JP2009062998A - Vehicle control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To appropriately take fail safe measures if required. <P>SOLUTION: Acceleration required from a driver (request acceleration), and actual acceleration of a vehicle are calculated, and whether the actual acceleration is larger than the request acceleration or not is determined (steps S101 to S103). If the actual acceleration is larger than the request acceleration, it is regarded as abnormality that the driver feels risky and strong fail safe measures such as fuel injection stop and fuel injection reduction are taken (a step S104). If the actual acceleration is equal to or larger than the request acceleration, the strong fail safe measures such as fuel injection stop and fuel injection reduction are not taken. Then, abnormality detection of system components such as a sensor or an actuator is performed. If any abnormality is detected in the sensor, actuator and the like, weak fail safe measures such as lighting a warning lamp and vehicle speed restriction are taken (steps S105 to S107). <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a vehicle control system, and more particularly to a technique that makes it possible to ensure traveling safety of a vehicle.

  In recent vehicle control systems, the parts, sensors, and software that make up the system are extensively and carefully monitored. If a failure is detected on the system, fail-safe measures are taken to The driving performance is limited. This prevents the driver from feeling afraid even if the driver unexpectedly accelerates due to some system failure. For example, in Patent Document 1, whether or not the change in engine output is within an allowable range is monitored, and fail-safe treatment is executed in accordance with the comparison result.

  However, the change in the engine output and the actual change in the behavior of the vehicle do not always coincide with each other, and even if the change in the engine output is out of the allowable range, there is a case where the immediate fail-safe treatment is not necessary. Here, if the behavior change of the vehicle does not appear, the driver does not feel a fear, and therefore it is considered unnecessary to perform fail-safe measures such as limiting the engine output. If the fail-safe treatment is excessively performed, there arises a disadvantage that the running performance of the vehicle is lowered.

Further, in today's and future more complicated systems, the monitoring becomes more complicated, resulting in an increase in design man-hours and an increase in monitoring programs. Along with this, there is a concern of causing problems such as failure to detect due to design / program errors / missing. In this case, if a failure in detection of a failure as a system occurs, there is a possibility that safety during vehicle traveling cannot be guaranteed.
JP-T-2001-522966

  The main object of the present invention is to provide a vehicle control system capable of appropriately performing fail-safe treatment as necessary.

  In a vehicle control system, it is important not to give a driver a fear due to a change in the behavior of the vehicle. To that end, whether abnormal acceleration or deceleration of the vehicle unintended by the driver has occurred. It is considered good to monitor. That is, abnormal acceleration (or deceleration) of the vehicle is one of the events that occur as a result of some system abnormality, and can be regarded as a higher-order event for abnormality of sensors, actuators, software, etc. on the system.

  In accordance with this idea, in the first aspect of the invention, abnormality detection is performed based on whether or not the change in behavior of the traveling vehicle is intended by the driver. As a treatment, at least the output of the power source is stopped or reduced. Also, abnormality detection is performed based on the state of various components in the system, and when an abnormality is detected, at least a warning is given to the driver as a fail-safe measure, or abnormality occurrence information Is stored in the memory.

  In this case, abnormalities in which the behavior of the vehicle is not intended by the driver can be considered as higher events, and abnormalities in various components of the system can be considered as lower events. Can be executed. Since the output stop or reduction of the power source is performed based on at least a change in the behavior of the vehicle, the vehicle can travel without giving fear to the driver, and the vehicle is provided with excessive fail-safe measures. A decrease in running performance can be suppressed. In addition, even when the system is complicated and the detection error of the system abnormality occurs due to a design / program error / missing, the traveling safety of the vehicle can be ensured.

  As described in claim 2, when the actual acceleration of the vehicle is different from the required acceleration requested by the driver, it is preferable to detect that an abnormality has occurred. That is, in this case, when the vehicle is in an abnormal acceleration (or deceleration) state, output stop or reduction of the power source is executed as a fail-safe measure. Thereby, even if acceleration / deceleration unintended by the driver occurs, safe traveling of the vehicle can be realized.

