of a vehicle such as an automobile by electronic control.

Background technique

Conventionally, as a vehicle control device, there is an operation control device that collectively controls control devices related to braking force, driving force, and steering angle by an electronic control device constituting one host (for example, Patent Document 1).

In recent years, with the goal of improving the driving comfort and safety of automobiles, it is not a mechanical combination, but an electronic control that reflects the driver's acceleration, steering, braking, etc. to the driving force and steering force of the vehicle. , The development of the vehicle control device on the braking force generating mechanism has become extremely active. Such a vehicle control device is required to have high reliability so as not to lose functions related to driving, steering, and braking of the vehicle.

Conventionally, control by a mechanical mechanism is converted into an electrical mechanism. Fly-by-Wire in aircraft control and X-by-Wire in car control are good examples. In these applications, conventionally, a mechanical backup mechanism has been prepared for failure, but as the mechanical mechanism disappears, high reliability of the electrical mechanism is required.

Even in the X-by-Wire (XBW system) of electronically controlled vehicles, the Steer-by-Wire of the electronically controlled steering gear and the Brake-by-Wire of the electronically controlled brake are required to perform reliable operation without malfunctioning, and require have high reliability. In particular, Steer-by-Wire requires high reliability because there is no fail-safe steering position at the time of failure.

In addition, it is widely believed that the advantage of X-by-Wire is the so-called vehicle stability control that improves vehicle stability by comprehensively controlling steering and braking through electronic control, thereby improving the active safety of automobile safety (for example, patent Document 3).

In addition, as a conventional example of a highly reliable vehicle control device, there is an example of improving reliability by duplicating a main controller having functions such as ABS (AntiLock Brake System) and TCS (Transmission Controlled System) (for example, Non-Patent Document 1) , and by constituting the control module of the front wheel brake that can continue to operate normally even if an error occurs (failure operation), and the control module of the rear wheel brake that stops this function when an error occurs (fault non-response) to achieve high An example of reliability (for example, Patent Document 2).

For example, as a kind of vehicle control device, there is an electric signal that converts the operation amount of the driver's operating device such as the brake pedal into an electrical signal, and transmits this to the braking mechanism through a communication device such as CAN (Control Area Network). A vehicle control device that is electronically controlled in a control computer.

[Patent Document 1] JP-A-2003-263235

[Patent Document 2] JP-A-2002-347602

[Patent Document 3] JP-A-10-291489

[Non-Patent Document 1] The bottom left picture of slide 12 on pages 3-6 of the 1st "X-by-Wire" seminar materials hosted by D&M Nikkei Mechanical Engineering, etc.

Such a vehicle control device is generally known as an X-by-Wire system, and compared with conventional mechanical and hydraulic mechanisms, it is considered that it can achieve a high degree of comprehensive driving control and vehicle control brought by the use of computers. Reduced weight and improved design freedom.

In the conventional vehicle control device, there is a problem that the sensor for monitoring the driver's operation amount and the state of the vehicle is input to the electronic control unit (main ECU) constituting one master, and the integrated control is used as the vehicle control device. The internal combustion engine control device, the brake control device, and the steering control device of the actuator, so that when the main ECU fails, since all operations cannot be performed, the reliability of the main ECU should be particularly improved in order to ensure safety.

Here, it is known that reliability can be ensured by multiplying main ECUs, but there is a problem of increasing costs by multiplying main ECUs that require high-level processing.

In the conventional control system structure, the subsystems of the internal combustion engine, steering gear, and brake constitute the whole vehicle. This is due to the 1-to-1 association of the actuating device with the actuator, like the accelerator with the internal combustion engine, the steering wheel with the steering gear, the brake pedal with the brakes.

The XBW systems that are currently in practical use are often designed as extensions of the conventional control architecture described above. That is, the subsystems are formed according to the functions of Drive-by-Wire, Steer-by-Wire and Brake-by-Wire, and the vehicle motion control is realized through the coordination among these subsystems.

When the problems of these conventional technologies (conventional control architecture) are considered, it can be seen that in order to ensure the reliability, real-time performance, and expandability required of the vehicle control device, there is a problem that the cost becomes very high. The problems of the prior art are shown below.

In a vehicle integrated vehicle control device, high reliability is required. That is, it is necessary to ensure that the vehicle can run safely even if the controller and the sensor/actuator malfunction.

In the conventional technology, since the function development is performed for each subsystem, the failure operability (operability in the event of a failure) of each subsystem is required. That is, in the prior art, there is an ECU that controls actuators (steering, brakes, etc.) based on sensors (steering, pedals, etc.) for each subsystem.

Since the ECU centrally controls the sensors and actuators, in order to make the whole system fail-operable, it is necessary to make the ECU of each sub-system have fail-operability. In order to make the ECU fail-operable, it is necessary to perform multiplexing, etc., which leads to an increase in product cost.

In order to realize a high-reliability system at low cost, it has been difficult to realize in the conventional configuration that each subsystem has an ECU and the ECU has fault operability.

In view of this, the present inventors considered separating the control functions of the ECU into vehicle integrated control, actuator control, and sensor control, and provided sufficient and necessary reliability for each function. For the actuator control function, even When the comprehensive control function of the vehicle is abnormal, it can also provide an autonomous backup function that can be controlled based on sensor information. As long as this can be achieved, a high-reliability and low-cost system can be effectively realized.

In addition, in vehicle control devices, hard real-time processing satisfying strict time constraints is essential. That is, it is necessary to reflect the changes of the occupant's manipulation and road surface conditions in the control within a limited time. In the conventional technology, since the function development is carried out for each subsystem, it is relatively easy to ensure real-time performance in the subsystem.

However, it is difficult to ensure real-time performance when combining the control of multiple actuators, such as the control of the sideslip posture. That is, since the information obtained from one sensor is transmitted to the vehicle control functions of multiple sub-systems such as brakes, steering gear, and internal combustion engine, it is difficult to ensure the actions within the "dead line" required for control.

Furthermore, due to the delay in data transmission, it is also difficult to ensure simultaneous reference of data in each subsystem. Therefore, in order to achieve a high degree of coordination of vehicle motion control in the conventional technology, it is necessary to increase man-hours for adaptation and adjustment of the system and subsystems, which increases the development cost.

In the conventional configuration, it is difficult to achieve real-time integrated control at low cost, and to distribute vehicle control logic modules and device drivers to each ECU and to achieve coordination among ECUs.

In view of this, the present inventors consider dividing the control function into the vehicle comprehensive control ECU and the equipment (actuator, sensor) controller, as long as each can operate autonomously and share data, real-time comprehensive control can be effectively realized.

In addition, in the development of new vehicles, in order to reduce development costs, the method of developing multiple models using a common platform is generally adopted. Therefore, it is necessary to be able to easily implement the addition of functions and the modification of components for each vehicle type. However, in the conventional technology, since the functions are realized by ECUs at the system level, it is difficult to standardize the sensor and actuator levels.

That is, as the control logic module included in the ECU, there are both a logical and abstract control application program and a device driver part that actually controls sensors and actuators.

There is also a movement to standardize device drivers, but in any case, it is the standardization of the interface, and it is closely related to the control application program in terms of real-time performance and ECU resources.

Therefore, if there is an addition or change of sensors and actuators, design changes such as control tasks at the sub-system level will occur, and there is a problem of bringing about an increase in development costs.

In order to realize a highly expandable system, it is necessary to provide a virtual shared memory in the distributed vehicle control device in addition to having a controller capable of autonomous operation. In this regard, the inventors considered that each sensor/actuator uses a high-dimensional interface such as state information and control target value, propagates it in a shared memory, and at the same time, autonomously acquires and controls the data necessary for each sensor/actuator. Effective.

The problem for the practical use of a highly reliable vehicle control device is to achieve high reliability without greatly increasing the cost. However, in the conventional technology, a main controller or a part of the control unit is constructed by complicated hardware such as redundancy. It cannot be considered as the optimal system configuration in terms of cost to realize failure operation.

In addition, in the above-mentioned conventional technology, even when the driver operates beyond the limit of the vehicle, the brake operation is electronically corrected, so that slipping, rotation, etc. of the vehicle can be avoided, and accidents can be prevented before they occur.

However, since information from the brake pedal and various sensors to the brakes of each wheel is centrally controlled by the electronic control unit (ECU), when the electronic control unit (ECU) fails, the brakes are not operated, so the electronic control The unit (ECU) requires high reliability, and further consideration needs to be given to the reliability of the control device.

Contents of the invention

In view of the above problems, an object of the present invention is to provide a method for ensuring high reliability and real-time operation with a simple ECU configuration and low cost by preventing errors in the entire system without increasing the redundancy of each controller more than necessary. Sexuality and scalability of the vehicle control device.

In the vehicle control device of the present invention, the sensor slave computer (sensor controller) outputs sensor values to the same network, and the master computer (command controller) receives the sensor values and calculates a control target value based on the sensor values, and outputs the sensor values to the network. At the same time, the actuator slave computer (executor controller) receives the control target value and controls the actuator; when the actuator slave computer cannot correctly receive the control target value, the actuator slave computer receives the sensor slave computer The control target value is calculated based on the sensor value output to the same network, and the actuator is controlled.

According to the vehicle control device of the present invention, the operation amount generation node that calculates the operation amount command value based on the driver's request signal and the vehicle state signal controls the actuator based on the operation amount designation value given from the operation amount generation node. The actuator drives the nodes to drive, steer, and brake the vehicle. Each of the above-mentioned nodes has a fault detection function. When a fault is detected in the node through the fault detection function, it does not involve notifying the node to the outside of the node. For functions other than the failure state, when a failure occurs on any node, based on the failure detection notification given from a node in the failure state, it continues to function as a system by performing switching control in a normal node other than the node. Overall normal movement.

The sensor that detects the above-mentioned driver's request is connected to the communication network, and when a fault is detected in the sensor, it does not involve the action of notifying the node that it is in a state other than a fault to the outside of the node.

The sensor is specifically composed of a plurality of sensor components, an A/D converter for converting the outputs of the plurality of sensor components into digital values, a coincidence detection function for a plurality of A/D converted values, a filter function, and a communication interface.

The operation amount generating node described above, when receiving a failure detection notification given from a node in a failure state, stably maintains the running state of the vehicle by switching control corresponding to the failure.

The actuator drive node has a function of generating an operation amount command value based on the signal of the sensor detecting the driver's request when the operation amount command value given from the operation amount generating node cannot be received. When the above operation amount generation node gives the operation amount command value, the running state of the vehicle is stably maintained by switching from the normal control to the control for realizing this function.

A sensor detecting a driver's request, an operation variable generating node, and an actuator driving node are connected to the same communication network. This communication network is composed of a main bus and a backup bus. The main bus is connected with all the sensors detecting the driver's request, the operation amount generation node and the actuator drive node, and the backup bus is connected with the sensors for detecting the driver's request. A part, and a part of the actuator drive node, when the main bus fails, the actuator drive node keeps the running state of the vehicle stably.

More specifically, in the vehicle control device of the present invention, the sensor for detecting the above-mentioned driver's request is a steering angle sensor for measuring the rotation angle of the steering gear, a brake pedal position sensor for measuring the depression amount of the brake pedal, and The accelerator pedal position sensor that measures the amount of depression of the accelerator pedal, and the operation amount generation node interpret the driver's intention based on the signal of the sensor that detects the above-mentioned driver's request, and control the vehicle motion comprehensively together with the sensor signal that detects the vehicle state The vehicle motion integrated controller, and the drive system integrated controller that comprehensively controls the driving system of the vehicle, the actuator drive node, the steering actuator actuator drive controller that controls the steering actuator that generates the steering force, and the control that generates the braking force A brake actuator drive controller for the brake actuators and a suspension actuator drive controller for controlling the suspension actuators that adjust the damping force are connected to the same communication network. In addition, a radar or a camera for detecting the external state of the vehicle may also be connected to the above-mentioned communication network.

Furthermore, the accelerator pedal position sensor may receive a torque command value from the drive system integrated control controller while being connected to the communication network, and may be directly connected to an engine control controller for controlling an internal combustion engine based on this.

In such a vehicle control device, when the brake pedal and the brake force generating mechanism are not mechanically connected, at least the brake pedal position sensor continues to operate normally even in the event of a single failure.

When the steering gear and the steering force generating mechanism are not mechanically combined, at least the steering angle sensor and the steering gear actuator drive controller continue to operate normally even in the event of a single failure, and the steering gear actuator becomes redundant.

It is characterized in that the force generated by each steering gear actuator is smaller than the force generated by the steering gear actuator used in the system that mechanically combines the steering gear and the steering force generating mechanism.

In addition, when the above-mentioned steering gear actuator drive controller detects a fault in a node, it does not involve the function of notifying the node that the node is in a fault state and making the drive nodes redundant, and the drive nodes are independently Drive the aforementioned redundant steering gear actuators.

In a vehicle control device without a backup mechanism for brakes and steering gears, the above-mentioned brake pedal position sensor and steering angle sensor are A/D devices that convert the outputs of the multiple sensor components into digital values. Converter, a plurality of A/D conversion value consistency check function, filter function, and communication interface constitute a sensor that does not respond to a failure to implement a redundant sensor, or is composed of at least three sensor components, the plurality of sensor components It is a fault-operated sensor composed of an A/D converter that converts the output into a digital value, a majority judgment function for multiple A/D conversion values, a filter function, and a communication interface.

The vehicle control device of the present invention has an operation amount generating node, a correction amount generating node, and an actuator driving node. On the actuator driving node, when the correction amount generating node is normal, the operation amount given by the operating amount generating node is The actuator is controlled by applying the correction amount given from the correction amount generation node as the control target value, and when the correction amount generation node is abnormal, the actuator is controlled using the operation amount given by the operation amount generation node as the control target value.

As a result, even when the correction amount generation node fails, the correction is not performed, but the actuator can be controlled based on the operation amount.

In addition, the vehicle control device of the present invention has: a plurality of actuator driving devices for controlling the actuators based on the driver's request or the state of the vehicle; and a communication device for connecting the plurality of actuator driving devices to control the driving and steering of the vehicle. . At least one of the brakes, the actuator drive device has a control method selection device for selecting a control method of the actuator based on its own operating state and the operating state of other actuator drive devices.

In addition, the vehicle control device of the present invention has: a plurality of actuator driving devices for controlling the actuators based on the driver's request or the state of the vehicle; and a communication device for connecting the plurality of actuator driving devices to control the driving and steering of the vehicle. 1. At least one of the brakes, the actuator drive device, has a fault detection device that detects its own fault and notifies other actuator drive devices of the failure through a communication device, and based on its own fault state and other actuator drive devices. A control method selection device that selects the control method of the actuator according to the fault state.

In addition, the vehicle control device of the present invention is provided with: a plurality of actuator driving devices for controlling the actuators based on the driver's request or the state of the vehicle; At least one of steering and braking, the actuator drive device has a control method selection device for selecting a control method of the actuator based on the reception state of the short message received from the other actuator drive device through the communication device.

In addition, the vehicle control device of the present invention has: a plurality of actuator driving devices for controlling the actuators based on the driver's request or the state of the vehicle; and a communication device for connecting the plurality of actuator driving devices to control the driving and steering of the vehicle. , At least one of the brakes, the actuator drive device, has the function of sending a short message for notifying the action state to the other actuator drive device through the communication device and selecting based on whether the above short message is received from the other actuator drive device. A control method selection device for a control method of an actuator.

In addition, the vehicle control device of the present invention has: at least one operation amount generation device that calculates an operation amount command value based on a driver's request or a vehicle state; A plurality of actuator drive devices for actuators, and a communication device that connects the operation amount generation device and the actuator drive device, and controls at least one of driving, steering, and braking of the vehicle, and the actuator drive device has an action state based on itself , and the operating state of the other actuator driving device, and the operating state of the operation amount generating device to select the control method selection device for the control method of the actuator.

In addition, the vehicle control device of the present invention has: at least one operation amount generation device that calculates an operation amount command value based on a driver's request or a vehicle state; A plurality of actuator drive devices for actuators, and a communication device that connects the operation amount generation device and the above actuator drive device, and controls at least one of driving, steering, and braking of the vehicle, and the operation amount generation device has a function of detecting its own failure And through the communication device, the failure detection device notifies the above-mentioned actuator driving device or the operation amount generating device of the occurrence of the failure. A control method selection device that selects a control method for the actuator by notifying the fault detection device of the occurrence of the fault, the fault state of itself, the fault state of other actuator drive devices, and the fault occurrence state of the manipulated variable generating device.

In addition, the vehicle control device of the present invention has: at least one operation amount generation device that calculates an operation amount command value based on a driver's request or a vehicle state; A plurality of actuator drive devices for actuators, and a communication device that connects the operation amount generation device and the above-mentioned actuator drive device, and controls at least one of driving, steering, and braking of the vehicle, and the actuator drive device has The control method selection device that selects the control method of the executive component based on the receiving status of the short message given by the component driving device or the operation amount generating device.

In addition, the vehicle control device of the present invention has: at least one operation amount generation device that calculates an operation amount command value based on a driver's request or a vehicle state; A plurality of actuator drive devices for actuators, and a communication device that connects the operation amount generation device with the above actuator drive device, and controls at least one of driving, steering, and braking of the vehicle, and the operation amount generation device communicates the operation through the communication device The command value of the actuator is sent to each actuator drive device; the actuator drive device, when receiving the command value of the operation variable, sends the response short message to the operation variable generating device or other actuator drive devices through the above communication device, The actuator driving device has a control method selection device, and the control method selection device selects and executes the control method based on whether an operation variable command value given from the operation variable generating device or a response short message given from another actuator drive device is received. The control method of the component.

In addition, the vehicle control device of the present invention has: a sensor device for detecting a driver's request or a vehicle state; at least one operation amount generating device for calculating an operation amount command value based on information given from the sensor device; a plurality of actuator driving means for controlling the actuators from an operation amount command value given by the operation amount generating means or information given from the above-mentioned sensor, and a communication means connecting the sensor means with the operation amount generating means and the actuator driving means, and Controlling at least one of the driving, steering, and braking of the vehicle, the actuator drive device has a control method selection device, and the control method selection device is based on its own action state and the action state of other actuator drive devices. For the operating state of the device's failure, select any one of the control method using the operation amount command value given from the operation amount generating device, the control method using information given from the sensor, and the control method that makes the actuator a predetermined state. method.

In addition, the vehicle control device of the present invention has: a sensor device for detecting a driver's request or a vehicle state; at least one operation amount generating device for calculating an operation amount command value based on information given from the sensor device; A plurality of actuator driving devices that control the actuators by generating an operation amount command value from the device or information from the above-mentioned sensors, and a communication device that connects the sensor device with the operation amount generating device and the actuator drive device, and controls the vehicle At least one of driving, steering, and braking, the operation variable generation device, the fault detection device that detects its own fault and notifies the actuator drive device or the operation variable generation device through the communication device of the failure detection device, the actuator drive device, has A control method selection device, the control method selection device is based on detecting its own fault and notifying other actuator drive devices or operation variable generation devices of the fault detection device, its own fault state, and other actuator drive devices through the communication device. The failure state of the device and the occurrence state of the failure of the manipulated variable generating device, select the control method using the manipulated variable command value given from the manipulated variable generating device, the control method using the information given from the sensor, and make the actuator a predetermined value. Any one of the state control methods.

