JPH0441960A - Control device for vehicle - Google Patents

Abstract

PURPOSE:To eliminate danger accompanied with rapid shifting to a fail condition by arranging double microcomputers for control, providing a switch logic which switches outputs of both microcomputers for outputting, and gradually shifting the output signal to that of the fail condition at the detecting of abnormality. CONSTITUTION:In case of application to an electric power steering system for a vehicle, an output signal 10 of a torque detector 3 and a pulse signal 11 generated by a vehicle speed sensor are inputted to a control device 8 for vehicle. A main microcomputer 81 are communicated with a sub-microcomputer 82 through communication lines 12, 13. Outputs 14, 15 of the microcomputers are switches by a switching logic 17 and applied to FETs 18 to 21, to control electric curent of a motor 7. A signal for driving a relay 16 is output in order to stop the supply of the motor electric current at the failure of the control device. When an abnormality occurs at eigher of the microcomputers, the output of the normal microcomputer is gradually inclined to that of a control stopping condition. The output is selected by the switch logic 17 and applied to a controlled object.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a vehicle control device using a microcomputer.

[Conventional technology]

In recent years, electronic control technology in automobiles has progressed rapidly with the adoption of microcomputers (hereinafter referred to as microcomputers), and its applications are not only in controlling engine fuel supply and ignition timing, but also in shifting gears in automatic transmissions. It has been widely adopted for point control, damping force control in suspensions, assist force control in steering, etc. As the objects of control have expanded in this way, the reliability of microcomputers that form the basis of electronic control has become extremely important, and measures are being taken to improve reliability. The conventional example is JP-A No. 63-2551.
There is a system disclosed in Publication No. 73, in which two sets of control devices are prepared, a main system and an auxiliary system, and the auxiliary control device takes over calculations if the main control device fails. is not interrupted. Therefore, the failure rate of the entire system is the rate at which both of the two control devices fail, and this can be set to an extremely small value.

[Problem to be solved by the invention]

If the amount of fuel supplied suddenly changes due to incorrect operation of the control device, the vehicle may suddenly accelerate or decelerate, and if the steering assist force suddenly changes due to incorrect operation, there is a possibility that the steering wheel may be lost. Although the probability that the main and auxiliary surface control devices will fail at the same time is extremely small, if simultaneous failures occur, the above-mentioned risks will occur. However, the conventional technology has a problem in that no countermeasures have been taken against this danger.

SUMMARY OF THE INVENTION An object of the present invention is to provide a vehicle control device that does not pose a danger to vehicle operation when a microcomputer of the control device malfunctions.

[Means to solve the problem]

In order to achieve the above object, in the present invention, control microcomputers are duplicated and a switching logic is provided to switch and output the output of both microcomputers, and each microcomputer mutually transmits the watchdog pulse outputted by the other microcomputer. The microcomputer that monitors and detects an abnormality in the other microcomputer gradually brings the control output from its own microcomputer closer to the state when the control is stopped, and when this reaches a predetermined range, outputs a control stop signal, and the switching logic monitors the watchdog pulses output from each microcontroller, and outputs the control output from the normal microcontroller when one of the microcontrollers has an abnormality, and outputs the control output from the normal microcontroller when both microcontrollers are judged to be abnormal or when at least one of the microcontrollers is abnormal. When the microcomputer outputs the control stop signal, a signal is generated to turn off a relay provided in a control current supply circuit to the controlled device.

[Effect]

Although it is rare for an abnormality to occur in both duplicated microcomputers at the same time, in this case, the switching logic immediately stops supplying control current to the controlled object, providing a failsafe. When an abnormality occurs in one of the microcontrollers, the normal microcontroller gradually brings its output closer to the state when the control was stopped, and this output is selected by the switching logic and applied to the controlled object. The state gradually approaches the control stop state. Then, after the normal microcomputer output reaches a predetermined range, a control-off signal is output and the control current supply is turned off, which reliably prevents the risk of falling due to sudden switching to the control stop state when an abnormality occurs. can.

