JP2006228002A - Dual system with failure detection function - Google Patents

Abstract

Provided is a duplex system with a failure detection function that can determine which of the redundant subsystems has a high possibility of failure and can determine the failure without using a sensor.
A dual system D composed of subsystems A and B having an input U as a common input and an input U, and an output Q _{A of the} subsystem _A or an output Q _B of the subsystem _B are estimated by modeling. The calculation model X generated by calculation using the estimated value as a pseudo output P is compared with the outputs Q _A and Q _B and the pseudo output P, and it is determined by majority logic whether one of the subsystems A or B is faulty. And a determination selection unit G that selects the normal one of the outputs Q _A and Q _B and sets it as the output Q of the system 1. The determination selection unit G determines that the pseudo output P is always correct. In the calculation model X, a transfer function model of the subsystem A or B is realized by a program, and an output when an input U is added to the transfer function is set as a pseudo output P.
[Selection] Figure 1

Description

  The present invention is a dual system in which reliability is improved by providing two subsystems of the same configuration in parallel, particularly when one of the two subsystems fails. The present invention relates to a dual system capable of detecting whether a subsystem has failed.

  A manual steering device of an automobile includes a steering wheel (steering wheel), a column, a steering gear, a steering link device, and the like. The steering link device steers an automobile by turning a turning wheel (referred to as a “steering wheel”). When the driver rotates the steering wheel and performs a steering operation, the rotational force applied to the steering wheel and the steering angle (same as the above-mentioned operating angle) are determined by turning the wheel through the column, steering gear, and steering link device. To be told.

  The column, the steering gear, and the steering link device in the above-described current steering device are mechanical elements, and a large installation space is required, which restricts the interior space of the automobile. A steering system called a steer-by-wire system in which such mechanical elements are replaced with electric systems has been proposed. In the steer-by-wire system, a motor (servo motor) that rotates the rotating wheel is provided, and steering angle information of the steering wheel is sent to the motor control system via an electric line, and the motor control system controls the rotation of the motor based on the steering angle information. The rotational force of the motor is transmitted to the turning wheel via the link mechanism, and the turning wheel is steered.

  In a steer-by-wire system, there is a concern that a serious situation such as inability to steer will occur if a control system comprising an electric circuit fails. As a means for improving the safety (fail-safe) of the steer-by-wire system, it is first considered to make the control system redundant. Patent Document 1 discloses a triple redundant control device as shown in FIG. In the control device of Patent Document 1, the sensor data (2) of the sensor (1) for detecting the position of the spacecraft and the relative posture with the target is processed by the sensor signal processing circuit (3) in the three controllers. -Obtain relative attitude data (4). The three computers (5) input the data (4), perform various processes, generate an actuator control signal (6), and output it to the monitoring control circuit (13). The monitoring control circuit (13) checks the actuator control signal (6) output from the three controllers (8) and outputs a drive signal to the actuator (12). The supervisory control circuit (13) checks the operation of the controller (8). The three controllers (8) perform control processing to avoid danger by checking the operation of the supervisory control circuit (13).

FIG. 8 is a diagram showing the automobile control device described in Patent Document 2. As shown in FIG. In this automobile control device, the opening degree of the throttle valve 7 is set to a plurality of throttle opening degree sensors 8 _1.
-8 _n , and the estimated throttle opening calculation means 11 calculates the estimated throttle opening from the air density ρ, the rotational speed Ne, and the intake air amount q, and the estimated throttle opening Θ _I and a plurality of throttle opening sensors The comparison calculation means 15 compares the detected signal and determines whether or not the throttle opening sensor has failed, and depending on the degree, the fuel supply is stopped or forced cylinder deactivation is performed. The air density ρ is detected by the air density sensor 9, the rotation speed Ne is detected by the rotation speed sensor 10, and the intake air amount q is detected by the air flow rate sensor 12 and the intake air amount detection means 13. In Patent Document 2, with the configuration of FIG. 8, it is possible to prevent the runaway of the automobile due to the failure of the throttle opening sensor and improve the drivability by ensuring the failure detection of the throttle opening sensor. It is said that the reliability of the device will be improved.