In addition, the vehicle control device of the present invention has: a sensor device for detecting a driver's request or a vehicle state; at least one operation amount generating device for calculating an operation amount command value based on information given from the sensor device; A plurality of actuator driving devices that control the actuators by generating an operation amount command value given by the device or information given from the sensor, and a communication device that connects the sensor device and the above-mentioned operation amount generating device and the actuator drive device, and controls the vehicle At least one of driving, steering, and braking, the actuator driving device has a control method selection device, and the control method selection device is based on the reception status of the short message given from the other actuator driving device or the operation amount generating device, Any one of the control method using the manipulated variable command value given from the manipulated variable generator, the control method using information given from the sensor, and the control method of setting the actuator in a predetermined state is selected.

In addition, the vehicle control device of the present invention has: a sensor device for detecting a driver's request or a vehicle state; at least one operation amount generating device for calculating an operation amount command value based on information given from the sensor device; A plurality of actuator driving devices that control the actuators by generating an operation amount command value given by the device or information given from the sensor, and a communication device that connects the sensor device and the above-mentioned operation amount generating device and the actuator drive device, and controls the vehicle At least one of driving, steering, and braking, the operating variable generating device sends the operating variable command value to each actuator driving device through the communication device; the actuator driving device, when receiving the operating variable command value, communicates The device sends the response short message to the operation variable generating device or the above-mentioned other actuator driving devices. The actuator driving device has a control method selection device. Manipulation command value or response short message given from other actuator drive devices, select the control method using the manipulating command value given from the manipulating quantity generating device, the control method using the information given from the sensor, and make the execution Any one of the control methods for the element to be in a specified state.

In addition, the vehicle control device according to the present invention has a structure in which the vehicle is driven, steered, and braked, and is arranged in a distributed manner: a node that detects a driver's request and outputs a signal, calculates an operation amount command value based on the request signal, and An operation amount generation node that performs signal output, and an actuator drive node that controls the actuator based on an operation amount command value given from the operation amount generation node; each of the above-mentioned nodes is provided with a data receiving table that stores each signal output, and It has the functions of judging its content and detecting faults of other nodes.

In addition, the vehicle control device of the present invention includes information indicating the time of the short message in the data receiving table, and when the delay of the time is greater than a predetermined value, it is judged that the sending place or its communication path is not working normally, or has Return to normal state.

In addition, the vehicle control device of the present invention includes a failure voting unit in the data reception table, and has a function of specifying a failure node or a node returning to a normal state based on a predetermined algorithm. Thereby, it is possible to determine the failure occurrence and recovery of a node, and to continue vehicle control safely.

In addition, the vehicle control device of the present invention outputs the fault diagnosis information of other nodes as a fault vote, and shares the fault judgment status of each node. As a result, since the failure judgments of the respective nodes agree, vehicle control can be continued safely.

(invention effect)

The vehicle control device of the present invention can safely continue vehicle control through other actuator drive devices even if it cannot control the operation amount generating device or any actuator drive device. Therefore, it is not necessary to increase the redundancy of each controller more than necessary, and it is possible to ensure high reliability, real-time performance, and expandability with a simple ECU configuration and low cost.

Description of drawings

FIG. 1 is a block diagram showing a basic configuration of Embodiment 1 of a vehicle control device according to the present invention.

2( a ) and ( b ) are data flow diagrams each showing a specific example of the flow of communication data in the vehicle control device of the first embodiment.

3 is a schematic diagram of a vehicle to which the vehicle control device of the first embodiment is applied.

4 is a control block diagram of a vehicle motion integrated control ECU of the vehicle control device of Embodiment 1. FIG.

Fig. 5 is an explanatory diagram showing the state of motion of the vehicle.

6 is a flowchart showing the flow of vehicle state estimation processing performed by the vehicle state estimation unit of the vehicle motion integrated control ECU.

7 is a flowchart showing the flow of target state calculation processing performed by the target state calculation unit of the vehicle motion integrated control ECU.

FIG. 8 is an explanatory diagram showing vehicle body manipulation vectors and manipulation torques.

9 is a flowchart showing the flow of operation amount calculation processing performed by the operation amount calculation unit of the vehicle motion integrated control ECU.

Fig. 10 is an explanatory diagram showing tire vectors for vehicle body manipulation.

11( a ), ( b ) are schematic diagrams showing operation amount allocation processing.

12 is a control block diagram of an integrated control ECU of the DBW system of the vehicle control device according to Embodiment 1. FIG.

Fig. 13 is a block diagram showing a next-generation integrated vehicle control device for a vehicle to which the vehicle control device of the present invention is applied, an autonomous decentralized control platform (Embodiment 2).

14(a), (b) are block diagrams showing the outline of the data area of the autonomous distributed control platform.

15 is a block diagram showing the outline of the autonomous operation of the distributed control platform, and is a schematic diagram of vehicle motion state quantities.

Fig. 16 is a block diagram showing an outline of autonomous monitoring.

Fig. 17 is a diagram showing an operation flow of an actuator node.

18( a ), ( b ) are block diagrams showing configuration examples of the XBW vehicle control device.

Fig. 19 is a block diagram showing the basic configuration of Embodiment 2 of the vehicle control device of the present invention.

Fig. 20 is a block diagram showing the function of an operation amount generating node.

Fig. 21 is a block diagram showing the functions of an actuator driver node.

Fig. 22 is a schematic diagram showing a vehicle according to Embodiment 3 of the vehicle control device of the present invention.

Fig. 23 is an explanatory diagram showing a node failure detection method in TDM communication.

Fig. 24 is a diagram showing the functional configuration of a sensor node responding to no failure.

FIG. 25 is a diagram showing a hardware configuration of a sensor node that responds without failure.

Fig. 26 is a schematic diagram showing a vehicle according to a fourth embodiment of the vehicle control device of the present invention.

Fig. 27 is a schematic diagram showing a vehicle according to Embodiment 5 of the vehicle control device of the present invention.

Fig. 28 is a schematic diagram showing a vehicle according to a sixth embodiment of the vehicle control device of the present invention.

Fig. 29 is a schematic diagram showing a vehicle according to a seventh embodiment of the vehicle control device of the present invention.

Fig. 30 is a block diagram showing the configuration of an actuator drive node.

Fig. 31 is a block diagram showing an example of making the operation amount generating node and the correction amount generating node redundant.

Fig. 32 is a block diagram showing an example of an actuator drive node having a plurality of functions and comparison functions.

Fig. 33 is a block diagram showing an embodiment of an actuator drive node that performs a devariation operation at the time of failure.

Fig. 34 is a timing chart showing the devariation operation at the time of failure.

Fig. 35 is a block diagram showing an embodiment in which nodes are connected to the same communication path.

Fig. 36 is a diagram showing the flow of information transmitted through the same communication channel.

Fig. 37 is a block diagram showing a specific example of applying this embodiment to a Steer-by-Wire system.

Fig. 38 is a block diagram showing a specific example of applying this embodiment to Brake-by-Wire.

Fig. 39 is a block diagram showing a specific example of applying this embodiment to an integrated system integrating Steer-by-Wire and Brake-by-Wire.

Fig. 40 is a block diagram showing the basic configuration of Embodiment 8 of the vehicle control device of the present invention.

Fig. 41 is a block diagram showing a modified example of the eighth embodiment of the vehicle control device of the present invention.

Fig. 42 is a block diagram showing another modified example of the eighth embodiment of the vehicle control device of the present invention.

Fig. 43 is a block diagram showing the function of an operation amount generation node.

Fig. 44 is a block diagram showing the function of an actuator driver node.

Fig. 45 is a time chart showing the operation of the actuator drive node.

Fig. 46 is a flowchart showing control program selection processing.

47(a) and (b) are explanatory diagrams each showing an example of a control program selection table.

Fig. 48 is a time chart showing the operations of the operation amount generating node and the actuator driving node at the start time of brake control.

Fig. 49 is a timing chart showing the operations of the operation amount generating node and the actuator driving node in brake control.

Fig. 50 is a flowchart showing a process for selecting a wheel for braking control.

51( a ) and ( b ) are explanatory diagrams each showing an example of a brake wheel selection table.

52 is a time chart showing operations of the operation amount generating node and the actuator driving node when the actuator driving node of the left rear wheel or the actuator fails at the brake control start time.

53 is a time chart showing operations of the operation amount generating node and the actuator driving node when the actuator driving node of the left rear wheel or the actuator fails during braking control.

54 is a time chart showing the operation of the actuator drive node of the left rear wheel which temporarily failed during brake control, or the operation amount generating node and the actuator drive node when the actuator is restored.

Fig. 55 is a time chart showing the operation of the actuator driving node when the operation amount generating node fails during braking control.

Fig. 56 is a time chart showing operations of the operation amount generation node and the actuator drive node when the operation amount generation node which failed temporarily during braking control is restored.

57 is a time chart showing the operation of the operation amount generation node and the actuator drive node of the left rear wheel or the actuator drive node when the actuator fails during brake control.

Fig. 58 is a block diagram showing another modified example of the eighth embodiment of the vehicle control device of the present invention.

Fig. 59 is a block diagram showing a ninth embodiment of the vehicle control device of the present invention.

Fig. 60 is a diagram showing a specific example of a data reception table.

Fig. 61 is a flowchart showing failure diagnosis processing of other nodes.

Fig. 62 is a block diagram showing another embodiment of the vehicle control device of the present invention.

In the figure: 1-main computer, 1A-main function, 2-sensor slave computer, 2A-sensor processing function, 3-actuator slave computer, 3A-executive element control function, 3B-simple main function, 4-sensor, 5 -Executive components, 10-Comprehensive vehicle motion control device, 11-Steering control device, 12-Braking force control device, 13-Drive force control device, 20-DBW system comprehensive control ECU, 21-Internal combustion engine control ECU, 22-Transmission Control ECU, 23-Electric motor control ECU, 24-Battery control ECU, 25-HMI·ECU, 30-Vehicle motion integrated control ECU, 31-Rudder angle indicating device, 32-Deceleration indicating device, 33-Acceleration indicating device, 35 -Control system gateway, 36-Car body system gateway, 41, 41A-Steering sensor (steering angle sensor), 42, 42A-Brake pedal position sensor, 43-Accelerator pedal position sensor, 44-Millimeter wave radar/camera, 50 -vehicle, 51-steering wheel, 52-brake pedal, 53-accelerator pedal, 54-VGR mechanism, 60A, 60B-sensor components, 61A, 61B-A/D converter, 62-consistent verification function, 63-filter Function, 64-communication controller, 65A, 65B-communication driver, 71-front wheel steering mechanism, 72R, 72L-front wheel, 73-front wheel brake mechanism, 74-rear wheel steering mechanism, 75R, 75L-rear wheel , 76-Rear wheel brake mechanism, 77-Front wheel suspension mechanism, 78-Rear wheel suspension mechanism, 81, 81A-SBW·VGR driver ECU, 811-Simple control logic department, 82-SBW driver ECU, 83A～ 83D-BBW driver ECU, 831-simple control logic unit, 84A～84D-EAS driver ECU, 85-airbag ECU, 100-operated amount generation node, 101-vehicle state estimation unit, 102-target state calculation unit, 103-vehicle Body operation vector operation torque calculation unit, 104-operation amount calculation unit, 105-vehicle parameter storage unit, 110-SBW driver ECU, 120-operation value command value, 201-vehicle status signal, 210-fault detection function, 210A～210D -Fault detection function, 220-Control program selection function, 230-Fault detection notification, 300-Actuator drive node, 320-Controller, 400-Actuator, 500, 550-Sensor, 600-Network, 610-Operator generation Node, 611-failure tolerance function, 612, 612a~c-operating amount, 614, 624-time slot, 615-steering column, 616-brake pedal, 620-correction amount generation node, 621-failure detection function, 622, 622a , 622b-correction amount, 623-fault detection result, 625-acceleration sensor, yaw rate sensor, 630, 630-0~4-actuator drive node, 6 31-comparator, 632-controller, 633-majority decision function, 634-switcher, 635-controller, 636-gain variable, 637-slope generator, 640-executive element, 641, 641-0- Steering gear, 642-1~4-brake, 650, 651, 652-communication circuit, 9100-data receiving table, 3000-1-sensor controller, 3000-2-steering wheel angle sensor, 3001-1-sensor controller, 3001-2-Brake pedal position sensor, 3002-1-Actuator controller, 3002-2-Steering control motor, 3003-1-Actuator controller, 3003-2-Electric brake caliper, 3010-1-Comprehensive Controller A, 3010-2-Comprehensive Controller B, A10, A100-Controller Node, A11-Handler, A12-Time Condition, A13-Self Monitor, A20-Sensor Node, A21-Handler, A22-Time Condition, A23-Self Monitor, A30-Actuator Node, A31-Handler, A32-Time Condition, A33-Self Monitor, A200-Brake Pedal Sensor Node, A210-Radar Node, A300-Front Brake Actuator Node, A310-right front wheel brake actuator node, A320-left front wheel brake actuator node, A400-node, A410-action in normal state, A411-function stop processing, A430-self-monitoring function, AA30-actuator , AA300-left front wheel brake actuator, AA301-left rear wheel brake actuator, AA310-right front wheel brake actuator, AA320-left front wheel brake actuator, B10-vehicle movement overall control node, B101-communication driver, B102-Vehicle motion observer, B103-Driver's intention grasping part, B20-Brake pedal node, B201-Communication driver, B202-Filter correction processing part, B203-A/D converter, B204-Data standardization part, B30- Brake actuator node, B301-communication driver, B302-brake caliper control unit, B303-A/D converter, B304-pre-driver, B305-autonomous decentralized control function, D1, D2, D3B-data flow, D11-steering Volume target value, D12-braking force target value, D13-driving force target value, D31-rudder angle indicating device operating value, D32-deceleration indicating device operating value, D33-acceleration indicating device operating value, D3000-steering wheel angle information, D3001 -Brake pedal stepping amount information, D3010-1-target rudder angle, D3010-2-target braking force, DA10-controller data, DA20-sensor data, DA100-right front wheel target braking force, DA101-left front wheel Target braking force, DA200-brake pedal state quantity, DA210-inter-vehicle distance, D F10, DF20, DF30-data area, N1-network, N11-communication bus, N1A-control system network (main bus), N1B-control system backup network (backup bus), N2-DBW system secondary network, N3-general network , N3000-in-vehicle network, M1, M1A, M1B, M2, M3A～M3D, M4A～M4D, M5, M6-electric motor, SA20-sensor, SA200-brake pedal, SA210-radar.

Detailed ways

(Example 1)

First, the basic configuration of the vehicle control device of the present invention will be described with reference to FIG. 1 .

The vehicle control device has a main computer (command controller) 1, a sensor slave computer (sensor controller) 2, and an actuator slave computer (actuator controller) 3. These parts are wired, wireless, and bus-type , mesh, star, and ring network N1 can be connected in two directions for data communication.

The host computer 1 is an instruction controller for calculating a control target value, and has a main control function (main control device) 1A.

A sensor 4 for observing (measuring) the state of a control object is connected to the sensor device slave computer 2 . The sensor slave computer 2 has a sensor processing function (sensor processing means) 2A for processing sensor signals supplied by the sensor 4 .

The actuator slave computer 3 is connected with the actuator 5 for the control object. The actuator slave computer 3 is a slave computer for controlling the actuator 5, has an actuator control function (actuator control means) 3A for controlling the actuator 5 based on a control target value given by the host computer 1, and controls the control target The simple main function (control target value generation device) 3B that calculates the value.

On the network N1, a data stream D1 of control target values and a data stream D2 of sensor measurement values exist.

The data stream D2 of sensor measured values is a data stream of sensor values output from the sensor slave computer 2, and both the master control function 1A of the master computer 1 and the simple master function 3B of the actuator slave computer 3 receive the sensor output from the sensor slave computer 2. value.

The data stream D1 of the control target value is the data stream of the control target value output by the host computer 1 , and the actuator control function 3A of the actuator slave computer 3 receives the control target value output by the host computer 1 .

During normal operation, the actuator slave computer 3 controls the actuator 5 based on the control target value given by the actuator control function 3A from the host computer 1 received by the data stream D1.

However, when an abnormality occurs in the data stream D1, the actuator slave computer 3 controls the actuator 5 based on the control target value calculated by the simple master function 3B. That is, the simple main function 3B calculates the control target value based on the sensor measurement value obtained from the data stream D2, and the actuator control function 3A calculates the simple main function 3B based on the data stream D3B in the actuator slave computer 3. The resulting control target value is used to control the actuator 5.

By adopting the above-mentioned structure, even if the main control function 1A of the host computer 1 cannot be used, the actuator control can be performed based on the calculation result of the simple main function 3B, and the driver's operation or the state change of the vehicle can be reflected. A highly reliable vehicle control device can be realized.

In addition, in FIG. 1, the host computer 1 is shown as one computer, but the host control function may be divided and installed in a plurality of computers.

A specific example of the communication flow in the vehicle control device shown in FIG. 1 will be described with reference to FIGS. 2( a ) and ( b ).

As a host computer, there is a vehicle motion integrating device 10 that comprehensively controls the motion of the entire vehicle.

As the sensor slave computer, it has a steering angle indicating device (steering angle sensor system) 31 operated by the driver, a deceleration indicating device (brake pedal depression amount sensor system) 32, and an acceleration indicating device (accelerator pedal depression amount sensor system). sensor system)33.

The actuator slave computer includes a steering amount control device 11 for controlling the steering angle of the vehicle, a braking force control device 12 for controlling the braking force of the vehicle, and a driving force control device 13 for controlling the driving force of the vehicle.

Rudder angle indicating device 31 , deceleration indicating device 32 , acceleration indicating device 33 , steering amount control device 11 , braking force control device 12 , driving force control device 13 , and vehicle motion integrated control device 10 are connected to each other through communication bus N11.

FIG. 2( a ) shows the data flow when the vehicle motion integrated control device 10 operates normally.

In this data stream, the symbol D31 is the operation amount of the driver's steering angle indicating device 31 , which is converted into an electrical signal by the steering angle indicating device 31 and output to the communication bus N11 .

Symbol D32 is an operation amount of the deceleration instructing device 32 by the driver, which is converted into an electrical signal by the deceleration instructing device 32 and output to the communication bus N11.

The symbol D33 is the operation amount of the accelerator pointing device 33 by the driver, which is converted into an electric signal by the accelerator pointing device 33 and output to the communication bus N11.

The vehicle motion integrated control device 10 receives the steering angle indicating device operation amount D31, the deceleration indicating device operation amount D32, and the acceleration indicating device operation amount D33 from the communication bus N11, and performs calculations for comprehensively controlling the motion of the vehicle.

Thereafter, the vehicle motion integrated control device 10 outputs the steering amount target value D11, the braking force target value D12, and the driving force target value D13 to the communication bus N11 as target values given to the control device for controlling the vehicle.

The steering force control device 11 receives the steering amount target value D11 from the communication bus N11, and controls a steering device such as a steering gear to realize the steering amount target value.

The braking force control device 12 receives the braking force target value D12 from the communication bus N11, and controls braking devices such as electric brakes to realize the braking force target value.