〔Example〕

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 2 is a diagram showing the configuration of an electric power steering system for an automobile. Rotation of a steering wheel 1 is transmitted to a steering mechanism 5 via a steering wheel shaft 2 and a speed reduction mechanism 4, and causes a front shaft 6 to rotate. A control device not shown in FIG.
The steering assist force generating motor 7 is driven in accordance with the output of the torque detector 3 which detects the torsional torque of the steering wheel.

FIG. 1 shows an embodiment of a vehicle control device 8 of the present invention, which is used to control the above-mentioned power steering system. The input is the output signal 10 of the torque detector 3.
The pulse signal 11 generated by the vehicle speed sensor, which is omitted in FIG. Their output 1
4.Switch 15 with switching logic 17 and connect FET 18~
21 to control the current of the motor 7.

It also outputs a signal to drive the relay 16 for stopping the supply of motor current when the control device fails. FET1
8 to 21 constitute an H-type bridge, and when FET1B and 21 are turned on and the others are turned off, FET19
A current in the opposite direction is supplied to the motor 7 when the motor 20 is turned on and the others are turned off. The amount of current is controlled by chopping the FETs that are turned on. The amount of current flowing through the motor 7 is detected by a current detector 22 and fed back to the main microcomputer 81 and sub-microcomputer 82 via an amplifier 23.

Next, the normal operation of this embodiment will be explained. When the driver steers the steering wheel 1, the steering force (steering torque) 10 is detected by the torque detector 3 and input to the main microcomputer 81 and sub-microcomputer 82.

The main microcomputer 81 and the sub-microcomputer 82 each calculate a motor current command value as shown in FIG. 3 from this input and the vehicle speed 11. Here, the motor current is increased as the vehicle speed is lower, and this is because a larger force is required to rotate the steering wheel at lower speeds. Furthermore, each microcomputer 81, 82 sends a gate signal 1 to the FETs 1B to 21 as described later based on the calculated motor current command value and the motor current value detected by the current detector 22.
4. ．． 15 and sends it to the switching logic 17. The switching logic 17 normally selects the gate signal from the main microcomputer 81 and applies it to the FETs 18 to 21, thereby controlling the motor current, and outputting a torque proportional to this current value from the motor to apply assist force to the steering wheel. Given.

Regarding the steering system, if the steering does not operate according to the driver's will while driving, the car's course will not be determined and it will not be possible to avoid obstacles, so the reliability of this device system must be sufficiently high. It is also necessary to consider the response in the event of a failure (so-called failsafe). In this respect, components other than the control unit, such as torque detectors, high-speed sensors, relays, and motors, can be determined within the microcomputer, and it is easy to make them fail-safe. However, if a failure occurs in the microcomputer itself, it not only becomes impossible to carry out the above-mentioned failsafe, but also seriously affects the system. Considering the probability of occurrence of this problem, since the failure rate of microcomputers is generally more than 100 fits, it is calculated that one failure will occur if more than 10,000 units are produced per month for 10 years. In this way, the probability of a microcomputer failure is extremely small, but in the unlikely event that a failure occurs, it is necessary to stop the control operation by the microcomputer to avoid danger, and to do so, it is necessary to ensure that the force applied to the steering wheel does not suddenly change. In this embodiment, two microcomputers 81 are used for this purpose.
．． 82 and switching logic 17 are provided. The microcomputer failure detection method and switching operation will be explained below.

FIG. 4 shows the circuit configuration of the switching logic 17, in which inputs 31, 33, 35, and 37 are gate input signals 14. Input 32.34, 36.3
8 is a gate signal 15 output from the sub-microcomputer 82. Inputs 39 and 40 are drive signals for the relay 16 output from the main microcomputer 81 and sub-microcomputer 82,
This will be explained later. The input watchdog pulses 41 and 42 are input manually from the main microcomputer 81 and sub-microcomputer 82 via communication lines 13 and 12, respectively.