JP-A-5-286499 JP-A-5-312090

  In the triple redundant control device as in Patent Document 1, the supervisory control circuit (13) compares the actuator control signals output from the three controllers (8) and compares the three actuator control signals (6) with each other. When the difference exceeds a predetermined threshold, it is possible to determine which of the three controllers (8) is likely to be broken by the majority rule. However, it is easy to adopt a triple redundant system in a small system. For example, if the steer-by-wire steering system is to be mounted on a mini vehicle, three motors and a link mechanism are required, which increases the required space for mounting, increases the weight, and increases the manufacturing price. .

  In order to reduce the required space and weight of the triple redundant system, it is possible to adopt a dual redundant system provided with two subsystems. If a failure of one subsystem can be detected, it is possible to switch to the other subsystem, so it can be said that the safety is improved as compared to a single system having only one subsystem. However, in a simple dual system, majority logic cannot be applied to determine whether or not a working subsystem is faulty. Therefore, a simple dual system is not suitable for a system that requires a high level of safety such as a steer-by-wire system. In redundant systems that require a high level of safety, such as steer-by-wire systems, it is necessary to isolate the faulty subsystem from the redundant system. Adoption of means is inevitable.

According to the automobile control device of Patent Document 2, the estimated throttle opening Θ _I and the detection signals of the plurality of throttle opening sensors are compared and calculated by the comparison calculation means 15 to determine whether or not the throttle opening sensor has failed. It is. However, the estimated throttle opening Θ _I is determined by the air density ρ detected by the air density sensor 9, the rotational speed Ne detected by the rotational speed sensor 10, the intake air amount q detected by the air flow rate sensor 12 and the intake air amount detecting means 13. The estimated throttle opening calculation means 11 performs calculation using the estimated throttle opening calculation means 11. As described above, the vehicle control apparatus of Patent Document 2 that requires special air density sensor 9, rotation speed sensor 10, air flow rate sensor 12, and intake air amount detection means 13 for failure determination of the multiplexed throttle opening sensor. The configuration further complicates the multiplexing system. Even if the redundant system of Patent Document 2 is a duplex system having a minimum configuration with two subsystems called throttle opening sensors, the necessary sensors are still the air density sensor 9, the rotation speed sensor 10, and the air flow rate sensor 12. The complexity of the failure determination means in the configuration of the duplex system in which the number of subsystems is duplexed is not reduced. If a physical sensor is provided in the failure determination means, the sensor itself has a considerable probability of failure. Therefore, since the redundant system of Patent Document 2 requires a space for sensor installation, the disadvantage of the redundant system of Patent Document 1 that is difficult to adopt in a small system is not solved, and further, failure determination means As a result, there is a drawback that the safety and reliability are lowered due to the physical sensor.

  Therefore, an object of the present invention is to provide a duplex system with a failure detection function that can determine which of the redundant subsystems has a high possibility of failure and can determine the failure without using a sensor. .

  In order to solve the above-mentioned problems, the present invention provides the following means.

(1) a duplex system composed of first and second subsystems using the first physical quantity as it is or the second physical quantity obtained by converting the first physical quantity as a common input;
A calculation model that receives the first physical quantity or the second physical quantity and generates an estimated value obtained by modeling the output of the first or second subsystem by modeling as a pseudo output;
Determining means for comparing the outputs of the first and second subsystems and the pseudo output and determining by majority logic which of the first or second subsystem is faulty. Dual system with failure detection function.

(2) A first physical quantity that is a difference between a target steering direction of the vehicle based on an operation angle of a steering handle of the vehicle and a steering angle of a steering wheel of the vehicle is set as the first physical quantity,
A power unit that converts the first physical quantity into a movement quantity and uses the movement quantity as the second physical quantity;
Each of the first and second subsystems includes a link mechanism that extracts the steering angle based on the amount of movement, and a steering angle sensor that detects the steering angle extracted by the link mechanism,
The calculation model calculates an estimated value of the output of the steering angle sensor based on the first physical quantity, the estimated value as the pseudo output,
The determination means determines which one of the first and second subsystems is defective by comparing the output of the steering angle sensor of the first and second subsystems with the pseudo output. The dual system with a failure detection function according to (1) above.