The driving force control device 13 receives the driving force target value D13 from the communication bus N11, and controls a driving force source such as an internal combustion engine, a transmission, an electric motor, and a power transmission system to realize the driving force target value.

FIG. 2( b ) shows the flow of data when an error occurs in the vehicle motion integrated control device 10 .

When the vehicle motion integrated control device 10 fails, the steering amount target value D11, the braking force target value D12, and the driving force target value D13 are not output to the communication bus N11. However, the vehicle needs to be controlled according to the driver's intention.

Here, when the steering force control device 11 determines that an error has occurred in the vehicle motion integrated control device 10, it receives the steering angle indicating device operation amount D31 from the communication bus N11, and controls steering devices such as a steering gear based on the steering angle indicating device operating amount D31.

When the braking force control device 12 determines that an error has occurred in the vehicle motion integrated control device 10, it receives the deceleration pointing device operation amount D32 from the communication bus N11, and controls braking devices such as electric brakes based on the deceleration pointing device operation amount D32.

The driving force control device 13, when it is judged that an error has occurred in the vehicle motion integrated control device 10, receives the acceleration indicating device operation amount D33 from the communication bus N11, and controls the driving of the internal combustion engine, transmission, electric motor, etc. based on the acceleration indicating device operation amount D33. power source.

The occurrence of an error in the vehicle motion integrated control device 10 and the fact that the data output to the communication bus N11 has not been used for a certain period of time are judged on the data receiving side. In addition, when an error occurs in the vehicle motion integrated control device 10 itself, the meaning thereof may be output as a short message.

Next, an example of a vehicle (automobile) to which the vehicle control device of the present invention is applied will be described with reference to FIG. 3 .

The control system network N1A corresponds to the communication line of the present invention, and is used for communication of data related to vehicle motion control. The control system backup network N1B also corresponds to the communication line of the present invention, and is used as a backup device when a failure occurs in the control system network N1A due to force majeure such as disconnection due to a collision accident or the like.

The steering sensor 41 corresponds to the steering angle indicating device 31 . The steering sensor 41 measures the operation amount (steering angle) of the steering wheel 51 operated by the driver, performs signal processing such as filtering, and outputs the steering wheel operation amount as an electric signal to the control system network N1A and the control system backup network N1B.

In addition, the steering wheel 51 is connected to the front wheel steering mechanism 71 even if it is a mechanical mechanism. Even if the control system network N1A, the steering sensor 41, or the SBW·VGR driver ECU (Electronic Control Unit) 81 fails due to force majeure, It is also possible to control the steering angle of the front wheels 72R, 72L of the vehicle 50 .

The brake pedal position sensor 42 corresponds to the deceleration indicating device 22 . The brake pedal position sensor 42 measures the operation amount of the brake pedal 52 operated by the driver, performs signal processing such as filtering, and outputs the brake pedal operation amount as an electric signal to the control system network N1A and the control system backup network N1B.

In addition, the brake pedal 52 can also be connected to the front wheel brake 73 even if it is a hydraulic system. It is also possible to control the braking force of the vehicle 50 .

The accelerator pedal position sensor 43 corresponds to the acceleration indicating device 33 . The accelerator pedal position sensor 43 measures the operation amount of the accelerator pedal 53 operated by the driver, performs signal processing such as filtering, and outputs the accelerator pedal operation amount as an electric signal to the control system network N1A.

In addition, the accelerator pedal position sensor 43 can be connected to the internal combustion engine control ECU 21 even if it is another communication line, and even when the control system network N1A or the DBW system comprehensive control ECU 20 is hindered by force majeure, the internal combustion engine of the vehicle 50 can be controlled. .

The millimeter-wave radar/camera 44 is used to recognize the external state of the vehicle 50 by detecting the driving state of other vehicles ahead and behind, recognizing the white line of the driving lane, and the like. The millimeter-wave radar/camera 44 recognizes the external state, for example, calculates the relative angle, relative distance, and relative speed with the vehicle driving ahead through signal processing, and outputs it as an electrical signal to the control system network N1A.

The steering sensor 41, the brake pedal position sensor 42, the accelerator pedal position sensor 43, and the millimeter wave radar/camera 44 correspond to the sensor slave computer.

The integrated vehicle motion control ECU 30 is a host computer and corresponds to the above-mentioned integrated vehicle motion control device 10 . The comprehensive vehicle motion control ECU 30 inputs the operation amount by the driver, the running state of the vehicle, and the sensor measurement value of the vehicle comprehensive control ECU 30 to be output on the control system network N1A, comprehensively manages the motion of the vehicle 50, and drives Control target values of the force control device, braking force control device, steering amount control device, suspension control device, safety device control device, etc. are output to the control system network N1A.

Vehicle motion integrated control ECU 30 also has a gateway function between integrated system network N3 and control system network N1A.

As the actuator slave computers, there are SBW·VGR driver ECU81, BBW driver ECU83A to 83D, EAS driver ECU84A to 84D, and airbag ECU85.

SBW·VGR (Steer-By-Wire·Variable Gear Ratio) driver ECU81 is equivalent to the rudder angle control device. By controlling the electric motor M1, the front wheel steering mechanism 71 controls the rudder angle of the front wheels 72R and 72L. By controlling the electric motor M5 A known steering gear variable gear ratio (VGR) mechanism 54 is controlled.

The SBW driver ECU 82 also corresponds to a rudder angle control device, and controls the rudder angles of the rear wheels 75R, 75L by the rear wheel steering mechanism 74 by controlling the electric motor M2.

BBW (Brake By-Wire) driver ECU83A, 83B, 83C, 83D are respectively equivalent to the braking force control device.

The BBW driver ECU 83A controls the oil pressure of the pump P by controlling the electric motor M3A, and controls the braking force applied to the right front wheel 72R by the front wheel brake mechanism 73 .

The BBW driver ECU83B controls the oil pressure of the pump P by controlling the electric motor M3B, and controls the braking force on the left front wheel.

The BBW driver ECU 83C controls the oil pressure of the pump P by controlling the electric motor M3C, and controls the braking force generated on the right rear wheel 75R by the front wheel brake mechanism 73 and the rear wheel brake mechanism 76 .

The BBW driver ECU 13D controls the oil pressure of the pump P by controlling the electric motor M3D, and controls the braking force applied to the left rear wheel 75L by the rear wheel brake mechanism 76 .

EAS (Electric Active Suspension) driver ECUs 84A, 84B, 84C, and 84D correspond to suspension control devices, respectively, and control the suspension mechanisms 77 and 78 provided on the vehicle 50 .

The EAS driver ECU 84A controls the suspension length, spring constant, damping constant, etc. of the front wheel suspension mechanism 77 provided on the right front wheel 72R by controlling the electric motor M4A.

The EAS driver ECU 84B controls the suspension length, spring constant, damping constant, etc. of the front wheel suspension mechanism 77 provided on the left front wheel 72L by controlling the electric motor M4B.

The EAS driver ECU 84C controls the suspension length, spring constant, damping constant, etc. of the rear wheel suspension mechanism 78 provided on the right rear wheel 75R by controlling the electric motor M4C.

The EAS driver ECU 84D controls the suspension length, spring constant, damping constant, etc. of the front wheel suspension mechanism 78 provided on the left rear wheel 75R by controlling the electric motor M4D.

In this way, the vehicle motion comprehensive control ECU 30 can increase the spring constant of the front wheel suspension mechanism 77 during deceleration by controlling the EAS driver ECUs 84A to 84D to prevent the vehicle 50 from tilting in the forward direction, and increase the suspension spring constant of the outer side during rotation. In order to prevent lateral rotation, shorten the length of the front wheel suspension and extend the length of the rear wheel suspension when going uphill, which can reduce the tilt of the car body.

The airbag ECU 85 corresponds to a safety device control device, and controls occupant protection devices such as airbags.

The DBW (Drive-By-Wire) system integrated control ECU 20 is equivalent to a driving force control device. The DBW system comprehensive control ECU20 comprehensively controls the drive control and other devices related to the vehicle 50 such as the internal combustion engine control ECU21, the transmission control ECU22, the electric motor control ECU23, and the battery control ECU24 connected by the DBW system sub-network N2.

With such a configuration, it is only necessary to instruct the DBW system integrated control ECU 20 of the final drive force from the vehicle motion integrated control ECU 30 , and the target value can be indicated without depending on the configuration of the device related to the actual drive control, and a simple configuration can be achieved. control device.

The internal combustion engine control ECU 21 is an ECU for controlling an internal combustion engine (not shown), receives target values such as engine shaft torque and engine speed from the DBW system integrated control ECU 20 , and controls the internal combustion engine to achieve the target values.

The transmission control ECU 22 is an ECU for controlling an unillustrated transmission, receives target values such as a gear position from the DBW system integrated control ECU 20 , and controls the transmission to achieve the target values.

The electric motor control ECU 23 is an ECU for controlling an unillustrated driving force generating electric motor, receives target values such as output torque and rotation speed from the DBW system integrated control ECU 20 , and controls the internal combustion engine to achieve the target values. In addition, it also operates as a driving force generating source in the negative direction by regeneration of the electric motor.

The battery control ECU 24 is an ECU for controlling a battery not shown, and controls the state of charge of the battery and the like.

The information system gateway 35 is a gateway for connecting an information system network (MOST, etc. known to those skilled in the art) such as a wireless communication device such as a mobile phone (not shown), GPS, and car locator, to the integrated network N3.

By connecting the information system network and the control system network N1A through the gateway function, the control system network N1A can be logically separated from the information system network, and a relatively simple configuration can easily meet the specific requirements of the control system network N1A such as real-time performance.

The vehicle body system gateway 36 is a gateway for connecting a vehicle body system network (not shown), such as door locks and power windows, to the integrated network N3. By connecting the vehicle body system network and the control system network N1A through the gateway function, the control system network N1A can be logically separated from the vehicle body system network, and it is relatively simple to form a system that can easily meet the specific requirements of the control system network N1A such as real-time performance. constitute.

Next, the processing performed by the vehicle motion integrated control ECU 30 will be described with reference to FIG. 4 . FIG. 4 shows the flow of data when the vehicle motion integrated control ECU 30 operates normally.

The vehicle motion integrated control ECU 30 has a vehicle state estimation unit 101, a target state calculation unit 102, a vehicle body operation vector operation torque calculation unit 103, an operation amount calculation unit 104, and a vehicle parameter storage unit 105, and inputs the steering sensor 41, the brake pedal Sensor signals of position sensor 42 , accelerator pedal position sensor 43 , millimeter wave radar/camera 44 , and sensors S not shown in FIG. 3 , such as a wheel speed sensor, a vehicle body acceleration sensor, and an angular acceleration sensor.

The vehicle state estimation unit 101 estimates the current state of the vehicle using sensor signals.

The target state calculating unit 102 calculates the target state of the vehicle estimated by the vehicle state estimating unit 101 and controlled using the vehicle's running state and sensor signals, that is, the target motion state to be achieved by the vehicle.

The vehicle body operation vector operation moment calculating unit 103 calculates the force vector in the direction of the vehicle body by controlling the vehicle body based on the difference between the current state of the vehicle estimated by the vehicle state estimating unit 101 and the target state calculated by the target state calculating unit 102 and torque vector in the direction of rotation.

The operation amount calculation unit 104 calculates the BBW driver ECU83A-83D, DBW system integrated control ECU20, SBW·VGR driver ECU81, SBW driver ECU82, EAS based on the force vector and moment vector calculated by the vehicle body operation vector operation torque calculation unit 103. The target operation amount to be realized by control actuators such as the driver ECU84A to 84D and the airbag ECU85.

In the vehicle parameter storage unit 105, the dynamic constants of the vehicle body (such as mass, rotational inertia, center of gravity position, etc.), the specification parameters of the control actuators (such as the time constant of each actuator, the maximum braking force of the brake, the steering wheel, etc.) are stored. These vehicle parameters are referred to by the calculation processing of the vehicle state estimation unit 101, the target state calculation unit 102, the vehicle body operation vector manipulation torque calculation unit 103, and the operation amount calculation unit 104.

In addition, in FIG. 4, the output from the operation calculating part 104 to each driver ECU is described by one line, but this is not a line showing only one value, but a line showing a set of control quantities. For example, the BBW driver ECUs 83A to 83D may instruct the independent braking force for each wheel.

The vehicle motion integrated control ECU 30 is composed of a vehicle state estimation unit 101 , a target state calculation unit 102 , a vehicle body manipulation vector operation torque calculation unit 103 , and an operation calculation unit 104 , and has the effect of being able to comprehensively manage and control the motion of the vehicle.

In addition, by separating the vehicle state estimation unit 101, there is an effect that, for example, in a vehicle having the same flat type, even when only the power train is changed from an internal combustion engine to a hybrid type, etc., it is possible to change the control execution of the vehicle. In the configuration of the components, the part that calculates the mechanical characteristics of the vehicle can be reused to improve the development efficiency of the control device.

In addition, by separating the target state calculation unit 102, there is an effect that only the target state calculation unit 102 is changed, that is, even when the limit of the target value is changed according to the driver's individuality or the surrounding vehicles or road conditions. Yes, the development efficiency of the control device can be improved.

In addition, by configuring the vehicle body manipulation vector manipulation torque calculation unit 103 and the manipulation calculation unit 104 as independent configurations, calculation of the manipulation amount on the vehicle body can be performed independently of the configuration of the control device included in the vehicle.

For example, even if the structure is changed from a hybrid vehicle to an in-wheel electric motor vehicle, it is only necessary to calculate the same force and moment vector in the vehicle body operation vector operation torque calculation unit 103 and to change the operation amount calculation unit 104 . Therefore, the development efficiency of the vehicle control device can be improved.

Next, the current state of the vehicle calculated by the vehicle state estimating unit 101 and the target state of the vehicle calculated by the target state calculating unit 102 will be described with reference to FIG. 5 .

As the current state and the target state of the vehicle, the state quantity 1X of rigid body motion when the body portion of the vehicle 50 is assumed to be a rigid body is shown. The state quantity 1X refers to, for example, displacement (x, y, z), rotation angle (θx, θy, θz), velocity ( dx/dt, dy/dt, dz/dt), angular velocity (dθx/dt, dθy/dt, dθz/dt).

Since the components of the state quantity 1X are connected to each other in rigid body mechanics, there is an effect that more precise control can be performed by determining the state quantity 1X, and control with high occupant comfort and stability can be performed.

The flow of the vehicle state estimation process performed by the vehicle state estimation unit 101 will be described with reference to FIG. 6 .

First, in step S1011, the motion state in the local coordinate system 1G fixed to the vehicle is estimated.

Next, in step S1012, the motion state in a fixed coordinate system fixed at a specific point such as Nihonbashi is estimated.

Next, in step S1013, the state of the periphery where the vehicle is traveling is estimated.

Next, in step S1014, based on the measured value of the sensor S, the BBW driver ECUs 83A to 83D, the DBW system integrated control ECU 20, the SBW·VGR driver ECU 81, the SBW driver ECU 82, the EAS driver ECUs 84A to 84D, the airbag ECU 85, and the like are executed for control. The self-diagnosis results of the components presumably update the fault status of the vehicle.

The flow of the target state calculation process by the target state calculation unit 102 will be described with reference to FIG. 7 .

First, in step S1021 , the vehicle state intended by the driver is estimated based on the operation amounts of the steering sensor 41 , the brake pedal position sensor 42 , the accelerator pedal position sensor 43 , and the current vehicle state.

Next, in step S1022 , the limit of the vehicle is calculated based on the surrounding conditions of the vehicle, the performance of the vehicle control device, the failure state of equipment, laws and regulations, and the like. For example, when a part of the braking device fails, the maximum speed is limited within the range where the brakes can be safely braked by the capability of the normally operating braking device.

Then, in step S1023, the target state quantity of the vehicle 50 is determined according to the driver's intention within a range not exceeding the limit of the vehicle state.

FIG. 8 shows the operation force and moment vector calculated by the vehicle body operation vector operation torque calculation unit 103 .

As shown in FIG. 8, the operation force vector F (Fx, Fy, Fz) and the operation moment vector τ (τx, τy, τz) are calculated on a local coordinate system fixed to the vehicle body. Therefore, there is an effect that it is possible to easily switch to the operation amount of the control device fixed to the vehicle.

The flow of the operation amount calculation processing by the operation calculation unit 104 will be described with reference to FIG. 9 .

The operation calculation unit 104 receives the vehicle body operation force vector F and the moment vector τ calculated by the vehicle body operation vector operation torque calculation unit 103 , and calculates which control amount the actual control device uses as a target value.

First, in step S1041 , the vehicle body operation force vector F and the moment vector τ are distributed to the tire forces that occur on the tires mounted on the vehicle 50 . Thereafter, a control amount target value for the tire vector in an actual control device is calculated.

By using braking force, driving force, and rotational force (tire lateral force generated by steering) as target values in vehicle control, the movement of the entire vehicle can be comprehensively controlled.

FIG. 10 shows the tire vector calculated in step S1041.

FFR is the tire vectoring that occurs at the front wheels through control. FFL is the tire vector that occurs at the left front wheel through control. FRR is the tire vector that occurs at the right rear wheel through control. FRL is the tire vector that occurs at the left rear wheel through control. The tire vectors are respectively determined as components in the local coordinate system 1G fixed to the vehicle body 50 .

By determining the tire vector as a component of the local coordinate shape, there is an effect that the conversion of the operation amount to the tire drive shaft and the steering device fixed to the vehicle body 50 is facilitated.

In step S1042, distribution processing of the operation amount is performed. The allocation process of the operation amount is actually performed corresponding to the configuration of the actuators that control the vehicle.

11( a ), ( b ) show the details of the operation amount distribution processing.

FIG. 11( a ) shows the operation amount distribution process (step S1042 a ) when the vehicle 50 has an internal combustion engine drive or a hybrid internal combustion engine drive powertrain. In this operation amount distribution process, the tire vector is input, and the steering amount as the target value in the SBW·VGR driver ECU81 and the SBW driver ECU82 is output, the brake braking torque as the target value in the BBW driver ECU83A to 83D, and the brake torque as the target value in the The DBW system comprehensively controls the power drive torque of the target value in the ECU 20 .

FIG. 11( b ) shows the operation amount distribution process (step S1042b ) when the vehicle 50 has a known in-wheel electric motor type power drive system. The operation amount allocation process outputs the steering amount as the target value in the SBW·VGR driver ECU81 and the SBW driver ECU82, and the brake brake as the target value of the regenerative and brake pad control ECU by the in-wheel electric motor not shown in the figure. The torque is an electric motor drive torque that is a target value in an in-wheel electric motor control ECU (not shown).

By performing the allocation process of the operation amount corresponding to the configuration of the actuators that actually control the vehicle, even if the configuration of the actuators is changed, it is possible to respond by exchanging the execution device for the allocation processing of the operation amount, which has the effect of improving the development efficiency of the vehicle control device .

The configuration of the DBW system integrated control ECU 20 will be described with reference to FIG. 12 .