The time chart in FIG. 5 shows the operation of the operation check mechanism of each microcomputer using the watchdog pulses 41 and 42. Watchdog pulse 41 is capacitor C11
, differentiated by resistor R11, half-wave rectified by diode D1, and then further resistor R12 and capacitor C1.
2 to form the waveform of the signal 41a. Similarly, the watchdog pulse 42 has the waveform of the signal 42a.

This is then compared with predetermined threshold voltages Vthl and Vth2 by comparators CPI and CP2.

When it is larger than that, it is converted to 11 l 11, and when it is smaller, it is converted to logic signals 41b and 42b of 0'' level.Signal 41
b is the signal 41e to each AND gate at the top of Figure 4.
However, the signal 42b is sent as 42c=inversion of c4ib]・42 by the inverter 11 and the AND gate A1.
It is converted to b (. is AND) and sent to each AND gate at the top. Here, when the signals 41b and 42b are 111", it indicates that the watchdog pulse is being output normally, which means that the corresponding microcontroller is normal. In the section (i) of FIG. 82 is abnormal, main microcomputer 81 is normal, and at this time signal 4 l
b = “1” causes each of the gate signals 14 to be FE.
Applied to TI 8-21. In section (ii), both the main microcomputer 81 and the sub-microcomputer 82 are normal, and at this time as well, the gate signal 14 from the main microcomputer 81 is outputted by the signal 4 l b = "1". In the section (i i i), only the main microcomputer 81 is abnormal, and at this time, the signal 42 becomes LL I II, and each of the gate signals 15 from the sub microcomputer 82 becomes F E T
Output to. In section (iv), main microcomputer 8
1. Both sub-microcomputers 82 are abnormal, and neither of their gate signals 14 and 15 is output. From the above, when both microcontrollers are normal, the gate signal from the main microcontroller 81 is output, and when only one is normal, the gate signal from the normal microcontroller is output to FETs 19 to 21. play an important role.

The input 39 or 40 in FIG. 4 is output from the main microcomputer 81 or the sub microcomputer 82, and its value LL OII
, (11'' is determined as follows.

In other words, the main microcomputer 81 and sub-microcomputer 82 perform the same calculations, and monitor each other by constantly comparing the calculation results. If there is a large difference in the calculation results, it is determined that one of the microcontrollers is malfunctioning. Assuming that there is, input 39
．． 40 and each microcomputer is 110 II. In cases other than this failure, both are "1". Input 39.40
When both are “1”, the NOR gate N1 output is signal 4.
At least one of 1b or 42b is "1'" (normal)
If so, it becomes "1" and FET Fl is turned on, so that relay 16 (FIG. 1) is energized and current is supplied to motor 7. However, if the inputs 39 and 40 are "0", that is, if the microcomputer fails, the NOR gate N1 output will always be "O" and the FE
TF"l remains off, and the supply current to the motor 7 is cut off by the relay 16.

In this way, the risk of the handle not moving or rotating in an unintended direction due to abnormal operation of the microcomputer when it malfunctions is avoided, and fail-safe operation is ensured. If left as is, the motor current will suddenly be cut off in the event of a failure, and the steering wheel will suddenly become heavy, which will not only make it impossible to operate the steering wheel, but also cause injury to the hand holding the steering wheel. Serious problems may occur. Therefore, it is necessary to cut off the supply of motor current gradually and softly.

This software switching operation is executed by each microcomputer. Processing flowcharts for this purpose are shown in FIGS. 6 and 7.

These programs are provided in both the main microcomputer 81 and the sub microcomputer 82.