(3) The difference between the target steering direction of the vehicle based on the operation angle of the steering handle of the vehicle and the steering angle of the steering wheel of the vehicle is the first physical quantity,
Each of the first or second subsystem includes a motor that generates a rotational force based on the first physical quantity, and a current sensor that detects a driving current of the motor,
The calculation model calculates an estimated value of the output of the current sensor based on the first physical quantity, the estimated value as the pseudo output,
The determination means determines which one of the first and second subsystems is faulty by comparing the output of the current sensor of the first and second subsystems with the pseudo output. The dual system with a failure detection function according to (1) above.

(4) a subsystem that receives the first physical quantity as it is or receives the second physical quantity obtained by converting the first physical quantity;
A calculation model that receives the first or second physical quantity and generates an estimated value obtained by modeling the output of the subsystem by modeling as a pseudo output; and
A system with a failure detection function, comprising: a determination unit that compares the output of the subsystem with the pseudo output and determines whether or not there is a failure in the subsystem.

  The dual system with a fault detection function of the present invention having the above configuration is a pseudo triple system in which a calculation model is provided in addition to the dual subsystem. In the calculation model, an output approximate to the output of the subsystem is calculated as a pseudo output based on the physical quantity of the input of the duplexed subsystem. Therefore, in the dual system with a failure detection function of the present invention, by comparing each output of the pseudo triple system by the determination means, it is possible to determine which subsystem has a high possibility of failure by majority logic. Since the calculation model can be realized by a microprocessor and a program, it is smaller, lighter and cheaper than a subsystem such as a link mechanism. Therefore, the dual system with a fault detection function of the present invention can be easily applied to a small system. Applicable. Moreover, since the dual system with a failure detection function of the present invention is configured in a pseudo triple system, the safety and reliability of the entire system is improved as compared with a simple dual system.

  In addition, in the dual system with a failure detection function of the present invention, there is no triple system as in Patent Document 1, and there is no failure detection sensor as in Patent Document 2. Since the failure is judged, it can be easily applied to a small system, and the advantage that the safety and reliability of the entire system can be improved in the same way as when the subsystem is triple-systemd is ensured. As described above, the duplex system with a failure detection function of the present invention determines a subsystem failure without using a triple system and without providing a failure detection sensor. Compared to the triple redundant system, it is smaller, lighter, and less expensive, and can reduce the number of parts exchanges and inspections and the cost.

  Next, the present invention will be described more specifically with reference to embodiments.

FIG. 1 is a diagram showing the configuration of the first exemplary embodiment of the present invention. In this figure, 1 is a dual system with a fault detection function according to an embodiment of the present invention, C is a controller, D is a dual system, A and B are subsystems, X is a calculation model, and G is a decision selection. Part. The dual system 1 with a failure detection function includes a dual system D, a calculation model X, and a determination selection unit G. Duplex system D consists of subsystems A and B. The output of the controller C is an input U to the duplex system 1 with a failure detection function. The input U corresponds to the first physical quantity described above. Subsystems A and B have the same configuration and process input U to produce outputs Q _A and Q _B , respectively. The calculation model X includes a microprocessor and a program. The program calculates with a transfer function simulating the processing in the subsystem A and generates a pseudo output P. The pseudo output P is an estimated value obtained by estimating the output Q _A of the subsystem A when the input U is processed by the subsystem _A using a model.

FIG. 2 is a diagram illustrating an internal configuration of the determination selection unit G in FIG. The determination selection unit G includes a determination unit Γ and a selection unit Π. The determination unit Γ receives the outputs Q _A and Q _B and the pseudo output P, determines whether the subsystems A and B are normal or faulty according to the determination criterion table of Table 1, and determines determination data λ representing the determination Is output. Ξ and ξ ′ in the criterion table are allowable errors. The dimension of the tolerance ξ is the dimension of the outputs Q _A , Q _B , P. The selector Π selects one of the outputs Q _{A and} Q _{B as} the output Q according to the determination indicated by the determination data λ.