The right front wheel drive torque receiving unit 201 receives the drive torque to be generated by the right front wheel 72R. The left front wheel drive torque receiving unit 202 receives the drive torque that should be generated at the left front wheel 72L. The right rear wheel drive torque receiving unit 203 receives the drive torque that should be generated at the right rear wheel 75R. The left rear wheel drive torque receiving unit 204 receives the drive torque that should be generated at the left rear wheel 75L.

The powertrain operation amount calculation unit 205 calculates a value as a target value in the ECU that controls the actual actuators, and instructs the operation amount of the internal combustion engine control ECU 21 , transmission control ECU 22 , electric motor control ECU 23 , and battery control ECU 24 .

In a known torque-based vehicle control device, control is performed with the torque to be generated at the drive shaft of the drive device as a target value. Therefore, there is a problem that the DBW system integrated control ECU 20 for an in-wheel electric motor type capable of controlling the driving force for each wheel is not compatible.

Here, for example, in a drive system including a drive device that generates drive force intensively such as an internal combustion engine or a hybrid system, the drive force of each wheel is received as a control target value, and is integrated within the DBW system control ECU20. Then distribute to the actuator for driving. As a result, the command value receiving method (interface) of the DBW system integrated control ECU for the hybrid system and the DBW system integrated control ECU for the in-wheel electric motor system can be made common.

(Example 2)

An integrated vehicle control device for a next-generation vehicle and an autonomous decentralized control platform to which the vehicle control device of the present invention is applied will be described with reference to FIG. 13 .

The purpose of the autonomous decentralized control platform is to achieve high reliability, real-time processing, and scalability in vehicle control at low cost.

As "autonomous decentralization", it is one of the highly reliable decentralized system models in the field of control. Computation subjects called nodes corresponding to cells in living things are loosely combined systems where common data called data areas are placed.

In addition, for the details of "autonomous decentralization", please refer to "Proposal for the concept of self-discipline decentralization" by Shinji Mori, Miyamoto Niji, and Ihara Koichi, Journal of Electrical Society C V01.104No.12pp.303-310(1984) , and K. Mori: Autonomous Decentralized Systems: Concept, Data field Architecture and Future Trends: IEEE Interational Symposium on Autonomous Decentralized Systems (ISADS) pp.28-34 (1993-Mar).

In the autonomous distributed system, each node is set as a program that is independent from other nodes and can operate autonomously, so that a partial failure does not affect the overall configuration of the system, and a distributed system with good reliability and scalability can be realized. However, it is difficult to apply the concept of the biological model to an actual system, and it is impossible to establish a general application method. Therefore, architecture needs to be explored for each application system.

The autonomous distributed control platform consists of the following parts: 1) Data area DF10 for shared data, 2) Autonomous action, 3) Autonomous management, 4) Nodes (sensor node A20, actuator node) capable of autonomous backup A30, controller node A10). In addition, each node has a self-monitor (self-monitoring function) A13, A23, A33.

The controller node A10 activates the processing program A11 according to the time condition A12 (eg, 10 "ms" period). The controller node A10 acquires the sensor data DA20 from the data field DF10, calculates the control target value of the actuator node A30, and transmits it by radio to the data field DF10 as controller data DA10.

The data field DF10 is a shared storage space presumably provided on the control network, and in a normal state, there are sensor data DA20 output from the sensor node A20 and controller data (control target value) DA10 output from the controller node 10 .

The so-called autonomous operation is a function to perform processing spontaneously according to time conditions and the status of nodes without receiving processing requests from other nodes.

The so-called autonomous management function is a function performed by itself to monitor the operation and status of its own node that is hidden from other nodes.

The so-called self-disciplined backup is a function that realizes the minimum required processing by using the built-in simple control, and when there is an abnormality in the data required for the processing of the own node, the simple control calculates the data required by itself.

Hereinafter, according to the data field DF10, it is indicated that the expansion applicable to the vehicle control device is improved, and the time-driven action suitable for real-time distributed control through autonomous action is used to achieve reliability through the autonomous management function and the autonomous backup function. Guaranteed status monitoring and system failure tolerance.

Using Fig. 14(a) and (b), the data area in the autonomous distributed control platform will be described.

The goal of the data area is to increase the scalability of the vehicle control unit. The introduction of the data area not only standardizes the interface between nodes, but also facilitates replacement and addition of parts.

On the autonomous distributed control platform, data exchange between nodes is performed through the data field DF20 which is a virtual shared memory defined on the network. That is, the data itself is recognized as an object without knowing what kind of equipment is connected to the network.

Therefore, the data defined in the data field DF20 is data with a high degree of abstraction that can be standardized at the sensor/actuator level. For example, in sensor measurement, data that is not a basic element such as a voltage value, but a filtering process performed by multiple measurements or a floating-point physical value is defined in the data area. Also in actuator control, standardized data such as the target braking force for braking is defined in the data area.

In the example of Fig. 14(a), the depression amount of the brake pedal SA200 is measured by the brake pedal position sensor node A200, and converted into a physical quantity, as the brake pedal state quantity (brake depression Quantity) DA200 radio transmission to the data field DF20.

The controller node A100 calculates the target braking force of each wheel (only the right front wheel target braking force DA100 and the left front wheel target braking force DA101 is shown) with reference to the brake pedal state quantity DA200 and transmits it to the data area DF20 by radio.

The front wheel brake actuator node A300 controls the left front wheel brake actuator AA300 and the left rear wheel brake actuator AA301.

In the example of FIG. 14(b), the configuration of the brake controller is changed in addition to adding the inter-vehicle distance control function to the control structure of FIG. 14(a).

A radar SA210 for measuring the inter-vehicle distance to the preceding vehicle and a radar node A210 for controlling the radar are added, and the measured inter-vehicle distance DA210 is radio-transmitted to the data field DF20.

Controller node A100, referring to the brake pedal state quantity DA200 and inter-vehicle distance DA210, calculates the target braking force of the wheels (only the right front wheel target braking force DA100 and the left front wheel target braking force DA101 are shown) and transmits it to the data area DF20 by radio superior.

The brake actuator node A310 of the right front wheel refers to the right front wheel target braking force DA100 and controls the brake actuator AA310 of the right front wheel.

The left front wheel brake actuator node A320 controls the left front wheel brake actuator AA320 with reference to the left front wheel target braking force DA101 .

As above, as shown in Fig. 14(a) and (b), without affecting other sensors and actuators, it can be performed as a vehicle-to-vehicle distance measurement node only by adding the data of "vehicle distance" to the data area DF20. Addition of radar node A210.

In addition, although the brake actuator node is also changed from the front wheel control type to each wheel independent type, it does not affect other nodes and the data area DF20. That is, by using the data field DF20, each node can be loosely connected, and a distributed system with good expandability can be realized easily.

The autonomous operation among the characteristics of the distributed control platform will be described using FIG. 15 (and FIG. 13 ).

The purpose of the autonomous operation is to enable the prediction of the processing time to be performed according to the time-driven operation which is easy to perform in order to cope with the distributed real-time processing.

The so-called autonomous operation in the autonomous distributed control platform is an operation in which a node starts processing spontaneously according to a time condition or a state of a node. That is, as the operation condition of the node, not only the reception of the short message, but also the time condition (time and cycle) and the state change (insertion) of the own node are used to perform the start-up process.

In a real-time system, it is essential to capture the state of the system to be controlled and reflect it to the control within a certain period of time. Therefore, when designing the control, it is necessary to be able to design the processing execution time in End-to-End. Furthermore, on the other hand, a function of continuing the processing of the own node without being affected by the abnormality of other nodes is also required. In order to realize such a highly reliable decentralized real-time system, it is necessary to make the operation of nodes autonomous.

The sensor node A20 activates the processing program A21 according to the time condition A22 (eg, 10 [ms] cycle).

The sensor node A20 reads the measured value of the sensor SA20, performs pre-processing such as filter processing and floating-point conversion, and converts it into a physical quantity, and then wirelessly transmits the sensor data DA20 to the data area DF10.

The actuator node A30 also activates the processing program A31 according to the individual time condition 32 (20 [ms] cycle).

The actuator node A30 acquires the sensor data DA20 from the data area DF10, calculates the control target of its own node A30, and then controls the actuator AA30 to realize the target value.

In addition, the time conditions A22 and A32 serving as start conditions may be state changes of own nodes, such as engine rotation interruption, for example. In this way, autonomous operations of nodes can be performed by voluntarily starting processing and simultaneously obtaining necessary data and performing calculations.

Through autonomous actions, the actions of nodes are time-driven or driven by the state changes of their own nodes. That is, it does not require sporadic driving of other nodes, making the design of the worst execution time very easy. In addition, since processing can be continued without being affected by other node abnormalities, a highly reliable system can be realized.

Next, among the characteristics of the autonomous distributed control platform, autonomous management will be described. The purpose of autonomous management is to ensure the high reliability required for vehicle control. Specifically, operation monitoring of own nodes and handling of abnormalities (failure operation/failure non-response) are realized by each node unit constituting the distributed system. In addition, in order to achieve high reliability and cost reduction at the same time, failure operation (possibility of operation at failure) and failure non-response (non-runaway performance at failure) are assigned and used as abnormal processing according to the target node.

In the conventional configuration, sensor measurement, vehicle control variable calculation, and actuator control are performed by each subsystem's ECU. Therefore, in order to achieve high reliability of the system, a lot of ECU failure operability is required, resulting in high cost. In addition, when the mutual monitoring function provided by each ECU is used, there is a problem that the connection between ECUs becomes tighter, and the scalability and development efficiency deteriorate.

The outline of autonomous monitoring is shown in FIG. 16 .

In this configuration, a self-monitoring function A430 is provided in the node A400 to monitor the normal operation A410. And, when an abnormality occurs, the function stop processing A411 (failure non-response) is performed.

In addition, for nodes where it is difficult to back up the brake pedal, steering wheel, etc., there is failure operability, and the function is continued. In addition, by stopping the function of the node even when the autonomous monitoring function itself fails, runaway of the node can be prevented.

Through this autonomous monitoring, it is possible to maintain the connection of nodes in a dispersed manner, and at the same time, it is possible to construct a highly reliable system with a low-cost collection of nodes that do not respond to failures. Furthermore, by combining with autonomous backup described below, failover at the system level can be realized.

Next, among the features of the autonomous distributed control platform, autonomous backup will be described. The purpose of autonomous backup is to ensure the high reliability required for vehicle control. Specifically, it is a simple control function for compensating for a failure of a node constituting a distributed vehicle control device.

The so-called self-disciplined backup is usually a logical configuration of master-slave control nodes. When the node that performs the master function fails, the required minimum control is realized by sharing data between the slave nodes.

Fig. 17 shows the operation flow of the actuator node.

Normally, the controller node A10 calculates a control target value using the measured value of the sensor node A20, and the actuator node A30 controls the actuator AA30 based on the control target value (Yes in step S311→step S312→step S313).

On the other hand, the actuator node A30 incorporates a simplified version (simple control function) A34 (see FIG. 13 ) of the control function of the master node (controller node A10), and refers to the sensor measurement value together with the control target value, and The simple control target value is calculated based on the sensor measurement value. In case, when an abnormality occurs in the master node, the above-mentioned self-monitoring function is used to stop the function. Therefore, for example, based on the fact that the data on the data area DF10 is not updated, the actuator node A30 determines the failure of the master node in step S311. . After the actuator node A30 judges the failure of the master node, it executes step S311 negative → step S314 → step S313, and through the built-in simple control function A34, it backs up the necessary processing by itself in order to realize the function of its own node.

Through this autonomous backup function and the aforementioned autonomous monitoring function, a high-reliability failure operation system can be realized with a low-cost collection of failure-unresponsive nodes.

Next, an example of the operation of the autonomous decentralized control architecture will be described using the brake control function as an example. In particular, according to this proposal, it is shown that a failure operation system can be constructed by combining reliable nodes.

An example of the configuration of the XBW vehicle control device is shown in FIGS. 18( a ) and ( b ). In Fig. 18(a) and (b), focus is mainly on the vehicle integrated control ECU, brake pedal position sensor, brake actuator (BBW (Brake-By-Wire) driver ECU) and data area. Another data area is provided, for example, on a network for vehicle control implemented by FlexRay.

First, using FIG. 18( a ), the operation of the brake control function in the autonomous distributed control platform at normal times will be described.

The brake control function in the autonomous decentralized control platform is composed of a brake pedal node B20, a vehicle motion integrated control node (vehicle motion integrated control ECU) B10, and a brake actuator node B30.

The brake pedal node B20 is periodically activated autonomously, and uses the A/D converter B203 to measure the state of the brake pedal position sensor SB20.

The brake pedal node B20 performs filtering, correction processing, etc. on the measured value by the filter correction processing unit B202, and further normalizes the data by the data normalization unit B204. Thereafter, the data "brake pedal state" is published in the autonomous distributed data area DF30 using the communication driver B201.

The vehicle motion integrated control node B10 starts up periodically. After the vehicle motion integrated control node B10 starts, use the communication driver B101 to refer to the brake pedal state and other data (yaw rate, steering wheel rudder angle, etc.) on the autonomous decentralized data area DF30, and the vehicle motion observer B102 to estimate the motion of the vehicle state, the driver's intention to operate is estimated by the driver's intention grasping unit B103. Then, based on the estimation result, the actuator target value generation unit B104 calculates actuator control target values such as braking force, drive shaft torque, and steering angle. Thereafter, the control target value is disclosed on the autonomous distributed data field DF30 using the communication driver B101.

Here, the operation of the brake actuator node B30 will be described by taking the left rear wheel as an example. Like the other nodes, the brake actuator node B30 is also activated periodically. After the brake actuator node B30 is activated, the communication driver B301 is used to refer to the control target value, that is, the target braking force on the autonomous distributed data area NF30. And, the control of the brake actuator AB30 is performed based on the target braking force. The A/D converter B303 is used to observe the braking state, the brake caliper control unit B302 calculates the braking control amount based on the difference between the braking force generated by the brake and the target, and the brake actuator AB30 is controlled using the pre-driver B304.

In addition, the period referred to by the data area and the period controlled by the actuator are not necessarily the same period, and the period controlled by the actuator can be taken at a higher speed. Accordingly, appropriate control can be performed in accordance with the control time constant of the controlled actuator.

Next, the operation of the braking control function at the time of failure of the vehicle motion integrated control node B10 will be described using FIG. 18( b ).

The brake pedal node B20 is automatically activated and processed as usual. It is not affected by the failure of the vehicle motion integrated control node B10. When the vehicle motion integrated control node B10 detects its own failure through the self-discipline management function, it performs failure non-response processing. That is, when viewed from the outside, it is in a state where all processing is stopped. Therefore, the actuator target value on the autonomous distributed data area DF30 is not updated.

Here, the operation of the brake actuator node B30 will be described by taking the left rear wheel as an example. The brake actuator node B30 is activated periodically. After the brake actuator node B30 is activated, the control target value, that is, the target braking force on the autonomous distributed data area DF30 is referred to. However, since the data of the target braking force is not updated, a failure of the vehicle motion integrated control node B10 is detected. As a result, the autonomous distribution control function 305 of the brake pedal node B20 is activated. The autonomous distribution control function 305 calculates a simple target value with reference to the state of the brake pedal in the autonomous distribution data area DF30.

The brake caliper control unit B302 controls the brake actuator AB30 based on the simple target value calculated by the autonomous decentralized control function 305 instead of the control target value calculated by the vehicle motion integrated control node B10 .

Here, the simple target value is a value calculated using only the state of the brake pedal, and is not a value for controlling the behavior of the vehicle calculated by the vehicle motion integrated control node B10.

The operation of the brake control function using the autonomous distributed control platform has been described above. According to the data area, autonomous operation, autonomous management, and autonomous backup that are the characteristics of the autonomous distributed platform, it can be shown that, for example, even when the controller node that calculates the target value fails, it can operate as a vehicle control device.

According to this effect, it is considered that the failure-operating vehicle control device can be realized by combining failure-free nodes, which is considered to be effective for cost reduction of a highly reliable system.

The basic configuration of the vehicle control device of the present invention will be described with reference to FIG. 19 .

The vehicle control device is composed of a sensor 500 that detects a driver's request, a sensor 550 that detects a vehicle state, an actuator 400 , an operation amount generating node 100 , and an actuator driving node 300 .

Among them, the sensor 500 for detecting the driver's request, the operation amount generating node 100, and the actuator driving node 300 have failure detection functions 210A, 210B, and 210C, respectively. The failure detection function 210C of the actuator drive node 300 not only has a self-diagnosis function, but also has a function of detecting failure of the actuator 400 .

The operation amount generating node 100 calculates an operation amount command value based on the driver's request signal 200 and the vehicle state signal 201 .

The actuator drive node 300 receives the operation amount command value 120 and controls the actuator 400 to drive, steer, brake, etc. the vehicle.

The failure detection functions 210A, 210B, and 210C, when detecting a failure in the node or in the actuator 400, output the failure detection notification 230 for the failure state to the outside of the node. When all the nodes having a failure detection function are in a failure state, the output to the outside is stopped except for outputting the failure detection notification 230, that is, no response to failure is constituted.

FIG. 20 is a functional diagram of the operation amount generation node 100 . The operation amount generating node 100 is equipped with a plurality of control logics for vehicle control, and when receiving the failure detection notification 230 from other nodes, it switches the control logic (control A, control B, control C) according to the location of the failure and the degree of the failure. .

FIG. 21 is a functional diagram of the actuator drive node 300 . The actuator drive node 300 incorporates a plurality of control logics (control X, control Y, control Z) for calculating the operation target value of the actuator 400 based on the operation amount command value 120 generated by the operation amount generation node 100 . The controller 320 drives the actuator 400 to reach the target value.

The actuator drive node 300, when receiving the fault detection notification 230 from other nodes, switches the control logic according to the location of the fault and the degree of the fault. The actuator drive node 300 executes control X or control Y based on the command value when it can receive the command value of the operation amount 120, but it cannot receive the command value of the operation amount 120 due to a failure of the operation variable generating node 100 or the communication path. At this time, the driver's request signal 200 is taken in, and the control Z is switched to calculate the operation amount command value by itself.

(Example 3)

Embodiment 3 of the vehicle control device of the present invention will be described with reference to FIG. 22 . FIG. 22 is shown by extracting the parts related to the vehicle control device, especially the brake control and steering control.

This vehicle control device has a steering angle sensor 41 for measuring the rotation angle of the steering wheel 51 and a brake pedal position sensor 42 for measuring the depression amount of the brake pedal 52 as sensors for detecting the driver's request, and serves as an operation amount generating node. , interpreting the driver's intention from the signal of the sensor that detects the driver's request and controlling the vehicle comprehensively together with signals from the sensor that detects the state of the vehicle not shown, such as an acceleration sensor, a yaw rate sensor, and a wheel speed sensor Sporty vehicle motion comprehensive control ECU30.

This vehicle control device further has, as an actuator drive node, an electric motor M1 that controls the generation of the steering force of the front wheels, and an electric motor M5 that acts on a variable transmission ratio (VGR) mechanism mounted on the steering column shaft. SBW·VGR driver ECU81, SBW driver ECU82 which controls rotation electric motor M2 which generates steering force for the rear wheels, and BBW driver ECU83A to 83D which controls brake electric motors M3A to M3D which generate braking force for four wheels.