It always works under normal conditions. First, the process shown in FIG. 6 is activated by an interrupt every time a watchdog pulse from the other microcomputer is input via communication l1A12゜13, and first reads the value of the built-in free running counter (FRC) at the time the interrupt occurs (step 601). , check whether the value overflows (step 602), and if not, T w d = F RC, F'
RC=O is set (steps 603, 604) to return from the interrupt. When the three-run counter overflows, it means that no interrupt was generated within the predetermined time, which means that the interval between watchdog pulses was abnormally long, so return from the interrupt as T w d = O. .

FIG. 7 shows a process for controlling software switching, which is activated at regular intervals. When activated, it is first checked whether the watchdog pulse period Twd of the other microcomputer (the value obtained by the process shown in FIG. 6) is within a predetermined range of Tα<Tw d < Tβ (step 701).
), normal control is performed when it is on. That is, the input 39.40 of the switching logic 17 in FIG. 4 is the relay drive signal.
Step 702), determine the on-duty ratio Dt of the FET when performing chopping control of the motor current from the input torque value and vehicle speed value (Step 703), and set the maximum duty ratio Dtm to The value is set to the determined value Dt (step 704). Next, the sign of the duty ratio Dt is checked (step 705), and if it is positive, the FET 20 is turned on and off according to the duty ratio Dt, and the FET 22 is always on and the others are turned off (step 7
06), as a result, a motor current having a magnitude determined by the duty ratio Dt flows in the direction of the solid line arrow in FIG. When the sign of pt is negative, the FET 18 is turned on and off with a duty ratio of 1Dtl, the FET 21 is turned on, and the others are turned off (step 707). The motor current at this time is in the direction of the dotted arrow.

When a fail condition occurs in step 701.

Instead of immediately turning off the relay 16, the maximum value of the duty ratio is first reduced by 1 from Dtm immediately before entering the fail condition (step 708). Here, the duty ratio is usually expressed in %, and 1 means the size of a predetermined unit handled in this process.

Next, check the sign of Dtm (step 709), and if it is positive, determine the duty ratio Dt from the torque value and vehicle speed value as in normal control (step 710), and if this value is greater than or equal to Dtm determined in step 708. Let Dt=Dtm, step 711. '/12), and then output processing from step 705 of normal control is performed. At this time, the maximum value of the duty ratio is always reduced by one unit, and the output is only less than that value. Since abnormalities in two microcomputers rarely occur at the same time, the microcomputer that detected the other malfunction in step 701 can be considered to be normal. Therefore, as shown in the operation explanation of the switching logic in Figure 4, The output set in step 706 or 707 is output from the switching logic 717 to each FET. Such an operation is repeated every time the process shown in FIG. 7 is started, and each time the maximum value Dtm of the duty ratio becomes smaller.
The assist force applied to the steering from the control device is gradually reduced to a smaller value. Then, only when it is determined in step 709 that Dtm≦O, the relay drive signal (input 39 or 40) is turned off (step 713) and the motor current is cut off, so that sudden force is not applied to the steering wheel when the microcomputer is abnormal. Without.

Safety will be improved.

Next, another embodiment of the present invention will be described. FIG. 8 is a schematic diagram showing an engine equipped with a throttle valve control device and a drive system of a vehicle equipped with the engine.
The output is electrically transmitted to the vehicle via the transmission 101. A throttle valve 103 and an air cleaner 102 are provided in an intake pipe 105 of the engine, and the throttle valve 103 is driven to open and open by a DC motor 106. The opening degree of the throttle valve 103 is determined by the valve position sensor (rotation angle position sensor) 1.
04, and its detection output signal is detected by the control circuit]
07 is input. The control circuit 107 controls the energization of the motor 106 so that the output signal of the aforementioned valve position sensor 104 matches the output signal of the accelerator pebble sensor 108 that detects the amount of depression of the accelerator pedal. That is.

The throttle valve is controlled to follow the output signal of the accelerator pebble sensor 108 as a target value.