FIG. 3 is a functional configuration diagram illustrating an example of a dual system part and a related part in a general steer-by-wire system. Motor M _A and M _B is a servo motor, a steering force transmission mechanism F is a machine part that transmits the motor M _A, is the output steering force M _B to turn the wheel. The links L _A and L _B are links connected to a mechanical element (such as a knuckle arm) that rotates around the kingpin together with the turning wheel in order to detect the steering angle of the turning wheel. Outputting a [delta] _LB of the output link _{L A} [delta] _LA and link _{L B} of the output of. Dual system # 1 becomes a motor _{M A} and _{M B,} dual system # 2 is the link _{L A} and _{L B.}

The input U is a steering command generated by the controller of the steer-by-wire system based on an error angle that is a difference between the target steering direction of the vehicle based on the operation angle of the steering handle of the vehicle and the steering angle of the turning wheel of the vehicle. Represents a value and corresponds to the first physical quantity. Q _MA and _{Q MB} is an output of the motor _{M A} and _{M B,} those represented by the dimension of the torque. Q _M is the torque of the sum of Q _MA and Q _MB . R is a turning angle i.e. a steering angle of turn wheel by steering force transmission mechanism F is transmitting torque Q _M to turn the wheels is an angle turning wheels were turning. [delta] _LA and [delta] _LB, respectively taking out the link _{L A} and steering angle R in _{L B,} a steering angle detected by the steering angle sensor. [delta] _L is a steering angle, which is one of the steering angle [delta] _LA or [delta] _LB is selected in the selection unit [pi. [delta] _L, based on the input U, is data representing the result of the turn of the turn wheels by the motor M _A and M _B and the steering force transmission mechanism F, is fed back to the controller of the steer-by-wire system. The configuration of FIG. 3 is not practical because there is no means for determining which of the steering angles δ _LA or δ _LB should be selected.

FIG. 4 is a functional configuration diagram illustrating an example of a dual system portion and a related portion in the steer-by-wire system. The configuration of FIG. 3 is further embodied, and one of the steering angles δ _{A and} δ _B is selected. It is provided with a means for determining whether it should be. FIG. 4 is a second embodiment of a dual system with a failure detection function of the present invention. The input U is a steering command generated by the controller of the steer-by-wire system based on an error angle that is a difference between the target steering direction of the vehicle based on the operation angle of the steering handle of the vehicle and the steering angle of the turning wheel of the vehicle. Represents a value and corresponds to the first physical quantity described above. Motor _{M A} and _{M B} are servo motors, it consumes a drive current 101 and 102 corresponding to the input U respectively, to rotate. Current sensors S _A and S _B detect drive currents 101 and 102, respectively, and output them as currents I _A and I _B , respectively. Kta and Ktb is torque constant of each motor _{M A} and _{M B.} Q _A and _{Q B} are each an output of the motor _{M A} and _{M B,} which is a value obtained by converting the dimension of the torque, respectively the drive current 101 and 102 in torque constant Kta and KTb. The converted external force 105 is a value obtained by converting the external force received by the turning wheel from the road surface into a torque dimension, and is a large value when the turning wheel rides on a step on the road surface or the like. Q _T is a torque that is the sum of Q _A and Q _B and the converted external force 105. Motor _{M A} and _{M B} and torque constant Kta and Ktb correspond to a double system # 1 in FIG.

Transmission Z is a gear that reduces the rotation of the motor M _A and M _B, the gear ratio is Ng. The output of the transmission Z 107 is a torque Q _T is the input of the transmission a gear ratio Ng multiplied torque. The inertia moment J is a converted inertia moment of a mechanical element such as a link mechanism that transmits the output of the transmission Z to the rotating wheel. The output R of the moment of inertia J is a double integral of the input 107, represents the steering angle, and corresponds to the aforementioned second physical quantity. The links L _A and L _B are link mechanisms connected to mechanical elements (such as a knuckle arm) that rotate around the kingpin together with the turning wheel in order to extract the steering angle of the turning wheel. The links L _A and L _B take out the steering angle of one turning wheel independently of each other. Δ _A and Δ _B are steering angles extracted by the links L _A and L _B , respectively. The steering angle sensors Ψ _A and Ψ _B receive the angles of the links L _A and L _B , that is, the steering angles Δ _A and Δ _B of the turning wheels, respectively, and output the detected steering angles as δ _A and δ _B. The link L _A and the steering angle sensor Ψ _A constitute a subsystem A, and the link L _B and the steering angle sensor Ψ _B constitute a subsystem B. Subsystem A and subsystem B correspond to duplex system # 2 in FIG.