Here, as the sensor for measuring the brake pedal operation amount of the driver, a hydraulic pressure sensor for measuring the hydraulic pressure generated by stepping on the brake pedal 52 may be used.

All of the above-mentioned nodes are configured to fail to respond. The communication network is composed of a bus N1A and a backup line N1B, and the bus N1A is connected to all the above-mentioned nodes, and the backup line N1B is connected to the backup line N1B to connect the minimum necessary nodes related to the safe driving of the vehicle, that is, the vehicle motion integrated control ECU 30 , All nodes except the SBW driver ECU82 of the rear wheel. Although not shown in the figure, at least double power is supplied to all the nodes connected to the backup line N1B.

The SBW·VGR driver ECU 81 for the front wheels and the BBW driver ECUs 83A to 83D for the four wheels have simple control logic units 811 and 831 built therein. Here, the simple control means, for example, control in which the electric motor torque command value is simply proportional to the sensor signal value and the processing load is relatively small.

Under normal conditions, the SBW·VGR driver ECU81 for the front wheels, the SBW driver ECU82 for the rear wheels, and the BBW driver ECU83A-83D for the four wheels receive the rudder angle command and braking force command from the vehicle motion integrated control ECU30 via the communication network , to control the electric motor based on the command value.

In this embodiment, the steering wheel 51 is mechanically combined with the front wheel steering mechanism 71, and the brake pedal 52 is also connected with the front wheel brake 73 even if it is an oil pressure system. When the electronic control stops, these backup mechanisms are used to drive The driver can directly steer and brake the vehicle.

Hereinafter, the vehicle control device shown in FIG. 22 will be described in detail as an example. Even if a failure occurs somewhere in the vehicle control device, the functions of braking and steering will not be lost, and the vehicle will run stably.

In addition, here, the following example is used as the premise to explain. Assuming that two or more failures do not occur at the same time, when a failure occurs, the driver is warned of the main situation. By repairing the failure part in a relatively short period of time, the first failure can be prevented 2 glitches.

(1) When the vehicle motion integrated control ECU30 fails

At this time, vehicle motion integrated control ECU 30 outputs a failure detection notification to bus N1A. If the communication network is time-division multiple access (TDMA) and output to the network is performed in a predetermined time slot for each node, failure detection notification can be performed without output.

This is achieved, for example, by dividing the communication cycle into a data transmission cycle and a diagnosis cycle, as shown in FIG. 23 , and in the diagnosis cycle, all nodes can sequentially output certain data. In the example of FIG. 23 , since there is no output to the network at the time slot of node F in the diagnostic cycle, it can be known that other nodes have failed at node F.

When the SBW·VGR driver ECU 81 for the front wheels and the SBW driver ECU 82 for the rear wheels receive a failure detection notification from the vehicle motion integrated control ECU 30 , they take in the value of the steering angle sensor 41 from the network and execute simple control.

In addition, the four-wheel BBW driver ECUs 83A to 83D take in the value of the brake pedal position sensor 42 and execute simple control by the simple control logic unit 813 .

(2) In the communication network, when a failure occurs in the main line N1A

At this time, using the backup line N1B, the SBW·VGR driver ECU 81 for the front wheels, the BBW drivers ECU 83A to 83D for the four wheels, and the vehicle motion integrated control ECU 30 also perform simple control when failure occurs.

(3) When one of the BBW driver ECUs 83A, 83B of the front wheels or one of the brake electric motors M3A, M3B of the front wheels fails

At this time, by stopping the electric power supply to the front wheel brake electric motor on the faulty side, the wheel becomes unbrakeable, and the integrated vehicle motion control ECU 30 performs control so that the remaining three wheels stop the vehicle stably. Alternatively, the driver can stop the vehicle directly by using the backup mechanism.

Here, failures of the electric motor include failures of an electric motor rotational position sensor, a current sensor, and the like, which are necessary for controlling the electric motor, although not shown in the figure. The same applies to the case where one of the rear wheel BBW driver ECUs 83C, 83D or one of the rear wheel brake electric motors M3C, M3D fails.

(4) When one of the front wheel SBW·VGR driver ECU81 or the front wheel steering electric motor M1 (including sensors required for electric motor control) fails

At this time, the power supply to the front steering electric motor M1 and the electric motor M5 of the VGR mechanism 54 is stopped, and the driver uses the backup mechanism to directly steer the vehicle.

(5) When the steering angle sensor 41 or the brake pedal position sensor 42 fails

In this case, the power supply to the electric motor M5 acting on the steering electric motors M1, M2 and the VGR mechanism or the braking electric motors M3A-M3D is stopped, and the driver uses the backup mechanism to directly steer or brake the vehicle.

In addition, in this embodiment, a situation in which a single failure is used for steering and braking while using a backup mechanism does not occur.

As described above, according to the configuration of this embodiment, since errors can be backed up in the entire system, the redundancy of each node is not increased more than necessary, and in the vehicle control device with a backup mechanism, only by making all By configuring the nodes to operate without reaction to failure, it is possible to realize a vehicle control device with very high reliability.

The failure non-responsive node has a simple hardware configuration compared with a failure operation in which normal operation is continued even if a failure occurs. Therefore, according to the present invention, it is possible to provide a low-cost, high-reliability vehicle control device compared with known examples.

Furthermore, by connecting only the minimum nodes necessary for safe running of the vehicle to the backup line N1B, the number of nodes required to make the communication interface redundant can be reduced, thereby enabling cost reduction.

An example of the functional configuration of the steering angle sensor 41 or the brake pedal position sensor 42 that does not respond to a failure will be described with reference to FIG. 24 .

The steering angle sensor 41/brake pedal position sensor 42 is composed of two sensor units 60A, 60B, A/D converters 61A, 61B for converting the analog outputs of the respective sensor elements 60A, 60B into digital values, and malfunction The detection function 210, the filter function 63, the communication controller 64, the communication driver 65A for outputting a signal to the main line N1A, and the communication driver 65B for outputting a signal to the backup line N1B.

The failure detection function 210 has a coincidence checking function 62 for judging whether the two A/D conversion values formed by the A/D converters 61A and 61B are the same within the error range of the predetermined error range. When they are inconsistent, the communication drivers 65A and 65B are Inactivation does not respond to failure.

The failure detection function 210 outputs a trigger signal to the A/D converters 61A, 61B in order to perform A/D conversion of the two sensor units 60A, 60B simultaneously.

According to this configuration example, since the sensor has the filtering function 63, even when the sensor signal is sampled at a short cycle and filter processing such as oversampling is performed, since it is not necessary to output data to the communication network in accordance with the sampling cycle, the network load can be reduced. traffic.

A hardware configuration example of the steering angle sensor 41 or the brake pedal position sensor 42 that does not respond to a failure will be described with reference to FIG. 25 .

The steering angle sensor 41/brake pedal position sensor 42 is constituted by a main sensor unit 60A, a reference sensor unit 60B, a fail-safe LSI 600, and two communication drivers 65A, 65B.

The fail-safe LSI 600 is composed of redundant A/D converters 61A, 61B, CPUs 66A, 66B, communication controllers 64A, 64B, comparators 62A, 62B, and a ROM, RAM67.

In the fail-safe LSI 600, after A/D conversion is performed on the signals given from the respective sensor units 60A, 60B, the A/D conversion values are mutually exchanged between the CPUs 66A, 66B to be aligned. The CPUs 66A and 66B perform filter calculations using the aligned A/D conversion values, respectively.

The coincidence check of the calculation results is performed by inputting the outputs of the communication controllers 64A, 64B to the comparators 62A, 62B.

In this embodiment, since there are two communication buses, the communication controller 64 has two channels, and the outputs of each channel are compared with each other by comparators 62A and 62B.

In this embodiment, by integrating the failsafe function into one chip (1 chip), it is possible to configure a sensor node that does not respond to failure at low cost.

(Example 4)

Embodiment 4 of the vehicle control device of the present invention will be described with reference to FIG. 26 . In addition, in FIG. 26 , portions corresponding to those in FIG. 22 are assigned the same reference numerals as those in FIG. 22 , and description thereof will be omitted.

In Embodiment 3 shown in FIG. 22 , the sensor is directly connected to the network, but in Embodiment 4, the sensor signal is input to the HMI ECU 25, and after the HMI ECU 25 performs sensor value comparison and filtering processing, the sensor signal is connected to the network. Output sensor data.

At this time, the steering angle 41A and the brake pedal position sensor 42A are composed of only two sensor components.

In addition, in order to avoid a situation where the backup mechanism is used simultaneously for steering and braking in a single failure, it is necessary to configure the HMI·ECU 25 to operate in failure.

(Example 5)

Embodiment 5 of the vehicle control device of the present invention will be described with reference to FIG. 27 . In addition, in FIG. 27 , the parts corresponding to those in FIG. 22 are given the same reference numerals as those in FIG. 22 , and description thereof will be omitted.

Embodiment 5 is the relevant node configuration and network configuration, which is the same as Embodiment 3, but between the steering column (steering wheel 51) and the steering force generating mechanism, and the brake pedal 52 and the braking force generating mechanism, there is no mechanical Combined vehicle controls. Therefore, steering and braking of the vehicle using the mechanical backup mechanism described in the third embodiment cannot be expected.

Here, in the vehicle control device of this embodiment, the steering angle sensor 41B, the brake pedal position sensor 42B, and the SBW driver ECU 81A of the front wheels 72R, 72L are used as failure operation nodes that continue to operate normally even if a failure occurs.

Furthermore, the steering electric motors for the front wheels 72R, 72L are doubled (M1A, M1B).

Although not shown, the SBW driver ECU 81A for the front wheels is composed of two failure-free nodes, and each failure-free node independently controls the duplexed steering electric motors M1A, M1B. The SBW driver ECU 81A includes a simple control logic unit 811 .

Although the torque that can be generated as the steering electric motors M1A, M1B is small if used compared with the torque of the rotating electric motor used in the system of mechanically combining the rotation and steering force generating mechanism (here, in order to generate and mechanically If the combined system equivalent torque is 1/2 or more) electric motors, the increase in cost caused by duplication of electric motors can be reduced.

The SBW driver ECU 81A of the front wheels further controls the electric motor M6 acting on the mechanism that simulates the reaction force given from the road surface to the steering column.

The steering angle sensor 41B and the brake pedal position sensor 42B are configured by duplicating sensors that do not respond to the failure shown in FIG. 25 . For the non-response to failure sensor shown in FIG. 25 , the sensor parts are tripled, and the high-reliability non-response sensor can also be single-used by having a majority judgment function of three sensor signals.

When the fault non-response node of one side of the SBW driver ECU81A of the front wheel or one of the steering electric motors M1A and M1B (including the sensors required for electric motor control) fails, the node stops the steering electric motor on the faulty side. power supply, output failure detection notification.

After receiving the failure detection notification, the vehicle motion integrated control ECU 30 performs switching control so that the vehicle can be steered stably by the remaining steering electric motors.

When a failure occurs in other places, the braking and steering functions are not lost, and the method for making the vehicle run stably is as described in the third embodiment.

According to Embodiment 5, since errors can be backed up in the entire system, even in a vehicle control device that does not have a backup mechanism for steering and braking, it is possible to realize very low-cost operation only by introducing a minimum number of faulty operation nodes. High reliability vehicle control device.

(Example 6)

Embodiment 6 of the vehicle control device of the present invention will be described with reference to FIG. 28 . In addition, in FIG. 28 , portions corresponding to those in FIG. 3 and FIG. 22 are denoted by the same reference numerals as in FIG. 22 , and description thereof will be omitted.

Embodiment 6 is an embodiment in which nodes such as a drive system and a safety system are added to the vehicle control device of Embodiment 3, and an overall image of a control system related to vehicle travel is shown. This embodiment has a backup mechanism for steering and braking, and a vehicle control device that does not have it can have the same configuration.

In the main line N1A, in addition to the nodes related to the steering control and braking control described in Embodiment 3, there are also connected: the DBW system comprehensive control ECU 20 for comprehensively controlling the driving system of the vehicle, and the suspension electric motor for controlling and adjusting the damping force The EAS driver ECUs 84A to 84D of M4A to M4D, the accelerator pedal position sensor 43 to measure the depression amount of the accelerator pedal 53 , the millimeter wave radar/camera 44 to detect the external state of the vehicle, and the airbag ECU 85 to control the deployment of the airbag.

Simple control logic units 811 and 831 are built in the SBW·VGR driver ECU 81 for the front wheels and the BBW driver ECUs 83A to 83D for the four wheels.

The internal combustion engine control ECU21, the transmission control ECU22, the electric motor control ECU23, and the battery control ECU24 are connected to the DBW system integrated control ECU20 through the network N2.

The vehicle motion integrated control ECU 30 is connected to the following parts through the network N3: the information system gateway 35 as the entrance to the network of the equipment controlling the information system such as the vehicle satellite locator, the door lock, the door side mirror, and the control of various instruments, etc. The body system gateway 36 of the entrance to the network of machines of the body system; and access to these nodes and data.

Although not shown, the airbag ECU 85 is also configured to be connected at the other end to a safety system network that integrates various sensors and actuators necessary for airbag deployment control.

In this embodiment, the vehicle motion integrated control ECU 30 interprets the intention of driving from the steering angle sensor 41, the brake pedal position sensor 42, and the accelerator pedal position sensor 43, and from a sensor that detects a vehicle state not shown, such as an acceleration sensor , yaw rate sensor, and wheel speed sensor to calculate the rudder angle, braking force, driving force, etc. for optimal vehicle motion. The SBW·VGR driver ECU81 for the front wheel and the SBW driver ECU82 for the rear wheel A rudder angle command is sent, a braking force command is sent to the four-wheel BBW driver ECUs 83A to 83D, and a driving force command is sent to the DBW system integrated control ECU 20 .

The DBW system integrated control ECU20 receives the driving force command, considers energy efficiency, etc., calculates the driving force that should be generated by each driving force generation source such as the internal combustion engine and the electric motor, and sends the calculated driving force command to the internal combustion engine control ECU21 and the electric motor control through the network N2. ECU23 etc.

The integrated vehicle motion control ECU 30 performs follow-up driving, lane keeping running, Hazard avoidance controls for driving, etc.

Regarding reliability, all nodes connected to the main line N1A of the communication network are configured to fail to respond to failure. In addition, in the backup line N1B, as described in Embodiment 3, by connecting only the minimum nodes necessary for the safe running of the vehicle, the number of nodes requiring redundant communication interfaces can be reduced and the cost can be reduced. .

The accelerator pedal position sensor 43 can also drive the vehicle when one of the main line N1A, the DBW system integrated control ECU20, and the network N2 fails, and is also directly connected to the internal combustion engine control ECU21.

The method of backing up errors in this embodiment and the resulting effects are as described in Embodiment 3.

(Example 7)

Embodiment 7 of the vehicle control device of the present invention will be described with reference to FIGS. 29 and 30 .

The operation amount generation node 610 generates an operation amount 612 and sends the operation amount 612 to the actuator driver node 630 .

The correction amount generating node 620 generates a correction amount 622 and sends the correction amount 622 to the actuator driving node 630 .

As shown in Fig. 30, the actuator drive node 630 has a controller 632 and a switch 634. When the correction amount generation node 620 is normal, it applies the operation amount 612 given by the operation amount generation node 610 to the operation amount 612 from the operation amount generation node 610. The given correction amount 622 is used as a control target value 635 to control the actuator 640 . On the other hand, when the correction amount generation node 620 is abnormal, the actuator 640 is controlled using the operation amount 612 given from the operation amount generation node 610 as the control target value 635 .

In this embodiment, when the correction amount generation node 620 is normal, finer control can be performed by using the correction amount. In addition, when the correction amount generation node 620 fails, the function is degraded and the correction amount is not used. able to continue to take control.

Since it is necessary to know whether the correction amount generation node 620 is normal, it is desirable that the correction amount generation node 620 has a failure detection function 621 . Based on the failure detection result 623 performed by the failure detection function 621, the switch 634 of the actuator drive node 630 performs a switching operation.

In contrast to the highly advanced information processing required for correction amount generation, operation amount generation can be accomplished with relatively simple information processing. Therefore, the correction amount generation node 620 is required to have higher processing performance than the operation amount generation node 610. As a result, the number of parts increases, the operating frequency (clock frequency of the processor) becomes higher, and electricity and heat margins are required. A small amount of action. Therefore, the correction amount generation node 620 has a higher failure rate (the sum of failure rates (fit numbers) of components) than the operation amount generation node 610 .

That is, the correction amount generation node 620 is a node with higher processing capacity than the operation amount generation node 610 . For example, the correction amount generation node 620 is constituted by a computer (node) whose operating frequency is higher than that of the operation amount generation node 610 .

Therefore, a failure rate lower than that of the correction amount generation node 620 can be expected for the minimum operation amount generation node 610 necessary for continuation of control. That is, the operation amount generation node 610 is a node with a lower failure rate than the correction amount generation node 620 .

Furthermore, since the operation amount generation node 610 needs to be normal even when the correction amount generation node 620 fails, it is desirable that the operation amount generation node 610 has the failure tolerance function 611 .

Various considerations have been made as the failure detection function 621 of the correction amount generation node 620, but as shown in FIG. 31, by duplicating the correction amount generation node 620, the outputs can be compared.

In this case, there is a method of comparing the doubled correction amounts 622a and 622b output from the correction amount generation node 620 on the side of the correction amount generation node 620 in advance, and transmitting the fault detection result of the single sum of the correction amounts 622a and 622b to the actuator drive node 630. method; as shown in FIG. 32 , the correction amounts 622a and 622b output by the multiple correction amount generation node 620 are respectively transmitted to the actuator drive node 630, and the correction amount 622a is compared by the comparison function 631 at the actuator drive node 630 and 622b to obtain the fault detection result 623.

In addition, the failure tolerance function 611 of various operation amount generation nodes 610 is considered, but as shown in FIG. 31 , it can also be realized by a majority logic decision in which the operation amount generation nodes 610 are tripled and the output is obtained.

At this time, there is the following method: the operation amount 612a, 612b, 612c generated by the redundant operation amount generation node 610 is preliminarily adopted at the operation amount generation node 610 side to adopt a majority logic decision, and the method is transmitted to the actuator driving node 630; as shown in the figure As shown in 32, the operation quantities 612a, 612b, 612c generated by the operation quantity generation node 610 are respectively transmitted to the actuator driver node 630, and the majority decision function 633 of the actuator driver node 630 adopts the method of majority logic decision.

In addition, as shown in FIG. 33 , on the actuator drive node 630 , a gain variable 636 and a ramp generator 637 controlling the gain of the gain variable 636 are provided, and the fault detection result 623 is input into the ramp generator 637 , the value obtained by multiplying the correction amount 622 given by the operation amount generation node 610 by the variable gain with the gain variable device 636 is applied to the operation amount 612 given from the operation amount generation node 610 as the control target value 635 It is also possible to control the sensor device 640. At this time, when the correction amount generation node 620 is abnormal, the control target value 635 does not change rapidly but changes gradually.

The operation of this embodiment is shown in FIG. 34 . When the correction amount generation node 620 is normal, the ramp output 637 as the output of the ramp generator 637 is a high value, and the correction amount 622 given from the correction amount generation node 620 is multiplied by the gain variable 636 preset The high-order gain of is added to the operation amount 612 given from the operation amount generation node 610 to control the actuator 640 as the control target value 635 .