  Further, in the invention described in claim 3, since the fail-safe treatment is executed in a plurality of systems, even if any CPU breaks down, the fail-safe treatment is surely executed by another CPU, and the vehicle travels. Safety can be maintained.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, an embodiment of the invention will be described with reference to the drawings. The present embodiment is applied to a control system for an automobile gasoline engine, and a method for suitably controlling the operating state of the engine by an electronic control unit (hereinafter referred to as ECU) in the control system will be described below. Detailed description. Although not shown in the figure because it is a well-known configuration, the vehicle includes an engine and a transmission coupled to the crankshaft of the engine, and the output of the engine is transmitted to the transmission via the crankshaft. The vehicle travels by transmitting the rotation of the output shaft of the transmission to the wheels via the differential gear and the axle.

  FIG. 1 is a block diagram showing the main configuration of the present control system. FIG. 1 illustrates a configuration in which the injector and the throttle valve of the engine are electrically controlled by the ECU.

  The ECU 10 includes a first CPU 11, a second CPU 12, and a signal input unit 13. An air flow meter 21, a throttle opening sensor 22, an engine speed sensor 23, an accelerator sensor 24, and an acceleration sensor 25 are connected to the signal input unit 13, and detection signals are input from these sensors. Each of these sensors is well known, but in brief, the air flow meter 21 detects the amount of air taken in from the engine intake pipe (intake air amount). The throttle opening sensor 22 detects the throttle valve opening (throttle opening). The engine speed sensor 23 detects the crank angle position associated with the engine rotation, and the engine speed is detected based on the signal. The accelerator sensor 24 detects the amount of depression of the accelerator pedal (accelerator operation amount) by the driver. The acceleration sensor 25 detects the acceleration of the vehicle when the vehicle is traveling.

  The first CPU 11 and the second CPU 12 execute control programs prepared for each based on various detection information input via the signal input unit 13. In this case, in particular, the first CPU 11 controls the drive of the injector 31, and the second CPU 12 controls the drive of the throttle actuator 32. More specifically, the first CPU 11 calculates a target fuel amount based on the intake air amount, engine speed, etc. each time, and controls the drive of the injector 31 based on the target fuel amount. Further, the second CPU 12 calculates a target throttle opening based on the accelerator operation amount at each time, and controls the driving of the throttle actuator 32 based on the target throttle opening. By driving the throttle actuator 32, the actual throttle opening is adjusted to the target throttle opening.

  Further, the ECU 10 is configured to execute a predetermined fail-safe measure when any abnormality occurs in the system. In particular, in the present embodiment, the first CPU 11 and the second CPU 12 monitor the abnormality independently, and when the occurrence of the abnormality is detected, the CPUs 11 and 12 individually execute fail-safe measures. At this time, basically, the first CPU 11 executes a fail-safe procedure for the injector 31, and the second CPU 12 executes a fail-safe procedure for the throttle actuator 32.

  By the way, an abnormality (failure) occurring in the control system can be classified from an abnormality in a lower event such as a sensor or software to an abnormality in an upper event such as a change in vehicle behavior. This will be described with reference to FIG. When an abnormality occurs in a sensor or software as a lower event (for example, abnormalities a, b, c, etc.), various actuators malfunction due to the abnormalities (malfunctions A, B, C, etc.). Of course, besides the cause of sensor abnormality, malfunction may occur due to failure of the actuator itself. If the engine output increases due to abnormalities of these sensors, software, actuators, etc., abnormal acceleration unintended by the driver in the vehicle may occur as an upper event.

  The case where electronic throttle control is performed will be described in detail. For example, if a throttle opening sensor or a throttle actuator malfunctions, the throttle opening cannot be controlled to the intended position of the system. It is erroneously controlled to the same position as when the pedal is fully depressed. In this case, it is predicted that the vehicle behavior is unintended by the driver and a dangerous state occurs.

  Abnormalities (lower events) of sensors, software, actuators, etc. do not necessarily cause behavior changes that the driver feels dangerous, whereas abnormal accelerations (upper events) of the vehicle cause behavior changes that the driver feels dangerous. It is thought to give rise to.

Therefore, in this embodiment,
(1) an abnormality in which a behavior change that the driver feels dangerous in the vehicle appears;
(2) Other system abnormalities,
Each of them is always detected, and when an abnormality occurs, a fail-safe treatment corresponding to the abnormality is executed.