式（１）において、トルク定数Ｋta＝Ｋtb＝Ｋtとした。また、Ｊは前記慣性モーメント、Ｋpはシステムの比例ゲイン、Ｋdはシステムの速度ゲインである。 Calculation model X is made by a microprocessor and a program, receives an input U, generates a pseudo output [delta] _P. The program inputs the input U, processes the input U with the transfer function of equation (1) that imitates a physical real subsystem from the motor M _A to the steering angle sensor Ψ _A , and the steering angle sensor Ψ _A The steering angle δ _A of the output is calculated.

In equation (1), the torque constant Kta = Ktb = Kt. J is the moment of inertia, Kp is the system proportional gain, and Kd is the system speed gain.

The determination selection unit G has the configuration shown in FIG. However, the determination selection unit G in FIG. 4 is obtained by replacing Q _A , Q _B , Q, and P in FIG. 2 with δ _A , δ _B , δ, and δ _P , respectively. In the configuration of FIG. 4, the calculation model X is, no problem be estimated steering angle [delta] _B in place of the steering angle [delta] _A.

Determination unit Γ of Figure 2, receives the steering angle [delta] _A and [delta] _B, as well as pseudo output [delta] _P, in accordance with criteria table of the table 2, and the link L _A and subsystems A and link made by the steering angle sensor [psi _A L _B It is determined whether the subsystem _B composed of the steering angle sensor ΨB is normal or malfunctioning, and determination data λ representing the determination result is output. Ξ and ξ ′ in the criterion table are allowable errors. The dimensions of the tolerances ξ and ξ ′ are the same as the steering angle δ _A or δ _B. The selection unit に 従 い selects one of the steering angles δ _A or δ _B as the steering angle δ of the dual system with a failure detection function in FIG. 4 according to the determination indicated by the determination data λ.

In Table 2, the column “subsystem A output δ _A ” divides the case by comparing the absolute value of the difference between the output (steering angle) δ _A and the pseudo output δ _P with the allowable error ξ. The column “subsystem B output δ _B ” compares the absolute value of the difference between the output (steering angle) δ _B and the pseudo output δ _P with the allowable error ξ, and separates the cases. In this embodiment, the calculation model X does not fail and the pseudo output δ _P is always normal, so the column of the “pseudo output δ _P ” is always δ _P. The abnormality of the microprocessor constituting the calculation model X is monitored by a separate known means, and the system is configured to cope with the abnormality of the microprocessor.

The column of “Fault” in Table 2 indicates elements that are determined by the determination unit Γ as a failure, based on the status of “Subsystem A output δ _A ” and “Subsystem B output δ _B ”. In this embodiment, the link L _A and L _B in subsystem A and B are the possibility of failure is assumed to be substantially zero, failure in subsystem A and B only the steering angle sensor [psi _A or [psi _B It is assumed that it is possible. Therefore, in the column of “failure”, “normal” is determined when it is determined that all of the systems are normal, and the sensor Ψ _A or Ψ _B is “failed” when it is determined that the subsystem A or B has a failure. It is said. If marked "normal" in the column of "fault", the determination unit Γ outputs the decision data λ so as to select the steering angle [delta] _A to selector [pi. When “sensor Ψ _A ” is described in the “failure” column, the determination unit Γ outputs determination data λ to select the steering angle δ _B to the selection unit 、, and “sensor” in the “failure” column. when marked [psi _B ", the determination unit Γ outputs the decision data λ so as to select the steering angle [delta] _a to selector [pi.