In contrast, when the correction amount generating node 620 is abnormal, the ramp output 637 gradually changes from a high value to a low value over time from the time when the fault detection result 623 changes from "normal" to "abnormal".

As a result, the variable gain obtained by multiplying the correction amount 622 given from the correction amount generating node 620 by the gain variable unit 636 also gradually changes over time from a high-order gain value to a low-order gain value. As a result, the correction amount 622 given from the correction amount generation node 620 added when calculating the control target value 635 gradually decreases with time.

In the embodiment shown in FIG. 34 , the gain of the lower bit is assumed to be 0, and the magnitude of the gain of the lower bit may be determined according to the severity of the failure of the correction amount generating node 620 . In addition, in this embodiment, the ramp output 637 changes linearly from the high order value to the low order value, but it may change in any manner including a curve without being limited to linearity. In addition, it is desirable that the mode of change is monotonically decreasing.

According to the embodiment described above, since the control target value 635 does not change rapidly but gradually when the correction amount generation node 620 is abnormal, the operator does not feel uncomfortable. In addition, since the level difference of the control target value 635 accompanying switching does not occur, it is also possible to avoid deterioration of the controllability due to the delay of the operator's response to the level difference.

In addition, as shown in FIG. 35 , the operation amount 612 given from the operation amount generating node 610 and the correction amount 622 given from the correction amount generating node 620 can also be transmitted to the execution through a single communication path (communication bus) 650. A network configuration of element driver nodes 630 .

According to this embodiment, since it can be completed without separately having a communication path between node·to·node, it leads to saving wiring, and in this part, it is possible to reduce the weight of the system in addition to reducing the cost.

The information transmitted through the communication path 650 in this embodiment, as shown in FIG. 36 , is divided into multiple time slots according to the node time for each transmission, and the operation amount 612 is in the time slot 614 allocated by the operation amount generation node 610 Transmitted, the correction 622 is transmitted in the time slot 624 allocated by the correction generation node 620 .

Here, in the method of transmitting the correction amounts 622a and 622b outputted from the correction amount generation node 620 described above to the actuator drive node 630, the redundant correction amount generation nodes 620 are allocated individual time slots, and at each time The corrections 622a and 622b are transmitted intermittently.

In addition, in the method of transmitting the operation amounts 612a, 612b, and 612c generated by the operation amount generation node 610 to the actuator drive node 630, each time slot is allocated to the redundant operation amount generation node 610, and each time slot The operation quantities 612a, 612b, and 612c are transferred in the middle.

Fig. 37 shows a specific example of applying this embodiment to a Steer-by-Wire system.

A rotating column (rotating disk) 615 is connected to the operating amount generating node 610 to generate an operating amount 612 of a steering angle based on the operating angle of the rotating column 615 and transmit the operating amount 612 to the actuator driving node 630 through the communication path 650 .

The acceleration sensor and yaw rate sensor 625 are connected to the correction amount generation node 620, and a signal from the acceleration sensor and yaw rate sensor 625 and a correction amount 622 given from the information of the operation amount 612 are generated. The correction amount 622 The data is transmitted to the actuator drive node 630 through the communication path 650 .

At the actuator drive node 630, when the correction amount generation node 620 is normal, the steering device 641 is controlled using a value obtained by adding the correction amount 622 to the operation amount 612 as a control target value.

According to the present embodiment described above, when the driver turns the steering column 615 excessively, without the correction amount 622, the front wheels lose lock and the stability of the vehicle decreases, which is detected by the acceleration sensor and yaw rate sensor 625. For the lateral slip and rotation of the vehicle, since the correction amount generation node 620 generates the correction amount 622 to suppress the lateral slip and rotation, the steering stability of the vehicle can be improved.

Fig. 38 shows a specific example of applying this embodiment to a Brake-by-Wire system.

A brake pedal 616 is connected to an operation amount generation node 610 , and an operation amount 612 of brake pedal force according to the operation of the brake pedal 616 is generated and transmitted to the actuator drive nodes 630 - 1 to 630 - 4 through the communication path 650 .

The acceleration sensor/yaw rate sensor 625 is connected to the correction amount generation node 620, and the correction amount 622-1 to 622- 4. It is transmitted to the actuator driving node 30 through the communication path 650 .

When the actuator drive node 630-i (i=1~4), when the correction amount generating node 620 is normal, add the value of the correction amount 622-i (i=1~4) to the operation amount 612 as the control The brake 642-i (i=1-4) of each wheel is controlled according to the target value.

According to the present embodiment described above, when the driver steps on the brake pedal 616 too much, if there is no correction amount 622-i (i=1-4), each wheel will lose locking and the stability of the vehicle will decrease. However, when the acceleration sensor and the yaw rate sensor 625 detect the lateral slip and rotation of the vehicle, since the correction amount generating node 620 generates the correction amount 622-i (i=1 to 4) for suppressing the lateral slip and rotation, it is possible to improve The handling stability of the vehicle.

Fig. 39 shows a specific example of applying this embodiment to a system integrating Steer-by-Wire and Brake-by-Wire.

The steering column 615 and the brake pedal 616 are connected to the operation amount generation node 610, and the operation amount 612-0 of the steering angle according to the operation angle of the steering column 615 and the operation amount 612 of the brake pedal force according to the operation of the brake pedal 616 are generated. -2, which is transmitted to the actuator drive nodes 630-0 to 630-4 through the communication path 650.

In the actuator drive node 630-0, when the correction amount generation node 620 is normal, the steering device 641 is controlled using a value obtained by adding the correction amount 622-0 to the operation amount 612-0 as a control target value.

In the actuator driving node 630-i (i=1~4), when the correction amount generation node 620 is normal, the operation amount 612-i is added with the correction amount 622-i (i=1~4). The value is used as a target value to control the brake 642-i (i=1 to 4) of each wheel.

According to the present embodiment described above, when the driver turns the steering column 615 excessively and steps on the brake pedal 616 excessively, the front wheels lose lock when there is no correction amount 622-i (i=1-4). However, the stability of the vehicle is reduced, but the acceleration sensor and the yaw rate sensor 625 detect the lateral slip and rotation of the vehicle, and the correction amount 622-i (i=1) is generated by the correction amount generation node 620 to suppress the lateral slip and rotation. ~4), so the handling stability of the vehicle can be improved.

(Embodiment 8)

Embodiment 8 of the vehicle control device of the present invention will be described with reference to FIG. 40 .

The vehicle control device of this embodiment has the following configurations: a sensor 500 that detects the operation amount of the accelerator pedal, brake pedal, steering wheel, etc. indicating the driver's request for vehicle movement; detects the vehicle speed, Sensors 550 for acceleration, yaw rate, and information outside the vehicle obtained through radio waves or images; multiple actuators 400 corresponding to each of the power source for driving, braking, and steering, braking, and steering; generation control The operation amount generation node 100 of the target operation amount for these actuators 400 ; a plurality of actuators driving the nodes 300 that control the actuators 400 based on the target operation amount generated by the operation amount generation node 100 .

The operation amount generation node 100, not shown in detail in the figure, has a central processing unit (CPU) for executing programs, and a non-volatile memory device (ROM) and a non-volatile memory device (RAM) for storing programs and data. ), and the input/output device (I/O) for connecting the sensor 500, the sensor 550, and the actuator drive node 300, these can also be constructed by a general microcomputer connected by a bidirectional bus.

The operation variable generating node 100 further has an analog/digital conversion device (ADC), and the sensor 500 and sensor 550 can also be connected to the ADC, and a serial communication device (SCI) can also be used to connect the sensor 500, sensor 550, and actuator The drive node 300 is connected to the SCI. Furthermore, these devices may be realized by one or more semiconductor integrated circuits.

The operation amount generation node 100 calculates the target operation amount of each actuator 400 based on the driver request signal 200 output by the sensor 500 and the vehicle state signal 201 output by the sensor 500, and sends it as an operation amount command value 120 to the execution unit through the network. The element drives node 300 . The operation amount command value 120 is determined according to each actuator 400. If the actuator 400 is a power source, it is the target driving force, if it is braking, it is the target braking force of each four wheels, and if it is steering, it is the target rudder angle.

The actuator driver node 300 is not shown in detail in the figure, and it has: a central processing unit (CPU) for executing programs, and a non-volatile memory device (ROM) and a non-volatile memory device (RAM) for storing programs and data , and the output/input device (I/O) used to connect the sensor 500 and the operation amount generation node 100, these may also be connected by a bidirectional bus, further have a drive circuit for driving the actuator, and be connected to the general I/O Composition of the microcomputer.

The actuator drive node 300 further has an analog/digital conversion device (ADC), and the sensor 500 can also be connected to the ADC, and a serial communication device (SCI), and the sensor 500 can also be connected to the operand generation node 100 to the SCI superior. Furthermore, these devices may be realized by one or more semiconductor integrated circuits.

The actuator driving node 300 is not shown, but has a sensor that detects one of the driving force, braking force, and rudder angle of the actuator 400, or information necessary for estimating these. The driving force, braking force, and Drive control of the actuator 400 is performed in accordance with the operation amount command value 120 received from the operation amount generation node 100 by the steering angle.

In addition, the actuator driving node 300 transmits the driving force, braking force, and rudder angle of the actuator detected by the sensor to the operation amount generating node 100 . Thereby, the operation amount generation node 100 can calculate the target operation amount of each actuator 400 by referring to the driving force, the braking force, and the steering angle of the actuator 400 .

The sensor 500 , the operation amount generating node 100 , and the actuator driving node 300 each have failure detection functions 210A, 210B, and 210C for detecting their own failure.

Sensor failure detection by the failure detection function 210A can be realized by judging that the value detected by the sensor 500 deviates from a predetermined range, or by using multiple sensors to compare, collate, or majority logic judgment on these detection results.

The failure detection function 210B can detect the failure of the operation amount generation node 100, pause the CPU by the watchdog timer, detect the short-term error of the ROM, RAM and the bidirectional bus by redundant symbols, and compare and check by the I/O. Realization can also be realized by using a plurality of operation amount generation nodes 100 to perform comparison check or majority logic decision on these outputs.

The failure detection of the actuator drive node 300 of the failure detection function 210C, the pause of the CPU formed by the watchdog timer, the short-term error detection of the ROM, the RAM and the bidirectional bus formed by redundant symbols, and the comparison check of I/O can Realization, in addition, can also be realized by using a plurality of operation amount generation nodes to perform comparison check or majority logic decision on these outputs.

Furthermore, the failure detection function 210C also has a function of detecting a failure of the actuator 400 from the driving force of the actuator 400 , the braking force, the amount of change in the rudder angle, or the difference in the operation amount command value 120 .

The fault detection functions 210A, 210B, and 210C output a fault detection notification 230 for notifying themselves of a fault state to the operation variable generation node 100 and other actuator drive nodes 300 when detecting a fault of itself or the actuator 400 .

It is ideal for the sensor 500, the operation amount generating node 100, and the actuator driving node 300 to output only the failure detection notification 230 and stop other outputs in the failure state. Furthermore, when the failure detection notification 230 cannot be output normally It is ideal that the failure detection notification 230 also ceases when .

In addition, each actuator driving node 300 has a control program selection function for selecting a control program (actuator control method) based on failure detection results of itself, other actuator driving nodes 300, and operation amount generating nodes 100, etc. ( control method selection means) 200.

The control program selection function 200 normally selects a control program for controlling the actuator 400 based on the operation amount command value 120 given from the operation amount generating node 100, but when the operation amount generating node 100 fails, it selects the control program based on the operation amount command value 120 given from the sensor 500. The driver requires the signal 200 to select the control program for controlling the actuator 400, and selects the control program for safely stopping the control of the actuator 400 when the actuator drive node 300 in itself or other specific places fails.

Accordingly, even when the operation amount generation node 100 and the actuator driving node 300 fail, the vehicle control can be continued by the actuator driving node 300 in a normal state.

In the vehicle control device of this embodiment, as shown in FIG. 41 , the operation variable generating node 100, the actuator driving node 300, and the sensor 500 may be communicably connected by a network 600 such as CAN. Manipulation generating node 100 , actuator driving node 300 and sensor 500 send manipulating command value 120 , failure detection notification 230 , driver request signal 200 and other short messages to desired nodes via network 600 . Furthermore, multiple nodes can also receive short messages sent by each sensor.

In addition, as shown in FIG. 42 , the vehicle control device of this embodiment can also have a configuration in which the sensor 550 is also connected to the network 600 as one node. Thus, sensor 550 can transmit vehicle state signal 201 to a desired node via network 600 . Furthermore, a plurality of nodes can also receive the short message sent by the sensor 550 .

Moreover, in the vehicle control device shown in FIG. 41, FIG. 42, by having a plurality of networks 600 and having redundancy, the reliability of the network can be improved.

FIG. 43 is a functional block diagram of the operation amount generating node 100 . The operation amount generation node 100 loads multiple control programs for vehicle control into ROM and RAM, and when detecting its own failure through the failure detection function 210B, or when driving the node 400 from the sensor 500, sensor 550, and actuator When the fault detection notification 230 is received, the control program is switched according to the location and degree of the fault.

FIG. 44 is a functional block diagram of the actuator driving node 300 . The actuator drive node 300 loads, into ROM and RAM, a plurality of control programs for calculating operation target values of the actuator 400 based on the operation amount command value 120 received from the operation amount generating node 100 . The actuator driving node 300 has: a program X that controls the actuator 400 based on the operation amount command value 120 output from the operation amount generating node 100 , and a control program Y that controls the actuator 400 based on the driver request signal 200 output from the sensor 500 , and the control program Z that maintains the actuator in a predetermined state regardless of the operation amount command value 120 and the driver's request signal 200 can be switched by the control program selection function 220 according to its own failure or the failure status of other nodes control program.

Hereinafter, using FIGS. 40 to 44 as an example, the basic processing for continuing the vehicle movement when a failure occurs in the vehicle control device will be described.

Basic processing when the operation amount generating node 100 fails will be described. When the operation amount generation node 100 detects its own failure by the failure detection function, it stops transmission of the operation amount command value 120 and simultaneously transmits a failure detection notification 230 . When the failure detection notification 230 cannot be normally transmitted, the operation amount generating node 100 also stops transmission of the failure detection notification 230 .

Thus, each actuator drive node 300 connected to the network 600 can detect that a failure has occurred in the operation amount generation node 100 by receiving the failure detection notification 230 given from the operation amount generation node 100, and by Without receiving the operation amount command value 120 inside, it is possible to detect that some kind of abnormality has occurred in the operation amount generation node 100 .

In addition, if the network 600 is time-division multiple access (TDMA), and each node is configured to transmit a short message at a predetermined time slot, then it is confirmed by the operation amount generation node 100 that the time slot for sending the operation amount command value 120 It is possible to detect whether some kind of abnormality has occurred in the operation amount generation node 100 by receiving or not receiving.

Each actuator drive node 300 switches the control program from (X) to (Y) when detecting the fault detection notification 230 given from the operation amount generation node 100 or detecting that the transmission of the operation amount command value 120 is not received, Vehicle motion control of driving force, braking force, rudder angle, and the like is executed with the driver request signal 200 taken from the sensor 500 from the network 600 .

As a result, the operation amount generation node 100 continues to perform vehicle motion control even if a failure occurs.

Next, basic processing when the actuator drive node 300 and the actuator 400 fail will be described. Incidentally, failures of the actuator 400 include failures of a rotational position sensor, a current sensor, and the like necessary for actuator control not shown.

When the actuator drive node 300 or the actuator 400 installed on each of the brakes of the four wheels fails, the actuator drive node 300 detects its own fault through the fault detection function, and sends the fault detection notification 230. At the same time, switch the control program from (X) to (Z) to release the brake control of this wheel.

When the operation amount generating node 100 receives the failure detection notification 230, it controls the braking force of the remaining two to three wheels. Alternatively, the driver directly brakes the vehicle using a mechanical backup mechanism such as a hydraulic mechanism.

Accordingly, even if the actuator drive node 300 or the actuator 400 provided on each of the brakes of the four wheels fails, vehicle motion control can be continued.

When the actuator drive node 300 or the actuator 400 installed on the steering gear fails, when the actuator drive node 300 detects its own fault through the fault detection function 210C, while sending out the fault detection notification 230, the control program Switching from (X) to (Z) stops the rudder angle control.

In addition, the driver directly controls the steering of the vehicle using a mechanical backup mechanism such as a steering column. When there is no mechanical backup mechanism, a plurality of steering actuator drive nodes 300 and actuators 400 are provided, and at least one actuator drive node 300 and actuator 400 controls the rudder angle.

Accordingly, even if the actuator driving node 300 or the actuator 400 provided in the steering gear fails, the vehicle motion control can be continued.

When the actuator drive node 300 or the actuator 400 set as the driving force fails, when the actuator drive node 300 detects its own fault through the fault detection function, it sends out the fault detection notification 230 and transfers the control program from Switching from (X) to (Z) stops the drive control.

Thereby, even if the actuator drive node 300 or the actuator 400 provided as a driving force fails, the vehicle can be stopped safely.

When the brake pedal sensor 500 fails, the brakes on all wheels are released, and the driver directly brakes the vehicle using a mechanical backup mechanism such as a hydraulic mechanism. When there is no mechanical backup mechanism, a plurality of brake pedal sensors 500 are provided, and at least one sensor 500 can detect a driver's request.

Accordingly, even if the brake pedal sensor 500 fails, vehicle motion control can be continued.

When the sensor 500 for the steering wheel fails, the steering control is stopped, and the driver directly steers the vehicle using a mechanical backup mechanism such as a steering column. When there is no mechanical backup mechanism, a plurality of brake pedal sensors 500 are provided, and at least one sensor 500 can detect a driver's request.

Accordingly, even if the sensor 500 for the steering wheel fails, the vehicle motion control can be continued.

When the accelerator pedal sensor 500 fails, the driving force control is stopped to bring the vehicle to a safe stop. Alternatively, a plurality of brake pedal sensors 500 are provided, and at least one sensor 500 can detect a driver's request.

Accordingly, vehicle motion control can be continued.

When the sensor 500 fails, the operation amount generating node 100 continues the movement of the vehicle based on the normally acquired vehicle state information 201 and the driver request signal 200 acquired from the sensor 500 .

As described above, according to the present embodiment, since the operation amount generating node 100 and the actuator driving node 300 back up each other, there is no need to add a redundant backup device.

However, when the operation amount generating node 100 fails, the element driving nodes 300 perform control independently, respectively.

Therefore, it is necessary for the actuator drive nodes 300 to equally detect the failure of the operation amount generation node 100, and even if a part of the actuator drive nodes 300 fails on the basis of the vehicle motion integrated control ECU 30, it is necessary to pass the remaining actuators. The driving node 300 safely controls the vehicle. In particular, when there is a difference in the braking force between the left and right brakes, it is a state of one-sided effect, and the vehicle rotates while braking.

Operation examples of the manipulation amount generating node 100 and the actuator driving node 300 to avoid such a dangerous state will be described in detail with reference to FIGS. 45 to 57 . Here, each operation will be described using the brake as an example.