FIG. 9 is a diagram showing the connection relationship between the motor 106, the throttle valve 103, and the valve position sensor 104.
The state in which the throttle valve 103 rotated by 0 comes into contact with a stopper (not shown) and is stopped is as follows.
The throttle valve 103 is in the most stable state. When no current is applied to the motor 106, the throttle valve 103 is in the above-mentioned stable state, which is a closed state.

FIG. 10 shows an embodiment of the control circuit 107, which includes a main microcomputer, a sub microcomputer, a switching logic 118, and an FE.
It consists of T114 to T117.

The main microcomputer and sub-microcomputer input signals from two sensors 104 and 108 for throttle valve control to determine the target value of the motor current, and the motor 106 for driving the throttle valve 103 is controlled. Other than this, the other operations are exactly the same as the case in Figure 1, and when both microcontrollers monitor the other's watchdog pulse and detect an abnormality, they gradually transition to a fail-safe state and then switch the motor to the Control is performed to turn off the supply current.

〔Effect of the invention〕

According to the present invention, by making the microcontroller a dual system, the failure detection angle of the microcontroller is greatly increased, and since the switching logic is also provided with a failure detection section, the microcontroller group is configured as a dual system and failure detection is possible. Failure can be determined by both parts, greatly improving failure detection accuracy. In addition, when a failure is detected, control is performed using the output signal of the normal microcomputer, and during this control, the output signal is gradually brought into the fail state and then the control is turned off, so there is no danger associated with a sudden change to the fail state. It has the effect of preventing

[Brief explanation of drawings]

FIG. 1 is a block diagram showing an embodiment of the present invention, FIG. 2 is a configuration diagram of an electric power steering system, FIG. 3 is a diagram showing the relationship between steering torque and motor current, and FIGS.
6 is a circuit diagram of the switching logic and a time chart showing its operation, FIGS. 6 and 7 are flowcharts of processing in the microcomputer, and FIGS. 8 to 10 are diagrams showing other embodiments of the present invention. 16...Relay 17,118...Switching logic,
18-21...FET, 7.106...Motor, 4
1゜42...Watchdog pulse, 81...Main microcomputer, 82...Sub microcomputer. Representative Patent Attorney Tadashi Akimoto Mistake Figure 2, □ / Figure Steering Torque (103 (S) and Blue) ＼ 109 (Yapa Kasa) Light) Figure (Access Mube ° Yu) Recemi 4) l○8 Figure (Si technique circle #) 4ノ+06

Claims (4)

[Claims] 1. Two microcomputers that perform the same control processing and output pulses of a constant period during normal operation, a switching means that selects control output from the two microcomputers and applies it to the controlled object, and a control current supply to the controlled object. When each microcomputer detects an abnormality in the period or frequency of the pulses of the other microcomputer, it gradually returns the control output of its own microcomputer to the state at which the control was stopped. When the pulses are approached and the control output reaches a predetermined state, a control stop signal is output, and the switching means monitors the pulses and outputs the abnormal pulse if an abnormality is detected in the period or frequency of one of the pulses. Select the control output from the microcomputer that is not in use and output it to the controlled object, and when an abnormality in the pulses of both microcomputers is detected, or when the control stop signal is output from at least one of the microcomputers. A vehicle control device characterized in that the switch output is turned off. 2. The controlled object is a motor, the current supply path is composed of an FET bridge for controlling on/off the magnitude and direction of the current supplied to the motor, and the control output turns the FET on and off. 2. The vehicle control device according to claim 1, wherein the signal is a pulse signal. 3. The motor is a steering starting motor, and the control processing by each microcomputer is characterized by generating a pulse signal for turning on and off the FET based on the output of a steering torque detector and the output of a vehicle speed sensor. The vehicle control device according to claim 2. 4. The motor is a throttle valve starting motor, and the control processing by each microcomputer generates a pulse signal to turn on and off the FET based on the outputs of an accelerator pedal sensor and a throttle valve position sensor. The vehicle control device according to claim 2.