The “stop” column indicates an element that stops when the sensor Ψ _A or Ψ _B fails in the “failure” column. In the present embodiment, when the sensor Ψ _A or Ψ _B is faulty, the sensor Ψ _A or Ψ _B is stopped, and the stopped element is disconnected from the system. The column “operation” describes how the system is operated when the determination unit Γ makes the determination described in the column “failure”. In the case of No. 1 to No. 4, the output δ of the determination selection unit G is fed back (feedback) to the controller that generates the input U. In the case of No. 5, it is reported to the outside as a mechanical failure or a failure of the steering angle sensor Ψ _B. In the case of No. 6, it is reported to the outside as a mechanical failure or a failure of the steering angle sensor Ψ _A , and δ is switched to δ _B. In the case of No. 7, | δ _A −δ _P | ≧ ξ, | δ _B −δ _P | ≧ ξ, and | δ _A −δ _B | <ξ ′. In such a case, the road surface condition is bad and there is a high possibility of receiving a large external force from the road surface. Therefore, the determination unit Γ determines that the system is normal. However, if the converted external force 105 is abnormal, it is reported to the outside that the system is abnormal. In the case of No. 8, | δ _A −δ _P | ≧ ξ, | δ _B −δ _P | ≧ ξ, and | δ _A −δ _B | ≧ ξ ′. At this time, the determination unit Γ temporarily determines that the steering angle sensor Ψ _B is faulty, estimates the external force with the steering angle δ _A , and reports the estimated external force to the outside. In the case of straight running, both δ _A and δ _B are almost zero, but if the subsystem A or B is normal, the output δ _A or δ _B of the subsystem fluctuates, so the output δ _The criteria of Table 2 are such that if the fluctuation range of _A or δ _B exceeds a predetermined value, the subsystem is determined to be normal, and if the fluctuation range is equal to or less than the predetermined value, the subsystem is determined to be faulty. It is safe to change.

The dual system with a fault detection function of the present invention shown in FIG. 4 described above is a pseudo triple system in which a calculation model X is provided in addition to the dual subsystem consisting of subsystems A and B. In the calculation model X, an estimated value obtained by modeling the steering angle δ _A or δ _B of the output of the subsystem A or B based on the input U of the system is calculated as the pseudo output δ _P. Therefore, in the embodiment of FIG. 4, by comparing each of the pseudo triple system outputs δ _A , δ _B, and δ _P by the determination selection unit G, which of the subsystems has a high possibility of failure is determined by the majority logic. Can be determined. Since the calculation model X can be implemented by a microprocessor and program, compact than or subsystems A comprising the link L _A and the steering angle sensor [psi _A, the sub-system B comprising the link L _B and the steering angle sensor [psi _B, light weight, Since it is inexpensive, the embodiment of the present invention shown in FIG. 4 can be easily applied to a small system. Moreover, since the dual system with a failure detection function of the present embodiment has a pseudo triple system configuration, the safety and reliability of the entire system is improved as compared with a simple dual system.

  In addition, the dual system with a failure detection function in FIG. 4 does not have a triple system as in Patent Document 1 and does not have a failure detection sensor as in Patent Document 2. Since the failure is judged, it can be easily applied to a small system, and the advantage that the safety and reliability of the entire system can be improved in the same way as when the subsystem is triple-systemd is ensured. As described above, the dual system with a fault detection function of the embodiment of FIG. 4 is smaller, lighter, and less expensive than the triple redundant system in which the subsystem is a triple system. , Reduce costs.

FIG. 5 is a functional configuration diagram showing a third embodiment of the present invention that enables the failure determination of the dual system portion in the steer-by-wire system. In the embodiment of FIG. 5, the failure determination of the dual system portion in the steer-by-wire system is performed. However, the failure determination is performed for the dual system portion different from the portion in FIG. The motors M _A and M _B , the current sensors S _A and S _{B, the} determination selection unit G, and the input U are the same as those in FIG. The motor M _A and the current sensor S _A constitute a subsystem A, and the motor M _B and the current sensor S _B constitute a subsystem B.

Calculation model X ₂ is constituted by a microprocessor and a program, receives an input U, generates a pseudo output I _P. The program receives the input U, the transfer function of the subsystem A mimics comprising a motor M _A and the current sensor S _A, processes the input U, calculates the current I _A of the output of the current sensor S _A. A filter may be used in place of the transfer function. In the configuration of FIG. 5, the calculation model X ₂ is, no problem be estimated current I _B in place of the current I _A. The determination selection unit G has the configuration shown in FIG. However, the determination selection unit G in FIG. 4 is obtained by replacing Q _A , Q _B , Q, and P in FIG. 2 with I _A , I _B , I, and _IP , respectively.