The operation amount generation node 100 repeatedly executes the brake control process in a constant control cycle (A). This control cycle is determined by the necessary accuracy of vehicle braking control. In addition, each actuator driving node 300 repeatedly executes the braking force control of the actuator 400 in a shorter control cycle (B) than the control cycle (A) of the operation amount generating node 100 as described later. This is because the current feedback control of the actuator 400 requires higher precision.

Therefore, while the operation amount generation node 100 executes a series of processes in the control cycle (A), each actuator driving node 300 repeatedly executes the braking force control in the control cycle (B) based on the latest operation amount command value 120, and in the The braking force control is not interrupted during communication processing with the operation amount generation node 100 and the like.

FIG. 45 is a time chart showing the operation of the actuator drive node 300. The horizontal axis represents the passage of time from left to right. Each actuator drive node 300 repeatedly executes the following processing in a control cycle (B).

First, the actuator drive node 300 checks whether the operation amount command value 120 and the failure detection notification 230 are received from the operation amount generation node 100, and the driver request signal 200 is received from the sensor 500 (command value, failure detection notification reception confirmation B1). Since these are transmitted at intervals of the control cycle (A), reception of the operation amount command value 120 and the driver request signal 200 can be confirmed using a timer that measures the time of the control cycle (A). Alternatively, reception can also be confirmed by transmitting and receiving in predetermined time slots for these networks using a time division multiple access (TDMA) type.

Next, the actuator driver node 300 sends the braking force of the actuator 400 detected at the end of the previous control cycle and the diagnosis result given by the failure detection function 210C to the operation variable generation node 100 or other actuator drivers. Node 300 (response short message sending B2). At this time, when the operation amount command value 120 is not received by (command value, failure detection notification reception confirmation B1), when the operation amount command value is not received and the failure detection notification 230 is received, the failure detection notification reception is also notified together. . These are sent together as one reply SMS.

Next, the actuator drives the node 300, based on the presence or absence of reception of the operation amount command value 120, reception of the failure detection notification 230, presence or absence of failure of the actuator 400 and itself, and presence or absence of input from other actuator drive nodes 300. Answer the short message and its content selection control program (control program selection B3). The control program has a control program (X) that performs braking force control based on the operation amount command value 120, and a control program (Y) that performs braking force control based on the driver request signal 200, and is also related to the operation amount command value 120 and The driver requests the signal 200 to be independent of the brake release control program (Z), and selects one of them.

The selection procedure (B3) of this control program will be described with reference to the flow of FIG. 46 .

First, the abnormal occurrence of its own actuator driving node 300 or actuator 400 is judged by the following conditions (step S1610).

Condition 1: The result of self-diagnosis and actuator diagnosis, detected failure.

Condition 2: When the failure detection notification 230 is received from the operation amount generation node 100 , the other two or more actuator drive nodes 300 respond that the failure detection notification 230 has not been received.

Condition 3: No other two or more actuator drive nodes 300 respond to the receipt of the failure detection notification 230 when the operation amount generation node 100 receives the failure detection notification 230 .

Condition 4: When the manipulated variable command value 120 is received from the manipulated variable generation node 100 , the other two or more actuator drive nodes 300 respond that the manipulated variable command value 120 has not been received.

Condition 5: When the manipulated variable command value 120 is not received from the manipulated variable generation node 100 , the other two or more actuator drive nodes 300 respond that the manipulated variable command value 120 has been received.

When at least one of the above conditions 1 to 5 is satisfied, it is judged that it is abnormal, and the control program (Z) is selected to release the brake (step S1680).

Next, the occurrence of an abnormality in the operation amount generating node 100 is judged by the following conditions (step S1620).

Condition 6: The failure detection notification 230 is received from the operation amount generation node 100 , and two or more other operation amount generation nodes 100 also respond to the failure detection notification 230 being received.

Condition 7: The operation amount command value 120 has not been received from the operation amount generation node 100 , and two or more other operation amount generation nodes 100 also reply that the operation amount command value 120 has not been received.

When none of the conditions 6 and 7 are satisfied, the operation amount generating node 100 determines that it is normal, selects the control program (X) (step S1660 ), and executes braking force control based on the operation amount command value 120 .

In addition, when at least one of conditions 6 and 7 is satisfied, the operation amount generation node 100 determines abnormality, and the occurrence of abnormality in other actuator drive nodes 300 or actuator 400 is determined by the following conditions (step S1630).

Condition 8: Other actuators drive the node 300 to notify the failure.

Condition 9: the other actuator drive node 300 does not send a response short message.

Condition 10: When the failure detection notification 230 is received from the operation amount generating node 100 , only the other actuator driving node 300 replies that the failure detection notification 230 has not been received.

Condition 11: When the failure detection notification 230 is not received from the operation variable generation node 100 , only one other actuator driving node 300 acknowledges that the failure detection notification 230 has been received.

Condition 12: When the manipulated variable command value 120 is received from the manipulated variable generation node 100 , only one other actuator driving node 300 responds that the manipulated variable command value 120 has not been received.

Condition 13: When the manipulated variable command value 120 is not received from the manipulated variable generating node 100 , only one other actuator driving node 300 acknowledges that the manipulated variable command value 120 has been received.

When none of the above-mentioned conditions from condition 8 to condition 13 is established, the other actuator drive nodes 300 and actuator 400 are judged to be normal, and the control program (Y) is selected (step S1670), and the control program is executed based on the driver request signal 200. power control.

In addition, when at least one of conditions 8 to 13 is established, the other actuator drive node 300 or actuator 400 is judged to be abnormal. table (step S1640), select one of the control program (Y) or (Z) (step S1650).

As described above, the actuator driving node 300 judges the abnormality of its own actuator driving node 300 or actuator 400, the abnormality of the operation amount generation node 100, and the abnormality of other actuator driving nodes 300 or actuators based on conditions 1 to 13. 400 exception, and select the control program.

In addition, since the above-mentioned conditions differ depending on the form of the vehicle system and the form of each component, conditions based on them may be used.

In addition, non-reception of the operation amount command value 120 and failure detection notification 230 from the operation amount generation node 100 is not directly judged as abnormal, but may be judged as abnormal when it is not received twice or more. At this time, the unreceived counts may be exchanged among the actuator drive nodes 300, and the unreceived counts may be made to match by taking a majority logic decision.

47(a), (b) show control program selection tables.

Table (a) is the selection control for braking the vehicle by the brake of one of the front two wheels and the rear two wheels when the other actuator drive node 300 or the actuator 400 is abnormal during four-wheel braking program table.

In addition, table (b) is in the four-wheel braking, when other actuators drive node 300 or actuator 400 is abnormal, brake by the brakes of the front wheel and the rear wheel on the diagonal A list of vehicle ground selection control programs.

In addition, in these tables, the premise is that when the vehicle cannot be braked by the brakes of the front two wheels or the rear two wheels, or one of the front and rear wheels on the diagonal line, the The brake formed by the full actuator 400, and the driver brakes the vehicle through the hydraulic mechanism.

Of course, even in such cases, vehicle braking can also be performed via the remaining normal actuator 400 .

In addition, when there is no backup of the hydraulic mechanism, even when the vehicle cannot be braked by the brakes of the front two wheels or the rear two wheels, or one of the front and rear wheels on the diagonal line, Vehicle braking also needs to be performed via the remaining normal actuator 400 . It is desirable to suppress the influence of the one-sided effect of braking by reducing the speed of the vehicle by controlling the number of revolutions of the internal combustion engine at these times.

After the selection of the control program is completed, return to the description using FIG. 45 , calculate the braking force and execute the braking control (B4), and thereafter, take in the actual braking force and collect the fault information (B5).

FIG. 48 is a time chart showing the operations of the operation amount generating node 100 and the actuator driving node 300 at the start time of braking. The horizontal axis represents the passage of time from left to right.

First, the operation amount generation node 100 transmits a brake start notification to the four-wheel actuator drive node 300 after detecting the driver's depression of the brake pedal (1810).

After receiving the braking start notification, each actuator driving node 300 uses the fault detection function 210C to perform its own fault diagnosis and the fault diagnosis of the actuator 400 (1820), and sends the diagnosis result to the operation variable generation node 100 through a response message (1830). In addition, the individual actuator drive nodes 300 mutually receive other diagnostic results.

The operation variable generation node 100 receives the diagnosis result of each actuator drive node 300, and selects a wheel to be braked according to the presence or absence of a faulty node and the position of the faulty node (1840). In addition, when the actuator driver node 300 does not transmit a diagnosis result, this node is regarded as a node where a failure has occurred. Alternatively, the brake start notification may be retransmitted once to several times to try transmission from the diagnosis result given by the actuator drive node 300 .

The operation amount generation node 100 calculates the target operation amount for the wheel to be controlled (1850), and transmits the operation amount command value 120 to the target actuator drive node 300 (1860).

Each actuator driving node 300 receives the operation amount command value 120, updates the target value of the braking force control, and executes the braking force control of the actuator 400 (1870).

In addition, each actuator driving node 300 sends the detection of the braking force of the actuator 400 and the periodic diagnosis result detected by the fault detection function 210C to the operation amount generation node 100 by replying a short message at a certain period (1880). At this time, the individual actuator drive nodes 300 also receive other diagnostic results from each other.

FIG. 49 is a time chart showing the operations of the operation amount generating node 100 and the actuator driving node 300 in braking control. The horizontal axis represents the passage of time from left to right.

The operation amount generating node 100 executes the following processing every control cycle (A).

First, the operation amount generation node 100 receives the response message from each actuator drive node 300 (1910), refers to the fault diagnosis result of each actuator drive node 300 included in the response message, and confirms that each actuator drive node Whether or not there is an abnormality in 300 and the actuator 400 and the location of the abnormality, each actuator drive node 300 to be brake-controlled is selected (1920).

Next, the operation amount generation node 100 calculates the target operation amount for the wheel to be braked (1930), and sends the operation amount command value 120 to the target actuator drive node 300 (1940).

In addition, in FIG. 49 , the operation amount generation node 100 detects that the driver's brake pedal is depressed, and sends a brake start notification to the four-wheel actuator drive node 300 to start brake control. Whether or not the brake pedal is depressed is regarded as a difference in the driver's request amount, regardless of whether or not the driver's brake pedal is depressed, and the operation amount generating node 100 is always controlled as shown in FIG. 49 The cycle (A) can repeatedly execute a series of processes.

Fig. 50 is a flow chart for selecting a wheel for braking control.

First, the operation amount generation node 100 judges the occurrence of its own abnormality according to the following conditions (step S2010).

Condition 1: The diagnosis result and failure are detected by own failure detection function 210B.

Condition 2: no response short messages from more than three actuator drive nodes 300 are received.

When at least one of the above conditions 1 and 2 is satisfied, the operation amount generation node 100 determines that it is abnormal, and at the same time as sending the fault detection notification 230 to the actuator drive node 300 (step S2040), the operation amount command value 120 is stopped. Send (step S2050).

In addition, when neither the condition 1 nor the condition 2 is satisfied, the operation amount generation node 100 judges that it is normal, and the abnormal occurrence of the actuator driving node 300 or the actuator 400 is judged by the following conditions (step S2020).

Condition 3: Failure detection notification is received from the actuator drive node 300 .

Condition 4: The response short messages given from two or less actuator drive nodes 300 are not received.

When the above-mentioned condition 3 and condition 4 are not satisfied, all actuator drive nodes 300 and actuators 400 are judged to be normal, and the braking force control of all four wheels is executed (step S2070 ).

In this regard, in the condition 3 and the condition, when any one of them is established, the actuator drive node 300 or the actuator 400 is judged to be abnormal. In order to avoid the one-sided effect of the brake, refer to the brake wheel selection table ( 2030), execute the braking force control given by the selected wheel (step S2060).

As explained above, the operation variable generation node 100 judges its own abnormality, the abnormality of the actuator driving node 300 or the actuator 400 based on the conditions 1 to 4, and if it is normal, it uses the normal actuator to drive the node 300 and avoids the brake. The brake control is executed in a unilateral effect, and if the self-control is abnormal, the self-brake control is stopped, and the self-regulatory brake control is performed by the actuator drive node 300 .

In addition, since the above-mentioned conditions differ depending on the form of the vehicle system and the form of each component, conditions based on them may be used. In addition, the non-reception of the response short message given from the actuator drive node 300 is not directly judged as abnormal, but may be judged as abnormal when it is not received twice or more.

Fig. 51 (a), (b) shows a brake wheel selection table.

Table (a) is the selective control system for braking the vehicle by one of the brakes of the front two wheels or the rear two wheels when the actuator drive node 300 or the actuator 400 is abnormal during four-wheel braking. Wheel watch.

Table (b) is, in four-wheel braking, when other actuators drive node 300 or actuator 400 is abnormal, the vehicle is braked by the brakes of the front and rear wheels on the diagonal Select the table for braked wheels.

In addition, although it is not shown in these tables, the premise is that the vehicle cannot be braked by the brakes of the front two wheels or the two rear wheels, or one of the front and rear wheels on the diagonal line. At this time, the operation amount generation node 100 releases the brake calculation operation amount instruction 120 of all actuators 400, and the driver brakes the vehicle through hydraulic pressure.

Of course, even in such a situation, the vehicle braking operation amount instruction 120 can be executed by the remaining normal actuator 400 .

In addition, when there is no oil pressure backup mechanism, even when the vehicle cannot be braked by the brakes of the front two wheels or the rear two wheels, or one of the front and rear wheels on the diagonal line, Vehicle braking also needs to be performed via the remaining normal actuator 400 . It is desirable that the influence of the one-sided effect of braking can be suppressed by controlling the number of revolutions of the internal combustion engine to reduce the speed of the vehicle at these times.

52 is a time chart showing the operations of the operation amount generating node 100 and the actuator driving node 300 when the actuator driving node 300 or the actuator 400 of the left rear wheel fails at the start of braking. The horizontal axis represents the passage of time from left to right.

In addition, in this time chart, the operation amount generating node 100 is a node for selecting a wheel for performing braking force control based on the braking wheel selection table (a) shown in FIG. 51 .

First, when the operation amount generation node 100 detects that the driver has stepped on the brake pedal, it transmits a brake start notification to the four-wheel actuator drive node 300 (2210).

Each actuator driving node 300 uses the fault detection function 210C to perform its own fault diagnosis and the fault diagnosis of the actuator 400 after receiving the notification of braking start (2220), and sends the diagnosis result to the operation variable generation node 100 through the response message (2230). At this time, the actuator drive node 300 of the left rear wheel transmits the detected fault to the operation variable generating node 100 through a response short message. In addition, the individual actuator drive nodes 300 mutually receive other diagnostic results.

The operation variable generation node 100 receives the diagnosis results of the actuator drive nodes 300, and detects that the actuator drive node 300 of the left rear wheel is faulty, and selects the wheel by performing braking control on the front two wheels (2240).

The operation amount generating node 100 calculates the target operation amount for the first two rounds (2250), and sends the operation amount instruction value 120 to the actuator driving nodes 300 of the second round while sending The operation amount command value of releasing the braking force is 120 (2260).

The actuator drive node 300 of the first two wheels updates the target value of the braking force control and executes the braking force control of the actuator 400 after receiving the operation amount command value 120 . In addition, the actuator drive node 300 of the right rear wheel updates the target value of the braking force control and executes the braking force control of the actuator 400 after receiving the operation amount command value 120. value, so no braking force actually occurs.

In addition, the actuator drive node 300 of the left rear wheel does not generate a braking force (2270) because the control program (Z) is selected as a result of detecting its own failure.

53 is a time chart showing the operations of the operation amount generation node 100 and the actuator drive node 300 when the actuator drive node 300 or the actuator 400 of the left rear wheel fails during braking control. The horizontal axis represents the passage of time from left to right.

In addition, in this time chart, the operation amount generating node 100 is a node for selecting a wheel for performing braking force control based on the braking wheel selection table (a) shown in FIG. 51 .

Firstly, the operation amount generation node 100 receives the response message from each actuator drive node 300, and detects the actuator drive of the left rear wheel from the fault diagnosis results of each actuator drive node 300 included in the response message. Node 300 fails (2310), and the front two wheels perform braking control to select the wheel (2320).

Next, the operation amount generation node 100 calculates the target operation amount for the wheel to be braked and controlled (2330), and while sending the operation amount command value 120 to the actuator driving node 300 of the front two wheels, the execution of the two rear wheels The element driving node 300 transmits an operation amount command value 120 for releasing the braking force (2240).

The actuator drive node 300 of the first two wheels updates the target value of the braking force control and executes the braking force control of the actuator 400 after receiving the operation amount command value 120 . In addition, the actuator drive node 300 of the right rear wheel updates the target value of the braking force control and executes the braking force control of the actuator 400 after receiving the operation amount command value 120. value, so no braking force actually occurs.

In addition, the actuator of the left rear wheel drives the node 300, and as a result of detecting its own failure, no braking force occurs due to the selection control program (Z) (2270).

As described above with reference to FIG. 52 and FIG. 53 , even when any actuator driving node 300 or actuator 400 fails, the operation amount generation node 100 uses the normal first two rounds or the last two rounds of actuators to drive. The node 300 brakes the vehicle and generates the operation amount command value 120 for this purpose, so that the one-sided effect of braking can be avoided.

54 is a time chart showing operations of the operation amount generation node 100 and the actuator drive node 300 when the actuator drive node 300 or the actuator 400 of the left rear wheel that failed temporarily during braking control is recovered. The horizontal axis represents the passage of time from left to right.

In addition, in this time chart, the operation amount generating node 100 is a node for selecting a wheel for performing braking force control based on the braking wheel selection table (a) shown in FIG. 51 .

The operation variable generating node 100, since the actuator drive node 300 of the left rear wheel fails, the brake control of the first two wheels is performed to select the wheel, and at the same time, the operation amount command value 120 is sent to the actuator drive node 300 of the first two wheels , transmits the operation amount command value 120 for releasing the braking force to the actuator drive node 300 of the rear two wheels (2410).

Each actuator driver node 300 uses the fault detection function 210C to perform its own fault diagnosis and the fault diagnosis of the actuator 400, and sends the diagnosis result to the operation variable generation node 100 through a response message (2420). At this time, the actuator drive node 300 of the left rear wheel switches the control program from (Z) to (X) when the failure is restored, and maintains the braking force in the released state based on the operation amount command value 120 for releasing the braking force. At the same time, the fault has been recovered and the operand generation node 100 is notified by replying a short message. In addition, the individual actuator drive nodes 300 mutually receive other diagnostic results.

The operation amount generation node 100 receives the diagnosis result of each actuator drive node 300, detects that the failure of the actuator drive node 300 of the left rear wheel has been recovered, performs brake control and selects the wheel by four wheels (2430).

The operation amount generation node 100 calculates the target operation amount for the four wheels (2440), and sends the operation amount command value 120 to the actuator drive node 300 for the four wheels (2450).

The actuator drive node 300 of the first two wheels updates the target value of the braking force control and executes the braking force control of the actuator 400 after receiving the operation amount command value 120 . In addition, the actuator drive node 300 of the right rear wheel also updates the target value of the braking force control and executes the braking force control of the actuator 400 after receiving the new operation amount command value 120 . Furthermore, after the actuator driving node 300 of the left rear wheel also receives the new operation amount command value 120 , it updates the target value of the braking force control and executes the braking force control of the actuator 400 .