  More specifically, the abnormality (1) can be detected, for example, when the actual acceleration of the vehicle is greater than the acceleration required by the driver (requested acceleration). When the occurrence of the abnormality (1) is detected, a relatively strong fail-safe treatment is performed so that the engine operation is immediately stopped or restricted. For example, the first CPU 11 stops the fuel injection or reduces the fuel injection amount, and the second CPU 12 controls the throttle opening to the fully closed side to reduce the intake air amount. Thereby, engine output is significantly suppressed. In this case, since the first CPU 11 and the second CPU 12 execute two systems of fail-safe measures, even if one of the CPUs is not functioning correctly, the other CPU can execute the appropriate fail-safe measures. In other words, a CPU that is not functioning properly has low reliability in detecting an abnormality and fail-safe treatment, but the other CPU compensates for it.

  If the abnormality (2) is also detected when the abnormality (1) is detected, the cause of the abnormality (1) is specified as the abnormality (2). In this case, together with information on the occurrence of abnormality, information indicating that the cause is (2) is stored and held in a backup memory (for example, EEPROM or backup RAM) of the ECU 10. In a vehicle repair shop or the like, failure analysis is performed based on information stored and held in a backup memory.

  If only the occurrence of abnormality (1) is detected, the cause cannot be specified as (2). However, when the abnormality (1) occurs, execution of fail-safe measures for avoiding danger is a top priority. As long as safety is guaranteed, there is no problem.

  The abnormality (2) can be detected by appropriately monitoring the sensor output and the operating state of various actuators. Here, when only the abnormality (2) is detected, it is not necessarily a dangerous state, so that a strong fail-safe as in the abnormality detection (1) is not necessary. Therefore, in order to suppress a dangerous state due to the subsequent occurrence of a secondary abnormality, relatively minor fail-safe treatment is executed. For example, each of the CPUs 11 and 12 turns on a warning lamp in the meter panel and stores abnormality occurrence information in a backup memory in order to prompt the driver to repair. In addition, it is also possible to limit the vehicle speed, suppress acceleration, or prohibit execution of cruise control.

  Next, abnormality diagnosis processing procedures executed by the first CPU 11 and the second CPU 12 will be described. FIG. 3 is a flowchart showing the abnormality diagnosis process executed by the first CPU 11.

  In FIG. 3, in step S101, the acceleration required by the driver (requested acceleration) is calculated. At this time, the required acceleration is calculated from the accelerator operation amount (absolute amount) detected by the accelerator sensor 24 and / or the degree of change thereof. In step S102, the actual acceleration of the vehicle detected by the acceleration sensor 25 is read. It is also possible to estimate the actual acceleration of the vehicle from the amount of change in each wheel speed.

  Thereafter, in step S103, it is determined whether or not the actual acceleration is greater than the required acceleration. If the actual acceleration is greater than the required acceleration, it is considered that the driver feels dangerous, and a strong fail-safe measure such as stopping fuel injection or reducing the fuel injection amount is executed in step S104. When the actual acceleration is equal to or less than the required acceleration, a strong fail-safe measure such as stopping fuel injection or reducing the fuel injection amount is not executed. However, in this case, in addition to the direct comparison between the actual acceleration and the required acceleration, the fail-safe treatment may be performed when the deviation (= actual acceleration−required acceleration) exceeds a predetermined threshold value.

  Thereafter, in step S105, abnormality detection is performed on system components such as sensors and actuators. If an abnormality is detected in the sensor, actuator, or the like (YES in step S106), weak fail-safe measures such as turning on a warning lamp or limiting the vehicle speed are executed in step S107. Finally, in step S108, when the occurrence of an abnormality is detected, the abnormality occurrence information and the like are stored as diagnostic data in an EEPROM or the like. The second CPU 12 also executes the abnormality diagnosis process similar to that in FIG. The only difference is the content of the fail-safe treatment, and illustration and explanation are omitted here.

  According to the embodiment described above in detail, the following excellent effects can be obtained.

  When the actual acceleration of the vehicle is greater than the required acceleration required by the driver, the engine output is stopped or reduced as a fail-safe measure, and an abnormality occurs in various system components (sensors, actuators, etc.) In addition, a warning is given to the driver as a fail-safe measure. For this reason, even if abnormal acceleration of the vehicle occurs, the vehicle can travel without giving the driver a fear. Further, it is possible to suppress a decrease in vehicle running performance due to excessively performing fail-safe treatment. Further, even if the system is complicated and the detection error of the system abnormality occurs due to a design / program error / missing, the traveling safety of the vehicle can be ensured.

  Two CPUs 11 and 12 are provided, and each of the CPUs 11 and 12 is configured to execute abnormality detection and fail-safe treatment in two systems. As a result, the redundancy of the system is enhanced, and even if one of the CPUs breaks down, the fail-safe treatment is surely executed by the other CPU, and the traveling safety of the vehicle can be maintained.