The input U is a steering command generated by the controller of the steer-by-wire system based on an error angle that is a difference between the target steering direction of the vehicle based on the operation angle of the steering handle of the vehicle and the steering angle of the turning wheel of the vehicle. Represents a value and corresponds to the first physical quantity described above. Motor _{M A} and _{M B} are servo motors, it consumes a drive current 101 and 102 corresponding to the input U respectively, to rotate. Current sensors S _A and S _B detect drive currents 101 and 102, respectively, and output them as currents I _A and I _B , respectively.

The determination unit Γ Figure 2 receives a current I _A and I _B and the pseudo output I _P, in accordance with criteria table of the table 3, subsystem A and the motor M _B and a current sensor comprising a motor M _A and the current sensor S _A It is determined whether the subsystem _B consisting of S _B is normal or faulty, and determination data λ representing the determination is output. In the criterion table, ξ is an allowable error. The dimension of the tolerance ξ is current. The selection unit に 従 い selects one of the currents I _A and I _B as the current I of the dual system with the fault detection function of FIG. 5 according to the determination indicated by the determination data λ. This dual systems with fault detection function of the present invention in FIG. 5 is a pseudo-triple system provided the calculation model X ₂ In addition to the duplex subsystem consisting subsystem A and B, as shown in Table 3, The faulty subsystem can be detected by the majority rule similar to the system of FIG. 4, and the output of the normal subsystem can be selected as the system output I, and the faulty subsystem can be disconnected from the system. The dual system with a fault detection function of FIG. 5 has many advantages similar to the system of FIG.

FIG. 6 is a diagram showing the configuration of the fourth exemplary embodiment of the present invention. This embodiment has a configuration excluding the subsystem B in the embodiment of FIG. The calculation model X is the same as that shown in FIG. 1, and includes a microprocessor and a program. The program calculates with a transfer function simulating the processing in the subsystem A and generates a pseudo output P. The pseudo output P is an estimated value obtained by estimating the output Q _A of the subsystem A when the input U is processed by the subsystem A. The determination selection unit G has the configuration shown in FIG. However, since the determination selection unit G in FIG. 6 does not have the input of Q _B in FIG. 2, it is not possible to determine the presence or absence of a failure of the subsystem A based on the majority rule. Therefore, the determination unit Γ of determination selecting section G, the comparison of the output Q _A and the pseudo output P of the subsystem A, when the output Q _A is the absolute value of the difference between the pseudo output P exceeds the allowable value ξ Warns of a possible failure of subsystem A.

Although the embodiments have been described above and the present invention has been specifically described, the present invention is not limited to these embodiments. For example, FIG. 1, FIG. 4, in the embodiment of FIGS. 5 and 6, the program in the calculation model X or X ₂ is a transfer function has been to calculate the pseudo output, calculation model of the present invention instead of the transfer function The pseudo output can be calculated using a filter. In the embodiment of FIG. 4, the calculation model X receives the input U (corresponding to the first physical quantity described above) and estimates the steering angle δ _A or δ _B by modeling. In response to the steering angle R (corresponding to the second physical quantity described above) output from the steering force transmission mechanism F, the steering angle δ _A or δ _B may be estimated by modeling. In the embodiment of FIG. 6, the calculation model X and the subsystem A commonly receive the input U (corresponding to the first physical quantity described above) as it is, and the calculation model X models the output Q _A of the subsystem A. As in the embodiment of FIG. 4, the embodiment of FIG. 6 is modified and the input U is converted to another physical quantity (corresponding to the second physical quantity described above) by another subsystem. Then, the other physical quantity is input to the subsystem A, and the calculation model X estimates the output Q _A of the subsystem _A by modeling (modeling of a system composed of another subsystem and the subsystem A). There is no problem.

1 is a diagram showing a configuration of a first exemplary embodiment of the present invention. It is a figure which shows the internal structure of the determination selection part G in FIG. It is a functional block diagram which shows an example of the duplex part and related part in a general steer-by-wire system. FIG. 4 is a functional configuration diagram illustrating an example of a dual system portion and a related portion in a steer-by-wire system, further specifying the configuration of FIG. 3 and determining which of the steering angles δ _A or δ _B should be selected. It is a figure which shows the structure of the 2nd Embodiment of this invention provided with the means to do. It is a block diagram which shows the 3rd Embodiment of this invention which enabled the failure determination of the double part in a steer-by-wire system. It is a figure which shows the structure of the 4th Embodiment of this invention. It is a figure which shows the conventional triple redundant control apparatus. It is a figure which shows the control apparatus for motor vehicles which enables the failure determination of a some throttle opening sensor.