As described above using FIG. 54 , even when the actuator driving node 300 or the actuator 400 that failed temporarily has recovered, the operation amount generation node 100 depends on whether the actuator driving node 300 or the actuator 400 is normal or abnormal. Since the operation amount command value 120 is generated, the normal control state can be restored without causing a one-sided effect of braking.

FIG. 55 is a timing chart showing the operation of the actuator driving node 300 when the operation amount generating node 100 fails during braking control. The horizontal axis represents the passage of time from left to right.

In addition, in this time chart, the actuator drive node 300 is a node for selecting a control program based on the control program selection table (a) shown in FIG. 47 .

When the operation amount generation node 100 detects a failure by the failure detection function 210B, the transmission of the operation amount command value 120 is stopped, and the failure detection notification 230 is transmitted (2510).

Each actuator drive node 300, when receiving the failure detection notification 230, sends a response short message to mutually confirm the receipt of the failure detection notification 230, and judges that the operation amount generation node 100 is abnormal (2520).

Each actuator drive node 300 switches the control program (X) to the control program (Y) when it is judged that the operation amount generating node 100 is abnormal, and executes braking force control based on the driver request signal 200 .

As described above using FIG. 55, even when the operation amount generation node 100 fails, each actuator drive node 300 mutually confirms that the operation amount generation node 100 has failed, switches the control program as a whole, and uses the driver's request signal. 200 to brake the vehicle, so the braking control of the vehicle can be maintained.

FIG. 56 is a time chart showing operations of the manipulated variable generating node 100 and the actuator driving node 300 when the manipulated variable generating node 100 which failed temporarily during braking control is recovered. The horizontal axis represents the passage of time from left to right.

In this time chart, the actuator drive node 300 is a node for selecting a control program based on the control program selection table (a) shown in FIG. 47 .

The actuator drive node 300 performs braking force control based on the driver request signal 200 using the control program (Y) since the operation variable generating node 100 fails.

The operation amount generation node 100, when recovering from the fault, receives the response message (2610) given by each actuator drive node 300, and confirms the fault diagnosis result of each actuator drive node 300 included in the response message to confirm Whether or not there is abnormality and abnormality in the driving node 300 and the actuator 400 is selected, and each actuator to be controlled by braking is selected to drive the node 300 (2620).

Next, the operation amount generation node 100 calculates the target operation amount for the wheel to be braked (2630), and sends the operation amount command value 120 to the target actuator drive node 300 (2640). In addition, the operation amount generation node 100 may also transmit a failure recovery notification in order to notify the actuator drive node 300 that the failure has been recovered.

Each actuator driving node 300, after receiving the operation amount command value 120, sends response information to mutually confirm the receipt of the operation amount instruction value 120, and judges that the operation amount generation node 100 is normal (2650). At this time, whether or not the operation amount generating node 100 is normal may be judged by receiving the failure recovery notification.

Each actuator drive node 300 switches the control program (Y) to the control program (X) when it judges that the operation amount generating node 100 is normal, and executes braking force control based on the operation amount command value 120 .

As described above using FIG. 56 , even when the temporarily failed operation amount generation node 100 is restored, each actuator drive node 300 switches the control program according to whether the operation amount generation node 100 is normal or abnormal. A one-sided effect of braking occurs to restore normal control.

57 is a time chart showing the operation of the actuator driving node 300 when the operation amount generating node 100 and the actuator driving node 300 or the actuator 400 of the left rear wheel fail during braking control. The horizontal axis represents the passage of time from left to right.

In addition, in this time chart, the actuator drive node 300 is a node for selecting a control program based on the control program selection table (a) shown in FIG. 47 .

When the operation amount generation node 100 detects a failure by the failure detection function 210B, the transmission of the operation amount command value 120 is stopped, and the failure detection notification 230 is transmitted (2510). In addition, the actuator drive node 300 of the left rear wheel switches the control program (X) to the control program (Z) when a failure is detected by the failure detection function 210B.

Each actuator drive node 300, when receiving the fault detection notification 230, sends a response short message and mutually confirms the receipt of the fault detection notification 230. At this time, the actuator drive node 300 of the failed left rear wheel notifies other actuator drive nodes 300 of the detected fault by using the reply short message (2720).

Accordingly, other actuator drive nodes 300 judge that the operation amount generating node 100 and the left rear wheel actuator drive node 300 are abnormal, and select a control program based on the control program selection table (a).

The actuators of the left and right front wheels drive the node 300 , switch the control program (X) to the control program (Y), and execute braking force control based on the driver request signal 200 . In addition, the actuator of the right rear wheel drives the node 300, switches the control program (X) to the control program (Z), and releases the braking force.

As described above using FIG. 57 , even when the operation amount generating node 100 and the actuator driving node 300 fail, each actuator driving node 300 mutually confirms that the operation amount generating node 100 and the actuator driving node 300 have failed. Since the control program is switched according to where the faulty actuators drive the node 300, and the braking force control or braking force release using the driver request signal 200 is appropriately performed, it is possible to avoid the one-sided effect of braking. Maintain brake control of the vehicle.

In the above description, the operation of the operation variable generating node 100 and the actuator driving node 300 is described by taking braking as an example, but the present invention is also applicable to steering.

When the steering angle control actuator drive node 300 or the actuator 400 fails, the steering angle control actuator drive node 300 sends a failure detection notification to the operation variable generation node 100 and other actuator drive nodes 300 .

And, when the operation amount generation node 100 receives the failure detection notification given from the actuator drive node 300 for steering angle control, if the actuator drive node 300 for steering angle control and the actuator 400 are multiplexed, the normal The actuator drive node 300 for steering angle control sends the operation amount command value 120, and the steering control can be continued. Alternatively, the steering control can be continued by sending the operation amount command value 120 to the actuator drive node 300 for steering angle control so that the rotational motion of the vehicle is generated by the braking force difference between the braked right wheel and the left wheel.

In addition, when a failure of the operation amount generation node 100 occurs, the operation amount generation node 100 transmits a failure detection notification to each actuator drive node 300 . And the actuator drive node 300 for steering angle control takes in the driver request signal 200 of the sensor 500, and can continue steering control.

In addition, when the actuator drive node 300 for steering angle control or the actuator 400 fails, because the actuator drive node 300 for brake control receives the failure detection given from the actuator drive node 300 for steering angle control Notify or do not receive the reply short message, then detect the failure of the actuator drive node 300 used for rudder angle control, based on the driver's request signal 200 of the sensor 500, the braking force difference between the right wheel and the left wheel of the brake produces a vehicle The rotary motion of the steering wheel can be cross-referenced to each operation value by answering the short message, and the steering control can also be continued at the same time.

In the above description, the vehicle control device having the operation amount generation node 100 and the actuator drive node 300 has been described, but the present invention does not use the operation amount generation node 100 as shown in FIG. A vehicle control device that drives the node 300 to control the vehicle is also effective.

The actuator drive node 300 in the vehicle control device of this embodiment selects one of the control program (Y) or the control program (Z) to control the actuator 400, but the selection of the control program depends on the above-mentioned In the embodiment, it is the same as the case where the operation amount generating node 100 fails.

As a result, the independently operating actuator driving nodes 300 control the actuators 400 while coordinating with each other, so that a safe vehicle control device can be realized even when there is no operation amount generating node 100 .

(Example 9)

Next, Embodiment 9 of the vehicle control device of the present invention will be described using FIGS. 59 to 61 .

Fig. 58 shows the basic configuration of the vehicle control device in the ninth embodiment. The vehicle control device is composed of a sensor 500 for detecting a driver's request, an actuator 400 , an operation amount generating node 100 , and an actuator driving node 300 .

Among them, the sensor 500 for detecting the driver's request, the operation amount generating node 100, and the actuator driving node 300 have failure detection functions 210A, 210B, and 210C, respectively. The failure detection function 210C of the actuator drive node 300 is not only a self-diagnosis function, but also has a function of detecting failure of the actuator 400 .

The operation amount generation node 100 calculates an operation amount command value 120 based on a driver's request signal 200 and a vehicle state signal 201 . Receiving the operation amount command value 120, the actuator drive node 300 controls the actuator 400 to execute driving, steering, braking, etc. of the vehicle.

When the fault detection functions 210A, 210B, and 210C detect a fault in the node or in the actuator 400 , they output a fault detection notification 230 notifying that they are in a fault state to the outside of the node. When all nodes having a failure detection function are in a failure state, the output to the outside is stopped except for outputting the failure detection notification 230 . That is to say, there is no response to failure.

In addition, each node has a data reception table 9100 . The description is omitted here, but a data transmission table is also provided similarly. The data loaded in the transmission table is output to other nodes at a cycle predetermined in the system. On the other hand, data received from other nodes is temporarily stored in the data reception table, read out and used according to the control cycle of the node.

The connection of each node may be a bus configuration or a network configuration using a common communication path by time division, other than the connection of signal lines shown in FIG. 59 . In this embodiment, data output from one node can be received by a plurality of nodes. Each failure detection function 210A, 210B, 210C estimates the status of other nodes based on the contents of the data reception table, and also has a function of reporting the estimation result to a plurality of nodes.

FIG. 60 is a diagram describing a specific example of the data reception table 9100 . There is a short message number field 9101 for distinguishing the sending source and further distinguishing the sending items. This may also be an actual information group, or a specific address pre-allocated in the short message, or there may be no actual information group.

Among the other information groups in the data receiving table 9100, there are effective information group 9102 indicating the validity of the short message, time information group 9103 recording the sending time of the short message, short message data information group 9104, fault voting information group 9105 .

These messages are included in the short message output from each node, and are stored in a table in a predetermined message group division at the receiving node.

In addition, since there is no need to store unnecessary short messages at this node, the effective information group can be made invalid (0) from the beginning as the short message number (No. 2) in FIG. 60 . In addition, although it is not necessary at the time of control, it can be effective only for signal monitoring. Of course, when there is a failure detection notification 230 from each node, it is reflected in the data field, and it is possible to determine whether it is valid or not.

A fault diagnosis method for other nodes will be described using FIG. 61 . Here, a case where the operation amount generating node fails is shown, but the same applies to other nodes.

First, take out the short message number information group corresponding to the operation amount generation node (step S2110). In the case of an embodiment where the information set is an address, the purpose can be achieved by accessing the address.

Next, referring to the validity information group 9102 of the data reception table 9100, if it is valid and the time information group 9103 is updated, control is performed using the data 9104 given from the operation amount generation node. Here, it is determined whether to update, for example, whether the difference between the time information (now) owned by the node and the time information group (time) 9103 of each short message is within a predetermined value (limit) (step S2120).

Returning to the description of FIG. 60, the time included in the short message of node 5 lags behind other nodes by a difference of 50 or more. It is judged that there is no action based on this. When it is determined by these methods that it is not valid, it indicates that the operation amount generation node is not operating normally, and control is performed using information transmitted from other nodes (step S2140). On the other hand, when it is determined that it is valid, control is performed using information transmitted from the operation amount generation node (step S2130).

Thereafter, failure vote output is performed to notify other nodes of the judgment result (step S2150). This is stored as a failure voting field. The failure voting information group 9105 of the data reception table 9100 is expressed in binary numbers, and corresponds to the short message numbers in order from the left. In the example in FIG. 60 , all valid nodes except node 5 are judged to be faulty at node 5 (vote=1).

Although only the node 5 itself gives a normal (vote=0) output, the determined algorithm, for example, determines that the node 5 is invalid by majority logic, and invalidates the valid information group (step S2160, step S2170).

When a non-active node is revived, for example, it is realized by canceling the undesired state, automatic reset, etc. In other cases, the revival is determined by voting based on the observation results of other nodes.

As a result, all the nodes applying control can receive the node 5 at the same time, and it is possible to avoid a situation in which the control method is different for each system part.

In addition, the voting algorithm in the case of resurrection can also choose a method different from the algorithm for failure identification. For example, the resurrection can be identified even if all nodes agree. In addition, fault voting is performed, and output processing is performed even for actuator nodes in order to share the state in the system.

As mentioned above, this Example is not limited to the above-mentioned example, It can implement in various forms. For example, the command controllers that generate control commands do not necessarily need to be concentrated on one, and may be composed of a plurality of command controllers.

As shown in FIG. 62 , it is also possible to adopt a configuration in which the information of the steering wheel angle sensor 3000-2 is taken in, the steering wheel angle information D3000 is output to the sensor controller 3000-1 on the network, and the information of the brake pedal position sensor 3001 is taken in. The information of -2 outputs the D3001 of the brake pedal depression amount to the sensor controller 3001-1 of the network, and the actuator controller 3002-1 that makes the rudder angle control electric motor 3002-2 act, and makes the electric brake caliper The operating actuator controller 3003-1, the integrated controller A (3010-1), and the integrated controller B (3010-2) are connected by an in-vehicle network N3000.

By adopting such a configuration, the comprehensive control function can completely reduce the loss of the command controller 3010-2 by physically leaving the configuration of the command controller 3010-2 for calculating the target braking force D3010-2 and the command controller 3010-1 for calculating the target rudder angle D3010-1. established.

The vehicle control device of the present invention can obtain the following effects.

(1) Even when the vehicle motion integrated control device cannot be used, communication between the driver's operating device and the vehicle control device can be performed, and there is an effect that vehicle control can be performed according to the driving intention.

(2) In the vehicle control device, when any node fails, the normal node can prevent errors in the entire system through switching control based on the failure notification sent by the failed node, so the redundancy of each node It is possible to realize a very high reliability vehicle control device at low cost without increasing it more than necessary.

(3) By correcting the operation amount performed by the driver with the correction amount generated by the generated node, appropriate steering operation and braking operation can be obtained as a result, and the stabilization of the vehicle can be achieved.

(4) When a failure occurs in the correction amount generating node, the function can be deactivated without the correction amount and the operation can be performed according to the driver's operation.

(5) The operation amount can be generated by relatively simple information processing, which requires advanced information processing for correction amount generation. Therefore, the correction amount generation node requires an operation with a smaller electric and thermal margin than the operation amount generation node 10 because the number of parts increases and the operation frequency increases. As a result, the failure rate of the correction amount generation node 20 becomes higher than that of the operation amount generation node. Therefore, the effect of the present invention is particularly large in avoiding the influence of a failure of a correction amount generating node having a higher failure rate.

(6) Even when the operation amount generation node fails, since the actuator drive node detects the abnormality of the operation amount generation node and switches the control program to continue the vehicle control, there is no need for multiple operation amount generation nodes, and a safe and low-cost cost of vehicle controls.

(7) Since mutual abnormality is detected between the actuator drive nodes and an appropriate control program is switched, for example, dangerous vehicle motions such as one-sided effects of braking can be avoided even in the state where the operation amount generation node fails Safe vehicle control can also be maintained.

Claims (10)

1. controller of vehicle is characterized in that:

Connect sensor controller, instruction control unit and executive component controller by network, wherein:

The sensor controller is taken into quantity of state, the driver's of expression vehicle the sensor signal of operational ton;

Above-mentioned instruction control unit, the sensor signal according to the sensor controller is taken into generates control target;

Above-mentioned executive component controller receives control target and makes for motor vehicle executive component action of control from above-mentioned instruction control unit;

Above-mentioned executive component controller, has the controlled target generating apparatus, this controlled target generating apparatus, when the control target generation that above-mentioned instruction control unit generates is unusual, sensor values according to the sensor controller on the network of this executive component controller reception generates control target; And above-mentioned executive component controller comes control actuating component by the control target that is generated by above-mentioned controlled target value generation device.

2. according to the described controller of vehicle of claim 1, it is characterized in that: the sensor controller is a deceleration indication unit, quicken indicating device and rudder angle indicating device; Above-mentioned executive component controller is gradual braking device, driving-force control apparatus and rudder angle control device; Above-mentioned instruction control unit is the vehicle movement composite control apparatus of the motion state of control vehicle;

When above-mentioned instruction control unit generation is unusual, above-mentioned gradual braking device comes control brake power according to the operational ton of above-mentioned deceleration indication unit, above-mentioned driving-force control apparatus, operational ton according to above-mentioned acceleration indicating device comes controlling and driving power, above-mentioned rudder angle control device is controlled rudder angle according to the operational ton of above-mentioned rudder angle indicating device.

3. according to claim 1 or 2 described controller of vehicle, it is characterized in that: above-mentioned instruction control unit, constitute by the vehicle movement composite control apparatus, this vehicle movement composite control apparatus has:

Infer state of motion of vehicle the vehicle-state estimating device and

The dbjective state arithmetic unit of the target state that the computing vehicle should obtain and

The motion state of presumptive vehicle and target state carry out computing to the operating physical force that takes place and moment in vehicle operating physical force and Calculating Torque during Rotary device and

According to aforesaid operations power and moment, carry out operational ton arithmetic unit for the computing of the control target of above-mentioned gradual braking device, above-mentioned driving-force control apparatus and above-mentioned rudder angle control device.

4. according to the described controller of vehicle of claim 3, it is characterized in that: the motion state of vehicle and target state are the quantity of states in the rigid motion of vehicle.

5. according to the described controller of vehicle of claim 3, it is characterized in that: above-mentioned vehicle-state estimating device, infer that management is fixed on motion state in the local coordinate system on the vehicle, is fixed on motion state in the coordinate system in specific place, vehicle ' around environment and the malfunction of the control device that has of vehicle.

6. according to the described controller of vehicle of claim 3, it is characterized in that: above-mentioned dbjective state arithmetic unit, according to above-mentioned deceleration indication unit, the operational ton of above-mentioned acceleration indicating device and above-mentioned rudder angle indicating device and above-mentioned state of motion of vehicle, calculate driver's manipulation intention, mechanical constant according to vehicle, the malfunction of the control device that the specification of the control device that vehicle has and vehicle have, calculate the extreme sport state that vehicle can obtain, according to above-mentioned state of motion of vehicle, above-mentioned driver's manipulation intention and above-mentioned extreme sport state calculate target state.

7. according to the described controller of vehicle of claim 3, it is characterized in that: aforesaid operations power and moment arithmetic unit, calculate operating physical force and moment in the local coordinate system that is fixed on the vehicle.

8. according to the described controller of vehicle of claim 3, it is characterized in that: aforesaid operations amount arithmetic unit has tire vector calculation element and operation quantity distribution portion; Wherein:

Above-mentioned tire vector calculation element according to aforesaid operations power and moment, calculates the tire force vector that takes place on each tire;

Aforesaid operations amount dispenser according to above-mentioned tire force vector, is calculated the control target in above-mentioned gradual braking device, above-mentioned driving-force control apparatus and above-mentioned rudder angle control device.

9. according to the described controller of vehicle of claim 8, it is characterized in that: above-mentioned tire vector calculus device, computing are fixed on the force vector in the local coordinate system on the vehicle.

10. according to the described controller of vehicle of claim 9, it is characterized in that: the formation of the above-mentioned gradual braking device that corresponding vehicle has, above-mentioned driving-force control apparatus and above-mentioned rudder angle control device and aforesaid operations amount dispenser is set.

Images