  In addition, this invention is not limited to the content of description of the said embodiment, For example, you may implement as follows.

  When an abnormality occurs such that the actual acceleration is greater than the required acceleration, feedback control may be performed so that the actual acceleration matches the required acceleration as a fail-safe measure. Simply stopping or reducing the output of the engine is not preferable from the viewpoint of limp home performance because the running performance of the vehicle is significantly reduced. Therefore, even when a system failure occurs, the acceleration intended by the driver will be maximized to ensure the driving performance as much as possible.

  In the above embodiment, when monitoring the behavior change of the vehicle, it is determined whether or not the actual acceleration is in an abnormal acceleration state that is larger than the requested acceleration. Instead of or in addition to this, the abnormal deceleration state is determined. It may be determined whether or not. In the case of abnormal deceleration, as in the case of abnormal acceleration, the engine output is stopped or reduced as a fail-safe treatment.

  In the above embodiment, it is determined whether the behavior change of the vehicle is intended by the driver by directly comparing the requested acceleration based on the accelerator operation of the driver and the actual acceleration of the vehicle. To do. For example, it may be determined whether the actual acceleration of the vehicle is within a predetermined allowable range, thereby determining whether the behavior change of the vehicle is intended by the driver. The allowable range is determined, for example, by excluding those that are not possible as acceleration operations by the driver. In this case, the permissible range can be variably set using the vehicle speed, gear ratio, etc. as parameters.

  In the above embodiment, the engine ECU having two CPUs has been described. However, an ECU having a single CPU may be used. Even in such a case, as described above, the actual acceleration or the like of the vehicle is monitored, and the fail-safe treatment is executed according to the result, so that the fail-safe treatment can be appropriately performed as necessary.

  In the above-described embodiment, the abnormality detection and fail-safe treatment have been described for the case where the power source of the vehicle is a gasoline engine, but the present invention can also be applied to a vehicle having a power source other than the gasoline engine. For example, in the case of a vehicle using a diesel engine as a power source, the output is suppressed by stopping fuel injection or reducing the fuel injection amount as a fail-safe treatment. In the case of an electric vehicle using an electric motor as a power source, the output is suppressed by a complete stop of power supply or a reduction in power supply as a fail-safe measure. Furthermore, in the case of a hybrid vehicle using an electric motor and a gasoline engine as power sources, as a fail-safe measure, the power supply to the motor is completely stopped or the output is suppressed by reducing the power supply, and the fuel injection to the engine is completely stopped. Alternatively, when the output is suppressed by reducing the fuel injection amount, the output is suppressed by forcibly returning the throttle opening to a low opening simultaneously or independently.

It is a lineblock diagram showing an outline of a vehicle control system in an embodiment of the invention. It is a figure for demonstrating from the abnormal low order event to the high order event. It is a flowchart which shows an abnormality diagnosis process.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... ECU, 11 ... 1st CPU, 12 ... 2nd CPU, 31 ... Injector, 32 ... Throttle actuator.

Claims (3)

Applied to a vehicle control system for controlling the driving state of the power source according to the driver's request and driving the vehicle;
First abnormality detection means for detecting an abnormality depending on whether the behavior change of the running vehicle is intended by the driver;
Second abnormality detection means for detecting an abnormality based on the states of various components in the system;
First fail-safe means for stopping or reducing at least the output of the power source as a fail-safe treatment when an abnormality occurrence is detected by the first abnormality detection means;
A second fail-safe means for issuing a warning to at least the driver or the like as a fail-safe treatment when the second abnormality detecting means detects that an abnormality has occurred, or storing abnormality occurrence information in a memory;
A vehicle control system comprising:   The vehicle control system according to claim 1, wherein the first abnormality detection means detects that an abnormality has occurred when an actual acceleration of the vehicle is different from a requested acceleration requested by a driver. A vehicle control system including a plurality of CPUs, each of which controls an individual actuator.
Each of the plurality of CPUs performs each abnormality detection by the first abnormality detection means and the second abnormality detection means, and each failsafe by the first failsafe means and the second failsafe means. 3. The CPU according to claim 1, wherein a fail-safe measure for each CPU is executed by the first fail-safe unit when an abnormality is detected by at least the first abnormality detection unit. Vehicle control system.

Images