Explanation of symbols

1 failure detection function dual systems 101 motor _{M A} output 102 the motor _{M B} output 105 converted external force (friction, etc.)
107 transmission Z torque A was Ng multiplying gear ratio torque _{Q T} is the input, B subsystem C controller D dual system F steering force transmission mechanism G determination selecting section I determination selecting section output current I _A current of G sensor _{S A} if the detected current I _B current sensor _{S B} if the detected current I _P calculated current estimated by calculation in model _{X 2} J the moment of inertia Kta, KTb torque constant L _{A, L B} links M _{A, M B} motor Ng Gear ratio P Pseudo output Q Output of dual system 1 with failure detection function Q _A value obtained by converting output 101 of motor _A to torque dimension with torque constant Kta (and output of subsystem A in FIGS. 1 and 6) )
Q _B motor M value output 102 is converted by a torque constant Ktb dimension of torque _B (as well as the output of the sub system B of FIG. 1 and FIG. 4)
Q _MA motor _M outputs of Q _MB motor _{M B} of _A Q _M Q sum of _MA and _{Q MB Q T Q A,} the steering angle of the output torque R steering force transmission mechanism F of the sum of _{Q B} and converted external force 105 S _{A, S B} current sensor U input X, _{X 2} calculation model Z transmission delta _A subsystem link in A _L link in the steering angle delta _B subsystem B taken out by _{A L B} in the retrieved steering angle δ determination selecting section G steering angle [delta] _LB link _{L B} of the output of the steering angle [delta] _a delta steering angle of the steering angle [delta] _B delta _B detected by the steering angle sensor [psi _a detected by the steering angle sensor [psi _B to _a [delta] _LA link _{L a} of the output of the Steering angle of output of δ Steering angle estimated by calculation in _P calculation model X Γ determination unit 選 択 selection unit λ determination data

Claims (4)

A duplex system composed of the first and second subsystems using the first physical quantity as it is or the second physical quantity obtained by converting the first physical quantity as a common input;
A calculation model that receives the first physical quantity or the second physical quantity and generates an estimated value obtained by modeling the output of the first or second subsystem by modeling as a pseudo output;
Determining means for comparing the outputs of the first and second subsystems and the pseudo output and determining by majority logic which of the first or second subsystem is faulty. Dual system with failure detection function. The difference between the target steering direction of the vehicle based on the operation angle of the steering handle of the vehicle and the steering angle of the steering wheel of the vehicle is the first physical quantity,
A power unit that converts the first physical quantity into a movement quantity and uses the movement quantity as the second physical quantity;
Each of the first and second subsystems includes a link mechanism that extracts the steering angle based on the amount of movement, and a steering angle sensor that detects the steering angle extracted by the link mechanism,
The calculation model calculates an estimated value of the output of the steering angle sensor based on the first physical quantity, the estimated value as the pseudo output,
The determination means determines which one of the first and second subsystems is defective by comparing the output of the steering angle sensor of the first and second subsystems with the pseudo output. The dual system with a failure detection function according to claim 1. The difference between the target steering direction of the vehicle based on the operation angle of the steering handle of the vehicle and the steering angle of the steering wheel of the vehicle is the first physical quantity,
Each of the first or second subsystem includes a motor that generates a rotational force based on the first physical quantity, and a current sensor that detects a driving current of the motor,
The calculation model calculates an estimated value of the output of the current sensor based on the first physical quantity, the estimated value as the pseudo output,
The determination means determines which one of the first and second subsystems is faulty by comparing the output of the current sensor of the first and second subsystems with the pseudo output. The dual system with a failure detection function according to claim 1. A subsystem that receives the first physical quantity as it is or receives the second physical quantity obtained by converting the first physical quantity;
A calculation model that receives the first or second physical quantity and generates an estimated value obtained by modeling the output of the subsystem by modeling as a pseudo output; and
A system with a failure detection function, comprising: a determination unit that compares the output of the subsystem with the pseudo output and determines whether or not there is a failure in the subsystem.

Images